--- /dev/null
+From 3d6905fc754d2e50bc82874494d6a300c8d1b037 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 8992fdb92902f..d314afec44b56 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3032,7 +3032,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From db036304cd259ba1a1675fe6dc37bacac8d8b351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 949efdd1b9a18..cf824841ffead 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1406,6 +1406,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 060bb58a8f8b1041b14d40d9814ca109b22e0ef5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index a49a3254f9677..7b387886c0efd 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 755cf359103851c615419717214f5b64befbe8ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 3b3568b074355f23360b21f4e770ddad293763f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 03b9cdbd3170f..a258a410dd8df 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -46,7 +46,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From 137b2a448e6908677b18c7f45a8af99913e99bc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index b4b2781ad22e8..381b525db2b14 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -59,7 +59,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -119,7 +120,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk IN3_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (BYT_RT5640_JDSRC(byt_rt5640_quirk)) {
+--
+2.51.0
+
--- /dev/null
+From dff7002c52429975873f17841a94abe80ba55e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index a8289f74463e9..f5bcf68841c39 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From 891c75da3a05359b4874770a8068c2d2ef04f2bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index f0bc3398f3ed2..3a833fb4568c0 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -233,9 +233,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From cb56b776576ea021384672b7857af61359faea92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 18855d4bfda23..b2678e4dfa9e6 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -523,7 +523,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+ t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
+--
+2.51.0
+
--- /dev/null
+From b1eb0d1bb7d9516e6c1b6ab2b6c3febf37972622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 51b16c2a279f4..fda0bd990dcb7 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -3801,13 +3801,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ memset(&buf, 0, sizeof(buf));
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev) {
+--
+2.51.0
+
--- /dev/null
+From e41bcd9ab7d8a7f5543812c409b9e25d6944ca74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 076b317c35949..e7d3398c4d23b 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -8149,13 +8149,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 0993a368fcfb376a8423b81da5314b63dab0ecfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 088c8cce738ba..6e0d1a48bd505 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From 64df021ca81b9b05c523291a551dd517af41899f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 735527922a3d3..f34ae036485e0 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -963,7 +963,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 90588ec43b976c4c52342b8d6df919fb94a9cc1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 5f745c906c330..735527922a3d3 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -961,6 +961,11 @@ int __register_one_node(int nid)
+ return -ENOMEM;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From cbe1f138aaa6b9656db75a2c997329776ae5b764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 41800fcad4102..32f93bfb84752 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -621,7 +621,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @adev: amdgpu_device pointer
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(void *handle)
+ {
+@@ -631,6 +646,15 @@ static int uvd_v3_1_hw_init(void *handle)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -638,9 +662,6 @@ static int uvd_v3_1_hw_init(void *handle)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From 28ad31fa92e4bd93e1c9dc36ce57720fb81cd9f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index c738740f8b19e..9a13d0c174236 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1409,7 +1409,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1421,7 +1421,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From 867db948e5f400bf21e6bd3bfb1aa2540d9b39ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index 1646dadd7f37c..3b1c8d93b2654 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From 1c1329cf1fd7fb3b343ae80b7e3ee9f8b44e5b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 8f1d47ff97996..994cfdf346e15 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From d78dcaedf3cb3eba318be2aaa8aba4d28a0cd8f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 4747541517252..dc05775d12e1c 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -327,6 +327,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From c3cd483832f26c5a35d2061acbecbf0530eaad1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 265635db29aa5..79d0ac12a9930 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1065,6 +1065,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = mtk_i2c_clock_enable(i2c);
+@@ -1078,6 +1079,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1102,12 +1104,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1115,7 +1115,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 71300071a346043be74483695869aacead14b433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index de88f472eaad2..4f42bab1a9643 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4239bbabc248a546db2cbba648d2d3370c45e928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 03581a3487751..ae85cf4c05278 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -600,7 +600,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From cc64e02c76db1c632738a7f8d1469068e3862cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index cf925906f59b6..67d0d4f1f0db1 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From af012498e4a5984ec1313f30dd51d182d3c57cd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index f65e03e7cf944..4c6902c7bdff7 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4091,6 +4091,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From 4859807b2ed1f2030fda7bbd0b90573120ea706e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index 4cc51e0018744..b35b3e4286861 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client,
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From 9fc09c1814ee2e2ed603ab18257b926fe2085c7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 0db4000dedf20..cbf674a093680 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From 1bf20304d98aff6770972ae220de6ad740e9e831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index af1e96e0209fc..0af58c4dcebc1 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From c00855ef0696f1b63a79730546d8239fd873ef1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 3b2cd28f962de..7f4e11fea180f 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -681,7 +681,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From 4b98fcd151964391fe7fd9756ebcc3f34728c18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index acef52b0729bf..c0f5e8ab1e34e 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 4c5776a3fd2bcd633b2f98f4cd51866e7b7e7d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 636118b0f2ef4..bac75e3afa96b 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -87,7 +87,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From ddc87ea17342fca8d5f9a2d45d62ab17a0a9f47e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index 311873ff57e33..3ffaa487be947 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1012,7 +1012,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From a84f113ff217751f4d695b1b8b69a0208d02ef57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c094413c17541..87774f3b4c354 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8971,7 +8971,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 82e61424dd4fabd8f9ea906485d5af9dff701ba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 7397064c3f359..c7a0625954c60 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 0cf03240e6aa3cfbdc11c1c5a426d201fbd973e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index b4eb75f25906e..e712841ccaa3e 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1365,7 +1365,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 7a97cb568f383768d1be48209a4b78231f3fbfee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 6fbfcab4918cf..3280c4b488d44 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -93,7 +93,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From 07c8dc05a6c800c28b2abaa0cda004a8ff7d981f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 32552d795bb2c..cd2685b65b7f4 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From 78a28309e5abb92474810783f8513c1d7a1e5d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index 212a4a9c3a8fc..59dc5a965fb82 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -745,7 +745,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From b93654ccbab74b12d64c3481e9473de82e5c2b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 5600ceb9212d9..964573e30d691 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -604,8 +604,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From b3b6f7e9c7ccd36dd471537e65df40ad859e8ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index ea966fc67d287..dbeb67ffebf33 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From 16db0e33954f999f4b8e839ad2154619750cec63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 0846917ff2d2a..d799537f320c8 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(chip->dev, "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From c822efd794ea03c82cf8f1cd9052eea199e75dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 26c66685a43dd..a9c5852f52165 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1063,8 +1063,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From 2f6220a12b52019e84186ec627cb57dfcf2a721b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 65e3e7df8a4b0..779e9af479fdd 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4699d0cae2a7ba687f0cd914574331d8cf5df880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 1d4e0dc550e42..edfbad96665ca 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -757,7 +757,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -943,9 +943,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -970,15 +978,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 892961eb58f4e96c51c5db4cc0528811248253c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index fb463d19a70a0..02c21fce457c1 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -853,7 +853,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+
+ /* Bulk read/write */
+--
+2.51.0
+
--- /dev/null
+From 401b2a304fd7089650dc133f2b70a4555759c412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index fd6fd36268d93..f2080738ca05e 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -115,9 +115,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From 1385aff6b7dec7fcf04dd5bd7b6888d6f3d3e993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index a23e3d810f3e4..80af7a5ac6046 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index cef60bc2589cc..c3ff1fc577a7c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -42,7 +42,6 @@
+ #include "eswitch.h"
+ #include "en.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2875,11 +2874,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2889,18 +2886,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 0fbb0808b724212bded86a723760bce4a7171421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index 326265fd7f91a..caf887364567b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -811,11 +811,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From 8167cedc979c1e65226ee26e8f0cc534e04581f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 857a73e856a14..8e2867a6f6471 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From b0a096a08708c09e2594f8ac4c33a01972bc28c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 3244f30dffec2..765c5be6c84ca 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From b25147c0a9ca2af20bcb570baf99be985a54af7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From 7961df64e375f009a3b3fecdb0a3b61cb5a90e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 09773695d219f..4056706d63f7e 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -240,6 +240,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From b2bfa5498d01d49b29669f1abda593810196e973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 363b68555fe62..4ef2762347f62 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+ }
+--
+2.51.0
+
drm-amd-display-remove-redundant-safeguards-for-dmub-srv-destroy.patch
drm-amd-display-fix-potential-null-dereference.patch
crypto-rng-ensure-set_ent-is-always-present.patch
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+libbpf-fix-reuse-of-devmap.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+serial-max310x-add-error-checking-in-probe.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-18358
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24062
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-10095
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
--- /dev/null
+From 23965cd645dff57608534ba510f458fc6cab40bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 26e6dd860b5d9..dbad1c4435cf4 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -432,13 +432,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req, err);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
+--
+2.51.0
+
--- /dev/null
+From 982347ee199b84ec1fd570871f1583a78c30c289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index a6f4ee3918977..021b94a383d13 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 3cd598a7e30d902ebdd165d0b129455e95cd21cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From e15b0a3527362897cdee9914fc1779eadba299b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From 7c36bad8d63489f0b59b0c29ba1ec44ac58cf524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index 8e4d22a6ba0b2..846a8c4ea394f 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -80,8 +80,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From be37f2a5f05df5e4d5e604fb130a6875349fb139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From 0f1deb4c9a6b3a60d06b8c82bd6834adc061eefe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index afc31f1def760..6ffda70e7e58e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2536,8 +2536,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -2556,11 +2556,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f551f33dbb438ff0d2b4c23d265216151bfd89a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index d810b96a7ba43..4256b1d09380f 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1358,6 +1358,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From 2de4b8ace7f1106510ef8cd671ecb0a506dfce6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index db1b73486e90b..7ab8c518dfc2b 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From 4de2451af41a0c7be5292501273bcc57be102ad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index ab3c38a7d8ac0..a73604af8960e 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From cdba6eb9a344f8aafc21768e6ebd5c5295700664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index affcb928771d8..2d2506c598818 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 8af18ef42136ec3de0ee9fed383257b45634c033 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 3fc457bc16db3..18349ec0c1010 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f29e620571cce6080bedc726e9ed931b3b2611b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index c9a74f3e2e601..858db97ecfed9 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From deb94749e730cd8551178b39fac9773dbeb4e262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index ba927033bbe8c..1206769cdc7fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 90cbe67b352f4ab03d0675a864437a76aacf7f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 7eace21a08040..b1c9c7a9e5dbc 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From 06ed324db2d83e6f067cd7cfe086e02b1081999b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 72044026eb3c2..8686f5cfbc6b7 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 8276d10bde557b2858671a2af6f4d02c2aebb24f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 2a6fdce3c2e6b..e420f773d6744 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3021,7 +3021,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From bfb8509653b8955339decf8f9e4c54b322bb87a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 74459ac13f4bc..6b71082d474f9 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1403,6 +1403,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 90e1f2c8471104e38abadac9afc5f045dd041149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index b5b0d43bb8dcd..c3f2717aebf25 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 16760900e90ee3e2e51cd4768dc9979ebeefb370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 2f0a370a13096..60f9d6f5f8229 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -868,7 +868,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCK1..4 settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -912,7 +912,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From 021d3e78925658bf83df573cefd8e59248700b53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 1e1a69e3bae4fabe4e8d605ff256a56b213417f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index b5c97d35864a6..923e69c7695c2 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -46,7 +46,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From cbaf9a3c3ebe42bee78dc2f1fb2b3095002e3f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 4954e8c494c6d..0c7da72a7b846 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -65,7 +65,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -134,7 +135,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From e14b56a67e6662a0712ee179efbb82bd09e52436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 93cec4d916273..b0b41a03c083e 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From 81c756214a89790a02c7498f449a14e4bcff1c97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 7074ce8d2d03f..09f4faca338a2 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -178,9 +178,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From 07e8626abc923225c1ffab89820b7ea9f726fc5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index d501084bab4a4..85346a6f1c773 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -514,7 +514,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+ t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
+--
+2.51.0
+
--- /dev/null
+From cbfe09e2b338ad338231b9dd366b10c67ccfee4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index a54eb754e9a70..1d04fb42f13f2 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -3824,13 +3824,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ memset(&buf, 0, sizeof(buf));
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev) {
+--
+2.51.0
+
--- /dev/null
+From 444c4d4e6a1137593f18b6dc84ba616ba1bc2f83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index f346f19cf468c..b95af925b9c27 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -8595,13 +8595,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 54ec247421fe0db150e05b82a0c985d169c1cf13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index fac63d092c7be..732a4bed3f207 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -18,7 +18,8 @@
+ #include <asm/barrier.h>
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From b77ee4ff9a9d04c93ad2f3ce262d71a41ddc8042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 732a4bed3f207..dfdb5d4263259 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -503,12 +503,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -518,7 +518,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From 7b244689684ffe537cd9d5ac3e3ce2837dc4bcc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 1f12109526fa6..35287ab0148a2 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+ #include <linux/scmi_protocol.h>
+@@ -319,6 +320,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 74ea01d7d1c4b18d4e9e738a65e40905acb12b26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 088c8cce738ba..6e0d1a48bd505 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From d64be4b63eb7450cbb1e9a0e8c3528d5374b2da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 0e3bae3b877df..dd8c8fdfd158a 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -985,7 +985,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 101858991350ec1dd9e296bfcb4ffc96250a7340 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 5366d1b5359c8..0e3bae3b877df 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -983,6 +983,11 @@ int __register_one_node(int nid)
+ return -ENOMEM;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From 3ed4e606d472696482c806705420c5890f3c4ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 0fef925b66024..e458e0d5801b0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @handle: handle used to pass amdgpu_device pointer
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(void *handle)
+ {
+@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From b22983b8bb3d12bf32efc9f8cac342ed8ce429ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 7f55decc5f37b..d21bebfa884ed 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -3228,7 +3228,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 787727cefeab6132cdbe6757d506499dd3b1fe55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 7fe2c49854987..d5e5f08deeec5 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1410,7 +1410,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1422,7 +1422,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From b0f9575246685695c6ee6c2f00ccf9845b7d69f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index 1646dadd7f37c..3b1c8d93b2654 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From edee17b2e60bf305c3b4fbdb924da06f402660c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From a420e2e2ad98d0a35b0eb582b1cf47e5c91bbc4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 6940ee5432ba3..52ce16218b299 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -935,12 +936,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else
+ return -EINVAL;
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1101,7 +1106,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From 30a5f1513ff05849fa1b12b00c9e3c4b00215c5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 2f2f21f1b659e..d7b42888f25c2 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From a108e36ec5e030862e2131c6cbdcee3e2c0da739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 718bebe4fb877..09fcd155c6410 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -322,6 +322,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From bc60cb0de6ca8b293836d25dd7632718acb000b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 72acda59eb399..03e5d488f874f 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1067,6 +1067,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = mtk_i2c_clock_enable(i2c);
+@@ -1080,6 +1081,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1104,12 +1106,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1117,7 +1117,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 0571fff7de8d170631f9fcefca62c511d7dc44a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 62a4d06bcfb5d..27f55b5e388d9 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -308,6 +308,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 37f954ab7a321e9d1c2f40d362ad89cb944cf100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 1557c71dd152f..2b13cf6e827c6 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -982,6 +982,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -989,7 +991,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1007,9 +1008,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8c3dbc584cf09609cb5875884a58f0fb4863803c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 5eabb54c1fc72..8815747e67be7 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -619,7 +619,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 542fc1776f0a856104838a4585bfef45bb49e253 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index ef1f45e43b630..61d3797fb7995 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From 0c3fc26093f0c83762882d0002a8fee4fe57bd71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 13dea519e59f2..d9589c92e05d2 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4485,6 +4485,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From dcdf46fb24909e2be5427475223f50457a887a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index 2e4018c269124..f1953c819666b 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client,
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From d4a39e1256ad7638e4f0ada610100d8d7992ea2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From c3792c6533316a27cef974ba7f4ef267be93b618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 81395852b4d43..ca8bfd1b8278e 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -957,15 +957,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From 99c02a542ed4a0d6b774b8d824d7d967d99c8e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 413082f10dc1c..31f05356a7c06 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -688,7 +688,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From da05012fb38e60405bad2249e8aad5570ccab333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index d5aa92660217c..324bec0c22fb4 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 0058e3ca261d86f77b505bc45ec925972cd26466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 0bd6bf46f05f3..1f9ca5040982d 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -62,7 +62,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From 77b2d7fb3fcf0ee77e7980c90991935ad0953921 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index d295942968f33..160f853e93adc 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1001,7 +1001,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From a46575f7f9b299f39c442f77309d81f69a6fab03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3d854e2537bc2..a98b10c85b700 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9117,7 +9117,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From bbc6a5080993d165029441920e8cb23d50213edd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 812d085d49c99..4c4b528b89ebe 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 5a7a58cfb0c0c20ad9ba626870396d5f14b0e4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 85a47621e0c07..f9ecabe3c09e5 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1030,6 +1030,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 813237ce043414a84ea358ade7d71461ecb104b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index cb0aa65d6934a..30d63ae20d8b7 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1346,7 +1346,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 11daca8975b2b3a28d85082d1cc20a332bb7796a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index cd5945e17fdf7..5ba677353d040 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -93,7 +93,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From c18605b109f78c031946f9f89889af8de767f6d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 51408996255bd..e2601e45935e6 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From cedd5b34a52a220e6218a27e8381f11846b8154f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index f3eecb20c0869..37f8d51046b89 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -755,7 +755,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From e137e0cc785b8ca9677129cb2dbb9f9ab4ee02de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index c784de10b494e..9cd0a837af425 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -601,8 +601,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From e197175d7017d69f85d9c12f920880a0c05bea51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index ea966fc67d287..dbeb67ffebf33 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From 6e24f33c135668502d22a91e899d0f3dcf8583fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 5b723a48c5f1d..3fef7d7987736 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(chip->dev, "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From a7bfe002d9c669e2de3088b3545ee9b6c9712f53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 96e00e86ebbf6..5dc864cec9f83 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1039,8 +1039,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From c0ca331265d6de4f908ea568aa9181442b1bec33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index 65e3e7df8a4b0..779e9af479fdd 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -461,14 +461,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b9e22beae3617c5a0a3dc8c8a6225fdca6a66bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 124242e387a59..c83701d04c955 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -759,7 +759,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -945,9 +945,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -972,15 +980,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 049fa7de38bfeec025c89fc9c73ca4c99d1e61a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index ebddc69bc969c..35cfbec6bf9ac 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -888,7 +888,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+
+ /* Bulk read/write */
+--
+2.51.0
+
--- /dev/null
+From 7e9fde61d1c7fe99b517f2523a517dc4ab921f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index 41ae7ac27ff6a..7c0d29c7856bb 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From a9e72cffdb218fa63135569b1041434968ed6a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 7e9244c748da6..515c6d68e47ce 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -116,9 +116,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From a6874f84f8744e0d14929ad5fa019cbab6677221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index a23e3d810f3e4..80af7a5ac6046 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index bb7e3c80ad74e..321441e6ad328 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -42,7 +42,6 @@
+ #include "eswitch.h"
+ #include "en.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2243,11 +2242,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2257,18 +2254,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9410cf6cf69231e58b28cb775669c0eee73899ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index ddb7c88d53650..0ff63e9d815aa 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1183,19 +1183,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command)
+--
+2.51.0
+
--- /dev/null
+From d8e8fd96619ecf5f4cbbcce6a25f8dc12cbeb3e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index e8a4750f6ec47..7d6e4fe31ceed 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From a2dc7b8b8c27f6280cc046aa7fa32272019e4310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 3f05f13fb107a..ec834b5951e72 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From b6e8c1e3cc242ecfb8519ec1aeb3d3e818b5914c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 0c79f2a9eba76..c4f5a2a17bd6a 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -892,7 +893,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From 8c19164721993c1d412a59f42c3ca621006c3850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index ac702f74dd984..dfc7bff420cda 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1539,7 +1539,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3525,7 +3525,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 7dc6f2565abdf802f2403f3c8387ec7edef9ffde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 2053c560b580c..5f3593680c953 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2061,11 +2061,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 72da5c863ce7bf65aeddab9d8fdd154a55f4d8ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From 5159ddda3bea44f2f81679aae49d1f69b0343175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 09773695d219f..4056706d63f7e 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -240,6 +240,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
crypto-rng-ensure-set_ent-is-always-present.patch
minmax-add-in_range-macro.patch
net-9p-fix-double-req-put-in-p9_fd_cancelled.patch
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+libbpf-fix-reuse-of-devmap.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-28011
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-24238
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-30768
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
--- /dev/null
+From 3dc875a08b141b5d1af0c9abeb2218ad26cac0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index b60525b34ab05..387df30ca5609 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -976,16 +976,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From db9468c6608ad9326bcfb17ebd48f056a622863c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 4c9400cf6686b..5dc60ee0b07a1 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -415,13 +415,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req, err);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
+--
+2.51.0
+
--- /dev/null
+From d9a6b096be044238107aaee9088f04c454f80b43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index a6f4ee3918977..021b94a383d13 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 93d046213047220c8441753a24318c56d9b583a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index 8e4d22a6ba0b2..846a8c4ea394f 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -80,8 +80,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From 9a8103335e6ca2c3653ac0adc37fe11529f79e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From 99b8546ad736625879dbea856c0a19d7a5c30b7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From b914269e6c241a0332d012f7a570db484cf1560d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From 0918c63cda458d4fdf362636ee452de11f80e3e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 9508e2c90b840..b3d373372e841 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2747,8 +2747,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -2767,11 +2767,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2852c0a61128a5a63f355c600e7ffbb5194a260f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index 9006e01e18c20..62c20d5c2a66a 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From 3979440264cc75dd6fab78abd087f193dd145e9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index bfd889422dd32..22cd3d5384910 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From 2c6b22c6ae86c9381a1f8d58321498d574ed7b78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index a0ea830e1ba17..f9eccd40c221f 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -46,6 +46,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From f6b74a0edb061956c40c65ce177de9a2b4f82e7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 6423930b0e72e..9a3de907de696 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1364,6 +1364,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From 04c0a6160ed319f169c3ba936a1d1e29f3049c90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 37a5914f79871..b2641009519b5 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From db4dc0bdaf47682be2477e3d2c15e393dfb4d8d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index ab3c38a7d8ac0..a73604af8960e 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From d3b450edb964b6ace2ca61f22de0808b92ea21d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 6b98f5ab6dfed..e3c8483d7ba40 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 8f84afcfb078561c57abc14e1e58ac8f991a735f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 1c569be72ea29..15644ae2387fd 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 60645098e7576d86c7e5c3c89170081d7696bc7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 572aabc0541c5..5817501b0c3fe 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From 631542853380d08c7ed3f8c9b87095312e462531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index ba927033bbe8c..1206769cdc7fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 25a5e4f5aef3fa3628889fa5a0fe3eb081ff3c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index d76a8523ef1d3..8978f18d98de4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -663,10 +663,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From 72edd4f3668715f3dae7acc45cc8489e4bd7ecad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 8dd8e8ec9fa55..879be4ffa06c7 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -242,7 +242,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -252,10 +252,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 77772ff2bab359bff86b9a5c8339629e093c75eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index e6bba26caf3c8..86655d65f3215 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1506,6 +1506,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From f9e93e02c994de133698aba34326353a0800ddc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index 00975e86473c5..6cf7572779d41 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 12da59cae3866d979651bec448b6d4a81cc2d9a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 57d6d0b48068c..006e489e7e890 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -46,7 +46,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From b707c8890729da1a45b6e6b50c7966583282907d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 5a8e86ba29004..88e84415d5a4b 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -60,7 +60,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -118,7 +119,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk IN3_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (BYT_RT5640_JDSRC(byt_rt5640_quirk)) {
+--
+2.51.0
+
--- /dev/null
+From 256bbb191132c4a18cd978f42388bd0ad454a79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 0c1c8628b9917..6a5098efdaf2b 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -99,14 +100,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From 95e01209971c9d5478e166131836badfb01ceea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 7abd66d1228ad..532afcb672412 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -241,9 +241,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From 347e823456d7bafeb36d71151da93057f8790884 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 13be635300a85..d4870441a38ac 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -505,7 +505,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+ t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
+--
+2.51.0
+
--- /dev/null
+From 16592f20721482d971c16fa0ed9e57ec31fdda09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index fd18497977bdf..2c56c910a0c13 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -7132,13 +7132,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 87cada16d5c4373098e72bb9f3c6e422cf07813b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index cb1bbe3068ab6..83b13a295bbe6 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -940,7 +940,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 917a3f24c1bf2f5d1c5cca91062c71bb727e995a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 666eb55c0774e..cb1bbe3068ab6 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -938,6 +938,11 @@ int __register_one_node(int nid)
+ return -ENOMEM;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From f1ccce3f0d096d04748e2fbec50baa3383e4ddda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index a85470213b27f..637a4f2a30af9 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1411,7 +1411,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1423,7 +1423,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From 56afa3827564107bdac62fda7bea5403f53a115a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 75313c80f132f..fd5ffe13c7033 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -414,6 +414,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 98081b948a53886c4dfc3b5065630a8ed9cab4d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 5587e7c549c4f..2b56ad08efed1 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -782,6 +782,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = mtk_i2c_clock_enable(i2c);
+@@ -795,6 +796,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -818,12 +820,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -831,7 +831,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 2f49e405f2205a4e86ad3ad90890f6aadfd14a07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 11ab6390eda4d..b05df8694a4a5 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1036,6 +1036,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1043,7 +1045,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1061,9 +1062,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c3dd5aef51da1ee18e7ae9be816f44b9324ecc31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 6374d50915557..6bdd175df021d 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -627,7 +627,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c12395915af8d578d11c07acb17109f3d40c4da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index cf925906f59b6..67d0d4f1f0db1 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From fd83666815449932ce946053dade1b4037abf810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index 4cc51e0018744..b35b3e4286861 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client,
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From 1b0e0d44f1358e70aaa4b35cb9bca65b8e36d402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 026c6ca245408..e53bdd5f04eaa 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -918,7 +918,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From 67cb300cef071b1ad27ff940a8e15767863dac24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index ae631b8770fc1..5f037e9db023a 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -633,7 +633,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_get(struct ena_adapter *adapter, u32 *indir)
+--
+2.51.0
+
--- /dev/null
+From ff944132526611c7af0f833d87e7eed307cc1618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 3829b7eb3fc90..1df289e7c1304 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -684,7 +684,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -698,7 +697,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From f042f4fba1d0cea593533039cb25fed5fb462f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 297631f9717bc..0dcba0a87283d 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -87,7 +87,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -716,7 +716,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -866,7 +866,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1059,7 +1059,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From 0002118c3ed8320156c7f1e3c466d63ebe10f55f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index ff88103571819..6e1707ef391dd 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -914,7 +914,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From c31549f92f0317f92665d33b7d9d9a136feb8b57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f511087d5e1c2..44770bb9017d5 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -8686,7 +8686,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From c863b1e36e8fd0204588bef3aed7f399c0702124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 7397064c3f359..c7a0625954c60 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1032,6 +1032,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 49e2495f2a47f52b7ffffb7ceda8a2e7f949b79b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 74c0ddd433815..9e3588d568ce4 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1394,7 +1394,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 78c5bc3b267fc8fbf09d311e1563650542dab068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 079701e8de186..91a6631af5567 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -75,7 +75,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From 59660c08cecc3b057463549624ca00c00537aca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index e8d1f3050487f..2da0f2ab4038e 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -400,6 +403,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -631,6 +636,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -751,6 +760,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From 0ca6f30ccf245105e2965174501d24be1af11710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index ea966fc67d287..dbeb67ffebf33 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From 2c32d84fa0305e6c09d29e3161bbcf5b6120450b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 7b4c770ce9d67..7414daef81a35 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(chip->dev, "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 424bd47994dfc46aaa5d5a8060df3f67d9ca8123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index c9e63c692b6e8..48de2285922f8 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -459,14 +459,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 82c6a4671cc2694b22b7b25a8fa8380c80006bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 236f9efaa75ce..b5a845985ba4c 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -779,7 +779,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !qp->kernel_verbs) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -965,9 +965,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -992,15 +1000,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From cab40a63e3cfd358987230c809d2cb4477d76c51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index c453c24afeb8a..5824cfd288125 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -824,7 +824,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+
+ /* Bulk read/write */
+--
+2.51.0
+
--- /dev/null
+From e6275c0675bba91527fe7bbf7797274e3d3515fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index eaeb6aee6da5c..9c9beeb3bcd74 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -113,9 +113,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From 0ef095a83033526a53b4d02674f79b6dd0d79070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index 7b852b87a609f..34f55b81a0deb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -64,23 +64,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 41bd16cc9d0f6..b3ba996004f1d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -42,7 +42,6 @@
+ #include "eswitch.h"
+ #include "en.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2895,11 +2894,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2909,18 +2906,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From d0ec63b6b6914a6988ecc92cca427e62aaa0e7c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index ebe78ec42da8b..a355471cf079b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -812,11 +812,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From 73f1ec2c4045ac52e34b1c5116cd1cf6bd635784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index bf0546fc555f2..04740f623a12e 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -499,14 +499,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -521,7 +521,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -534,7 +534,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From b5193c8eb5e536d21d6facc1f5a25be761e0db20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 1215fc36862da..45b1af5a8d748 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -875,6 +875,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -893,7 +894,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ PM8001_DISC_DBG(pm8001_ha,
+--
+2.51.0
+
--- /dev/null
+From 09538176ecbbef882eb74b9c3b407eaff93c713b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 09773695d219f..4056706d63f7e 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -240,6 +240,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From f79028e050f275c02e11e124cdd19aeb439d69a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 363b68555fe62..4ef2762347f62 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1660,6 +1660,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+ }
+--
+2.51.0
+
staging-axis-fifo-fix-maximum-tx-packet-length-check.patch
staging-axis-fifo-flush-rx-fifo-on-read-errors.patch
driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+serial-max310x-add-error-checking-in-probe.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-14259
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-17902
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21687
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
--- /dev/null
+From 26647faf120b74676d6c7f4e391d8ca6c9387a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 8924fcd9f5f59..a89d78afc8970 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -265,13 +265,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req, err);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
+--
+2.51.0
+
--- /dev/null
+From 9c14959c4c0ca60dbbe3a2bebd3eb5a9fa33cbe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index a6f4ee3918977..021b94a383d13 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 27a0a19aca6e01d4eb9c8c1394e732966b0e1011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From ce47bcb92bfb4c56692a9ad7106d87437f42e949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index 8e4d22a6ba0b2..846a8c4ea394f 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -80,8 +80,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -126,15 +126,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -161,6 +162,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -406,13 +413,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -469,7 +476,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From df37e3a1444594f434f243e34bbda382273fbd76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From 1e97348620b8446d5537f780beebfeaa66bea6f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From f6ec95a63639576f4de0433a61d8ccfa04822c1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index cc0efcb4a553c..a0a5590573b03 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2359,8 +2359,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -2379,11 +2379,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c7bdfd51b8d054eebf0256ab179b1be3e4f1075e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 476a22728e8d1..d2be874af7d3c 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1327,6 +1327,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From 9660391fe7b34cf62da16eebf223ac37dff0f4fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 5a21777197e95..cfdbe90f867e0 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From fc125761c4b9a73137465304e3c716bcd136dce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 9337c30f0743b..607c3f18356a4 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From 85dffec5ddfd40c1f3abe9190289b20fbc8b50b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index ee8fa558e3edd..d31b7e5895ce8 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 6cc7b4755b587facfc5053a09cba1b0ffca08f9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 3fc457bc16db3..18349ec0c1010 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f9ce0c7c8d85cf2b246c5fcf496b1d6a23cce4c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index ed6316c41cb78..0123d93323114 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1720,33 +1720,32 @@ void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From 34325cbb33d4e623efe23ba9edfa580b98873db9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index 68efb300c0d88..8c3603f113894 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ca9cc5e413a6e21312a9f8ffe711152d1412a798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 40e10f6e3dbf8..9f9826b94ad40 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -667,10 +667,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From 80637d690de558bf673495125a2411745dd78233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 6669164abadcb..531a0cb93b47b 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -253,7 +253,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -263,10 +263,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 7b6d20a1292a72c209c77b5b81e4f2f2ac2f8e8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 129c503b0951e..78c9f56b4ba34 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 3fb48a75cf41b3b56f3df0a645e0060d2e395f5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 3386d01c1f157..afa3b4ac367a3 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1411,6 +1411,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From afdda3578461ef7d0cb34785f23c7ca810561e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index b5b0d43bb8dcd..c3f2717aebf25 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 3050001ac7e979b0f8e9121f86d37ab97d2516f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index e4904faf17532..0af2598899fc5 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -868,7 +868,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCK1..4 settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -912,7 +912,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From aaeb0eaabed0c24dc744561dc171c9e145add2fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From b8d3b5bab77d226506aa92e5c273a40b8c39b09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 13:19:53 +0100
+Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
+
+On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
+are deleting a wrong and nonexistent node. Fixing the wrong node would
+invoke a dtb warning message, as channel0 is a required property.
+Disable CAN-FD channel0 instead of deleting the node.
+
+Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+index 6be25a8a28db7..866f1358d57a4 100644
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+@@ -50,7 +50,10 @@ aliases {
+ #if (SW_SCIF_CAN || SW_RSPI_CAN)
+ &canfd {
+ pinctrl-0 = <&can1_pins>;
+- /delete-node/ channel@0;
++
++ channel0 {
++ status = "disabled";
++ };
+ };
+ #else
+ &canfd {
+--
+2.51.0
+
--- /dev/null
+From 815704336c8054875b0989dd4fdc9509b8e13761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 4dd37848b30e3..fa2c3981dacac 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -46,7 +46,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From c3d2e49fc127b8a7b46eabf102c703fdf828bd5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index b00a9fdd7a9cc..6af53a766c27d 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -68,7 +68,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From 25a85c0b72d6bedb7e600d0a043becd96b2d1869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index d74d184e1c7f3..b9990cb1181ff 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From 7a097d855fd3aacd220273058c8cd103d59ff128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 4515288fbe351..f5870efec33e9 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -176,9 +176,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From aa9dd3ed68a8ca6a8efedd1b07f004f46c9b2a1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 305b47a38429e..741c4085b9e45 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -547,7 +547,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+ t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
+--
+2.51.0
+
--- /dev/null
+From fdcd3c1e74cd57fa1e81d8dfaa6127038ac7a7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 12:30:05 -0400
+Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
+ advertisements
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
+
+When creating an advertisement for BIG the address shall not be
+non-resolvable since in case of acting as BASS/Broadcast Assistant the
+address must be the same as the connection in order to use the PAST
+method and even when PAST/BASS are not in the picture a Periodic
+Advertisement can still be synchronized thus the same argument as to
+connectable advertisements still stand.
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 4c1b2468989a8..851a43a5aee0c 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -1304,7 +1304,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+ struct hci_rp_le_set_ext_adv_params rp;
+- bool connectable;
++ bool connectable, require_privacy;
+ u32 flags;
+ bdaddr_t random_addr;
+ u8 own_addr_type;
+@@ -1342,10 +1342,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ return -EPERM;
+
+ /* Set require_privacy to true only when non-connectable
+- * advertising is used. In that case it is fine to use a
+- * non-resolvable private address.
++ * advertising is used and it is not periodic.
++ * In that case it is fine to use a non-resolvable private address.
+ */
+- err = hci_get_random_address(hdev, !connectable,
++ require_privacy = !connectable && !(adv && adv->periodic);
++
++ err = hci_get_random_address(hdev, require_privacy,
+ adv_use_rpa(hdev, flags), adv,
+ &own_addr_type, &random_addr);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 96075aa64ca67f7ce10051d0518115d8f93a0d67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:22 +0300
+Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
+
+For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
+skb is leaked.
+
+Free skb after copying its data.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 5f6e4c79e190b..c542497f040cc 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -1729,7 +1729,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+ skb->len);
+ conn->rx_len -= skb->len;
+- return;
++ break;
+
+ case ISO_END:
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+--
+2.51.0
+
--- /dev/null
+From 0830c53d3508c7717623833638a1dd9a22e4ed7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:27:51 -0400
+Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
+
+This attempt to fix similar issue to sco_conn_free where if the
+conn->sk is not set to NULL may lead to UAF on iso_conn_free.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 437cbeaa96193..5f6e4c79e190b 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -581,6 +581,13 @@ static void iso_sock_kill(struct sock *sk)
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ if (iso_pi(sk)->conn) {
++ iso_conn_lock(iso_pi(sk)->conn);
++ iso_pi(sk)->conn->sk = NULL;
++ iso_conn_unlock(iso_pi(sk)->conn);
++ }
++
+ /* Kill poor orphan */
+ bt_sock_unlink(&iso_sk_list, sk);
+ sock_set_flag(sk, SOCK_DEAD);
+--
+2.51.0
+
--- /dev/null
+From c46218037e2719e9eee9b35da47b34d227da9c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 27876512c63a4..a11d25c389f8f 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4483,13 +4483,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ return -ENOMEM;
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev && hci_dev_le_state_simultaneous(hdev)) {
+--
+2.51.0
+
--- /dev/null
+From e5266d1fe6b7d0f1231ab0fb75f85ea820d909c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 19:12:00 +0200
+Subject: bpf: Enforce expected_attach_type for tailcall compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
+
+Yinhao et al. recently reported:
+
+ Our fuzzer tool discovered an uninitialized pointer issue in the
+ bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
+ This leads to a NULL pointer dereference when a BPF program attempts to
+ deference the txq member of struct xdp_buff object.
+
+The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
+entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
+neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
+of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
+to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
+egress_ifindex, and the latter is only allowed to be accessed under mentioned
+expected_attach_type. progB is then inserted into the tailcall which progA
+calls.
+
+The underlying issue goes beyond XDP though. Another example are programs
+of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
+as sock_addr_func_proto() have different logic depending on the programs'
+expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
+should not be allowed doing a tailcall into a program which calls bpf_bind()
+out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
+
+In short, specifying expected_attach_type allows to open up additional
+functionality or restrictions beyond what the basic bpf_prog_type enables.
+The use of tailcalls must not violate these constraints. Fix it by enforcing
+expected_attach_type in __bpf_prog_map_compatible().
+
+Note that we only enforce this for tailcall maps, but not for BPF devmaps or
+cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
+cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
+these situations are not prone to this issue.
+
+Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
+Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
+Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 5f01845627d49..142a21f019ff8 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -228,6 +228,7 @@ struct bpf_map_owner {
+ bool xdp_has_frags;
+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
+ const struct btf_type *attach_func_proto;
++ enum bpf_attach_type expected_attach_type;
+ };
+
+ struct bpf_map {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 3136af6559a82..6924f86a8a3ff 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2137,6 +2137,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map,
+ map->owner->type = prog_type;
+ map->owner->jited = fp->jited;
+ map->owner->xdp_has_frags = aux->xdp_has_frags;
++ map->owner->expected_attach_type = fp->expected_attach_type;
+ map->owner->attach_func_proto = aux->attach_func_proto;
+ for_each_cgroup_storage_type(i) {
+ map->owner->storage_cookie[i] =
+@@ -2148,6 +2149,10 @@ bool bpf_prog_map_compatible(struct bpf_map *map,
+ ret = map->owner->type == prog_type &&
+ map->owner->jited == fp->jited &&
+ map->owner->xdp_has_frags == aux->xdp_has_frags;
++ if (ret &&
++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
++ map->owner->expected_attach_type != fp->expected_attach_type)
++ ret = false;
+ for_each_cgroup_storage_type(i) {
+ if (!ret)
+ break;
+--
+2.51.0
+
--- /dev/null
+From 0e6f98201db6cf02733a6aadd64410030b958777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index cd0c28e94979a..183ede9345e61 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -9100,13 +9100,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 78d90695335cecc1c18c0bf0256cb98cd20cc908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:14:29 +0800
+Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
+
+Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
+called all the way from graph tracer, which disables preemption in
+function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
+need to use migrate_disable. As a result, some overhead may will be reduced.
+And add cant_sleep check for __this_cpu_inc_return.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 243122ca56793..e6fde598f7629 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2636,18 +2636,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ struct bpf_run_ctx *old_run_ctx;
+ int err;
+
++ /*
++ * graph tracer framework ensures we won't migrate, so there is no need
++ * to use migrate_disable for bpf_prog_run again. The check here just for
++ * __this_cpu_inc_return.
++ */
++ cant_sleep();
++
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+ err = 0;
+ goto out;
+ }
+
+- migrate_disable();
+ rcu_read_lock();
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
+ rcu_read_unlock();
+- migrate_enable();
+
+ out:
+ __this_cpu_dec(bpf_prog_active);
+--
+2.51.0
+
--- /dev/null
+From 8a065e53573aee9c8787e1a15f9156c1daa79c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:12:14 +0000
+Subject: bpf/selftests: Fix test_tcpnotify_user
+
+From: Matt Bobrowski <mattbobrowski@google.com>
+
+[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
+
+Based on a bisect, it appears that commit 7ee988770326 ("timers:
+Implement the hierarchical pull model") has somehow inadvertently
+broken BPF selftest test_tcpnotify_user. The error that is being
+generated by this test is as follows:
+
+ FAILED: Wrong stats Expected 10 calls, got 8
+
+It looks like the change allows timer functions to be run on CPUs
+different from the one they are armed on. The test had pinned itself
+to CPU 0, and in the past the retransmit attempts also occurred on CPU
+0. The test had set the max_entries attribute for
+BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
+bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
+likely to be in range. With the change to allow timers to run on other
+CPUs, the current CPU tasked with performing the retransmit might be
+bumped and in turn fall out of range, as the event will be filtered
+out via __bpf_perf_event_output() using:
+
+ if (unlikely(index >= array->map.max_entries))
+ return -E2BIG;
+
+A possible change would be to explicitly set the max_entries attribute
+for perf_event_map in test_tcpnotify_kern.c to a value that's at least
+as large as the number of CPUs. As it turns out however, if the field
+is left unset, then the libbpf will determine the number of CPUs available
+on the underlying system and update the max_entries attribute accordingly
+in map_set_def_max_entries().
+
+A further problem with the test is that it has a thread that continues
+running up until the program exits. The main thread cleans up some
+LIBBPF data structures, while the other thread continues to use them,
+which inevitably will trigger a SIGSEGV. This can be dealt with by
+telling the thread to run for as long as necessary and doing a
+pthread_join on it before exiting the program.
+
+Finally, I don't think binding the process to CPU 0 is meaningful for
+this test any more, so get rid of that.
+
+Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
+Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
+ .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+index 540181c115a85..ef00d38b0a8d2 100644
+--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+@@ -23,7 +23,6 @@ struct {
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+- __uint(max_entries, 2);
+ __type(key, int);
+ __type(value, __u32);
+ } perf_event_map SEC(".maps");
+diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+index 595194453ff8f..35b4893ccdf8a 100644
+--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+@@ -15,20 +15,18 @@
+ #include <bpf/libbpf.h>
+ #include <sys/ioctl.h>
+ #include <linux/rtnetlink.h>
+-#include <signal.h>
+ #include <linux/perf_event.h>
+-#include <linux/err.h>
+
+-#include "bpf_util.h"
+ #include "cgroup_helpers.h"
+
+ #include "test_tcpnotify.h"
+-#include "trace_helpers.h"
+ #include "testing_helpers.h"
+
+ #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+
+ pthread_t tid;
++static bool exit_thread;
++
+ int rx_callbacks;
+
+ static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
+@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
+ {
+ int err;
+
+- while (1) {
++ while (!exit_thread) {
+ err = perf_buffer__poll(pb, 100);
+ if (err < 0 && err != -EINTR) {
+ printf("failed perf_buffer__poll: %d\n", err);
+@@ -78,15 +76,10 @@ int main(int argc, char **argv)
+ int error = EXIT_FAILURE;
+ struct bpf_object *obj;
+ char test_script[80];
+- cpu_set_t cpuset;
+ __u32 key = 0;
+
+ libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(0, &cpuset);
+- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
+-
+ cg_fd = cgroup_setup_and_join(cg_path);
+ if (cg_fd < 0)
+ goto err;
+@@ -151,6 +144,13 @@ int main(int argc, char **argv)
+
+ sleep(10);
+
++ exit_thread = true;
++ int ret = pthread_join(tid, NULL);
++ if (ret) {
++ printf("FAILED: pthread_join\n");
++ goto err;
++ }
++
+ if (verify_result(&g)) {
+ printf("FAILED: Wrong stats Expected %d calls, got %d\n",
+ g.ncalls, rx_callbacks);
+--
+2.51.0
+
--- /dev/null
+From 961dfd2aeb51c6598a6ecf118b2ae82237719694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 01:24:45 -0700
+Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
+
+From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+
+[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
+
+The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
+To avoid invalid accesses, introduce a check on numextinsel
+(derived from TRCIDR5[11:9]) before reading or writing to this register.
+
+Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
+Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 1ad689db74da1..d89153d0517ec 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -451,7 +451,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+ etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
+@@ -1239,6 +1240,7 @@ static void etm4_init_arch_data(void *info)
+ etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
+ /* NUMEXTIN, bits[8:0] number of external inputs implemented */
+ drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
+ /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
+ drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
+ /* ATBTRIG, bit[22] implementation can support ATB triggers? */
+@@ -1671,7 +1673,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
+- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
++
++ if (drvdata->numextinsel)
++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
+@@ -1803,7 +1807,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 31754173091b9..b183d1d12f129 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -162,6 +162,7 @@
+ #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
+
+ #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
+ #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
+ #define TRCIDR5_ATBTRIG BIT(22)
+ #define TRCIDR5_LPOVERRIDE BIT(23)
+@@ -995,6 +996,7 @@ struct etmv4_drvdata {
+ u8 nr_cntr;
+ u8 nr_ext_inp;
+ u8 numcidc;
++ u8 numextinsel;
+ u8 numvmidc;
+ u8 nrseqstate;
+ u8 nr_event;
+--
+2.51.0
+
--- /dev/null
+From 79c69e915b7f5ce2c2d18b34175c3ba8b3af7224 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 925f6c9cecff4..bc6e247443e80 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -21,7 +21,8 @@
+ #include "coresight-self-hosted-trace.h"
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From 9dabf61e2f5ae94674221813caa69be0bedb6928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index bc6e247443e80..a584e5e83fb57 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -743,12 +743,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -758,7 +758,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From e11d242646e1422298bec710781a17ce50e4c521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 6ff77003a96ea..68325ebd56fe3 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+ #include <linux/scmi_protocol.h>
+@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e1c7626e7172b121f85563598901a0bab9c1daa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 17:22:12 +0200
+Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
+
+Make sure to drop the reference to the saw device taken by
+of_find_device_by_node() after retrieving its driver data during
+probe().
+
+Also drop the reference to the CPU node sooner to avoid leaking it in
+case there is no saw node or device.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index beedf22cbe78b..716474a793817 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -97,20 +97,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
+ return -ENODEV;
+
+ saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++ of_node_put(cpu_node);
+ if (!saw_node)
+ return -ENODEV;
+
+ pdev = of_find_device_by_node(saw_node);
+ of_node_put(saw_node);
+- of_node_put(cpu_node);
+ if (!pdev)
+ return -ENODEV;
+
+ data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ put_device(&pdev->dev);
+ return -ENOMEM;
++ }
+
+ data->spm = dev_get_drvdata(&pdev->dev);
++ put_device(&pdev->dev);
+ if (!data->spm)
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From 38b8fc8ae8d646fae5db6abb6160dcd7b0da88ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:54 +0800
+Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
+
+When the initialization of qm->debug.acc_diff_reg fails,
+the probe process does not exit. However, after qm->debug.qm_diff_regs is
+freed, it is not set to NULL. This can lead to a double free when the
+remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
+should be set to NULL after it is freed.
+
+Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+index a1d41ee39816b..cb27a44671ca1 100644
+--- a/drivers/crypto/hisilicon/debugfs.c
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -815,6 +815,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
+ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ ret = PTR_ERR(qm->debug.acc_diff_regs);
+ qm->debug.acc_diff_regs = NULL;
++ qm->debug.qm_diff_regs = NULL;
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0e0c453fd81f03327ece95c8c909b1673bcfc522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:05 +0800
+Subject: crypto: hisilicon - re-enable address prefetch after device resuming
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
+
+When the device resumes from a suspended state, it will revert to its
+initial state and requires re-enabling. Currently, the address prefetch
+function is not re-enabled after device resuming. Move the address prefetch
+enable to the initialization process. In this way, the address prefetch
+can be enabled when the device resumes by calling the initialization
+process.
+
+Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
+ drivers/crypto/hisilicon/qm.c | 3 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
+ 4 files changed, 43 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index b0596564d27d8..c72980dcce52b 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+
+ /* Config data buffer pasid needed by Kunpeng 920 */
+ hpre_config_pasid(qm);
++ hpre_open_sva_prefetch(qm);
+
+ hpre_enable_clock_gate(qm);
+
+@@ -1367,8 +1368,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ if (ret)
+ return ret;
+
+- hpre_open_sva_prefetch(qm);
+-
+ hisi_qm_dev_err_init(qm);
+ ret = hpre_show_last_regs_init(qm);
+ if (ret)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index a9bf65da30a68..42f1e7d0023e1 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4268,9 +4268,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
+ {
+ u32 value;
+
+- if (qm->err_ini->open_sva_prefetch)
+- qm->err_ini->open_sva_prefetch(qm);
+-
+ if (qm->ver >= QM_HW_V3)
+ return;
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 8dd4c0b10a74a..99f3e82e9ebfb 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -438,6 +438,45 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static void sec_close_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val |= SEC_PREFETCH_DISABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
++ val, !(val & SEC_SVA_DISABLE_READY),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++}
++
++static void sec_open_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ /* Enable prefetch */
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val &= SEC_PREFETCH_ENABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
++ val, !(val & SEC_PREFETCH_DISABLE),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++}
++
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+ {
+ u32 reg;
+@@ -471,45 +510,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base +
+ SEC_INTERFACE_USER_CTRL1_REG);
+ }
+-}
+-
+-static void sec_open_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- /* Enable prefetch */
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val &= SEC_PREFETCH_ENABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+- val, !(val & SEC_PREFETCH_DISABLE),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
+-}
+-
+-static void sec_close_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val |= SEC_PREFETCH_DISABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+- val, !(val & SEC_SVA_DISABLE_READY),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ sec_open_sva_prefetch(qm);
+ }
+
+ static void sec_enable_clock_gate(struct hisi_qm *qm)
+@@ -1092,7 +1093,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ if (ret)
+ return ret;
+
+- sec_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ sec_debug_regs_clear(qm);
+ ret = sec_show_last_regs_init(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 4e10090067f18..044e7303cb632 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -578,6 +578,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
+ writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
+ }
++ hisi_zip_open_sva_prefetch(qm);
+
+ /* let's open all compression/decompression cores */
+ dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
+@@ -589,6 +590,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
+ FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+
++ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+ return 0;
+@@ -1173,9 +1175,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- hisi_zip_set_high_perf(qm);
+-
+- hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ hisi_zip_debug_regs_clear(qm);
+
+--
+2.51.0
+
--- /dev/null
+From d223a1801378dc39666acbe6c2ad615ea6682f6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:04 +0800
+Subject: crypto: hisilicon/zip - remove unnecessary validation for
+ high-performance mode configurations
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
+
+When configuring the high-performance mode register, there is no
+need to verify whether the register has been successfully
+enabled, as there is no possibility of a write failure for this
+register.
+
+Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 86e5178120936..4e10090067f18 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -470,10 +470,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ return false;
+ }
+
+-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ {
+ u32 val;
+- int ret;
+
+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ if (perf_mode == HZIP_HIGH_COMP_PERF)
+@@ -483,13 +482,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+
+ /* Set perf mode */
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
+- val, val == perf_mode, HZIP_DELAY_1_US,
+- HZIP_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to set perf mode\n");
+-
+- return ret;
+ }
+
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+@@ -1181,9 +1173,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- ret = hisi_zip_set_high_perf(qm);
+- if (ret)
+- return ret;
++ hisi_zip_set_high_perf(qm);
+
+ hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+--
+2.51.0
+
--- /dev/null
+From 5e014f71c420ca45a32b33336f76d85f8beb83a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 088c8cce738ba..6e0d1a48bd505 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From 3d6920a2e8835d68f435a443dd883bc1dce92156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index cbaa4e2eddcef..6153dbd5be903 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -871,7 +871,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f687b48dc1b782f8c9c9b5296fc6730b7dcf9a45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index a4141b57b1478..cbaa4e2eddcef 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -869,6 +869,11 @@ int __register_one_node(int nid)
+ node_devices[nid] = node;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From d9366ae3b29f8c548151718415177153d7479dbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:50:14 +0800
+Subject: drm/amd/display: Remove redundant semicolons
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
+
+Remove unnecessary semicolons.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 9ba6cb67655f4..6c75aa82327ac 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ if (dual_plane) {
+ unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
+ num_pipes, pipe_idx);
+- ;
+ if (src->sw_mode == dm_sw_linear)
+ ASSERT(p1_pte_row_height_linear >= 8);
+
+--
+2.51.0
+
--- /dev/null
+From e48ca52f863b1bbfda2001a37fb86979e26a9ca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:07 +0200
+Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
+
+Based on some comments in dm_pp_display_configuration
+above the crtc_index and line_time fields, these values
+are programmed to the SMC to work around an SMC hang
+when it switches MCLK.
+
+According to Alex, the Windows driver programs them to:
+mclk_change_block_cp_min = 200 / line_time
+mclk_change_block_cp_max = 100 / line_time
+Let's use the same for the sake of consistency.
+
+Previously we used the watermark values, but it seemed buggy
+as the code was mixing up low/high and A/B watermarks, and
+was not saving a low watermark value on DCE 6, so
+mclk_change_block_cp_max would be always zero previously.
+
+Split this change off from the previous si_upload_smc_data
+to make it easier to bisect, in case it causes any issues.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 85ab0d87eb337..267aa96edc890 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ crtc_index = amdgpu_crtc->crtc_id;
+
+ if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 55da5ee2e3b74b46e35ff54a262c8c36aed2a9fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:09 +0200
+Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
+
+According to pp_pm_compute_clocks the non-DC display code
+has "issues with mclk switching with refresh rates over 120 hz".
+The workaround is to disable MCLK switching in this case.
+
+Do the same for legacy DPM.
+
+Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 42efe838fa85c..2d2d2d5e67634 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ (amdgpu_crtc->v_border * 2));
+
+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* we have issues with mclk switching with
++ * refresh rates over 120 hz on the non-DC code.
++ */
++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
++ vblank_time_us = 0;
++
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From cbc4e659a2cb5fdd9262ea12e4f2bd8175218b41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:10 +0200
+Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
+ (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
+
+Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
+switching on Oland when two 4K 60Hz monitors are connected")
+
+This is an ad-hoc DPM fix, necessary because we don't have
+proper bandwidth calculation for DCE 6.
+
+We define "high pixelclock" for SI as higher than necessary
+for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
+this category.
+
+When two high pixel clock displays are connected to Oland,
+additionally disable shader clock switching, which results in
+a higher voltage, thereby addressing some visible flickering.
+
+v2:
+Add more comments.
+v3:
+Split into two commits for easier review.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index b3c011542daf7..7a85c042a6db9 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ {
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
++ struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+ u16 vddc, vddci, min_vce_voltage = 0;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+ u32 max_sclk = 0, max_mclk = 0;
++ u32 high_pixelclock_count = 0;
+ int i;
+
+ if (adev->asic_type == CHIP_HAINAN) {
+@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ }
+ }
+
++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
++ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
++ * Find number of such displays connected.
++ */
++ for (i = 0; i < adev->mode_info.num_crtc; i++) {
++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
++ !adev->mode_info.crtcs[i]->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
++
++ if (conn->pixelclock_for_modeset > 297000)
++ high_pixelclock_count++;
++ }
++
++ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
++ * They are necessary because we don't have something like dce_calcs
++ * for these GPUs to calculate bandwidth requirements.
++ */
++ if (high_pixelclock_count) {
++ /* On Oland, we observe some flickering when two 4K 60Hz
++ * displays are connected, possibly because voltage is too low.
++ * Raise the voltage by requiring a higher SCLK.
++ * (Voltage cannot be adjusted independently without also SCLK.)
++ */
++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
++ disable_sclk_switching = true;
++ }
++
+ if (rps->vce_active) {
+ rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
+ rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
+--
+2.51.0
+
--- /dev/null
+From f79300a82782579577cf9c524d0b243ca3d30322 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:04 +0200
+Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
+
+Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
+is unsupported, to make sure it is properly turned off.
+
+v3:
+Simplify si_disable_ulv further.
+Always check the return value of amdgpu_si_send_msg_to_smc.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 52e4397d4a2a9..c17d567cf8bc5 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
+
+ static int si_disable_ulv(struct amdgpu_device *adev)
+ {
+- struct si_power_info *si_pi = si_get_pi(adev);
+- struct si_ulv_param *ulv = &si_pi->ulv;
++ PPSMC_Result r;
+
+- if (ulv->supported)
+- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
+- 0 : -EINVAL;
+-
+- return 0;
++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
+ }
+
+ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+--
+2.51.0
+
--- /dev/null
+From 4b34ab5e1a5d8606e736d61944a640f0373784c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:06 +0200
+Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
+
+The si_upload_smc_data function uses si_write_smc_soft_register
+to set some register values in the SMC, and expects the result
+to be PPSMC_Result_OK which is 1.
+
+The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
+checking the result of a command sent to the SMC.
+However, the si_write_smc_soft_register actually doesn't send
+any commands to the SMC and returns zero on success,
+so this check was incorrect.
+
+Fix that by not checking the return value, just like other
+calls to si_write_smc_soft_register.
+
+v3:
+Additionally, when no display is plugged in, there is no need
+to restrict MCLK switching, so program the registers to zero.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index c17d567cf8bc5..85ab0d87eb337 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5793,9 +5793,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+ struct amdgpu_crtc *amdgpu_crtc = NULL;
+ int i;
+-
+- if (adev->pm.dpm.new_active_crtc_count == 0)
+- return 0;
++ u32 crtc_index = 0;
++ u32 mclk_change_block_cp_min = 0;
++ u32 mclk_change_block_cp_max = 0;
+
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+@@ -5804,26 +5804,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ }
+ }
+
+- if (amdgpu_crtc == NULL)
+- return 0;
++ /* When a display is plugged in, program these so that the SMC
++ * performs MCLK switching when it doesn't cause flickering.
++ * When no display is plugged in, there is no need to restrict
++ * MCLK switching, so program them to zero.
++ */
++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
++ crtc_index = amdgpu_crtc->crtc_id;
+
+- if (amdgpu_crtc->line_time <= 0)
+- return 0;
++ if (amdgpu_crtc->line_time) {
++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ }
++ }
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_crtc_index,
+- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_crtc_index,
++ crtc_index);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
++ mclk_change_block_cp_min);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
++ mclk_change_block_cp_max);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From c814ba10787d3008d4601f5a682c052135b54bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:08 +0200
+Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
+
+Some parts of the code base expect that MCLK switching is turned
+off when the vblank time is set to zero.
+
+According to pp_pm_compute_clocks the non-DC code has issues
+with MCLK switching with refresh rates over 120 Hz.
+
+v3:
+Add code comment to explain this better.
+Add an if statement instead of changing the switch_limit.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 267aa96edc890..b3c011542daf7 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+- if (vblank_time < switch_limit)
++ /* Consider zero vblank time too short and disable MCLK switching.
++ * Note that the vblank time is set to maximum when no displays are attached,
++ * so we'll still enable MCLK switching in that case.
++ */
++ if (vblank_time == 0)
++ return true;
++ else if (vblank_time < switch_limit)
+ return true;
+ else
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 3212a2e6d479e62308a089b70941347763d53fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 0fef925b66024..e458e0d5801b0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @handle: handle used to pass amdgpu_device pointer
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(void *handle)
+ {
+@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From 3cf61ca42c65c67490a352d25ee4117d2ba7dd19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 09ce90cf6b532..2ee3a74ae0d8f 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -4002,7 +4002,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 91a27b1508e696f3373b749f6143836c2537a6bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:20:45 +0800
+Subject: drm/msm/dpu: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
+
+Change 'ret' from unsigned long to int, as storing negative error codes
+in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
+errors.
+
+Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/671100/
+Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+index 05a09d86e1838..fd5f9d04f81e6 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+@@ -452,7 +452,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+ static int dpu_encoder_phys_wb_wait_for_commit_done(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- unsigned long ret;
++ int ret;
+ struct dpu_encoder_wait_info wait_info;
+ struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+--
+2.51.0
+
--- /dev/null
+From 9993f52c5e84dff742a2c5120421274c9ec97cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 21:23:41 -0600
+Subject: drm/panel: novatek-nt35560: Fix invalid return value
+
+From: Brigham Campbell <me@brighamcampbell.com>
+
+[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
+
+Fix bug in nt35560_set_brightness() which causes the function to
+erroneously report an error. mipi_dsi_dcs_write() returns either a
+negative value when an error occurred or a positive number of bytes
+written when no error occurred. The buggy code reports an error under
+either condition.
+
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+index cc7f96d708263..52df7e776fae0 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+@@ -162,7 +162,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
+ par = 0x00;
+ ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
+ &par, 1);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9e4b37f9e778f95ae6656c5b36873c0205d401a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 780352f794e91..b63d935391dcd 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From a2d66d08c1a7822ca4f36d0e2edb7d2b3e64e689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:21 +0800
+Subject: f2fs: fix zero-sized extent for precache extents
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
+
+Script to reproduce:
+f2fs_io write 1 0 1881 rand dsync testfile
+f2fs_io fallocate 0 7708672 4096 testfile
+f2fs_io write 1 1881 1 rand buffered testfile
+fsync testfile
+umount
+mount
+f2fs_io precache_extents testfile
+
+When the data layout is something like this:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+...
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+During precache_extents, we map the last block(valid blkaddr) in dnode1:
+map->m_flags |= F2FS_MAP_MAPPED;
+map->m_pblk = blkaddr(valid blkaddr);
+map->m_len = 1;
+then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
+map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
+
+map->m_len = 1
+ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
+ei.fofs = start_pgofs = 1882
+ei.len = map->m_len - ofs = 1 - 1 = 0
+
+Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
+A,B,C is valid blkaddr
+case1:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case2:
+dnode1: dnode2:
+[0] A [0] C (C!=B+1)
+[1] A+1 [1] C+1
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case3:
+dnode1: dnode2:
+[0] A [0] C (C!=B+2)
+[1] A+1 [1] C+1
+... ....
+[1015] A+1015
+[1016] B (B!=A+1016)
+[1017] B+1 [1017] 0x0
+
+[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 2b018d365b914..ac7d0ed3fb894 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1737,9 +1737,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ if (map->m_flags & F2FS_MAP_MAPPED) {
+ unsigned int ofs = start_pgofs - map->m_lblk;
+
+- f2fs_update_read_extent_cache_range(&dn,
+- start_pgofs, map->m_pblk + ofs,
+- map->m_len - ofs);
++ if (map->m_len > ofs)
++ f2fs_update_read_extent_cache_range(&dn,
++ start_pgofs, map->m_pblk + ofs,
++ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+ *map->m_next_extent = pgofs + 1;
+--
+2.51.0
+
--- /dev/null
+From c4c9516ae6200800d63a197e90223ec3f4b1aa62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index 1646dadd7f37c..3b1c8d93b2654 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From eceb6b11cfb27aa032118f19f68e955ef2d53759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From 1b866d14057b41e7a080cfb5a507ea7dc6143b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 12d8682f33b53..340a4cbe8b5ca 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else
+ return -EINVAL;
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1148,7 +1153,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From 7c2562aa02b5dd391640a979de1fbaf0a3811c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:48:58 +0200
+Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
+ different subsystems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
+
+Distinct between fan speed setting request coming for hwmon and
+thermal subsystems.
+
+There are fields 'last_hwmon_state' and 'last_thermal_state' in the
+structure 'mlxreg_fan_pwm', which respectively store the cooling state
+set by the 'hwmon' and 'thermal' subsystem.
+The purpose is to make arbitration of fan speed setting. For example, if
+fan speed required to be not lower than some limit, such setting is to
+be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
+not set fan below this limit.
+
+Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
+cooling state to never be set to a lower value.
+
+Eliminate update of 'last_thermal_state', when request is coming from
+'hwmon' subsystem.
+
+Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index 7514d57661048..fbb18bd3f09b9 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -113,8 +113,8 @@ struct mlxreg_fan {
+ int divider;
+ };
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state);
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal);
+
+ static int
+ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ * last thermal state.
+ */
+ if (pwm->last_hwmon_state >= pwm->last_thermal_state)
+- return mlxreg_fan_set_cur_state(pwm->cdev,
+- pwm->last_hwmon_state);
++ return _mlxreg_fan_set_cur_state(pwm->cdev,
++ pwm->last_hwmon_state,
++ false);
+ return 0;
+ }
+ return regmap_write(fan->regmap, pwm->reg, val);
+@@ -347,9 +348,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state)
+-
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal)
+ {
+ struct mlxreg_fan_pwm *pwm = cdev->devdata;
+ struct mlxreg_fan *fan = pwm->fan;
+@@ -359,7 +359,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return -EINVAL;
+
+ /* Save thermal state. */
+- pwm->last_thermal_state = state;
++ if (thermal)
++ pwm->last_thermal_state = state;
+
+ state = max_t(unsigned long, state, pwm->last_hwmon_state);
+ err = regmap_write(fan->regmap, pwm->reg,
+@@ -371,6 +372,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state)
++
++{
++ return _mlxreg_fan_set_cur_state(cdev, state, true);
++}
++
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+ .get_max_state = mlxreg_fan_get_max_state,
+ .get_cur_state = mlxreg_fan_get_cur_state,
+--
+2.51.0
+
--- /dev/null
+From 53d6ed526ebbeba588441ac6be5f8f21d876de20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 2f2f21f1b659e..d7b42888f25c2 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 6fc2a5e8c97cf8bb4ab5dcd131aedc81ae9257b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 17:28:00 +0200
+Subject: hwrng: nomadik - add ARM_AMBA dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
+
+Compile-testing this driver is only possible when the AMBA bus driver is
+available in the kernel:
+
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
+nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
+nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
+x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
+
+The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
+specified for the COMPILE_TEST case.
+
+Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index 3da8e85f8aae0..84e13fd67ea6c 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG
+ config HW_RANDOM_NOMADIK
+ tristate "ST-Ericsson Nomadik Random Number Generator support"
+ depends on ARCH_NOMADIK || COMPILE_TEST
++ depends on ARM_AMBA
+ default HW_RANDOM
+ help
+ This driver provides kernel-side support for the Random Number
+--
+2.51.0
+
--- /dev/null
+From 3a978dc8dc33925e7c45976979a0141fa0cb741c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 74182db03a88b..a29f4ef793cf3 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -380,6 +380,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From a32c81794da559028b530fadaafca4af07580e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index fc7bfd98156ba..38d3dff7a2614 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1218,6 +1218,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+@@ -1231,6 +1232,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1255,12 +1257,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1268,7 +1268,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 7cd66a71171a9147e86799250408e1ee0c2eaabd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index a18d5876678c1..fda472d84549b 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -361,6 +361,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From eacc22b04c870c6999bdeb4369f5ce2b4fe926b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:08 +0800
+Subject: i3c: master: svc: Use manual response for IBI events
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
+
+Driver wants to nack the IBI request when the target is not in the
+known address list. In below code, svc_i3c_master_nack_ibi() will
+cause undefined behavior when using AUTOIBI with auto response rule,
+because hw always auto ack the IBI request.
+
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ svc_i3c_master_nack_ibi(master);
+ ...
+ break;
+
+AutoIBI has another issue that the controller doesn't quit AutoIBI state
+after IBIWON polling timeout when there is a SDA glitch(high->low->high).
+1. SDA high->low: raising an interrupt to execute IBI ISR
+2. SDA low->high
+3. Driver writes an AutoIBI request
+4. AutoIBI process does not start because SDA is not low
+5. IBIWON polling times out
+6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
+
+Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 9b287f92d078d..a18d5876678c1 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -422,9 +422,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ */
+ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
+- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
+- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
+- SVC_I3C_MCTRL_IBIRESP_AUTO,
++ /*
++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
++ * instend of using AUTO_IBI.
++ *
++ * Using AutoIBI request may cause controller to remain in AutoIBI state when
++ * there is a glitch on SDA line (high->low->high).
++ * 1. SDA high->low, raising an interrupt to execute IBI isr.
++ * 2. SDA low->high.
++ * 3. IBI isr writes an AutoIBI request.
++ * 4. The controller will not start AutoIBI process because SDA is not low.
++ * 5. IBIWON polling times out.
++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
++ */
++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
++ SVC_I3C_MCTRL_TYPE_I3C |
++ SVC_I3C_MCTRL_IBIRESP_MANUAL |
++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
+ master->regs + SVC_I3C_MCTRL);
+
+ /* Wait for IBIWON, should take approximately 100us */
+@@ -444,10 +459,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
+ svc_i3c_master_nack_ibi(master);
+- else
++ } else {
++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
++ svc_i3c_master_ack_ibi(master, true);
++ else
++ svc_i3c_master_ack_ibi(master, false);
+ svc_i3c_master_handle_ibi(master, dev);
++ }
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
+ if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
+--
+2.51.0
+
--- /dev/null
+From 65cbb5710d80daae5b1f82e51c40b3eec868df50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 8c69bdb5bb754..f56eee73ee4a1 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1021,6 +1021,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1028,7 +1030,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1046,9 +1047,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2d86bb08764777fdcb2cbb180f603ddff32410dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 5c210f48bd9ce..c7795feb904ed 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -669,7 +669,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8d8c9db356c535c1918f7637f894787758cf6ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:11:05 +0200
+Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
+
+INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
+init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
+prevent asking the user about this feature when configuring a kernel
+without initramfs support.
+
+Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 8b6a2848da4a5..b70e0e05a1856 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1405,6 +1405,7 @@ config BOOT_CONFIG_EMBED_FILE
+
+ config INITRAMFS_PRESERVE_MTIME
+ bool "Preserve cpio archive mtimes in initramfs"
++ depends on BLK_DEV_INITRD
+ default y
+ help
+ Each entry in an initramfs cpio archive carries an mtime value. When
+--
+2.51.0
+
--- /dev/null
+From 7f8b31987f69d7e3ab107aed5cc0c62ad307c8d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index ef1f45e43b630..61d3797fb7995 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From 5fc06f89f8487e421331582a185c6ddf8777abb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 2fb66ca0f50a5..7bd6aff6e260e 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4882,6 +4882,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From 4eb823365201d271922a8473eb8e9474c3b22c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index 1c3502f34cd37..86f4971222ba7 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client,
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From 7d2093502b48f74002d8d8c97d66453ee5bc5ddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 11:31:56 +0200
+Subject: media: st-delta: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
+
+Building with a reduced stack warning limit shows that delta_mjpeg_decode()
+copies a giant structure to the stack each time but only uses three of
+its members:
+
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Open-code the passing of the structure members that are actually used here.
+
+Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+index 0533d4a083d24..a078f1107300e 100644
+--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
+ return 0;
+ }
+
+-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
+ {
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+
+ memset(params, 0, sizeof(*params));
+
+- params->picture_start_addr_p = (u32)(au->paddr);
+- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
++ params->picture_start_addr_p = pstart;
++ params->picture_end_addr_p = pend;
+
+ /*
+ * !WARNING!
+@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+ int ret;
+- struct delta_au au = *pau;
++ void *au_vaddr = pau->vaddr;
++ dma_addr_t au_dma = pau->paddr;
++ size_t au_size = pau->size;
+ unsigned int data_offset = 0;
+ struct mjpeg_header *header = &ctx->header_struct;
+
+ if (!ctx->header) {
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ goto err;
+ }
+
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ ctx->header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+ goto err;
+ }
+
+- au.paddr += data_offset;
+- au.vaddr += data_offset;
++ au_dma += data_offset;
++ au_vaddr += data_offset;
+
+- ret = delta_mjpeg_ipc_decode(pctx, &au);
++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
+ if (ret)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From 3a5b287fa79b05863f5c02895f1e9f9537a62a02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:30:15 +0300
+Subject: media: zoran: Remove zoran_fh structure
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
+
+The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
+mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
+but the structure stayed by mistake. It is now used in a single
+location, assigned from a void pointer and then recast to a void
+pointer, without being every accessed. Drop it.
+
+Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/zoran/zoran.h | 6 ------
+ drivers/media/pci/zoran/zoran_driver.c | 3 +--
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
+index 56340553b2823..63592c4f9ed8c 100644
+--- a/drivers/media/pci/zoran/zoran.h
++++ b/drivers/media/pci/zoran/zoran.h
+@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
+
+ struct zoran;
+
+-/* zoran_fh contains per-open() settings */
+-struct zoran_fh {
+- struct v4l2_fh fh;
+- struct zoran *zr;
+-};
+-
+ struct card_info {
+ enum card_type type;
+ char name[32];
+diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
+index fa672cc8bc678..feb39854a989e 100644
+--- a/drivers/media/pci/zoran/zoran_driver.c
++++ b/drivers/media/pci/zoran/zoran_driver.c
+@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
+ struct v4l2_format *fmt)
+ {
+ struct zoran *zr = video_drvdata(file);
+- struct zoran_fh *fh = __fh;
+ int i;
+ int res = 0;
+
+ if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
+- return zoran_s_fmt_vid_out(file, fh, fmt);
++ return zoran_s_fmt_vid_out(file, __fh, fmt);
+
+ for (i = 0; i < NUM_FORMATS; i++)
+ if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
+--
+2.51.0
+
--- /dev/null
+From 8f5c90f8aae611e8ee0566180b5d51430f7673fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From 27915d61f6e0a5daa9d00ccc80811b1b52d710da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:07:27 +0300
+Subject: mtd: rawnand: atmel: Fix error handling path in
+ atmel_nand_controller_add_nands
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
+
+In case of a jump to the err label due to atmel_nand_create() or
+atmel_nand_controller_add_nand() failure, the reference to nand_np
+need to be released
+
+Use for_each_child_of_node_scoped() to fix the issue.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index 78f317ac04afa..56fd897721ad5 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1859,7 +1859,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
+
+ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+ {
+- struct device_node *np, *nand_np;
++ struct device_node *np;
+ struct device *dev = nc->dev;
+ int ret, reg_cells;
+ u32 val;
+@@ -1886,7 +1886,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ reg_cells += val;
+
+- for_each_child_of_node(np, nand_np) {
++ for_each_child_of_node_scoped(np, nand_np) {
+ struct atmel_nand *nand;
+
+ nand = atmel_nand_create(nc, nand_np, reg_cells);
+--
+2.51.0
+
--- /dev/null
+From d034885df7631c210491d6f38bca52d4b34d5dd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:22:43 +0000
+Subject: nbd: restrict sockets to TCP and UDP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
+
+Recently, syzbot started to abuse NBD with all kinds of sockets.
+
+Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
+made sure the socket supported a shutdown() method.
+
+Explicitely accept TCP and UNIX stream sockets.
+
+Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
+Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Richard W.M. Jones <rjones@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Yu Kuai <yukuai1@huaweicloud.com>
+Cc: linux-block@vger.kernel.org
+Cc: nbd@other.debian.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 120b75ee703d1..2a959c08bd3cb 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1107,6 +1107,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (!sock)
+ return NULL;
+
++ if (!sk_is_tcp(sock->sk) &&
++ !sk_is_stream_unix(sock->sk)) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
++ *err = -EINVAL;
++ sockfd_put(sock);
++ return NULL;
++ }
++
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From e1719f5e816efd2feae13e0e4bff56d7a562d444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 2acb63b547c35..bf58181589bf2 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -956,15 +956,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From 412ba5d0507efb9476b74f23818bef87ccbe858f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 444ccef76da29..b93abcc4d64b0 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -695,7 +695,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From 4f99ee5693b98062238eaaed9f7212141129cf7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:09 +0300
+Subject: net/mlx5: fw reset, add reset timeout work
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
+
+Add sync reset timeout to stop poll_sync_reset in case there was no
+reset done or abort event within timeout. Otherwise poll sync reset will
+just continue and in case of fw fatal error no health reporting will be
+done.
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 1a818759a9aac..de130c75de64e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -22,6 +22,7 @@ struct mlx5_fw_reset {
+ struct work_struct reset_reload_work;
+ struct work_struct reset_now_work;
+ struct work_struct reset_abort_work;
++ struct delayed_work reset_timeout_work;
+ unsigned long reset_flags;
+ struct timer_list timer;
+ struct completion done;
+@@ -180,6 +181,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
+ return -EALREADY;
+ }
+
++ if (current_work() != &fw_reset->reset_timeout_work.work)
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ mlx5_stop_sync_reset_poll(dev);
+ if (poll_health)
+ mlx5_start_health_poll(dev);
+@@ -250,6 +253,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+ }
+ mlx5_stop_health_poll(dev, true);
+ mlx5_start_sync_reset_poll(dev);
++
++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
++ &fw_reset->reset_flags))
++ schedule_delayed_work(&fw_reset->reset_timeout_work,
++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
+ return 0;
+ }
+
+@@ -445,6 +453,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
+ }
+ }
+
++static void mlx5_sync_reset_timeout_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_fw_reset *fw_reset =
++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
++ struct mlx5_core_dev *dev = fw_reset->dev;
++
++ if (mlx5_sync_reset_clear_reset_requested(dev, true))
++ return;
++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
++}
++
+ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+@@ -513,6 +534,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
+ cancel_work_sync(&fw_reset->reset_reload_work);
+ cancel_work_sync(&fw_reset->reset_now_work);
+ cancel_work_sync(&fw_reset->reset_abort_work);
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ }
+
+ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+@@ -535,6 +557,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
+ INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
+ INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
++ mlx5_sync_reset_timeout_work);
+
+ init_completion(&fw_reset->done);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 0f2e7be3981ac8f3e768db130bd1d9be9794eaf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:08 +0300
+Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
+ teardown
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
+
+The reclaim_pages_cmd() function sends a command to the firmware to
+reclaim pages if the command interface is active.
+
+A race condition can occur if the command interface goes down (e.g., due
+to a PCI error) while the mlx5_cmd_do() call is in flight. In this
+case, mlx5_cmd_do() will return an error. The original code would
+propagate this error immediately, bypassing the software-based page
+reclamation logic that is supposed to run when the command interface is
+down.
+
+Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
+that command interface is down. If this is the case, fall through to
+the software reclamation path. If the command failed for any another
+reason, or finished successfully, return as before.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 99909c74a2144..cab25eb30ca66 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -483,9 +483,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
++ int err;
+
+- if (!mlx5_cmd_is_down(dev))
+- return mlx5_cmd_do(dev, in, in_size, out, out_size);
++ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
++ if (err != -ENXIO)
++ return err;
+
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+--
+2.51.0
+
--- /dev/null
+From ae7cf660b697e1c1fb4a5ea0ab1f74988b34cd62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:07 +0300
+Subject: net/mlx5: Stop polling for command response if interface goes down
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
+
+Stop polling on firmware response to command in polling mode if the
+command interface got down. This situation can occur, for example, if a
+firmware fatal error is detected during polling.
+
+This change halts the polling process when the command interface goes
+down, preventing unnecessary waits.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index c83523395d5ee..4c614a256ee05 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+ return;
+ }
+ cond_resched();
++ if (mlx5_cmd_is_down(dev)) {
++ ent->ret = -ENXIO;
++ return;
++ }
+ } while (time_before(jiffies, poll_end));
+
+ ent->ret = -ETIMEDOUT;
+@@ -1056,7 +1060,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 95b4ee21e82fdf097871e87333f40961ab841e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index ddff6f19ff98e..92add3daadbb1 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 2d70ef5e498ac704acf517a931a40e8bf0e086f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 0bd6bf46f05f3..1f9ca5040982d 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -62,7 +62,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From cda08cc98c2248bf5587a300d50bd2f40a09e80c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index af376b9000677..7ee919201985f 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1409,7 +1409,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From 836200516047ba760e20a4af5a48d1e818b17c97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index f8a91d15982dc..cbcff4603232b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9231,7 +9231,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 83109d93efa7b7ecdb84e347c7c09383b59adde1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:07:32 +0800
+Subject: null_blk: Fix the description of the cache_size module argument
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
+
+When executing modinfo null_blk, there is an error in the description
+of module parameter mbps, and the output information of cache_size is
+incomplete.The output of modinfo before and after applying this patch
+is as follows:
+
+Before:
+[...]
+parm: cache_size:ulong
+[...]
+parm: mbps:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (uint)
+[...]
+
+After:
+[...]
+parm: cache_size:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (ulong)
+[...]
+parm: mbps:Limit maximum bandwidth (in MiB/s).
+ Default: 0 (no limit) (uint)
+[...]
+
+Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index e66cace433cbf..683e2c61822b0 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
+
+ static unsigned long g_cache_size;
+ module_param_named(cache_size, g_cache_size, ulong, 0444);
+-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+
+ static unsigned int g_mbps;
+ module_param_named(mbps, g_mbps, uint, 0444);
+--
+2.51.0
+
--- /dev/null
+From e2e28aa2c8d22911842af2a5afd0f6d4e1ba2f7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 570c58d2b5a58..a15e764bae35b 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From ef0560125f46e91752e3b5d4af9dcd28d131824d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 64e6ddcfe329a..e28905e58bd6a 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1024,6 +1024,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 968149d393f5f59022010a41cc55ae335a7c5734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 8e323e93be915..c165f69454590 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1346,7 +1346,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 4952cc4223dc0a0f3f39eb27233ba425d08f2d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 11:30:22 +0200
+Subject: PCI: tegra194: Fix duplicate PLL disable in
+ pex_ep_event_pex_rst_assert()
+
+From: Nagarjuna Kristam <nkristam@nvidia.com>
+
+[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
+
+During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
+called twice.
+
+pex_ep_event_pex_rst_assert() should do the opposite of
+pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
+tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
+tegra_pcie_bpmp_set_pll_state() call should instead be a call to
+tegra_pcie_bpmp_set_ctrl_state().
+
+With this, the uninitialization sequence also matches that of
+tegra_pcie_unconfig_controller().
+
+Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
+Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
+[cassel: improve commit log]
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 0839454fe4994..5100d2a53b8ab 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1720,9 +1720,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
+ ret);
+ }
+
+- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
+ if (ret)
+- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
+
+ pcie->ep_state = EP_STATE_DISABLED;
+ dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
+--
+2.51.0
+
--- /dev/null
+From 38fb763f366c295643e68998bb180bac757825a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 00e3a637f7b63..815bf2e2dffa4 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -95,7 +95,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From c233f155ddf7cfdf624ea873ab73efdd601c6038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 51408996255bd..e2601e45935e6 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From 6618eff297258376b36d2245bb030bd86850a572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index b438d24c13b5c..ea2fbabe1c64b 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -747,7 +747,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From 877597ab4e87f0d7827b856609c9d2cfbbf44d22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:58:23 +0300
+Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
+ probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
+
+The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
+would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
+that the pointer is valid.
+
+Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
+index e5458ada5197a..a68f51cc5ef96 100644
+--- a/drivers/devfreq/mtk-cci-devfreq.c
++++ b/drivers/devfreq/mtk-cci-devfreq.c
+@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
+ out_free_resources:
+ if (regulator_is_enabled(drv->proc_reg))
+ regulator_disable(drv->proc_reg);
+- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
++ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
++ regulator_is_enabled(drv->sram_reg))
+ regulator_disable(drv->sram_reg);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 044696d8058ad608b1ae77ba6ef69230dd620b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index baa31194cf20d..ef5157fc8dcc5 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From a12cf6a75fc5b9b5f5a70ba1a7ed777244ff3be5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 20:32:59 +0800
+Subject: power: supply: cw2015: Fix a alignment coding style issue
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
+
+Fix the checkpatch warning:
+CHECK: Alignment should match open parenthesis
+
+Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index 9d957cf8edf07..ae6f46b452101 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
+ if (!cw_bat->battery_workqueue)
+ return -ENOMEM;
+
+- devm_delayed_work_autocancel(&client->dev,
+- &cw_bat->battery_delay_work, cw_bat_work);
++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ queue_delayed_work(cw_bat->battery_workqueue,
+ &cw_bat->battery_delay_work, msecs_to_jiffies(10));
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From e1e696da6c3189280096a67dfc9fbe58f7edac5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index ea966fc67d287..dbeb67ffebf33 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From cc90a2934eb22c31619f52fff58a067023c93eb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 48ca0ff690ae2..6b3248be2bf10 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(chip->dev, "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 80aac5386f82834b5248a449635d8fb1d9abe16b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 0a113d0d6b08f..5c336ab12ee1d 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From 64bc5b8580cb275099ba2b84b5cfe74770ae2969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index f253295795f0a..cdb3b99e057cf 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 76119946f64d10fcffe35e12869b9a410185becc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 193f7d58d3845..dce86f5aee1f7 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 4aa0ac9603018a2cf3f32086c52fe0bab19d05cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 168532931c86d..bdbde64e4b21d 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -880,7 +880,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+ if (config->reg_update_bits)
+ map->reg_update_bits = config->reg_update_bits;
+--
+2.51.0
+
--- /dev/null
+From 90aedaa87baa1e099cc9eb9b430ae11e63edecee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index b9918f4fd2418..7252fa32cf054 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From dcd3652ff310fbd3428fbe978509015719a59b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 497acfb33f8f8..6cce6dd9fd232 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -162,9 +162,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From 5868098779b2e9e8c4b8db0fb39b246b850b1176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index a23e3d810f3e4..80af7a5ac6046 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 7612070b66160..887d446354006 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -42,7 +42,6 @@
+ #include "eswitch.h"
+ #include "en.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2641,11 +2640,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2655,18 +2652,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 11584a92787576d3c3681a4a1390f7965a5b9be4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index c8e1ead0c09e6..cb0bf8b6e0172 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1175,19 +1175,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command) {
+--
+2.51.0
+
--- /dev/null
+From e914494199d26803d391162633b32f589e7ca672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index e8a4750f6ec47..7d6e4fe31ceed 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From f199b4f8a6b82203873cb127b85ec3dcc514e847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 95e7c00cb7e54..2626e13e52a2d 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From 0b35b7b3f046be4e3a8071738ba30c9a2ad60bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index a87c3d7e3e5ca..00d70b458b48c 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -704,6 +704,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -720,7 +721,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From ed41feb4e20ff98c6d28db67c891b5de5e0147b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index 969008071decd..482c04ac06ba4 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1755,7 +1755,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3621,7 +3621,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From e9e8cbd9b337a195114ae0e0b544fb74d0eaa3a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 682e74196f4b0..d2243f809616d 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2060,11 +2060,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 53878a9117e3dab21caf7257df2bbbf348d004a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 18:31:18 +0200
+Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
+ fast
+
+From: Johannes Nixdorf <johannes@nixdorf.dev>
+
+[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
+
+Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
+event to the tracer, and starts to wait interruptibly. With
+SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
+message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
+and is subsequently interrupted, the tracee begins to wait again
+uninterruptibly (but killable).
+
+This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
+is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
+condition to begin waiting again. In this case the tracee is interrupted
+even though the tracer already acted on its behalf. This breaks the
+assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
+namely that the tracer can be sure the syscall is not interrupted or
+restarted on the tracee after it is received on the tracer. Fix this
+by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
+switch to uninterruptible waiting.
+
+With the condition changed the loop in seccomp_do_user_notification()
+would exit immediately after deciding that noninterruptible waiting
+is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
+skipping the code that processes pending addfd commands first. Prevent
+this by executing the remaining loop body one last time in this case.
+
+Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
+Reported-by: Ali Polatel <alip@chesswob.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
+Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
+Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index e9852d1b4a5ec..8dcb585ae78c1 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1090,7 +1090,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
+ static bool should_sleep_killable(struct seccomp_filter *match,
+ struct seccomp_knotif *n)
+ {
+- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
+ }
+
+ static int seccomp_do_user_notification(int this_syscall,
+@@ -1134,13 +1134,11 @@ static int seccomp_do_user_notification(int this_syscall,
+
+ if (err != 0) {
+ /*
+- * Check to see if the notifcation got picked up and
+- * whether we should switch to wait killable.
++ * Check to see whether we should switch to wait
++ * killable. Only return the interrupted error if not.
+ */
+- if (!wait_killable && should_sleep_killable(match, &n))
+- continue;
+-
+- goto interrupted;
++ if (!(!wait_killable && should_sleep_killable(match, &n)))
++ goto interrupted;
+ }
+
+ addfd = list_first_entry_or_null(&n.addfd,
+--
+2.51.0
+
--- /dev/null
+From f5c831ff6153083165460d91fa0f4d38c656f3c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From a0e55976bc7eb8caa1dd595cfadebd7d730fab54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 09773695d219f..4056706d63f7e 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -240,6 +240,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 8cce6956a283a1253c68278e206195b09e957f2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 4eb8d372f619f..44b78e979cdc4 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1656,6 +1656,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+ }
+--
+2.51.0
+
driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
crypto-rng-ensure-set_ent-is-always-present.patch
net-9p-fix-double-req-put-in-p9_fd_cancelled.patch
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+smb-server-fix-ird-ord-negotiation-with-the-client.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+bpf-selftests-fix-test_tcpnotify_user.patch
+bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+libbpf-fix-reuse-of-devmap.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+null_blk-fix-the-description-of-the-cache_size-modul.patch
+nbd-restrict-sockets-to-tcp-and-udp.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+i3c-master-svc-use-manual-response-for-ibi-events.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+media-zoran-remove-zoran_fh-structure.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+serial-max310x-add-error-checking-in-probe.patch
+drm-amd-display-remove-redundant-semicolons.patch
+hwrng-nomadik-add-arm_amba-dependency.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+media-st-delta-avoid-excessive-stack-usage.patch
+crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+drm-amd-pm-fix-si_upload_smc_data-v3.patch
+drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+drm-msm-dpu-fix-incorrect-type-for-ret.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+f2fs-fix-zero-sized-extent-for-precache-extents.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-9322
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27178
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-15359
+crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+coresight-etm4x-conditionally-access-register-trcext.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+vhost-vringh-fix-copy_to_iter-return-value-check.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+net-mlx5-stop-polling-for-command-response-if-interf.patch
+net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+net-mlx5-fw-reset-add-reset-timeout-work.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+vhost-vringh-modify-the-return-value-check.patch
--- /dev/null
+From 7458c72c9de5a09bebb5d58d15d551cfd829f7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:34:58 +0200
+Subject: smb: server: fix IRD/ORD negotiation with the client
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
+
+Already do real negotiation in smb_direct_handle_connect_request()
+where we see the requested initiator_depth and responder_resources
+from the client.
+
+We should detect legacy iwarp clients using MPA v1
+with the custom IRD/ORD negotiation.
+
+We need to send the custom IRD/ORD in big endian,
+but we need to try to let clients with broken requests
+using little endian (older cifs.ko) to work.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
+ 1 file changed, 85 insertions(+), 14 deletions(-)
+
+diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
+index 84b5b2f5df998..af1c41f922bb3 100644
+--- a/fs/smb/server/transport_rdma.c
++++ b/fs/smb/server/transport_rdma.c
+@@ -152,6 +152,10 @@ struct smb_direct_transport {
+ struct work_struct disconnect_work;
+
+ bool negotiation_requested;
++
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ };
+
+ #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
+@@ -345,6 +349,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
+ t->cm_id = cm_id;
+ cm_id->context = t;
+
++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
++ t->responder_resources = 1;
++
+ t->status = SMB_DIRECT_CS_NEW;
+ init_waitqueue_head(&t->wait_status);
+
+@@ -1618,21 +1625,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
+ static int smb_direct_accept_client(struct smb_direct_transport *t)
+ {
+ struct rdma_conn_param conn_param;
+- struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+ int ret;
+
++ /*
++ * smb_direct_handle_connect_request()
++ * already negotiated t->initiator_depth
++ * and t->responder_resources
++ */
+ memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
+- SMB_DIRECT_CM_INITIATOR_DEPTH);
+- conn_param.responder_resources = 0;
+-
+- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
+- t->cm_id->port_num,
+- &port_immutable);
+- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = conn_param.responder_resources;
+- ird_ord_hdr[1] = 1;
++ conn_param.initiator_depth = t->initiator_depth;
++ conn_param.responder_resources = t->responder_resources;
++
++ if (t->legacy_iwarp) {
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2018,10 +2025,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
+ return true;
+ }
+
+-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
++ struct rdma_cm_event *event)
+ {
+ struct smb_direct_transport *t;
+ struct task_struct *handler;
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+ int ret;
+
+ if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
+@@ -2035,6 +2045,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+ if (!t)
+ return -ENOMEM;
+
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ t->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * First set what the we as server are able to support
++ */
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ new_cm_id->device->attrs.max_qp_rd_atom);
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ t->responder_resources = min_t(u8, t->responder_resources,
++ peer_responder_resources);
++
+ ret = smb_direct_connect(t);
+ if (ret)
+ goto out_err;
+@@ -2059,7 +2130,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
+ {
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST: {
+- int ret = smb_direct_handle_connect_request(cm_id);
++ int ret = smb_direct_handle_connect_request(cm_id, event);
+
+ if (ret) {
+ pr_err("Can't create transport: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From 78bc556bc8362a1001eedf0d3d3a600657c2962b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 0acd433afa7bc..42e1067fae7ad 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -1005,16 +1005,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From d494ed1eb8fac1f4180e48b5369c74a8b0e3a855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index ff2b9eb9f669f..5797d95705417 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -415,13 +415,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req, err);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, RSC_DRV_CMD_ENABLE, i, 0);
+--
+2.51.0
+
--- /dev/null
+From 90bc58775df8322460f1d6957234dd0cd906cc06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index a6f4ee3918977..021b94a383d13 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 97de11a25009abcfba354665b586aa0120650167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From ab90feeeaeb32ec0425adf207086e7ef8621e1ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index ee51c12306894..bbd3ea0a64822 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -79,8 +79,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From b582e995683bc068e62ce89452cb864be120ceba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From c87af974907c76b2d136ff55ee6bd9905bd3a590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From baeca32fbd63537ca0256cadc0fbe46551799686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index d94daa296d59d..c195f85149519 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2905,8 +2905,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -2925,11 +2925,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4397306b65166cac28a21be0d90f3c4d33c58ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index 1434ab8f6988c..c7deb7c19d7a9 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From 60562038bd095dd31b37cb666e2faa65b225eb8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index 2c7f3f9a26ebb..a6bb01082ec69 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From d1ef1307d8f2feb914ea6e700411ed50081db6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index a0ea830e1ba17..f9eccd40c221f 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -46,6 +46,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From 3ef7f5a274c539130a6739576e5a52942b625404 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index cdbf12639dfa7..f55dcc3a40184 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1356,6 +1356,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From 6b5dc97a10990e3ac718e608d9a39fb88dafd096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index 8aaafba058aa9..f170741206e1d 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From f1d6125fe8f961d5537aebd599a587f430cc3dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index ab3c38a7d8ac0..a73604af8960e 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From 54b53143f57fd741030c7971858d977c9a5a79a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 6b98f5ab6dfed..e3c8483d7ba40 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 99cced339fea5b937f5ae4f2505c48ec0acd85ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:04:08 -0400
+Subject: vhost: vringh: Fix copy_to_iter return value check
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
+
+The return value of copy_to_iter can't be negative, check whether the
+copied length is equal to the requested length instead of checking for
+negative values.
+
+Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 10bfc5f1c50d5..c570d214d5b68 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1195,6 +1195,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
+ len - total_translated, &translated,
+@@ -1206,9 +1207,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+
+ iov_iter_bvec(&iter, ITER_DEST, iov, ret, translated);
+
+- ret = copy_to_iter(src, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_to_iter(src, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From bfb1f14407685d1d8e159fa0de3e4abada0bd571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:17:38 +0800
+Subject: vhost: vringh: Modify the return value check
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
+
+The return value of copy_from_iter and copy_to_iter can't be negative,
+check whether the copied lengths are equal.
+
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Cc: "Stefano Garzarella" <sgarzare@redhat.com>
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index c570d214d5b68..d89c2bce94cbf 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1162,6 +1162,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
+ len - total_translated, &translated,
+@@ -1173,9 +1174,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+
+ iov_iter_bvec(&iter, ITER_SOURCE, iov, ret, translated);
+
+- ret = copy_from_iter(dst, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_from_iter(dst, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From 1a2e69f274e1874e385182e02a16a6a1ec2772a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 1c569be72ea29..15644ae2387fd 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 65ad424b25495d98290bbcfb2fbe7a477a5178cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index b126ffba480f1..2fda5ca3e6ee9 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From 0f891bf8fe4eff07cd0a28a4756318298c38ab66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 12:42:03 +0530
+Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
+ available
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
+
+In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
+information, an attempt is made to find the station using the address 2
+(source address) field in the header. Since pubsta is missing, link
+information such as link_valid and link_id is also unavailable. Now if such
+a situation comes, and if a matching ML station entry is found based on
+the source address, currently the packet is dropped due to missing link ID
+in the status field which is not correct.
+
+Hence, to fix this issue, if link_valid is not set and the station is an
+ML station, make an attempt to find a link station entry using the source
+address. If a valid link station is found, derive the link ID and proceed
+with packet processing. Otherwise, drop the packet as per the existing
+flow.
+
+Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
+Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8c9267acb227b..776f9fcf05abe 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5106,12 +5106,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ continue;
++
++ link_id = link_sta->link_id;
++ }
++
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
+- continue;
+-
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+
+ prev_sta = sta;
+@@ -5119,10 +5127,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+- goto out;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
++ link_id = link_sta->link_id;
++ }
++
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+--
+2.51.0
+
--- /dev/null
+From b39ff11fbcce205631fc26547d0c5712514bf314 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index ba927033bbe8c..1206769cdc7fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ceb5e4a5e4f387ab704e42f73fd1aaf37cf013e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 5e25060647b2d..3b9b75eb4cdb8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From 5bbcf36b03e1da1b8b1b51d2773efec5f180b049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:50 +0300
+Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
+
+Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
+scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
+wiphy lock inside. However, this workqueue can be flushed when e.g.
+closing the interface and wiphy lock is already taken in that case.
+
+Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
+the global workqueue.
+
+[1]:
+
+ WARNING: possible circular locking dependency detected
+ 6.17.0-rc2 #17 Not tainted
+ ------------------------------------------------------
+ kworker/u32:1/61 is trying to acquire lock:
+ ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
+
+ but task is already holding lock:
+ ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
+ process_one_work+0x7c6/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
+ touch_wq_lockdep_map+0x8e/0x180
+ __flush_workqueue+0x129/0x10d0
+ ieee80211_stop_device+0xa8/0x110
+ ieee80211_do_stop+0x14ce/0x2880
+ ieee80211_stop+0x13a/0x2c0
+ __dev_close_many+0x18f/0x510
+ __dev_change_flags+0x25f/0x670
+ netif_change_flags+0x7b/0x160
+ do_setlink.isra.0+0x1640/0x35d0
+ rtnl_newlink+0xd8c/0x1d30
+ rtnetlink_rcv_msg+0x700/0xb80
+ netlink_rcv_skb+0x11d/0x350
+ netlink_unicast+0x49a/0x7a0
+ netlink_sendmsg+0x759/0xc20
+ ____sys_sendmsg+0x812/0xa00
+ ___sys_sendmsg+0xf7/0x180
+ __sys_sendmsg+0x11f/0x1b0
+ do_syscall_64+0xbb/0x360
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock((wq_completion)phy0);
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock(&rdev->wiphy.mtx);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u32:1/61:
+ #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
+ #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
+ Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ print_circular_bug.cold+0x178/0x1be
+ check_noncircular+0x14c/0x170
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index f5dacdc4d11ab..24a9025e5bea8 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -204,7 +204,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
+
+ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ {
+- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ struct ser_msg *msg = NULL;
+
+ if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
+@@ -220,7 +219,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ list_add(&msg->list, &ser->msg_q);
+ spin_unlock_irq(&ser->msg_q_lock);
+
+- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
++ schedule_work(&ser->ser_hdl_work);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8361bd2492f4e50fc523469d114a516268ad6a41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 2e7890dd58a47..7865f180eb087 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -243,7 +243,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -253,10 +253,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 5792df105c5eb0241ed7c2fa98a849c5964c3391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ae035b93da087..3eb56b77cb6d9 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 39d2449c66161c5f1a726324f720d817c3593802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 0888e4d618d53..b524cf27213d4 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 2099147103d90c446c2cfc554bdc32b682b4698e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:03:16 +0200
+Subject: ACPICA: Fix largest possible resource descriptor index
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
+
+ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
+used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
+
+Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
+clamped incorrectly and resulting value may issue an out-of-bounds
+access for 'acpi_gbl_resource_types' array. Compile tested only.
+
+Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
+Link: https://github.com/acpica/acpica/commit/cf00116c
+Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/aclocal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
+index 6f4fe47c955bd..35460c2072a4a 100644
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -1141,7 +1141,7 @@ struct acpi_port_info {
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92
+ #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93
+-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94
++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93
+
+ /*****************************************************************************
+ *
+--
+2.51.0
+
--- /dev/null
+From f243439bce8cee0e28d0aae23f3d6cd5707d49d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index 9d95ecb299aed..a99acd1125e74 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From c2c8484f8b3d91f39813cdef10a4e02ccb0946f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:28:51 +0200
+Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
+ PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]
+
+snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
+via spin_lock_irq(). This also implicitly disables the handling of
+softirqs such as TIMER_SOFTIRQ.
+On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
+disable them. That means a timer can be invoked during spin_lock_irq()
+on the same CPU. Due to synchronisations reasons local_bh_disable() has
+a per-CPU lock named softirq_ctrl.lock which synchronizes individual
+softirq against each other.
+syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
+acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
+is a possible deadlock.
+
+The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
+would lead to too much synchronisation against individual threads on the
+system. To avoid the possible deadlock, softirqs must be manually
+disabled before the lock is acquired.
+
+Disable softirqs before the lock is acquired on PREEMPT_RT.
+
+Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com
+Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_native.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 9b91f68b3fff0..d15de21f6ebf0 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
+ }
+
+ /* define group lock helpers */
+-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
+ static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
+ { \
+- if (nonatomic) \
++ if (nonatomic) { \
+ mutex_ ## mutex_action(&group->mutex); \
+- else \
+- spin_ ## action(&group->lock); \
+-}
+-
+-DEFINE_PCM_GROUP_LOCK(lock, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock, unlock);
+-DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
++ } else { \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \
++ local_bh_disable(); \
++ spin_ ## action(&group->lock); \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
++ local_bh_enable(); \
++ } \
++}
++
++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
+
+ /**
+ * snd_pcm_stream_lock - Lock the PCM stream
+--
+2.51.0
+
--- /dev/null
+From 82e1fdd4060e19deda8fc29ac223cd0978edddb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index e5869cca5e791..94dece1839af3 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -872,7 +872,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCK1..4 settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -916,7 +916,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From 7429527966d01a62333970dbcc9f82e92f015427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 23:59:57 +0200
+Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
+ property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
+
+The dtbs_check validation for am335x-cm-t335.dtb flags an error
+for an unevaluated 'num-serializer' property in the mcasp0 node.
+
+This property is obsolete; it is not defined in the davinci-mcasp-audio
+schema and is not used by the corresponding (or any) driver.
+
+Remove this unused property to fix the schema validation warning.
+
+Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+index 06767ea164b59..ece7f7854f6aa 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+@@ -483,8 +483,6 @@ &mcasp1 {
+
+ op-mode = <0>; /* MCASP_IIS_MODE */
+ tdm-slots = <2>;
+- /* 16 serializers */
+- num-serializer = <16>;
+ serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */
+ 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
+ >;
+--
+2.51.0
+
--- /dev/null
+From 593d2fec6f71dd6144963a9cd1a4042172d53c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 15:49:48 +0200
+Subject: ARM: dts: renesas: porter: Fix CAN pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
+
+According to the schematics, the CAN transceiver is connected to pins
+GP7_3 and GP7_4, which correspond to CAN0 data group B.
+
+Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+index 93c86e9216455..b255eb228dd74 100644
+--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+@@ -290,7 +290,7 @@ vin0_pins: vin0 {
+ };
+
+ can0_pins: can0 {
+- groups = "can0_data";
++ groups = "can0_data_b";
+ function = "can0";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From c3d9fa4cff3a1002201c0c36354762f7113c90f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:25:30 +0200
+Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in
+ DTS to use correct boolean syntax
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
+
+The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
+schema, was incorrectly assigned a value (<1>) in the DTS file, causing
+a validation error: "size (4) error for type flag". The driver uses
+of_property_read_bool(), expecting a boolean. Remove the value to fix
+the dtbs_check error.
+
+Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
+Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+index a4beb718559c4..9ee9e7a1343c4 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+@@ -270,7 +270,7 @@ &tps {
+ vcc7-supply = <&vbat>;
+ vccio-supply = <&vbat>;
+
+- ti,en-ck32k-xtal = <1>;
++ ti,en-ck32k-xtal;
+
+ regulators {
+ vrtc_reg: regulator@0 {
+--
+2.51.0
+
--- /dev/null
+From 645f2ecd1e1493c92478ec1a89f92bd706cdd4e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:50:52 +0200
+Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on
+ property to use correct boolean syntax in DTS
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
+
+The ti,keep-vref-on property, defined as a boolean flag in the Device
+Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
+causing a validation error: "size (4) error for type flag". Remove
+the value to match the schema and ensure compatibility with the driver
+using device_property_read_bool(). This fixes the dtbs_check error.
+
+Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+index a7f99ae0c1fe9..78c657429f641 100644
+--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+@@ -65,7 +65,7 @@ ads7846@0 {
+ ti,debounce-max = /bits/ 16 <10>;
+ ti,debounce-tol = /bits/ 16 <5>;
+ ti,debounce-rep = /bits/ 16 <1>;
+- ti,keep-vref-on = <1>;
++ ti,keep-vref-on;
+ ti,settle-delay-usec = /bits/ 16 <150>;
+
+ wakeup-source;
+--
+2.51.0
+
--- /dev/null
+From b115cdc017ccba7727dc764543c6229a86beedb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:44 +0200
+Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
+
+PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
+and disabled. Linux' PCI subsystem assigns the ethernet nic from
+`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
+disabled port as iommu. The `pcie0_dart_1` instance is disabled and
+probably fused off (it is on the M2 Pro Mac mini which has a disabled
+PCIe port as well).
+Without iommu the ethernet nic is not expected work.
+Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
+subsystem's bus number.
+
+Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
+index 152f95fd49a21..7089ccf3ce556 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
+@@ -21,6 +21,14 @@ aliases {
+ };
+ };
+
++/*
++ * Adjust pcie0's iommu-map to account for the disabled port01.
++ */
++&pcie0 {
++ iommu-map = <0x100 &pcie0_dart_0 1 1>,
++ <0x200 &pcie0_dart_2 1 1>;
++};
++
+ &bluetooth0 {
+ brcm,board-type = "apple,santorini";
+ };
+@@ -36,10 +44,10 @@ &wifi0 {
+ */
+
+ &port02 {
+- bus-range = <3 3>;
++ bus-range = <2 2>;
+ status = "okay";
+ ethernet0: ethernet@0,0 {
+- reg = <0x30000 0x0 0x0 0x0 0x0>;
++ reg = <0x20000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 00];
+ };
+--
+2.51.0
+
--- /dev/null
+From 49c15ffc3b498378b5f3f89e274fbea82d8e7fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:45 +0200
+Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator
+
+From: Annette Kobou <annette.kobou@kontron.de>
+
+[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]
+
+The regulator uses the wrong GPIO. Fix this.
+
+Signed-off-by: Annette Kobou <annette.kobou@kontron.de>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 89e97c604bd3e..9a9e5d0daf3ba 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -33,7 +33,9 @@ pwm-beeper {
+
+ reg_vcc_panel: regulator-vcc-panel {
+ compatible = "regulator-fixed";
+- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_reg_vcc_panel>;
++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+@@ -161,3 +163,11 @@ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+ };
++
++&iomuxc {
++ pinctrl_reg_vcc_panel: regvccpanelgrp {
++ fsl,pins = <
++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */
++ >;
++ };
++};
+--
+2.51.0
+
--- /dev/null
+From 28ba4eef28ec2db0d9bc44182cb6ec3da4a5be98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:46 +0200
+Subject: arm64: dts: imx93-kontron: Fix USB port assignment
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]
+
+The assignment of the USB ports is wrong and needs to be swapped.
+The OTG (USB-C) port is on the first port and the host port with
+the onboard hub is on the second port.
+
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -137,6 +137,16 @@ &tpm6 {
+ };
+
+ &usbotg1 {
++ adp-disable;
++ hnp-disable;
++ srp-disable;
++ disable-over-current;
++ dr_mode = "otg";
++ usb-role-switch;
++ status = "okay";
++};
++
++&usbotg2 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ disable-over-current;
+@@ -149,16 +159,6 @@ usb1@1 {
+ };
+ };
+
+-&usbotg2 {
+- adp-disable;
+- hnp-disable;
+- srp-disable;
+- disable-over-current;
+- dr_mode = "otg";
+- usb-role-switch;
+- status = "okay";
+-};
+-
+ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+--
+2.51.0
+
--- /dev/null
+From dbfda702e1bd4302c44ebd9ed331822431b4e61b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:25:31 +0800
+Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
+
+From: Joy Zou <joy.zou@nxp.com>
+
+[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]
+
+According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
+and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.
+
+Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
+Signed-off-by: Joy Zou <joy.zou@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
+index 7365d6538a733..ddbc94c375e0c 100644
+--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
+@@ -822,7 +822,7 @@ lpuart7: serial@42690000 {
+ interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART7>;
+ clock-names = "ipg";
+- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+@@ -834,7 +834,7 @@ lpuart8: serial@426a0000 {
+ interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART8>;
+ clock-names = "ipg";
+- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+--
+2.51.0
+
--- /dev/null
+From 9038e627203b768ca44beca607f695974e5fb0da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:52 +0200
+Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node
+ names
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
+
+The node names for "pmic", "regulators", "rtc", and "keys" are
+dictated by the PMIC MFD binding: change those to adhere to it.
+
+Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+index d89858c73ab1b..243afbffa21fd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+@@ -6,12 +6,12 @@
+ #include <dt-bindings/input/input.h>
+
+ &pwrap {
+- pmic: mt6331 {
++ pmic: pmic {
+ compatible = "mediatek,mt6331";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6331regulator: mt6331regulator {
++ mt6331regulator: regulators {
+ compatible = "mediatek,mt6331-regulator";
+
+ mt6331_vdvfs11_reg: buck-vdvfs11 {
+@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
+ };
+
+ mt6331_vdig18_reg: ldo-vdig18 {
+- regulator-name = "dvdd18_dig";
++ regulator-name = "vdig18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-ramp-delay = <0>;
+@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
+ };
+ };
+
+- mt6331rtc: mt6331rtc {
++ mt6331rtc: rtc {
+ compatible = "mediatek,mt6331-rtc";
+ };
+
+- mt6331keys: mt6331keys {
++ mt6331keys: keys {
+ compatible = "mediatek,mt6331-keys";
+ power {
+ linux,keycodes = <KEY_POWER>;
+--
+2.51.0
+
--- /dev/null
+From 00a8dc79991976b36dc331aa5a3149776aa98745 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:56 +0200
+Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
+
+Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
+actually used, the final value that gets written to the register
+field for DAT_LATCH_CK_SEL is just 0x4.
+
+This also fixes dtbs_check warnings.
+
+Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+index 91de920c22457..03cc48321a3f4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+@@ -212,7 +212,7 @@ proximity@48 {
+
+ &mmc0 {
+ /* eMMC controller */
+- mediatek,latch-ck = <0x14>; /* hs400 */
++ mediatek,latch-ck = <4>; /* hs400 */
+ mediatek,hs200-cmd-int-delay = <1>;
+ mediatek,hs400-cmd-int-delay = <1>;
+ mediatek,hs400-ds-dly3 = <0x1a>;
+--
+2.51.0
+
--- /dev/null
+From 822478c582d0c72b907aa9f6e19d9d7cfd20a64e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 17:01:34 +0800
+Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]
+
+The touchscreen controller used with the original Krabby design is the
+Elan eKTH6918, which is in the same family as eKTH6915, but supporting
+a larger screen size with more sense lines.
+
+OTOH, the touchscreen controller that actually shipped on the Tentacruel
+devices is the Elan eKTH6A12NAY. A compatible string was added for it
+specifically because it has different power sequencing timings.
+
+Fix up the touchscreen nodes for both these. This also includes adding
+a previously missing reset line. Also add "no-reset-on-power-off" since
+the power is always on, and putting it in reset would consume more
+power.
+
+Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++----
+ .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+index 7c971198fa956..72a2a2bff0a93 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+@@ -71,14 +71,14 @@ &i2c1 {
+ i2c-scl-internal-delay-ns = <10000>;
+
+ touchscreen: touchscreen@10 {
+- compatible = "hid-over-i2c";
++ compatible = "elan,ekth6915";
+ reg = <0x10>;
+ interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&touchscreen_pins>;
+- post-power-on-delay-ms = <10>;
+- hid-descr-addr = <0x0001>;
+- vdd-supply = <&pp3300_s3>;
++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
++ vcc33-supply = <&pp3300_s3>;
++ no-reset-on-power-off;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+index 26d3451a5e47c..24d9ede63eaa2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
+ CROS_STD_MAIN_KEYMAP
+ >;
+ };
++
++&touchscreen {
++ compatible = "elan,ekth6a12nay";
++};
+--
+2.51.0
+
--- /dev/null
+From 4f93864114d381c26437105092e060b33b8e32a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 17:59:59 +0800
+Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from
+ pcie0
+
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+
+[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
+
+When test suspend resume with 6.8 based kernel, system can't resume
+and I got below error which can be also reproduced with 6.16 rc6+
+kernel.
+
+mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
+mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
+mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
+
+After investigation, looks pcie0 has the same problem as pcie1 as
+decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
+Remove suspend-breaking reset from pcie1").
+
+Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
+Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index 2e138b54f5563..451aa278bef50 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 {
+
+ power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
+
+- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
+- reset-names = "mac";
+-
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+--
+2.51.0
+
--- /dev/null
+From 162714cbad0c05ecd372ec4dbb10514cdbb018a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:13 +0200
+Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator
+ nodes
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]
+
+All of the MT6360 regulator nodes were wrong and would not probe
+because the regulator names are supposed to be lower case, but
+they are upper case in this devicetree.
+
+Change all nodes to be lower case to get working regulators.
+
+Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+index e2e75b8ff9188..9ab4fee769e40 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+@@ -351,7 +351,7 @@ regulator {
+ LDO_VIN2-supply = <&vsys>;
+ LDO_VIN3-supply = <&vsys>;
+
+- mt6360_buck1: BUCK1 {
++ mt6360_buck1: buck1 {
+ regulator-name = "emi_vdd2";
+ regulator-min-microvolt = <600000>;
+ regulator-max-microvolt = <1800000>;
+@@ -361,7 +361,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_buck2: BUCK2 {
++ mt6360_buck2: buck2 {
+ regulator-name = "emi_vddq";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1300000>;
+@@ -371,7 +371,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_ldo1: LDO1 {
++ mt6360_ldo1: ldo1 {
+ regulator-name = "mt6360_ldo1"; /* Test point */
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -379,7 +379,7 @@ mt6360_ldo1: LDO1 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo2: LDO2 {
++ mt6360_ldo2: ldo2 {
+ regulator-name = "panel1_p1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -387,7 +387,7 @@ mt6360_ldo2: LDO2 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo3: LDO3 {
++ mt6360_ldo3: ldo3 {
+ regulator-name = "vmc_pmu";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -395,7 +395,7 @@ mt6360_ldo3: LDO3 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo5: LDO5 {
++ mt6360_ldo5: ldo5 {
+ regulator-name = "vmch_pmu";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+@@ -403,7 +403,7 @@ mt6360_ldo5: LDO5 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo6: LDO6 {
++ mt6360_ldo6: ldo6 {
+ regulator-name = "mt6360_ldo6"; /* Test point */
+ regulator-min-microvolt = <500000>;
+ regulator-max-microvolt = <2100000>;
+@@ -411,7 +411,7 @@ mt6360_ldo6: LDO6 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo7: LDO7 {
++ mt6360_ldo7: ldo7 {
+ regulator-name = "emi_vmddr_en";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+--
+2.51.0
+
--- /dev/null
+From c3b6de7df508698e4e49b922a8b8b0bf3586c63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 7bfd792066fc92177c505e01f3d1c944f4c03392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 13:19:53 +0100
+Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
+
+On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
+are deleting a wrong and nonexistent node. Fixing the wrong node would
+invoke a dtb warning message, as channel0 is a required property.
+Disable CAN-FD channel0 instead of deleting the node.
+
+Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+index 377849cbb462e..5785a934c28bf 100644
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+@@ -48,7 +48,10 @@ sound_card {
+ #if (SW_SCIF_CAN || SW_RSPI_CAN)
+ &canfd {
+ pinctrl-0 = <&can1_pins>;
+- /delete-node/ channel@0;
++
++ channel0 {
++ status = "disabled";
++ };
+ };
+ #else
+ &canfd {
+--
+2.51.0
+
--- /dev/null
+From 5427f21eb2c93740417dcf89b3ac63912c87d79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index d3327bc237b5f..7975dc0ceb351 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -47,7 +47,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From 5df25d100ea222954e2031c44fdb057f1cc98026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index b6434b4731261..d6991864c5a49 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -68,7 +68,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From fdf08725c99cc96189e3dc5e355dea60b861f4bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 8e4b821efe927..6860ac41e6b32 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From 8963c0cdb5a4b3d3358c0cda0f0bba26d682876f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:02:35 +0100
+Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]
+
+In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
+is not NULL before calling it.
+
+The original code assumed that if include_sidecar is true, the codec
+on that link has an add_sidecar callback. But there could be other
+codecs on the same link that do not have an add_sidecar callback.
+
+Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 5911a05586516..00d840d5e585c 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -741,7 +741,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
+ (*codec_conf)++;
+ }
+
+- if (sof_end->include_sidecar) {
++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
+ ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From e5d2de30fc7d3a8962570a250de9f81418166d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 156e9bb07abf1..2fb234ab467b1 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From dd72522a0d5376f6d141c19947eaa6fb68f4eb01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index f24fffdb6c294..d72a283401c3a 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -552,7 +552,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
+
+--
+2.51.0
+
--- /dev/null
+From d236699e9317a0b66821f392d919fccb7d9647bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 12:30:05 -0400
+Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
+ advertisements
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
+
+When creating an advertisement for BIG the address shall not be
+non-resolvable since in case of acting as BASS/Broadcast Assistant the
+address must be the same as the connection in order to use the PAST
+method and even when PAST/BASS are not in the picture a Periodic
+Advertisement can still be synchronized thus the same argument as to
+connectable advertisements still stand.
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 333f32a9fd219..853acfa8e9433 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+ struct hci_rp_le_set_ext_adv_params rp;
+- bool connectable;
++ bool connectable, require_privacy;
+ u32 flags;
+ bdaddr_t random_addr;
+ u8 own_addr_type;
+@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ return -EPERM;
+
+ /* Set require_privacy to true only when non-connectable
+- * advertising is used. In that case it is fine to use a
+- * non-resolvable private address.
++ * advertising is used and it is not periodic.
++ * In that case it is fine to use a non-resolvable private address.
+ */
+- err = hci_get_random_address(hdev, !connectable,
++ require_privacy = !connectable && !(adv && adv->periodic);
++
++ err = hci_get_random_address(hdev, require_privacy,
+ adv_use_rpa(hdev, flags), adv,
+ &own_addr_type, &random_addr);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 13ec3f161dee03ad31522b4599d77fd7a2d449cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:22 +0300
+Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
+
+For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
+skb is leaked.
+
+Free skb after copying its data.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index e38f52638627d..2cd0b963c96bd 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -2304,7 +2304,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+ skb->len);
+ conn->rx_len -= skb->len;
+- return;
++ break;
+
+ case ISO_END:
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+--
+2.51.0
+
--- /dev/null
+From ddfe072e7e2cb2ef7545bcac80122900ff13edc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:27:51 -0400
+Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
+
+This attempt to fix similar issue to sco_conn_free where if the
+conn->sk is not set to NULL may lead to UAF on iso_conn_free.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index a08a0f3d5003c..df21c79800fb6 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -743,6 +743,13 @@ static void iso_sock_kill(struct sock *sk)
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ if (iso_pi(sk)->conn) {
++ iso_conn_lock(iso_pi(sk)->conn);
++ iso_pi(sk)->conn->sk = NULL;
++ iso_conn_unlock(iso_pi(sk)->conn);
++ }
++
+ /* Kill poor orphan */
+ bt_sock_unlink(&iso_sk_list, sk);
+ sock_set_flag(sk, SOCK_DEAD);
+--
+2.51.0
+
--- /dev/null
+From 454fef95bff14970c57d9607aece8ba130634eaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:21 +0300
+Subject: Bluetooth: ISO: free rx_skb if not consumed
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]
+
+If iso_conn is freed when RX is incomplete, free any leftover skb piece.
+
+Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index df21c79800fb6..e38f52638627d 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
+ /* Ensure no more work items will run since hci_conn has been dropped */
+ disable_delayed_work_sync(&conn->timeout_work);
+
++ kfree_skb(conn->rx_skb);
++
+ kfree(conn);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6a24b0ad227310bc30fb489258f9b4ff779776ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 8b75647076bae..563cae4f76b0d 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4412,13 +4412,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ return -ENOMEM;
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev && hci_dev_le_state_simultaneous(hdev)) {
+--
+2.51.0
+
--- /dev/null
+From ed607f5a1f610df58100d10be60b15fd65b3c75d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:26:53 +0000
+Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]
+
+The current implementation seems incorrect and does NOT match the
+comment above, use bpf_jit_binary_pack_finalize() instead.
+
+Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Acked-by: Song Liu <song@kernel.org>
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 5553508c36440..ca6d002a6f137 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -2754,8 +2754,7 @@ void bpf_jit_free(struct bpf_prog *prog)
+ * before freeing it.
+ */
+ if (jit_data) {
+- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
+- sizeof(jit_data->header->size));
++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+ kfree(jit_data);
+ }
+ hdr = bpf_jit_binary_pack_hdr(prog);
+--
+2.51.0
+
--- /dev/null
+From 8445a155baa1d7f8f98303c3e9e099b54a890b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 19:12:00 +0200
+Subject: bpf: Enforce expected_attach_type for tailcall compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
+
+Yinhao et al. recently reported:
+
+ Our fuzzer tool discovered an uninitialized pointer issue in the
+ bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
+ This leads to a NULL pointer dereference when a BPF program attempts to
+ deference the txq member of struct xdp_buff object.
+
+The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
+entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
+neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
+of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
+to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
+egress_ifindex, and the latter is only allowed to be accessed under mentioned
+expected_attach_type. progB is then inserted into the tailcall which progA
+calls.
+
+The underlying issue goes beyond XDP though. Another example are programs
+of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
+as sock_addr_func_proto() have different logic depending on the programs'
+expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
+should not be allowed doing a tailcall into a program which calls bpf_bind()
+out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
+
+In short, specifying expected_attach_type allows to open up additional
+functionality or restrictions beyond what the basic bpf_prog_type enables.
+The use of tailcalls must not violate these constraints. Fix it by enforcing
+expected_attach_type in __bpf_prog_map_compatible().
+
+Note that we only enforce this for tailcall maps, but not for BPF devmaps or
+cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
+cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
+these situations are not prone to this issue.
+
+Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
+Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
+Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 6db72c66de91d..e8d9803cc6756 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -281,6 +281,7 @@ struct bpf_map_owner {
+ bool xdp_has_frags;
+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
+ const struct btf_type *attach_func_proto;
++ enum bpf_attach_type expected_attach_type;
+ };
+
+ struct bpf_map {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 1f51c8f20722e..08bdb623f4f91 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2326,6 +2326,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ map->owner->type = prog_type;
+ map->owner->jited = fp->jited;
+ map->owner->xdp_has_frags = aux->xdp_has_frags;
++ map->owner->expected_attach_type = fp->expected_attach_type;
+ map->owner->attach_func_proto = aux->attach_func_proto;
+ for_each_cgroup_storage_type(i) {
+ map->owner->storage_cookie[i] =
+@@ -2337,6 +2338,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ ret = map->owner->type == prog_type &&
+ map->owner->jited == fp->jited &&
+ map->owner->xdp_has_frags == aux->xdp_has_frags;
++ if (ret &&
++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
++ map->owner->expected_attach_type != fp->expected_attach_type)
++ ret = false;
+ for_each_cgroup_storage_type(i) {
+ if (!ret)
+ break;
+--
+2.51.0
+
--- /dev/null
+From 2a6b8ababb36d1f0f46d485e4efcc4ba41904832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 02fedc404d7f7..c850e5d6cbd87 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -9233,13 +9233,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 36f78742c56469f5b5d3562e6c94e7d432553723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 10:14:26 +0200
+Subject: bpf: Mark kfuncs as __noclone
+
+From: Andrea Righi <arighi@nvidia.com>
+
+[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]
+
+Some distributions (e.g., CachyOS) support building the kernel with -O3,
+but doing so may break kfuncs, resulting in their symbols not being
+properly exported.
+
+In fact, with gcc -O3, some kfuncs may be optimized away despite being
+annotated as noinline. This happens because gcc can still clone the
+function during IPA optimizations, e.g., by duplicating or inlining it
+into callers, and then dropping the standalone symbol. This breaks BTF
+ID resolution since resolve_btfids relies on the presence of a global
+symbol for each kfunc.
+
+Currently, this is not an issue for upstream, because we don't allow
+building the kernel with -O3, but it may be safer to address it anyway,
+to prevent potential issues in the future if compilers become more
+aggressive with optimizations.
+
+Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
+cloned and remain distinct, globally visible symbols, regardless of
+the optimization level.
+
+Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
+Acked-by: David Vernet <void@manifault.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/btf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/btf.h b/include/linux/btf.h
+index d99178ce01d21..e473bbfe41286 100644
+--- a/include/linux/btf.h
++++ b/include/linux/btf.h
+@@ -82,7 +82,7 @@
+ * as to avoid issues such as the compiler inlining or eliding either a static
+ * kfunc, or a global kfunc in an LTO build.
+ */
+-#define __bpf_kfunc __used __retain noinline
++#define __bpf_kfunc __used __retain __noclone noinline
+
+ #define __bpf_kfunc_start_defs() \
+ __diag_push(); \
+--
+2.51.0
+
--- /dev/null
+From 8de7121feb0ee7d01dc205b3924a5b19dfb6710f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 23:04:33 +0800
+Subject: bpf: Reject negative offsets for ALU ops
+
+From: Yazhou Tang <tangyazhou518@outlook.com>
+
+[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
+
+When verifying BPF programs, the check_alu_op() function validates
+instructions with ALU operations. The 'offset' field in these
+instructions is a signed 16-bit integer.
+
+The existing check 'insn->off > 1' was intended to ensure the offset is
+either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
+signed, this check incorrectly accepts all negative values (e.g., -1).
+
+This commit tightens the validation by changing the condition to
+'(insn->off != 0 && insn->off != 1)'. This ensures that any value
+other than the explicitly permitted 0 and 1 is rejected, hardening the
+verifier against malformed BPF programs.
+
+Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
+Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 1829f62a74a9e..96640a80fd9c4 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -14545,7 +14545,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ } else { /* all other ALU ops: and, sub, xor, add, ... */
+
+ if (BPF_SRC(insn->code) == BPF_X) {
+- if (insn->imm != 0 || insn->off > 1 ||
++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+@@ -14555,7 +14555,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ if (err)
+ return err;
+ } else {
+- if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From ff369db1b266397593302835d91ebfa8d3c75028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:14:29 +0800
+Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
+
+Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
+called all the way from graph tracer, which disables preemption in
+function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
+need to use migrate_disable. As a result, some overhead may will be reduced.
+And add cant_sleep check for __this_cpu_inc_return.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 3ec7df7dbeec4..4a44451efbcc6 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2759,19 +2759,24 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ struct bpf_run_ctx *old_run_ctx;
+ int err;
+
++ /*
++ * graph tracer framework ensures we won't migrate, so there is no need
++ * to use migrate_disable for bpf_prog_run again. The check here just for
++ * __this_cpu_inc_return.
++ */
++ cant_sleep();
++
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+ bpf_prog_inc_misses_counter(link->link.prog);
+ err = 0;
+ goto out;
+ }
+
+- migrate_disable();
+ rcu_read_lock();
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
+ rcu_read_unlock();
+- migrate_enable();
+
+ out:
+ __this_cpu_dec(bpf_prog_active);
+--
+2.51.0
+
--- /dev/null
+From e4482f101f976dee368f553d26cfa863adb9a01b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:12:14 +0000
+Subject: bpf/selftests: Fix test_tcpnotify_user
+
+From: Matt Bobrowski <mattbobrowski@google.com>
+
+[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
+
+Based on a bisect, it appears that commit 7ee988770326 ("timers:
+Implement the hierarchical pull model") has somehow inadvertently
+broken BPF selftest test_tcpnotify_user. The error that is being
+generated by this test is as follows:
+
+ FAILED: Wrong stats Expected 10 calls, got 8
+
+It looks like the change allows timer functions to be run on CPUs
+different from the one they are armed on. The test had pinned itself
+to CPU 0, and in the past the retransmit attempts also occurred on CPU
+0. The test had set the max_entries attribute for
+BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
+bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
+likely to be in range. With the change to allow timers to run on other
+CPUs, the current CPU tasked with performing the retransmit might be
+bumped and in turn fall out of range, as the event will be filtered
+out via __bpf_perf_event_output() using:
+
+ if (unlikely(index >= array->map.max_entries))
+ return -E2BIG;
+
+A possible change would be to explicitly set the max_entries attribute
+for perf_event_map in test_tcpnotify_kern.c to a value that's at least
+as large as the number of CPUs. As it turns out however, if the field
+is left unset, then the libbpf will determine the number of CPUs available
+on the underlying system and update the max_entries attribute accordingly
+in map_set_def_max_entries().
+
+A further problem with the test is that it has a thread that continues
+running up until the program exits. The main thread cleans up some
+LIBBPF data structures, while the other thread continues to use them,
+which inevitably will trigger a SIGSEGV. This can be dealt with by
+telling the thread to run for as long as necessary and doing a
+pthread_join on it before exiting the program.
+
+Finally, I don't think binding the process to CPU 0 is meaningful for
+this test any more, so get rid of that.
+
+Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
+Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
+ .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+index 540181c115a85..ef00d38b0a8d2 100644
+--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+@@ -23,7 +23,6 @@ struct {
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+- __uint(max_entries, 2);
+ __type(key, int);
+ __type(value, __u32);
+ } perf_event_map SEC(".maps");
+diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+index 595194453ff8f..35b4893ccdf8a 100644
+--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+@@ -15,20 +15,18 @@
+ #include <bpf/libbpf.h>
+ #include <sys/ioctl.h>
+ #include <linux/rtnetlink.h>
+-#include <signal.h>
+ #include <linux/perf_event.h>
+-#include <linux/err.h>
+
+-#include "bpf_util.h"
+ #include "cgroup_helpers.h"
+
+ #include "test_tcpnotify.h"
+-#include "trace_helpers.h"
+ #include "testing_helpers.h"
+
+ #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+
+ pthread_t tid;
++static bool exit_thread;
++
+ int rx_callbacks;
+
+ static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
+@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
+ {
+ int err;
+
+- while (1) {
++ while (!exit_thread) {
+ err = perf_buffer__poll(pb, 100);
+ if (err < 0 && err != -EINTR) {
+ printf("failed perf_buffer__poll: %d\n", err);
+@@ -78,15 +76,10 @@ int main(int argc, char **argv)
+ int error = EXIT_FAILURE;
+ struct bpf_object *obj;
+ char test_script[80];
+- cpu_set_t cpuset;
+ __u32 key = 0;
+
+ libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(0, &cpuset);
+- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
+-
+ cg_fd = cgroup_setup_and_join(cg_path);
+ if (cg_fd < 0)
+ goto err;
+@@ -151,6 +144,13 @@ int main(int argc, char **argv)
+
+ sleep(10);
+
++ exit_thread = true;
++ int ret = pthread_join(tid, NULL);
++ if (ret) {
++ printf("FAILED: pthread_join\n");
++ goto err;
++ }
++
+ if (verify_result(&g)) {
+ printf("FAILED: Wrong stats Expected %d calls, got %d\n",
+ g.ncalls, rx_callbacks);
+--
+2.51.0
+
--- /dev/null
+From 226fe4ef03179ea644f08d82e54dccc9cc08b408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 08:40:45 +0930
+Subject: btrfs: return any hit error from extent_writepage_io()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]
+
+Since the support of bs < ps support, extent_writepage_io() will submit
+multiple blocks inside the folio.
+
+But if we hit error submitting one sector, but the next sector can still
+be submitted successfully, the function extent_writepage_io() will still
+return 0.
+
+This will make btrfs to silently ignore the error without setting error
+flag for the filemap.
+
+Fix it by recording the first error hit, and always return that value.
+
+Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
+Reviewed-by: Daniel Vacek <neelx@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index afebc91882bef..60fe155b1ce05 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1479,7 +1479,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ unsigned long range_bitmap = 0;
+ bool submitted_io = false;
+- bool error = false;
++ int found_error = 0;
+ const u64 folio_start = folio_pos(folio);
+ u64 cur;
+ int bit;
+@@ -1536,7 +1536,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ */
+ btrfs_mark_ordered_io_finished(inode, folio, cur,
+ fs_info->sectorsize, false);
+- error = true;
++ if (!found_error)
++ found_error = ret;
+ continue;
+ }
+ submitted_io = true;
+@@ -1553,11 +1554,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ * If we hit any error, the corresponding sector will still be dirty
+ * thus no need to clear PAGECACHE_TAG_DIRTY.
+ */
+- if (!submitted_io && !error) {
++ if (!submitted_io && !found_error) {
+ btrfs_folio_set_writeback(fs_info, folio, start, len);
+ btrfs_folio_clear_writeback(fs_info, folio, start, len);
+ }
+- return ret;
++ return found_error;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 2d5c08ad1c62021a02bc34772c4c37081bb8983e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:38 +0100
+Subject: coresight: catu: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]
+
+The atclk is an optional clock for the CoreSight CATU, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the CATU driver, and dynamically
+control the clock during suspend and resume.
+
+The checks for driver data and clocks in suspend and resume are not
+needed, remove them. Add error handling in the resume function.
+
+Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-catu.h | 1 +
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index 25fd02955c38d..abfff42b20c93 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -521,6 +521,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
+ struct coresight_platform_data *pdata = NULL;
+ void __iomem *base;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
+ if (!catu_desc.name)
+ return -ENOMEM;
+@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int catu_runtime_resume(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
+index 755776cd19c5b..6e6b7aac206dc 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.h
++++ b/drivers/hwtracing/coresight/coresight-catu.h
+@@ -62,6 +62,7 @@
+
+ struct catu_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ int irq;
+--
+2.51.0
+
--- /dev/null
+From 319890118034616f638fe4bdf08ee9c1b9982864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 01:24:45 -0700
+Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
+
+From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+
+[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
+
+The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
+To avoid invalid accesses, introduce a check on numextinsel
+(derived from TRCIDR5[11:9]) before reading or writing to this register.
+
+Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
+Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index be8b46f26ddc8..cdfd35e03c1dc 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+ etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
+@@ -1362,6 +1363,7 @@ static void etm4_init_arch_data(void *info)
+ etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
+ /* NUMEXTIN, bits[8:0] number of external inputs implemented */
+ drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
+ /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
+ drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
+ /* ATBTRIG, bit[22] implementation can support ATB triggers? */
+@@ -1789,7 +1791,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
+- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
++
++ if (drvdata->numextinsel)
++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
+@@ -1921,7 +1925,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 9e9165f62e81f..899790c8777a9 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -162,6 +162,7 @@
+ #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
+
+ #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
+ #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
+ #define TRCIDR5_ATBTRIG BIT(22)
+ #define TRCIDR5_LPOVERRIDE BIT(23)
+@@ -998,6 +999,7 @@ struct etmv4_drvdata {
+ u8 nr_cntr;
+ u8 nr_ext_inp;
+ u8 numcidc;
++ u8 numextinsel;
+ u8 numvmidc;
+ u8 nrseqstate;
+ u8 nr_event;
+--
+2.51.0
+
--- /dev/null
+From 51dc54927ce5834c83085a9561c707a6d1c4e865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:39 +0100
+Subject: coresight: etm4x: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
+
+The atclk is an optional clock for the CoreSight ETMv4, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the ETMv4 driver, and dynamically
+control the clock during suspend and resume.
+
+No need to check the driver data and clock pointer in the runtime
+suspend and resume, so remove checks. And add error handling in the
+resume function.
+
+Add a minor fix to the comment format when adding the atclk field.
+
+Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++-
+ 2 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index cdfd35e03c1dc..7b9eaeb115d21 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2157,6 +2157,10 @@ static int etm4_probe(struct device *dev)
+ if (WARN_ON(!drvdata))
+ return -ENOMEM;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
+ pm_save_enable = coresight_loses_context_with_cpu(dev) ?
+ PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
+@@ -2405,8 +2409,8 @@ static int etm4_runtime_suspend(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
+
+ return 0;
+ }
+@@ -2414,11 +2418,17 @@ static int etm4_runtime_suspend(struct device *dev)
+ static int etm4_runtime_resume(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
+
+- return 0;
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 899790c8777a9..3683966bd0603 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -920,7 +920,8 @@ struct etmv4_save_state {
+
+ /**
+ * struct etm4_drvdata - specifics associated to an ETM component
+- * @pclk APB clock if present, otherwise NULL
++ * @pclk: APB clock if present, otherwise NULL
++ * @atclk: Optional clock for the core parts of the ETMv4.
+ * @base: Memory mapped base address for this component.
+ * @csdev: Component vitals needed by the framework.
+ * @spinlock: Only one at a time pls.
+@@ -988,6 +989,7 @@ struct etmv4_save_state {
+ */
+ struct etmv4_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ spinlock_t spinlock;
+--
+2.51.0
+
--- /dev/null
+From 5d627dd4dfe54a3a0870063e17548ab160136e75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 20:20:22 +0800
+Subject: coresight: Fix incorrect handling for return value of devm_kzalloc
+
+From: Lin Yujun <linyujun809@h-partners.com>
+
+[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]
+
+The return value of devm_kzalloc could be an null pointer,
+use "!desc.pdata" to fix incorrect handling return value
+of devm_kzalloc.
+
+Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
+Signed-off-by: Lin Yujun <linyujun809@h-partners.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 5755674913723..d771980a278dc 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -1267,7 +1267,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
+ * into the device for that purpose.
+ */
+ desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
+- if (IS_ERR(desc.pdata))
++ if (!desc.pdata)
+ goto cpu_clear;
+
+ desc.type = CORESIGHT_DEV_TYPE_SINK;
+--
+2.51.0
+
--- /dev/null
+From dc9c691869d4f8ac55886438fc2c457a7bbce503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:26:19 +0800
+Subject: coresight: Only register perf symlink for sinks with alloc_buffer
+
+From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+
+[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
+
+Ensure that etm_perf_add_symlink_sink() is only called for devices
+that implement the alloc_buffer operation. This prevents invalid
+symlink creation for dummy sinks that do not implement alloc_buffer.
+
+Without this check, perf may attempt to use a dummy sink that lacks
+alloc_buffer operationsu to initialise perf's ring buffer, leading
+to runtime failures.
+
+Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
+Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index b7941d8abbfe7..f20d4cab8f1df 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1200,8 +1200,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
+ goto out_unlock;
+ }
+
+- if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
++ sink_ops(csdev)->alloc_buffer) {
+ ret = etm_perf_add_symlink_sink(csdev);
+
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 79d83976561649b471d894234f11122ea041e90b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:37 +0100
+Subject: coresight: tmc: Support atclk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]
+
+The atclk is an optional clock for the CoreSight TMC, but the driver
+misses to initialize it. In most cases, TMC shares the atclk clock with
+other CoreSight components. Since these components enable the clock
+before the TMC device is initialized, the TMC continues properly,
+which is why we don’t observe any lockup issues.
+
+This change enables atclk in probe of the TMC driver. Given the clock
+is optional, it is possible to return NULL if the clock does not exist.
+IS_ERR() is tolerant for this case.
+
+Dynamically disable and enable atclk during suspend and resume. The
+clock pointers will never be error values if the driver has successfully
+probed, and the case of a NULL pointer case will be handled by the clock
+core layer. The driver data is always valid after probe. Therefore,
+remove the related checks. Also in the resume flow adds error handling.
+
+Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-tmc.h | 2 ++
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 475fa4bb6813b..96ef2517dd439 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -480,6 +480,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
+ struct coresight_desc desc = { 0 };
+ struct coresight_dev_list *dev_list = NULL;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ ret = -ENOMEM;
+
+ /* Validity for the resource is already checked by the AMBA core */
+@@ -700,18 +704,26 @@ static int tmc_runtime_suspend(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int tmc_runtime_resume(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
+index 2671926be62a3..2a53acbb5990b 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.h
++++ b/drivers/hwtracing/coresight/coresight-tmc.h
+@@ -166,6 +166,7 @@ struct etr_buf {
+
+ /**
+ * struct tmc_drvdata - specifics associated to an TMC component
++ * @atclk: optional clock for the core parts of the TMC.
+ * @pclk: APB clock if present, otherwise NULL
+ * @base: memory mapped base address for this component.
+ * @csdev: component vitals needed by the framework.
+@@ -191,6 +192,7 @@ struct etr_buf {
+ * @perf_buf: PERF buffer for ETR.
+ */
+ struct tmc_drvdata {
++ struct clk *atclk;
+ struct clk *pclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+--
+2.51.0
+
--- /dev/null
+From b2ec4bc0c00bcef3916790b377cc02e8f7c65ef5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 07:53:04 +0800
+Subject: coresight: tpda: fix the logic to setup the element size
+
+From: Jie Gan <jie.gan@oss.qualcomm.com>
+
+[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]
+
+Some TPDM devices support both CMB and DSB datasets, requiring
+the system to enable the port with both corresponding element sizes.
+
+Currently, the logic treats tpdm_read_element_size as successful if
+the CMB element size is retrieved correctly, regardless of whether
+the DSB element size is obtained. This behavior causes issues
+when parsing data from TPDM devices that depend on both element sizes.
+
+To address this, the function should explicitly fail if the DSB
+element size cannot be read correctly.
+
+Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
+index bfca103f9f847..865fd6273e5e4 100644
+--- a/drivers/hwtracing/coresight/coresight-tpda.c
++++ b/drivers/hwtracing/coresight/coresight-tpda.c
+@@ -71,12 +71,15 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+ if (tpdm_has_dsb_dataset(tpdm_data)) {
+ rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+ "qcom,dsb-element-bits", &drvdata->dsb_esize);
++ if (rc)
++ goto out;
+ }
+ if (tpdm_has_cmb_dataset(tpdm_data)) {
+ rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+ "qcom,cmb-element-bits", &drvdata->cmb_esize);
+ }
+
++out:
+ if (rc)
+ dev_warn_once(&csdev->dev,
+ "Failed to read TPDM Element size: %d\n", rc);
+--
+2.51.0
+
--- /dev/null
+From 064b9a5e300e17748e29d4ce905966a2ba57d18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 96a32b2136699..492b2612f64e0 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -22,7 +22,8 @@
+ #include "coresight-self-hosted-trace.h"
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From 6285539af63522cf8653ff77ee6b623018bc49d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 492b2612f64e0..5755674913723 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -745,12 +745,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -760,7 +760,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From 301c5bdad74138c9b387849dfbcf25ad0de107d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index beb660ca240cc..a2ec1addafc93 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+ #include <linux/scmi_protocol.h>
+@@ -398,6 +399,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4d09d95415696b6824041698878eb251450123c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 17:22:12 +0200
+Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
+
+Make sure to drop the reference to the saw device taken by
+of_find_device_by_node() after retrieving its driver data during
+probe().
+
+Also drop the reference to the CPU node sooner to avoid leaking it in
+case there is no saw node or device.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index 1fc9968eae199..b6b06a510fd86 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
+ return -ENODEV;
+
+ saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++ of_node_put(cpu_node);
+ if (!saw_node)
+ return -ENODEV;
+
+ pdev = of_find_device_by_node(saw_node);
+ of_node_put(saw_node);
+- of_node_put(cpu_node);
+ if (!pdev)
+ return -ENODEV;
+
+ data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ put_device(&pdev->dev);
+ return -ENOMEM;
++ }
+
+ data->spm = dev_get_drvdata(&pdev->dev);
++ put_device(&pdev->dev);
+ if (!data->spm)
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From 2d571fdcbc9fe57b3ae2993d71ccfdb5acea50e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:07 +0800
+Subject: crypto: hisilicon/qm - check whether the input function and PF are on
+ the same device
+
+From: Zhushuai Yin <yinzhushuai@huawei.com>
+
+[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
+
+Function rate limiting is set through physical function driver.
+Users configure by providing function information and rate limit values.
+Before configuration, it is necessary to check whether the
+provided function and PF belong to the same device.
+
+Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
+Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 5bbb2759a6691..a9550a05dfbd3 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3657,6 +3657,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
+ }
+
+ pdev = container_of(dev, struct pci_dev, dev);
++ if (pci_physfn(pdev) != qm->pdev) {
++ pci_err(qm->pdev, "the pdev input does not match the pf!\n");
++ return -EINVAL;
++ }
+
+ *fun_index = pdev->devfn;
+
+--
+2.51.0
+
--- /dev/null
+From d00bf0f99debc11048d8b719160a011700abc37d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:54 +0800
+Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
+
+When the initialization of qm->debug.acc_diff_reg fails,
+the probe process does not exit. However, after qm->debug.qm_diff_regs is
+freed, it is not set to NULL. This can lead to a double free when the
+remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
+should be set to NULL after it is freed.
+
+Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+index 45e130b901eb5..17eb236e9ee4d 100644
+--- a/drivers/crypto/hisilicon/debugfs.c
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
+ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ ret = PTR_ERR(qm->debug.acc_diff_regs);
+ qm->debug.acc_diff_regs = NULL;
++ qm->debug.qm_diff_regs = NULL;
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f2e795257b0bf03d8b3747bcb877646e1f222ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:05 +0800
+Subject: crypto: hisilicon - re-enable address prefetch after device resuming
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
+
+When the device resumes from a suspended state, it will revert to its
+initial state and requires re-enabling. Currently, the address prefetch
+function is not re-enabled after device resuming. Move the address prefetch
+enable to the initialization process. In this way, the address prefetch
+can be enabled when the device resumes by calling the initialization
+process.
+
+Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
+ drivers/crypto/hisilicon/qm.c | 3 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
+ 4 files changed, 43 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 34d30b7838134..a11fe5e276773 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+
+ /* Config data buffer pasid needed by Kunpeng 920 */
+ hpre_config_pasid(qm);
++ hpre_open_sva_prefetch(qm);
+
+ hpre_enable_clock_gate(qm);
+
+@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ if (ret)
+ return ret;
+
+- hpre_open_sva_prefetch(qm);
+-
+ hisi_qm_dev_err_init(qm);
+ ret = hpre_show_last_regs_init(qm);
+ if (ret)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index b18692ee7fd56..5bbb2759a6691 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4272,9 +4272,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
+ {
+ u32 value;
+
+- if (qm->err_ini->open_sva_prefetch)
+- qm->err_ini->open_sva_prefetch(qm);
+-
+ if (qm->ver >= QM_HW_V3)
+ return;
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 75c25f0d5f2b8..9014cc36705ff 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -441,6 +441,45 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static void sec_close_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val |= SEC_PREFETCH_DISABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
++ val, !(val & SEC_SVA_DISABLE_READY),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++}
++
++static void sec_open_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ /* Enable prefetch */
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val &= SEC_PREFETCH_ENABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
++ val, !(val & SEC_PREFETCH_DISABLE),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++}
++
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+ {
+ u32 reg;
+@@ -474,45 +513,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base +
+ SEC_INTERFACE_USER_CTRL1_REG);
+ }
+-}
+-
+-static void sec_open_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- /* Enable prefetch */
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val &= SEC_PREFETCH_ENABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+- val, !(val & SEC_PREFETCH_DISABLE),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
+-}
+-
+-static void sec_close_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val |= SEC_PREFETCH_DISABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+- val, !(val & SEC_SVA_DISABLE_READY),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ sec_open_sva_prefetch(qm);
+ }
+
+ static void sec_enable_clock_gate(struct hisi_qm *qm)
+@@ -1094,7 +1095,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ if (ret)
+ return ret;
+
+- sec_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ sec_debug_regs_clear(qm);
+ ret = sec_show_last_regs_init(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 18177aba3d3a6..323f53217f0c0 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
+ writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
+ }
++ hisi_zip_open_sva_prefetch(qm);
+
+ /* let's open all compression/decompression cores */
+ dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
+@@ -568,6 +569,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
+ FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+
++ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+ return 0;
+@@ -1163,9 +1165,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- hisi_zip_set_high_perf(qm);
+-
+- hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ hisi_zip_debug_regs_clear(qm);
+
+--
+2.51.0
+
--- /dev/null
+From b882359173578a59373ad3659209c512d0ac5f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:04 +0800
+Subject: crypto: hisilicon/zip - remove unnecessary validation for
+ high-performance mode configurations
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
+
+When configuring the high-performance mode register, there is no
+need to verify whether the register has been successfully
+enabled, as there is no possibility of a write failure for this
+register.
+
+Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 80c2fcb1d26dc..18177aba3d3a6 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -449,10 +449,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ return false;
+ }
+
+-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ {
+ u32 val;
+- int ret;
+
+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ if (perf_mode == HZIP_HIGH_COMP_PERF)
+@@ -462,13 +461,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+
+ /* Set perf mode */
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
+- val, val == perf_mode, HZIP_DELAY_1_US,
+- HZIP_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to set perf mode\n");
+-
+- return ret;
+ }
+
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+@@ -1171,9 +1163,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- ret = hisi_zip_set_high_perf(qm);
+- if (ret)
+- return ret;
++ hisi_zip_set_high_perf(qm);
+
+ hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+--
+2.51.0
+
--- /dev/null
+From 6a97cdd2947274b5eb32253986b94d412098364a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 14:03:30 +0200
+Subject: crypto: keembay - Add missing check after sg_nents_for_len()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
+
+sg_nents_for_len() returns an int which is negative in case of error.
+
+Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+index fdeca861933cb..903f31dc663e9 100644
+--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ struct device *dev = rctx->hcu_dev->dev;
+ unsigned int remainder = 0;
+ unsigned int total;
+- size_t nents;
++ int nents;
+ size_t count;
+ int rc;
+ int i;
+@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ /* Determine the number of scatter gather list entries to process. */
+ nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
+
++ if (nents < 0)
++ return nents;
++
+ /* If there are entries to process, map them. */
+ if (nents) {
+ rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
+--
+2.51.0
+
--- /dev/null
+From 8ff0b5c303747f3600f6af49e649404a72c6eda1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:24:57 +0200
+Subject: crypto: octeontx2 - Call strscpy() with correct size argument
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]
+
+In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
+of the source string rather than the size of the destination buffer.
+
+This is fine as long as the destination buffer is larger than the source
+string, but we should still use the destination buffer size instead to
+call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
+we can safely omit the size argument and let strscpy() infer it using
+sizeof().
+
+Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+index 1493a373baf71..cf68b213c3e62 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+@@ -1614,7 +1614,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
+ return -EINVAL;
+ }
+ err_msg = "Invalid engine group format";
+- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
++ strscpy(tmp_buf, ctx->val.vstr);
+ start = tmp_buf;
+
+ has_se = has_ie = has_ae = false;
+--
+2.51.0
+
--- /dev/null
+From 4d577890cdc1ba13dffe47066fa20869fbe00dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 23:22:38 +0300
+Subject: dm vdo: return error on corrupted metadata in start_restoring_volume
+ functions
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]
+
+The return values of VDO_ASSERT calls that validate metadata are not acted
+upon.
+
+Return UDS_CORRUPT_DATA in case of an error.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Reviewed-by: Matthew Sakai <msakai@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
+index 12f954a0c5325..afb062e1f1fb4 100644
+--- a/drivers/md/dm-vdo/indexer/volume-index.c
++++ b/drivers/md/dm-vdo/indexer/volume-index.c
+@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+--
+2.51.0
+
--- /dev/null
+From ec12a5ff221ad40a7a3bb4a6967ecd10f9263d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 5765eb3e9efa7..a30f4bed11b4e 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From b8af17afdcbeb6bdcbb12e707a0aa7c961f04d97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 6f09aa8e32237..deccfe68214ec 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -881,7 +881,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a18eb5e728273d13108cd050e16158029f058ade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index eb72580288e62..6f09aa8e32237 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -879,6 +879,11 @@ int __register_one_node(int nid)
+ node_devices[nid] = node;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From 08445c0404819e0f842f05391793223d0a4b4ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:50:14 +0800
+Subject: drm/amd/display: Remove redundant semicolons
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
+
+Remove unnecessary semicolons.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 9ba6cb67655f4..6c75aa82327ac 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ if (dual_plane) {
+ unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
+ num_pipes, pipe_idx);
+- ;
+ if (src->sw_mode == dm_sw_linear)
+ ASSERT(p1_pte_row_height_linear >= 8);
+
+--
+2.51.0
+
--- /dev/null
+From 366fdfa31f4ea7b3998dfbb665bb7feec312e971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:07 +0200
+Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
+
+Based on some comments in dm_pp_display_configuration
+above the crtc_index and line_time fields, these values
+are programmed to the SMC to work around an SMC hang
+when it switches MCLK.
+
+According to Alex, the Windows driver programs them to:
+mclk_change_block_cp_min = 200 / line_time
+mclk_change_block_cp_max = 100 / line_time
+Let's use the same for the sake of consistency.
+
+Previously we used the watermark values, but it seemed buggy
+as the code was mixing up low/high and A/B watermarks, and
+was not saving a low watermark value on DCE 6, so
+mclk_change_block_cp_max would be always zero previously.
+
+Split this change off from the previous si_upload_smc_data
+to make it easier to bisect, in case it causes any issues.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 341f2d796aeeb..a8fe6aa6845eb 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5809,8 +5809,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ crtc_index = amdgpu_crtc->crtc_id;
+
+ if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 285864728bf419d7720a9aef37c54de0db0d1919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:09 +0200
+Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
+
+According to pp_pm_compute_clocks the non-DC display code
+has "issues with mclk switching with refresh rates over 120 hz".
+The workaround is to disable MCLK switching in this case.
+
+Do the same for legacy DPM.
+
+Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 42efe838fa85c..2d2d2d5e67634 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ (amdgpu_crtc->v_border * 2));
+
+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* we have issues with mclk switching with
++ * refresh rates over 120 hz on the non-DC code.
++ */
++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
++ vblank_time_us = 0;
++
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 7cc4bb0894ddeeefb953a247bd30cdb56fe9dc7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:10 +0200
+Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
+ (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
+
+Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
+switching on Oland when two 4K 60Hz monitors are connected")
+
+This is an ad-hoc DPM fix, necessary because we don't have
+proper bandwidth calculation for DCE 6.
+
+We define "high pixelclock" for SI as higher than necessary
+for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
+this category.
+
+When two high pixel clock displays are connected to Oland,
+additionally disable shader clock switching, which results in
+a higher voltage, thereby addressing some visible flickering.
+
+v2:
+Add more comments.
+v3:
+Split into two commits for easier review.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 76fc08cda7480..82167eca26683 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ {
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
++ struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+ u16 vddc, vddci, min_vce_voltage = 0;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+ u32 max_sclk = 0, max_mclk = 0;
++ u32 high_pixelclock_count = 0;
+ int i;
+
+ if (adev->asic_type == CHIP_HAINAN) {
+@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ }
+ }
+
++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
++ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
++ * Find number of such displays connected.
++ */
++ for (i = 0; i < adev->mode_info.num_crtc; i++) {
++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
++ !adev->mode_info.crtcs[i]->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
++
++ if (conn->pixelclock_for_modeset > 297000)
++ high_pixelclock_count++;
++ }
++
++ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
++ * They are necessary because we don't have something like dce_calcs
++ * for these GPUs to calculate bandwidth requirements.
++ */
++ if (high_pixelclock_count) {
++ /* On Oland, we observe some flickering when two 4K 60Hz
++ * displays are connected, possibly because voltage is too low.
++ * Raise the voltage by requiring a higher SCLK.
++ * (Voltage cannot be adjusted independently without also SCLK.)
++ */
++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
++ disable_sclk_switching = true;
++ }
++
+ if (rps->vce_active) {
+ rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
+ rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
+--
+2.51.0
+
--- /dev/null
+From cf781c7b185899bfe6acbf23b4466f54252f0b09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:04 +0200
+Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
+
+Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
+is unsupported, to make sure it is properly turned off.
+
+v3:
+Simplify si_disable_ulv further.
+Always check the return value of amdgpu_si_send_msg_to_smc.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index a5ad1b60597e6..6a97ddcd695b5 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5613,14 +5613,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
+
+ static int si_disable_ulv(struct amdgpu_device *adev)
+ {
+- struct si_power_info *si_pi = si_get_pi(adev);
+- struct si_ulv_param *ulv = &si_pi->ulv;
++ PPSMC_Result r;
+
+- if (ulv->supported)
+- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
+- 0 : -EINVAL;
+-
+- return 0;
++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
+ }
+
+ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+--
+2.51.0
+
--- /dev/null
+From 50abd6c9e72e7cea0e8b7abc4cf23762865a3f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:06 +0200
+Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
+
+The si_upload_smc_data function uses si_write_smc_soft_register
+to set some register values in the SMC, and expects the result
+to be PPSMC_Result_OK which is 1.
+
+The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
+checking the result of a command sent to the SMC.
+However, the si_write_smc_soft_register actually doesn't send
+any commands to the SMC and returns zero on success,
+so this check was incorrect.
+
+Fix that by not checking the return value, just like other
+calls to si_write_smc_soft_register.
+
+v3:
+Additionally, when no display is plugged in, there is no need
+to restrict MCLK switching, so program the registers to zero.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 6a97ddcd695b5..341f2d796aeeb 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5789,9 +5789,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+ struct amdgpu_crtc *amdgpu_crtc = NULL;
+ int i;
+-
+- if (adev->pm.dpm.new_active_crtc_count == 0)
+- return 0;
++ u32 crtc_index = 0;
++ u32 mclk_change_block_cp_min = 0;
++ u32 mclk_change_block_cp_max = 0;
+
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+@@ -5800,26 +5800,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ }
+ }
+
+- if (amdgpu_crtc == NULL)
+- return 0;
++ /* When a display is plugged in, program these so that the SMC
++ * performs MCLK switching when it doesn't cause flickering.
++ * When no display is plugged in, there is no need to restrict
++ * MCLK switching, so program them to zero.
++ */
++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
++ crtc_index = amdgpu_crtc->crtc_id;
+
+- if (amdgpu_crtc->line_time <= 0)
+- return 0;
++ if (amdgpu_crtc->line_time) {
++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ }
++ }
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_crtc_index,
+- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_crtc_index,
++ crtc_index);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
++ mclk_change_block_cp_min);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
++ mclk_change_block_cp_max);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 10b9bbaba69bdabd0c16ed89774b0431220e1f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:08 +0200
+Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
+
+Some parts of the code base expect that MCLK switching is turned
+off when the vblank time is set to zero.
+
+According to pp_pm_compute_clocks the non-DC code has issues
+with MCLK switching with refresh rates over 120 Hz.
+
+v3:
+Add code comment to explain this better.
+Add an if statement instead of changing the switch_limit.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index a8fe6aa6845eb..76fc08cda7480 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+- if (vblank_time < switch_limit)
++ /* Consider zero vblank time too short and disable MCLK switching.
++ * Note that the vblank time is set to maximum when no displays are attached,
++ * so we'll still enable MCLK switching in that case.
++ */
++ if (vblank_time == 0)
++ return true;
++ else if (vblank_time < switch_limit)
+ return true;
+ else
+ return false;
+--
+2.51.0
+
--- /dev/null
+From a082c22d0ea13a508714a29c4953538f08d97df5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 805d6662c88b6..21376d98ee498 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @handle: handle used to pass amdgpu_device pointer
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(void *handle)
+ {
+@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(void *handle)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(void *handle)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From 9c6f33cd0e038d328fdcf5c09f55876505f82ab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 3e9e0f36cd3f4..a8d4b3a3e77af 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -4231,7 +4231,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1de342a8efd76e4679fb729ea5984f496fa2c7dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:58:25 -0700
+Subject: drm/bridge: it6505: select REGMAP_I2C
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
+
+Fix
+
+ aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
+ ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
+index 3eb955333c809..66369b6a023f0 100644
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -101,6 +101,7 @@ config DRM_ITE_IT6505
+ select EXTCON
+ select CRYPTO
+ select CRYPTO_HASH
++ select REGMAP_I2C
+ help
+ ITE IT6505 DisplayPort bridge chip driver.
+
+--
+2.51.0
+
--- /dev/null
+From 8d007154f96372eb8d581e26e1492f8b16e76335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:20:45 +0800
+Subject: drm/msm/dpu: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
+
+Change 'ret' from unsigned long to int, as storing negative error codes
+in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
+errors.
+
+Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/671100/
+Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+index 07035ab77b792..4597fdb653588 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+@@ -445,7 +445,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+ static int dpu_encoder_phys_wb_wait_for_commit_done(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- unsigned long ret;
++ int ret;
+ struct dpu_encoder_wait_info wait_info;
+ struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+--
+2.51.0
+
--- /dev/null
+From 7397d8821cda24cdaaac4be8145e1c519bcdc89d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 21:23:41 -0600
+Subject: drm/panel: novatek-nt35560: Fix invalid return value
+
+From: Brigham Campbell <me@brighamcampbell.com>
+
+[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
+
+Fix bug in nt35560_set_brightness() which causes the function to
+erroneously report an error. mipi_dsi_dcs_write() returns either a
+negative value when an error occurred or a positive number of bytes
+written when no error occurred. The buggy code reports an error under
+either condition.
+
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+index 5bbea734123bc..ee04c55175bb8 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
+ par = 0x00;
+ ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
+ &par, 1);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From bbbd614293eff0335e254e31dc84929bb1bacc95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index ac77d1246b945..811265648a582 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From ad4b08e0d88e677426862192cfdb9ca32a896563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:57:07 +0800
+Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
+
+When loading the i10nm_edac driver on some Intel Granite Rapids servers,
+a call trace may appear as follows:
+
+ UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
+ shift exponent -66 is negative
+ ...
+ __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
+ skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
+ i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
+ skx_register_mci+0x159/0x220 [skx_edac_common]
+ i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
+ ...
+
+This occurs because some BIOS may disable a memory controller if there
+aren't any memory DIMMs populated on this memory controller. The DIMMMTR
+register of this disabled memory controller contains the invalid value
+~0, resulting in the call trace above.
+
+Fix this call trace by skipping DIMM enumeration on a disabled memory
+controller.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
+Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index ac4b3d95531c5..d8cd12d906a72 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -967,6 +967,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
+ return !!GET_BITFIELD(mcmtr, 2, 2);
+ }
+
++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
++{
++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
++
++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
++
++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
++}
++
+ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ struct res_config *cfg)
+ {
+@@ -980,6 +989,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ if (!imc->mbase)
+ continue;
+
++ if (i10nm_channel_disabled(imc, i)) {
++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
++ continue;
++ }
++
+ ndimms = 0;
+
+ if (res_cfg->type != GNR)
+--
+2.51.0
+
--- /dev/null
+From cef9cc299937273efc940ab05e5dad1481477de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:03:38 +0800
+Subject: f2fs: fix condition in __allow_reserved_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
+
+If reserve_root mount option is not assigned, __allow_reserved_blocks()
+will return false, it's not correct, fix it.
+
+Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 2dec22f2ea639..0d3ef487f72ac 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2331,8 +2331,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+ {
+ if (!inode)
+ return true;
+- if (!test_opt(sbi, RESERVE_ROOT))
+- return false;
+ if (IS_NOQUOTA(inode))
+ return true;
+ if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
+@@ -2353,7 +2351,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+ avail_user_block_count = sbi->user_block_count -
+ sbi->current_reserved_blocks;
+
+- if (!__allow_reserved_blocks(sbi, inode, cap))
++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
+ avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+--
+2.51.0
+
--- /dev/null
+From fd7f8fd368e5334610f46861f95f8889475dc44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 10:47:09 +0800
+Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
+
+f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
+and page lookup, change as below to mitigate its overhead:
+- check new_size before grabbing invalidate_lock
+- lookup and invalidate pages only in range of [old_size, new_size]
+
+Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index eb58d05284173..2a108c561e8bc 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -35,15 +35,23 @@
+ #include <trace/events/f2fs.h>
+ #include <uapi/linux/f2fs.h>
+
+-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
++static void f2fs_zero_post_eof_page(struct inode *inode,
++ loff_t new_size, bool lock)
+ {
+ loff_t old_size = i_size_read(inode);
+
+ if (old_size >= new_size)
+ return;
+
++ if (mapping_empty(inode->i_mapping))
++ return;
++
++ if (lock)
++ filemap_invalidate_lock(inode->i_mapping);
+ /* zero or drop pages only in range of [old_size, new_size] */
+- truncate_pagecache(inode, old_size);
++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
++ if (lock)
++ filemap_invalidate_unlock(inode->i_mapping);
+ }
+
+ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+
+ f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
+
+ file_update_time(vmf->vma->vm_file);
+ filemap_invalidate_lock_shared(inode->i_mapping);
+@@ -1089,7 +1095,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ filemap_invalidate_lock(inode->i_mapping);
+
+ if (attr->ia_size > old_size)
+- f2fs_zero_post_eof_page(inode, attr->ia_size);
++ f2fs_zero_post_eof_page(inode, attr->ia_size, false);
+ truncate_setsize(inode, attr->ia_size);
+
+ if (attr->ia_size <= old_size)
+@@ -1208,9 +1214,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1495,7 +1499,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(inode->i_mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+
+ f2fs_lock_op(sbi);
+ f2fs_drop_extent_tree(inode);
+@@ -1618,9 +1622,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1754,7 +1756,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+ truncate_pagecache(inode, offset);
+
+ while (!ret && idx > pg_start) {
+@@ -1812,9 +1814,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ f2fs_balance_fs(sbi, true);
+
+@@ -4759,9 +4759,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode,
++ iocb->ki_pos + iov_iter_count(from), true);
+ return count;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 02cdb957fbafcfd0dfab8e4487c2994ee552e0d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:40:24 +0800
+Subject: f2fs: fix to truncate first page in error path of f2fs_truncate()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
+
+syzbot reports a bug as below:
+
+loop0: detected capacity change from 0 to 40427
+F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
+F2FS-fs (loop0): invalid crc value
+F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
+------------[ cut here ]------------
+kernel BUG at fs/inode.c:753!
+RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
+Call Trace:
+ <TASK>
+ evict+0x504/0x9c0 fs/inode.c:810
+ f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
+ get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
+ vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
+ do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
+ do_mount fs/namespace.c:4136 [inline]
+ __do_sys_mount fs/namespace.c:4347 [inline]
+ __se_sys_mount+0x317/0x410 fs/namespace.c:4324
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
+all page cache before destorying inode, that is because in below path, we
+will create page #0 in cache, but missed to drop it in error path, let's fix
+it.
+
+- evict
+ - f2fs_evict_inode
+ - f2fs_truncate
+ - f2fs_convert_inline_inode
+ - f2fs_grab_cache_folio
+ : create page #0 in cache
+ - f2fs_convert_inline_folio
+ : sanity check failed, return -EFSCORRUPTED
+ - clear_inode detects that inode->i_data.nrpages is not zero
+
+Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
+Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index fa77841f3e2cc..eb58d05284173 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -856,8 +856,16 @@ int f2fs_truncate(struct inode *inode)
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+- if (err)
++ if (err) {
++ /*
++ * Always truncate page #0 to avoid page cache
++ * leak in evict() path.
++ */
++ truncate_inode_pages_range(inode->i_mapping,
++ F2FS_BLK_TO_BYTES(0),
++ F2FS_BLK_END_BYTES(0));
+ return err;
++ }
+ }
+
+ err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
+--
+2.51.0
+
--- /dev/null
+From d8824daa309ce71fe6df0bea89575917045ed7c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:12:50 +0800
+Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
+
+Script to reproduce:
+mkfs.f2fs -O extra_attr,compression /dev/vdb -f
+mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
+cd /mnt/f2fs
+f2fs_io write 1 0 1024 rand dsync testfile
+xfs_io testfile -c "fsync"
+f2fs_io write 1 0 512 rand dsync testfile
+xfs_io testfile -c "fsync"
+cd /
+umount /mnt/f2fs
+mount /dev/vdb /mnt/f2fs
+f2fs_io precache_extents /mnt/f2fs/testfile
+umount /mnt/f2fs
+
+Tracepoint output:
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
+
+During precache_extents, there is off-by-one issue, we should update
+map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
+valid and not contiguous to previous extent.
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index efc30626760a6..a008d70b9f5ec 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1786,7 +1786,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+- *map->m_next_extent = pgofs + 1;
++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+ }
+ f2fs_put_dnode(&dn);
+ unlock_out:
+--
+2.51.0
+
--- /dev/null
+From 378691309a412ee14a0629f594cdc1b05ea93990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:21 +0800
+Subject: f2fs: fix zero-sized extent for precache extents
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
+
+Script to reproduce:
+f2fs_io write 1 0 1881 rand dsync testfile
+f2fs_io fallocate 0 7708672 4096 testfile
+f2fs_io write 1 1881 1 rand buffered testfile
+fsync testfile
+umount
+mount
+f2fs_io precache_extents testfile
+
+When the data layout is something like this:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+...
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+During precache_extents, we map the last block(valid blkaddr) in dnode1:
+map->m_flags |= F2FS_MAP_MAPPED;
+map->m_pblk = blkaddr(valid blkaddr);
+map->m_len = 1;
+then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
+map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
+
+map->m_len = 1
+ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
+ei.fofs = start_pgofs = 1882
+ei.len = map->m_len - ofs = 1 - 1 = 0
+
+Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
+A,B,C is valid blkaddr
+case1:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case2:
+dnode1: dnode2:
+[0] A [0] C (C!=B+1)
+[1] A+1 [1] C+1
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case3:
+dnode1: dnode2:
+[0] A [0] C (C!=B+2)
+[1] A+1 [1] C+1
+... ....
+[1015] A+1015
+[1016] B (B!=A+1016)
+[1017] B+1 [1017] 0x0
+
+[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index a008d70b9f5ec..040c06dfb8c03 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1781,9 +1781,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ if (map->m_flags & F2FS_MAP_MAPPED) {
+ unsigned int ofs = start_pgofs - map->m_lblk;
+
+- f2fs_update_read_extent_cache_range(&dn,
+- start_pgofs, map->m_pblk + ofs,
+- map->m_len - ofs);
++ if (map->m_len > ofs)
++ f2fs_update_read_extent_cache_range(&dn,
++ start_pgofs, map->m_pblk + ofs,
++ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+--
+2.51.0
+
--- /dev/null
+From a9f0ed2acdc8f1a8175e46198a1c5e3b73bdf06c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index b8d1e00a7982c..2dfeb158e848a 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From 221499d4ece1d9c0f828beab700a08938f89c2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:53:43 +0800
+Subject: firmware: arm_scmi: Mark VirtIO ready before registering
+ scmi_virtio_driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Junnan Wu <junnan01.wu@samsung.com>
+
+[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]
+
+After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
+standalone driver”), the VirtIO transport probes independently. During
+scmi_virtio_probe, scmi_probe() is called, which intune invokes
+scmi_protocol_acquire() that sends a message over the virtqueue and
+waits for a reply.
+
+Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
+virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
+Initialization):
+ | The driver MUST NOT send any buffer available notifications to the
+ | device before setting DRIVER_OK.
+
+Some type-1 hypervisors block available-buffer notifications until the
+driver is marked OK. In such cases, scmi_vio_probe stalls in
+scmi_wait_for_reply(), and the probe never completes.
+
+Resolve this by setting DRIVER_OK immediately after the device-specific
+setup, so scmi_probe() can safely send notifications.
+
+Note after splitting the transports into modules, the probe sequence
+changed a bit. We can no longer rely on virtio_device_ready() being
+called by the core in virtio_dev_probe(), because scmi_vio_probe()
+doesn’t complete until the core SCMI stack runs scmi_probe(), which
+immediately issues the initial BASE protocol exchanges.
+
+Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
+Signed-off-by: Junnan Wu <junnan01.wu@samsung.com>
+Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
+index d349766bc0b26..f78b87f334037 100644
+--- a/drivers/firmware/arm_scmi/transports/virtio.c
++++ b/drivers/firmware/arm_scmi/transports/virtio.c
+@@ -870,6 +870,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
+ /* Ensure initialized scmi_vdev is visible */
+ smp_store_mb(scmi_vdev, vdev);
+
++ /* Set device ready */
++ virtio_device_ready(vdev);
++
+ ret = platform_driver_register(&scmi_virtio_driver);
+ if (ret) {
+ vdev->priv = NULL;
+--
+2.51.0
+
--- /dev/null
+From 41ec0d71541ac6413b97b324fb1f7537878fd543 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From b1b9c93d3492bb8b3a7f63accb248883bed480ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 48566dff0dc92..662add939da78 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else {
+ /* The size of 'dlcn' can't be > 8. */
+ return -EINVAL;
+ }
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From 7627b5904f97d90fc835051c797bf3e6c88c22e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 10:40:16 -0700
+Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks
+ exist
+
+From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+
+[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
+
+Index allocation requires at least one bit in the $BITMAP attribute to
+track usage of index entries. If the bitmap is empty while index blocks
+are already present, this reflects on-disk corruption.
+
+syzbot triggered this condition using a malformed NTFS image. During a
+rename() operation involving a long filename (which spans multiple
+index entries), the empty bitmap allowed the name to be added without
+valid tracking. Subsequent deletion of the original entry failed with
+-ENOENT, due to unexpected index state.
+
+Reject such cases by verifying that the bitmap is not empty when index
+blocks exist.
+
+Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
+Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
+Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 1bf2a6593dec6..6d1bf890929d9 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
+ bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
+ }
+
++ /*
++ * Index blocks exist, but $BITMAP has zero valid bits.
++ * This implies an on-disk corruption and must be rejected.
++ */
++ if (in->name == I30_NAME &&
++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
++ err = -EINVAL;
++ goto out1;
++ }
++
+ bit = bmp_size << 3;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4f3e774ab27b03dd9d795f65b0dfd9ba8320af2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 23:57:24 +0200
+Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
+
+Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
+flag a second time after it has already been cleared. Fix that.
+
+Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 161fc76ed5b0e..e5558e63e2cba 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -801,8 +801,6 @@ __acquires(&gl->gl_lockref.lock)
+ clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
+ return;
+- } else {
+- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c314a8357cd860af56a61c0f4f1d4760d0d8a1bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 18:58:51 +0200
+Subject: HID: hidraw: tighten ioctl command parsing
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]
+
+The handling for variable-length ioctl commands in hidraw_ioctl() is
+rather complex and the check for the data direction is incomplete.
+
+Simplify this code by factoring out the various ioctls grouped by dir
+and size, and using a switch() statement with the size masked out, to
+ensure the rest of the command is correctly matched.
+
+Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hidraw.c | 224 ++++++++++++++++++++----------------
+ include/uapi/linux/hidraw.h | 2 +
+ 2 files changed, 124 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index c887f48756f4b..bbd6f23bce789 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
+ return 0;
+ }
+
+-static long hidraw_ioctl(struct file *file, unsigned int cmd,
+- unsigned long arg)
++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *arg)
+ {
+- struct inode *inode = file_inode(file);
+- unsigned int minor = iminor(inode);
+- long ret = 0;
+- struct hidraw *dev;
+- struct hidraw_list *list = file->private_data;
+- void __user *user_arg = (void __user*) arg;
+-
+- down_read(&minors_rwsem);
+- dev = hidraw_table[minor];
+- if (!dev || !dev->exist || hidraw_is_revoked(list)) {
+- ret = -ENODEV;
+- goto out;
+- }
++ struct hid_device *hid = dev->hid;
+
+ switch (cmd) {
+ case HIDIOCGRDESCSIZE:
+- if (put_user(dev->hid->rsize, (int __user *)arg))
+- ret = -EFAULT;
++ if (put_user(hid->rsize, (int __user *)arg))
++ return -EFAULT;
+ break;
+
+ case HIDIOCGRDESC:
+@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+ __u32 len;
+
+ if (get_user(len, (int __user *)arg))
+- ret = -EFAULT;
+- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+- ret = -EINVAL;
+- else if (copy_to_user(user_arg + offsetof(
+- struct hidraw_report_descriptor,
+- value[0]),
+- dev->hid->rdesc,
+- min(dev->hid->rsize, len)))
+- ret = -EFAULT;
++ return -EFAULT;
++
++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
++ return -EINVAL;
++
++ if (copy_to_user(arg + offsetof(
++ struct hidraw_report_descriptor,
++ value[0]),
++ hid->rdesc,
++ min(hid->rsize, len)))
++ return -EFAULT;
++
+ break;
+ }
+ case HIDIOCGRAWINFO:
+ {
+ struct hidraw_devinfo dinfo;
+
+- dinfo.bustype = dev->hid->bus;
+- dinfo.vendor = dev->hid->vendor;
+- dinfo.product = dev->hid->product;
+- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
+- ret = -EFAULT;
++ dinfo.bustype = hid->bus;
++ dinfo.vendor = hid->vendor;
++ dinfo.product = hid->product;
++ if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
++ return -EFAULT;
+ break;
+ }
+ case HIDIOCREVOKE:
+ {
+- if (user_arg)
+- ret = -EINVAL;
+- else
+- ret = hidraw_revoke(list);
+- break;
++ struct hidraw_list *list = file->private_data;
++
++ if (arg)
++ return -EINVAL;
++
++ return hidraw_revoke(list);
+ }
+ default:
+- {
+- struct hid_device *hid = dev->hid;
+- if (_IOC_TYPE(cmd) != 'H') {
+- ret = -EINVAL;
+- break;
+- }
++ /*
++ * None of the above ioctls can return -EAGAIN, so
++ * use it as a marker that we need to check variable
++ * length ioctls.
++ */
++ return -EAGAIN;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
++ return 0;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ int len = _IOC_SIZE(cmd);
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCSFEATURE(0):
++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCGFEATURE(0):
++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCSINPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCGINPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCSOUTPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ case HIDIOCGOUTPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
++ return -EINVAL;
++}
+
+- /* Begin Read-only ioctls. */
+- if (_IOC_DIR(cmd) != _IOC_READ) {
+- ret = -EINVAL;
+- break;
+- }
++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ struct hid_device *hid = dev->hid;
++ int len = _IOC_SIZE(cmd);
++ int field_len;
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCGRAWNAME(0):
++ field_len = strlen(hid->name) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len;
++ case HIDIOCGRAWPHYS(0):
++ field_len = strlen(hid->phys) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len;
++ case HIDIOCGRAWUNIQ(0):
++ field_len = strlen(hid->uniq) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
+- int len = strlen(hid->name) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->name, len) ?
+- -EFAULT : len;
+- break;
+- }
++ return -EINVAL;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
+- int len = strlen(hid->phys) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->phys, len) ?
+- -EFAULT : len;
+- break;
+- }
++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ struct inode *inode = file_inode(file);
++ unsigned int minor = iminor(inode);
++ struct hidraw *dev;
++ struct hidraw_list *list = file->private_data;
++ void __user *user_arg = (void __user *)arg;
++ int ret;
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
+- int len = strlen(hid->uniq) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->uniq, len) ?
+- -EFAULT : len;
+- break;
+- }
+- }
++ down_read(&minors_rwsem);
++ dev = hidraw_table[minor];
++ if (!dev || !dev->exist || hidraw_is_revoked(list)) {
++ ret = -ENODEV;
++ goto out;
++ }
++
++ if (_IOC_TYPE(cmd) != 'H') {
++ ret = -EINVAL;
++ goto out;
++ }
+
++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
+ ret = -ENOTTY;
++ goto out;
+ }
++
++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
++ if (ret != -EAGAIN)
++ goto out;
++
++ switch (_IOC_DIR(cmd)) {
++ case (_IOC_READ | _IOC_WRITE):
++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ case _IOC_READ:
++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ default:
++ /* Any other IOC_DIR is wrong */
++ ret = -EINVAL;
++ }
++
+ out:
+ up_read(&minors_rwsem);
+ return ret;
+diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
+index d5ee269864e07..ebd701b3c18d9 100644
+--- a/include/uapi/linux/hidraw.h
++++ b/include/uapi/linux/hidraw.h
+@@ -48,6 +48,8 @@ struct hidraw_devinfo {
+ #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
+ #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */
+
++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE)
++
+ #define HIDRAW_FIRST_MINOR 0
+ #define HIDRAW_MAX_DEVICES 64
+ /* number of reports to buffer */
+--
+2.51.0
+
--- /dev/null
+From eea6481fa69a67720377fb1ab32a54667eba54b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:02:54 +0530
+Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ]
+
+hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate
+operations. As per the original design in commit 40549ba8f8e0 ("hugetlb:
+use new vma_lock for pmd sharing synchronization"), if the trylock fails
+or the VMA has no lock, it should skip that VMA. Any remaining mapped
+pages are handled by remove_inode_hugepages() which is called after
+hugetlb_vmdelete_list() and uses proper lock ordering to guarantee
+unmapping success.
+
+Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs
+without shareable locks, the code proceeds to call unmap_hugepage_range().
+This causes assertion failures in huge_pmd_unshare() →
+hugetlb_vma_assert_locked() because no lock is actually held:
+
+ WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted
+ Call Trace:
+ hugetlb_vma_assert_locked+0x1dd/0x250
+ huge_pmd_unshare+0x2c8/0x540
+ __unmap_hugepage_range+0x6e3/0x1aa0
+ unmap_hugepage_range+0x32e/0x410
+ hugetlb_vmdelete_list+0x189/0x1f0
+
+Fix by using goto to ensure locks acquired by trylock are always released,
+even when skipping VMAs without shareable locks.
+
+Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com
+Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization")
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Oscar Salvador <osalvador@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hugetlbfs/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 4aa9a1428dd58..6fe6526c202cc 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -567,6 +567,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ if (!hugetlb_vma_trylock_write(vma))
+ continue;
+
++ /*
++ * Skip VMAs without shareable locks. Per the design in commit
++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages()
++ * called after this function with proper locking.
++ */
++ if (!__vma_shareable_lock(vma))
++ goto skip;
++
+ v_start = vma_offset_start(vma, start);
+ v_end = vma_offset_end(vma, end);
+
+@@ -577,6 +585,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ * vmas. Therefore, lock is not held when calling
+ * unmap_hugepage_range for private vmas.
+ */
++skip:
+ hugetlb_vma_unlock_write(vma);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From e80f6aa709a554dc0f721eac55c5bc5a34286dc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:48:58 +0200
+Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
+ different subsystems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
+
+Distinct between fan speed setting request coming for hwmon and
+thermal subsystems.
+
+There are fields 'last_hwmon_state' and 'last_thermal_state' in the
+structure 'mlxreg_fan_pwm', which respectively store the cooling state
+set by the 'hwmon' and 'thermal' subsystem.
+The purpose is to make arbitration of fan speed setting. For example, if
+fan speed required to be not lower than some limit, such setting is to
+be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
+not set fan below this limit.
+
+Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
+cooling state to never be set to a lower value.
+
+Eliminate update of 'last_thermal_state', when request is coming from
+'hwmon' subsystem.
+
+Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index c25a54d5b39ad..0ba9195c9d713 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -113,8 +113,8 @@ struct mlxreg_fan {
+ int divider;
+ };
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state);
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal);
+
+ static int
+ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ * last thermal state.
+ */
+ if (pwm->last_hwmon_state >= pwm->last_thermal_state)
+- return mlxreg_fan_set_cur_state(pwm->cdev,
+- pwm->last_hwmon_state);
++ return _mlxreg_fan_set_cur_state(pwm->cdev,
++ pwm->last_hwmon_state,
++ false);
+ return 0;
+ }
+ return regmap_write(fan->regmap, pwm->reg, val);
+@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state)
+-
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal)
+ {
+ struct mlxreg_fan_pwm *pwm = cdev->devdata;
+ struct mlxreg_fan *fan = pwm->fan;
+@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return -EINVAL;
+
+ /* Save thermal state. */
+- pwm->last_thermal_state = state;
++ if (thermal)
++ pwm->last_thermal_state = state;
+
+ state = max_t(unsigned long, state, pwm->last_hwmon_state);
+ err = regmap_write(fan->regmap, pwm->reg,
+@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state)
++
++{
++ return _mlxreg_fan_set_cur_state(cdev, state, true);
++}
++
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+ .get_max_state = mlxreg_fan_get_max_state,
+ .get_cur_state = mlxreg_fan_get_cur_state,
+--
+2.51.0
+
--- /dev/null
+From 3b015dcca82ad93a3b681f1aa3a8a14311d74bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 36c34252b4f63..3c514b4fbc8ae 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ if (IS_ERR(ks_sa_rng->regmap_cfg))
+ return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n");
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 4f92a37c6b5e289cbe0ccff3987ed5de3d9fcb05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 17:28:00 +0200
+Subject: hwrng: nomadik - add ARM_AMBA dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
+
+Compile-testing this driver is only possible when the AMBA bus driver is
+available in the kernel:
+
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
+nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
+nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
+x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
+
+The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
+specified for the COMPILE_TEST case.
+
+Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index b51d9e243f351..f0dde77f50b42 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG
+ config HW_RANDOM_NOMADIK
+ tristate "ST-Ericsson Nomadik Random Number Generator support"
+ depends on ARCH_NOMADIK || COMPILE_TEST
++ depends on ARM_AMBA
+ default HW_RANDOM
+ help
+ This driver provides kernel-side support for the Random Number
+--
+2.51.0
+
--- /dev/null
+From 3596738cbe344c95fdc714faa4bae9449df94dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 1615facff29c6..24c0ada72f6a5 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From abf7d8d42999ccfc030a26cf9a7fbafe61ef65e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:10 +0900
+Subject: i2c: designware: Fix clock issue when PM is disabled
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
+
+When the driver is removed, the clocks are first enabled by
+calling pm_runtime_get_sync(), and then disabled with
+pm_runtime_put_sync().
+
+If CONFIG_PM=y, clocks for this controller are disabled when it's in
+the idle state. So the clocks are properly disabled when the driver
+exits.
+
+Othewise, the clocks are always enabled and the PM functions have
+no effect. Therefore, the driver exits without disabling the clocks.
+
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 18
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+
+To ensure that the clocks can be disabled correctly even without
+CONFIG_PM=y, should add the following fixes:
+
+- Replace with pm_runtime_put_noidle(), which only decrements the runtime
+ PM usage count.
+- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index ef9bed2f2dccb..1615facff29c6 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
+ i2c_dw_disable(dev);
+
+ pm_runtime_dont_use_autosuspend(device);
+- pm_runtime_put_sync(device);
++ pm_runtime_put_noidle(device);
+ dw_i2c_plat_pm_cleanup(dev);
+
++ i2c_dw_prepare_clk(dev, false);
++
+ i2c_dw_remove_lock_support(dev);
+
+ reset_control_assert(dev->rst);
+--
+2.51.0
+
--- /dev/null
+From dfa04b11a8529a3ca86d9f5baea6cd04b4070bba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index e0ba653dec2d6..8beef73960c74 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 5d1ece0f231f5417625749851c79bbf8de9e1b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 7d8e1540f02ae..a1945bf9ef19e 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -377,6 +377,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 042a36e08309afacb57eedbe630fc91f69fe83c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:08 +0800
+Subject: i3c: master: svc: Use manual response for IBI events
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
+
+Driver wants to nack the IBI request when the target is not in the
+known address list. In below code, svc_i3c_master_nack_ibi() will
+cause undefined behavior when using AUTOIBI with auto response rule,
+because hw always auto ack the IBI request.
+
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ svc_i3c_master_nack_ibi(master);
+ ...
+ break;
+
+AutoIBI has another issue that the controller doesn't quit AutoIBI state
+after IBIWON polling timeout when there is a SDA glitch(high->low->high).
+1. SDA high->low: raising an interrupt to execute IBI ISR
+2. SDA low->high
+3. Driver writes an AutoIBI request
+4. AutoIBI process does not start because SDA is not low
+5. IBIWON polling times out
+6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
+
+Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 474a96ebda226..7d8e1540f02ae 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -438,9 +438,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ */
+ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
+- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
+- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
+- SVC_I3C_MCTRL_IBIRESP_AUTO,
++ /*
++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
++ * instend of using AUTO_IBI.
++ *
++ * Using AutoIBI request may cause controller to remain in AutoIBI state when
++ * there is a glitch on SDA line (high->low->high).
++ * 1. SDA high->low, raising an interrupt to execute IBI isr.
++ * 2. SDA low->high.
++ * 3. IBI isr writes an AutoIBI request.
++ * 4. The controller will not start AutoIBI process because SDA is not low.
++ * 5. IBIWON polling times out.
++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
++ */
++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
++ SVC_I3C_MCTRL_TYPE_I3C |
++ SVC_I3C_MCTRL_IBIRESP_MANUAL |
++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
+ master->regs + SVC_I3C_MCTRL);
+
+ /* Wait for IBIWON, should take approximately 100us */
+@@ -460,10 +475,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
+ svc_i3c_master_nack_ibi(master);
+- else
++ } else {
++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
++ svc_i3c_master_ack_ibi(master, true);
++ else
++ svc_i3c_master_ack_ibi(master, false);
+ svc_i3c_master_handle_ibi(master, dev);
++ }
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
+ if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
+--
+2.51.0
+
--- /dev/null
+From 17f83bc5f1c1a12c2fc89218201d3609422ae882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 53571e6b3162c..66df5bed6a562 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From a2eda285b83973516688315e2d2afa2f81ad6b12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 11:02:10 -0700
+Subject: idpf: fix mismatched free function for dma_alloc_coherent
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]
+
+The mailbox receive path allocates coherent DMA memory with
+dma_alloc_coherent(), but frees it with dmam_free_coherent().
+This is incorrect since dmam_free_coherent() is only valid for
+buffers allocated with dmam_alloc_coherent().
+
+Fix the mismatch by using dma_free_coherent() instead of
+dmam_free_coherent
+
+Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index f27a8cf3816db..d1f374da00981 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -727,9 +727,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
+ /* If post failed clear the only buffer we supplied */
+ if (post_err) {
+ if (dma_mem)
+- dmam_free_coherent(&adapter->pdev->dev,
+- dma_mem->size, dma_mem->va,
+- dma_mem->pa);
++ dma_free_coherent(&adapter->pdev->dev,
++ dma_mem->size, dma_mem->va,
++ dma_mem->pa);
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 50c8f4b769887a9bd4ed8e0a1365cba8c812ad31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:54:56 +0200
+Subject: idpf: fix Rx descriptor ready check barrier in splitq
+
+From: Alexander Lobakin <aleksander.lobakin@intel.com>
+
+[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]
+
+No idea what the current barrier position was meant for. At that point,
+nothing is read from the descriptor, only the pointer to the actual one
+is fetched.
+The correct barrier usage here is after the generation check, so that
+only the first qword is read if the descriptor is not yet ready and we
+need to stop polling. Debatable on coherent DMA as the Rx descriptor
+size is <= cacheline size, but anyway, the current barrier position
+only makes the codegen worse.
+
+Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Tested-by: Ramu R <ramu.r@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 4086a6ef352e5..087a3077d5481 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -3216,18 +3216,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
+ /* get the Rx desc from Rx queue based on 'next_to_clean' */
+ rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
+
+- /* This memory barrier is needed to keep us from reading
+- * any other fields out of the rx_desc
+- */
+- dma_rmb();
+-
+ /* if the descriptor isn't done, no work yet to do */
+ gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
+ VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
+-
+ if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
+ break;
+
++ dma_rmb();
++
+ rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
+ rx_desc->rxdid_ucast);
+ if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
+--
+2.51.0
+
--- /dev/null
+From 920eb68fc227f0c1f32d39f92884ec59dc51d736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:20 +0200
+Subject: iio: consumers: Fix handling of negative channel scale in
+ iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
+
+There is an issue with the handling of negative channel scales
+in iio_convert_raw_to_processed_unlocked() when the channel-scale
+is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
+
+Things work for channel-scale values > -1.0 and < 0.0 because of
+the use of signed values in:
+
+ *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
+
+Things will break however for scale values < -1.0. Lets for example say
+that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
+
+The result should then be 2 * 10 * -1.5 = -30.
+
+channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
+now lets see what gets stored in processed:
+
+1. *processed = raw64 * scale_val * scale;
+2. *processed += raw64 * scale_val2 * scale / 1000000LL;
+
+1. Sets processed to 2 * -1 * 10 = -20
+2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
+
+And the end result is processed = -20 + 10 = -10, which is not correct.
+
+Fix this by always using the abs value of both scale_val and scale_val2
+and if either is negative multiply the end-result by -1.
+
+Note there seems to be an unwritten rule about negative
+IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
+
+i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx
+ii. values <= -1.0 are written as val=-xxx val2=xxx
+
+But iio_format_value() will also correctly display a third option:
+
+iii. values <= -1.0 written as val=-xxx val2=-xxx
+
+Since iio_format_value() uses abs(val) when val2 < 0.
+
+This fix also makes iio_convert_raw_to_processed() properly handle
+channel-scales using this third option.
+
+Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
+Cc: Matteo Martelli <matteomartelli3@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 1155487f7aeac..0f394266ff8c0 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -10,6 +10,7 @@
+ #include <linux/mutex.h>
+ #include <linux/property.h>
+ #include <linux/slab.h>
++#include <linux/units.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/iio-opaque.h>
+@@ -602,7 +603,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ {
+ int scale_type, scale_val, scale_val2;
+ int offset_type, offset_val, offset_val2;
+- s64 raw64 = raw;
++ s64 denominator, raw64 = raw;
+
+ offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
+ IIO_CHAN_INFO_OFFSET);
+@@ -646,20 +647,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ *processed = raw64 * scale_val * scale;
+ break;
+ case IIO_VAL_INT_PLUS_MICRO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000LL);
+- break;
+ case IIO_VAL_INT_PLUS_NANO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000000LL);
++ switch (scale_type) {
++ case IIO_VAL_INT_PLUS_MICRO:
++ denominator = MICRO;
++ break;
++ case IIO_VAL_INT_PLUS_NANO:
++ denominator = NANO;
++ break;
++ }
++ *processed = raw64 * scale * abs(scale_val);
++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
++ if (scale_val < 0 || scale_val2 < 0)
++ *processed *= -1;
+ break;
+ case IIO_VAL_FRACTIONAL:
+ *processed = div_s64(raw64 * (s64)scale_val * scale,
+--
+2.51.0
+
--- /dev/null
+From 70d5f28f1058536d5bd039767ad00138c9272697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 0f394266ff8c0..85ba80c57d08f 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -638,7 +638,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 71e26e6ec850be8329ae06c9b12705dd03a605fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:30:51 +0000
+Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
+
+We need to check socket netns before considering them in ping_get_port().
+Otherwise, one malicious netns could 'consume' all ports.
+
+Add corresponding check in ping_lookup().
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 619ddc087957f..37a3fa98d904f 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
+
+ int ping_get_port(struct sock *sk, unsigned short ident)
+ {
++ struct net *net = sock_net(sk);
+ struct inet_sock *isk, *isk2;
+ struct hlist_head *hlist;
+ struct sock *sk2 = NULL;
+@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ for (i = 0; i < (1L << 16); i++, result++) {
+ if (!result)
+ result++; /* avoid zero */
+- hlist = ping_hashslot(&ping_table, sock_net(sk),
+- result);
++ hlist = ping_hashslot(&ping_table, net, result);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ if (isk2->inet_num == result)
+@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ if (i >= (1L << 16))
+ goto fail;
+ } else {
+- hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
++ hlist = ping_hashslot(&ping_table, net, ident);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ /* BUG? Why is this reuse and not reuseaddr? ping.c
+@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ pr_debug("was not hashed\n");
+ sk_add_node_rcu(sk, hlist);
+ sock_set_flag(sk, SOCK_RCU_FREE);
+- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++ sock_prot_inuse_add(net, sk->sk_prot, 1);
+ }
+ spin_unlock(&ping_table.lock);
+ return 0;
+@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ }
+
+ sk_for_each_rcu(sk, hslot) {
++ if (!net_eq(sock_net(sk), net))
++ continue;
+ isk = inet_sk(sk);
+
+ pr_debug("iterate\n");
+--
+2.51.0
+
--- /dev/null
+From a2904f35d70501996333aadb601789378b47f528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:11:05 +0200
+Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
+
+INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
+init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
+prevent asking the user about this feature when configuring a kernel
+without initramfs support.
+
+Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 45990792cb4a6..219ccdb0af732 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1440,6 +1440,7 @@ config BOOT_CONFIG_EMBED_FILE
+
+ config INITRAMFS_PRESERVE_MTIME
+ bool "Preserve cpio archive mtimes in initramfs"
++ depends on BLK_DEV_INITRD
+ default y
+ help
+ Each entry in an initramfs cpio archive carries an mtime value. When
+--
+2.51.0
+
--- /dev/null
+From bd77ba121ab472a70388310f0e95fbcb4486d33b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:59 +0800
+Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic
+
+From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+
+[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ]
+
+In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR
+maybe uninitialized or zero in that case and may cause oops like:
+
+ Oops: general protection fault, probably for non-canonical address
+ 0xf00087d3f000f000: 0000 [#1] SMP NOPTI
+ CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
+ RIP: 0010:pgtable_walk_level+0x98/0x150
+ RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206
+ RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e
+ RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000
+ RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002
+ R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000
+ R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98
+ FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ pgtable_walk_level+0x88/0x150
+ domain_translation_struct_show.isra.0+0x2d9/0x300
+ dev_domain_translation_struct_show+0x20/0x40
+ seq_read_iter+0x12d/0x490
+...
+
+Avoid walking the page table if TT is not 00b or 01b.
+
+Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table")
+Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index affbf4a1558de..5aa7f46a420b5 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m,
+ }
+ pgd &= VTD_PAGE_MASK;
+ } else { /* legacy mode */
+- pgd = context->lo & VTD_PAGE_MASK;
+- agaw = context->hi & 7;
++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2;
++
++ /*
++ * According to Translation Type(TT),
++ * get the page table pointer(SSPTPTR).
++ */
++ switch (tt) {
++ case CONTEXT_TT_MULTI_LEVEL:
++ case CONTEXT_TT_DEV_IOTLB:
++ pgd = context->lo & VTD_PAGE_MASK;
++ agaw = context->hi & 7;
++ break;
++ default:
++ goto iommu_unlock;
++ }
+ }
+
+ seq_printf(m, "Device %04x:%02x:%02x.%x ",
+--
+2.51.0
+
--- /dev/null
+From f390ebe5eb1d0ea430998c4b82abe1a4464d4f36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 10:41:30 +0800
+Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ]
+
+Dirty page tracking relies on the IOMMU atomically updating the dirty bit
+in the paging-structure entry. For this operation to succeed, the paging-
+structure memory must be coherent between the IOMMU and the CPU. In
+another word, if the iommu page walk is incoherent, dirty page tracking
+doesn't work.
+
+The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:
+
+"Remapping hardware encountering the need to atomically update A/EA/D bits
+ in a paging-structure entry that is not snooped will result in a non-
+ recoverable fault."
+
+To prevent an IOMMU from being incorrectly configured for dirty page
+tracking when it is operating in an incoherent mode, mark SSADS as
+supported only when both ecap_slads and ecap_smpwc are supported.
+
+Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index f521155fb793b..df24a62e8ca40 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -541,7 +541,8 @@ enum {
+ #define pasid_supported(iommu) (sm_supported(iommu) && \
+ ecap_pasid((iommu)->ecap))
+ #define ssads_supported(iommu) (sm_supported(iommu) && \
+- ecap_slads((iommu)->ecap))
++ ecap_slads((iommu)->ecap) && \
++ ecap_smpwc(iommu->ecap))
+ #define nested_supported(iommu) (sm_supported(iommu) && \
+ ecap_nest((iommu)->ecap))
+
+--
+2.51.0
+
--- /dev/null
+From 954ea043a2c7506b8d05757781f1ed75613661e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index d8a284999544b..206c6700e2006 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From f0b771c570a7b813d82da0b4356f431d9952ff5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 21:46:54 +0800
+Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
+
+From: Zhang Tengfei <zhtfdev@gmail.com>
+
+[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
+
+KCSAN reported a data-race on the `ipvs->enable` flag, which is
+written in the control path and read concurrently from many other
+contexts.
+
+Following a suggestion by Julian, this patch fixes the race by
+converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
+This lightweight approach ensures atomic access and acts as a
+compiler barrier, preventing unsafe optimizations where the flag
+is checked in loops (e.g., in ip_vs_est.c).
+
+Additionally, the `enable` checks in the fast-path hooks
+(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
+removed. These are unnecessary since commit 857ca89711de
+("ipvs: register hooks only with services"). The `enable=0`
+condition they check for can only occur in two rare and non-fatal
+scenarios: 1) after hooks are registered but before the flag is set,
+and 2) after hooks are unregistered on cleanup_net. In the worst
+case, a single packet might be mishandled (e.g., dropped), which
+does not lead to a system crash or data corruption. Adding a check
+in the performance-critical fast-path to handle this harmless
+condition is not a worthwhile trade-off.
+
+Fixes: 857ca89711de ("ipvs: register hooks only with services")
+Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
+Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
+ net/netfilter/ipvs/ip_vs_ctl.c | 6 +++---
+ net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++--------
+ 4 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index c0289f83f96df..327baa17882a8 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
+ * conntrack cleanup for the net.
+ */
+ smp_rmb();
+- if (ipvs->enable)
++ if (READ_ONCE(ipvs->enable))
+ ip_vs_conn_drop_conntrack(cp);
+ }
+
+@@ -1433,7 +1433,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
+ cond_resched_rcu();
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ break;
+ }
+ rcu_read_unlock();
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index c7a8a08b73089..5ea7ab8bf4dcc 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
+ if (unlikely(!skb_dst(skb)))
+ return NF_ACCEPT;
+
+- if (!ipvs->enable)
+- return NF_ACCEPT;
+-
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (af == AF_INET6) {
+@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
+ return NF_ACCEPT;
+ }
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
+ int r;
+
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ if (state->pf == NFPROTO_IPV4) {
+@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
+ return -ENOMEM;
+
+ /* Hold the beast until a service is registered */
+- ipvs->enable = 0;
++ WRITE_ONCE(ipvs->enable, 0);
+ ipvs->net = net;
+ /* Counters used for creating unique names */
+ ipvs->gen = atomic_read(&ipvs_netns_cnt);
+@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
+ ipvs = net_ipvs(net);
+ ip_vs_unregister_hooks(ipvs, AF_INET);
+ ip_vs_unregister_hooks(ipvs, AF_INET6);
+- ipvs->enable = 0; /* Disable packet reception */
++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */
+ smp_wmb();
+ ip_vs_sync_net_cleanup(ipvs);
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 3224f6e17e736..3219338feca4d 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
+ struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock;
+ if (!kd)
+ continue;
+@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+
+ *svc_p = svc;
+
+- if (!ipvs->enable) {
++ if (!READ_ONCE(ipvs->enable)) {
+ /* Now there is a service - full throttle */
+- ipvs->enable = 1;
++ WRITE_ONCE(ipvs->enable, 1);
+
+ /* Start estimation for first time */
+ ip_vs_est_reload_start(ipvs);
+diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
+index f821ad2e19b35..3492108bb3b97 100644
+--- a/net/netfilter/ipvs/ip_vs_est.c
++++ b/net/netfilter/ipvs/ip_vs_est.c
+@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
+ void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
+ {
+ /* Ignore reloads before first service is added */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ return;
+ ip_vs_est_stopped_recalc(ipvs);
+ /* Bump the kthread configuration genid */
+@@ -305,7 +305,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ int i;
+
+ if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
+- ipvs->enable && ipvs->est_max_threads)
++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
+ return -EINVAL;
+
+ mutex_lock(&ipvs->est_mutex);
+@@ -342,7 +342,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ }
+
+ /* Start kthread tasks only when services are present */
+- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
+ ret = ip_vs_est_kthread_start(ipvs, kd);
+ if (ret < 0)
+ goto out;
+@@ -485,7 +485,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
+ struct ip_vs_estimator *est = &stats->est;
+ int ret;
+
+- if (!ipvs->est_max_threads && ipvs->enable)
++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
+ ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
+
+ est->ktid = -1;
+@@ -662,7 +662,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ /* Wait for cpufreq frequency transition */
+ wait_event_idle_timeout(wq, kthread_should_stop(),
+ HZ / 50);
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ }
+
+@@ -680,7 +680,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ rcu_read_unlock();
+ local_bh_enable();
+
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ cond_resched();
+
+@@ -756,7 +756,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ mutex_lock(&ipvs->est_mutex);
+ for (id = 1; id < ipvs->est_kt_count; id++) {
+ /* netns clean up started, abort */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock2;
+ kd = ipvs->est_kt_arr[id];
+ if (!kd)
+@@ -786,7 +786,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ id = ipvs->est_kt_count;
+
+ next_kt:
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto unlock;
+ id--;
+ if (id < 0)
+--
+2.51.0
+
--- /dev/null
+From 3fc9ceb0def44f61b7f08622b8150f1f84539696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 21:15:50 +0000
+Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing
+
+From: Fan Wu <wufan@kernel.org>
+
+[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
+
+Fix the X.509 Basic Constraints CA flag parsing to correctly handle
+the ASN.1 DER encoded structure. The parser was incorrectly treating
+the length field as the boolean value.
+
+Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
+According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
+
+Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
+
+The basicConstraints extension with CA:TRUE is encoded as:
+
+ SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
+ ^-- v[2] ^-- v[3] ^-- v[4]
+
+The parser was checking v[3] (the length field, always 0x01) instead
+of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
+
+Also handle the case where the extension is an empty SEQUENCE (30 00),
+which is valid for CA:FALSE when the default value is omitted as
+required by DER encoding rules (X.690 section 11.5).
+
+Per ITU-T X.690-0207:
+- Section 11.5: Default values must be omitted in DER
+- Section 11.1: DER requires TRUE to be encoded as 0xFF
+
+Link: https://datatracker.ietf.org/doc/html/rfc5280
+Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
+Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
+Signed-off-by: Fan Wu <wufan@kernel.org>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index ee2fdab42334f..7e0ce7bf68c99 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -611,11 +611,14 @@ int x509_process_extension(void *context, size_t hdrlen,
+ /*
+ * Get hold of the basicConstraints
+ * v[1] is the encoding size
+- * (Expect 0x2 or greater, making it 1 or more bytes)
++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or
++ * 0x03 or greater for non-empty SEQUENCE)
+ * v[2] is the encoding type
+ * (Expect an ASN1_BOOL for the CA)
+- * v[3] is the contents of the ASN1_BOOL
+- * (Expect 1 if the CA is TRUE)
++ * v[3] is the length of the ASN1_BOOL
++ * (Expect 1 for a single byte boolean)
++ * v[4] is the contents of the ASN1_BOOL
++ * (Expect 0xFF if the CA is TRUE)
+ * vlen should match the entire extension size
+ */
+ if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+@@ -624,8 +627,13 @@ int x509_process_extension(void *context, size_t hdrlen,
+ return -EBADMSG;
+ if (v[1] != vlen - 2)
+ return -EBADMSG;
+- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
++ if (v[1] == 0)
++ return 0;
++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
+ ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
++ else
++ return -EBADMSG;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From efeac4b74bba20364303a2eea9f87d78db22ab5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:51:22 +0800
+Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
+
+There is a register to clamp the flash current per LED channel when
+safety timer is disabled. It needs to be updated according to the
+maximum torch LED current setting to ensure the torch current won't
+be clamped unexpectedly.
+
+Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
+index 07a83bb2dfdf6..bb00097b1ae59 100644
+--- a/drivers/leds/flash/leds-qcom-flash.c
++++ b/drivers/leds/flash/leds-qcom-flash.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #include <linux/bitfield.h>
+@@ -114,36 +114,39 @@ enum {
+ REG_THERM_THRSH1,
+ REG_THERM_THRSH2,
+ REG_THERM_THRSH3,
++ REG_TORCH_CLAMP,
+ REG_MAX_COUNT,
+ };
+
+ static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x08, 0, 7), /* status1 */
+- REG_FIELD(0x09, 0, 7), /* status2 */
+- REG_FIELD(0x0a, 0, 7), /* status3 */
+- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */
+- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x47, 0, 5), /* iresolution */
+- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */
+- REG_FIELD(0x4c, 0, 2), /* chan_en */
+- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */
+- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7),
++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2),
++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2),
++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6),
+ };
+
+ static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x06, 0, 7), /* status1 */
+- REG_FIELD(0x07, 0, 6), /* status2 */
+- REG_FIELD(0x09, 0, 7), /* status3 */
+- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */
+- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x49, 0, 3), /* iresolution */
+- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */
+- REG_FIELD(0x4e, 0, 3), /* chan_en */
+- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */
++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6),
++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3),
++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6),
+ };
+
+ struct qcom_flash_data {
+@@ -156,6 +159,7 @@ struct qcom_flash_data {
+ u8 max_channels;
+ u8 chan_en_bits;
+ u8 revision;
++ u8 torch_clamp;
+ };
+
+ struct qcom_flash_led {
+@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
+ u32 current_ua, timeout_us;
+ u32 channels[4];
+ int i, rc, count;
++ u8 torch_clamp;
+
+ count = fwnode_property_count_u32(node, "led-sources");
+ if (count <= 0) {
+@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
+ current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
+ led->max_torch_current_ma = current_ua / UA_PER_MA;
+
++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
++ if (torch_clamp != 0)
++ torch_clamp--;
++
++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
++
+ if (fwnode_property_present(node, "flash-max-microamp")) {
+ flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
+
+@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
+ flash_data->leds_count++;
+ }
+
+- return 0;
+-
++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
+ release:
+ fwnode_handle_put(child);
+ while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
+--
+2.51.0
+
--- /dev/null
+From 314bbd72b2fe8db98f10d14bf8872e2291c73ca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:47:12 +0200
+Subject: leds: leds-lp55xx: Use correct address for memory programming
+
+From: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+
+[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]
+
+Memory programming doesn't work for devices without page support.
+For example, LP5562 has 3 engines but doesn't support pages,
+the start address is changed depending on engine number.
+According to datasheet [1], the PROG MEM register addresses for each
+engine are as follows:
+
+ Engine 1: 0x10
+ Engine 2: 0x30
+ Engine 3: 0x50
+
+However, the current implementation incorrectly calculates the address
+of PROG MEM register using the engine index starting from 1:
+
+ prog_mem_base = 0x10
+ LP55xx_BYTES_PER_PAGE = 0x20
+
+ Engine 1: 0x10 + 0x20 * 1 = 0x30
+ Engine 2: 0x10 + 0x20 * 2 = 0x50
+ Engine 3: 0x10 + 0x20 * 3 = 0x70
+
+This results in writing to the wrong engine memory, causing pattern
+programming to fail.
+
+To correct it, the engine index should be decreased:
+ Engine 1: 0x10 + 0x20 * 0 = 0x10
+ Engine 2: 0x10 + 0x20 * 1 = 0x30
+ Engine 3: 0x10 + 0x20 * 2 = 0x50
+
+1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf
+
+Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
+Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp55xx-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
+index e71456a56ab8d..fd447eb7eb15e 100644
+--- a/drivers/leds/leds-lp55xx-common.c
++++ b/drivers/leds/leds-lp55xx-common.c
+@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
+ * For LED chip that support page, PAGE is already set in load_engine.
+ */
+ if (!cfg->pages_per_engine)
+- start_addr += LP55xx_BYTES_PER_PAGE * idx;
++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
+
+ for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
+ /* Write to the next page each 32 bytes (if supported) */
+--
+2.51.0
+
--- /dev/null
+From 259b4f9a6d5ccfd040d73ad3a43c13d5e88fffc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 15:17:51 +0800
+Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]
+
+When a module registers a struct_ops, the struct_ops type and its
+corresponding map_value type ("bpf_struct_ops_") may reside in different
+btf objects, here are four possible case:
+
++--------+---------------+-------------+---------------------------------+
+| |bpf_struct_ops_| xxx_ops | |
++--------+---------------+-------------+---------------------------------+
+| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux |
++--------+---------------+-------------+---------------------------------+
+| case 1 | btf_vmlinux | mod_btf | INVALID |
++--------+---------------+-------------+---------------------------------+
+| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in |
+| | | | vmlinux and mod. |
++--------+---------------+-------------+---------------------------------+
+| case 3 | mod_btf | mod_btf | be used and reg only in mod |
++--------+---------------+-------------+---------------------------------+
+
+Currently we figure out the mod_btf by searching with the struct_ops type,
+which makes it impossible to figure out the mod_btf when the struct_ops
+type is in btf_vmlinux while it's corresponding map_value type is in
+mod_btf (case 2).
+
+The fix is to use the corresponding map_value type ("bpf_struct_ops_")
+as the lookup anchor instead of the struct_ops type to figure out the
+`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
+the kern_type_id via btf__find_by_name_kind() with the `btf` we just
+obtained from find_ksym_btf_id().
+
+With this change the lookup obtains the correct btf and mod_btf for case 2,
+preserves correct behavior for other valid cases, and still fails as
+expected for the invalid scenario (case 1).
+
+Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index ac5ad30266a5e..060aecf60b76b 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -990,35 +990,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ const struct btf_member *kern_data_member;
+ struct btf *btf = NULL;
+ __s32 kern_vtype_id, kern_type_id;
+- char tname[256];
++ char tname[192], stname[256];
+ __u32 i;
+
+ snprintf(tname, sizeof(tname), "%.*s",
+ (int)bpf_core_essential_name_len(tname_raw), tname_raw);
+
+- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
+- &btf, mod_btf);
+- if (kern_type_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
+- tname);
+- return kern_type_id;
+- }
+- kern_type = btf__type_by_id(btf, kern_type_id);
++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
+
+- /* Find the corresponding "map_value" type that will be used
+- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example,
+- * find "struct bpf_struct_ops_tcp_congestion_ops" from the
+- * btf_vmlinux.
++ /* Look for the corresponding "map_value" type that will be used
++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
++ * and the mod_btf.
++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
+ */
+- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
+- tname, BTF_KIND_STRUCT);
++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
+ if (kern_vtype_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
+- STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
+ return kern_vtype_id;
+ }
+ kern_vtype = btf__type_by_id(btf, kern_vtype_id);
+
++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
++ if (kern_type_id < 0) {
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
++ return kern_type_id;
++ }
++ kern_type = btf__type_by_id(btf, kern_type_id);
++
+ /* Find "struct tcp_congestion_ops" from
+ * struct bpf_struct_ops_tcp_congestion_ops {
+ * [ ... ]
+@@ -1031,8 +1029,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ break;
+ }
+ if (i == btf_vlen(kern_vtype)) {
+- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
+- tname, STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
++ tname, stname);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0b61366b104a411d6b9f77b578af539da1918f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index e33cf3caf8b64..ac5ad30266a5e 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -5056,6 +5056,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From 1fa257c3b923ad686301414a9049c6f70f7d8bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 15:28:00 -0700
+Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]
+
+When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
+not need to be visible and settable since builtin_lsm_order is defined in
+security.o, which is only built when CONFIG_SECURITY=y.
+
+So make CONFIG_LSM depend on CONFIG_SECURITY.
+
+Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[PM: subj tweak]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 28e685f53bd1a..ce9f1a651ccc3 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -264,6 +264,7 @@ endchoice
+
+ config LSM
+ string "Ordered list of enabled LSMs"
++ depends on SECURITY
+ default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
+ default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
+ default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
+--
+2.51.0
+
--- /dev/null
+From bddf177ce3ee0c590abb728cd96cb6ef708b1ab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index b7ca39f63dba8..6dfc912168510 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From 675cd0c462276cd6a27ab0e542f9d4305509c046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 11:31:56 +0200
+Subject: media: st-delta: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
+
+Building with a reduced stack warning limit shows that delta_mjpeg_decode()
+copies a giant structure to the stack each time but only uses three of
+its members:
+
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Open-code the passing of the structure members that are actually used here.
+
+Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+index 0533d4a083d24..a078f1107300e 100644
+--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
+ return 0;
+ }
+
+-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
+ {
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+
+ memset(params, 0, sizeof(*params));
+
+- params->picture_start_addr_p = (u32)(au->paddr);
+- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
++ params->picture_start_addr_p = pstart;
++ params->picture_end_addr_p = pend;
+
+ /*
+ * !WARNING!
+@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+ int ret;
+- struct delta_au au = *pau;
++ void *au_vaddr = pau->vaddr;
++ dma_addr_t au_dma = pau->paddr;
++ size_t au_size = pau->size;
+ unsigned int data_offset = 0;
+ struct mjpeg_header *header = &ctx->header_struct;
+
+ if (!ctx->header) {
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ goto err;
+ }
+
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ ctx->header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+ goto err;
+ }
+
+- au.paddr += data_offset;
+- au.vaddr += data_offset;
++ au_dma += data_offset;
++ au_vaddr += data_offset;
+
+- ret = delta_mjpeg_ipc_decode(pctx, &au);
++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
+ if (ret)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From d6dfd17d0c7f3a65de1b3ea81fa2c9abf095ba60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:30:15 +0300
+Subject: media: zoran: Remove zoran_fh structure
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
+
+The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
+mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
+but the structure stayed by mistake. It is now used in a single
+location, assigned from a void pointer and then recast to a void
+pointer, without being every accessed. Drop it.
+
+Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/zoran/zoran.h | 6 ------
+ drivers/media/pci/zoran/zoran_driver.c | 3 +--
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
+index 1cd990468d3de..d05e222b39215 100644
+--- a/drivers/media/pci/zoran/zoran.h
++++ b/drivers/media/pci/zoran/zoran.h
+@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
+
+ struct zoran;
+
+-/* zoran_fh contains per-open() settings */
+-struct zoran_fh {
+- struct v4l2_fh fh;
+- struct zoran *zr;
+-};
+-
+ struct card_info {
+ enum card_type type;
+ char name[32];
+diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
+index 5c05e64c71a90..80377992a6073 100644
+--- a/drivers/media/pci/zoran/zoran_driver.c
++++ b/drivers/media/pci/zoran/zoran_driver.c
+@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
+ struct v4l2_format *fmt)
+ {
+ struct zoran *zr = video_drvdata(file);
+- struct zoran_fh *fh = __fh;
+ int i;
+ int res = 0;
+
+ if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
+- return zoran_s_fmt_vid_out(file, fh, fmt);
++ return zoran_s_fmt_vid_out(file, __fh, fmt);
+
+ for (i = 0; i < NUM_FORMATS; i++)
+ if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
+--
+2.51.0
+
--- /dev/null
+From 1bb85c3dabf2c8b175801ef711f791bdd9d628f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From 407b11bc4c7fa320078613ef7a5936a8da324861 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:06:05 +0200
+Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
+
+From: Bean Huo <beanhuo@micron.com>
+
+[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]
+
+Rename the inner 'frm' variable to 'resp_frm' in the write path of
+mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.
+
+The function declares 'frm' at function scope pointing to the request
+frame, but then redeclares another 'frm' variable inside the write
+block pointing to the response frame. This shadowing makes the code
+confusing and error-prone.
+
+Using 'resp_frm' for the response frame makes the distinction clear
+and improves code readability.
+
+Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 1d08009f2bd83..08b8276e1da93 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2876,15 +2876,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
+ return -ENOMEM;
+
+ if (write) {
+- struct rpmb_frame *frm = (struct rpmb_frame *)resp;
++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
+
+ /* Send write request frame(s) */
+ set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
+ 1 | MMC_CMD23_ARG_REL_WR, req, req_len);
+
+ /* Send result request frame */
+- memset(frm, 0, sizeof(*frm));
+- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
++ memset(resp_frm, 0, sizeof(*resp_frm));
++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
+ set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
+ resp_len);
+
+--
+2.51.0
+
--- /dev/null
+From 7cb2a3fa41d38fa9b31ab88cc91648a7bcc0ee82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:07:27 +0300
+Subject: mtd: rawnand: atmel: Fix error handling path in
+ atmel_nand_controller_add_nands
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
+
+In case of a jump to the err label due to atmel_nand_create() or
+atmel_nand_controller_add_nand() failure, the reference to nand_np
+need to be released
+
+Use for_each_child_of_node_scoped() to fix the issue.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index 5b02119d8ba23..543a0be9dc645 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
+
+ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+ {
+- struct device_node *np, *nand_np;
++ struct device_node *np;
+ struct device *dev = nc->dev;
+ int ret, reg_cells;
+ u32 val;
+@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ reg_cells += val;
+
+- for_each_child_of_node(np, nand_np) {
++ for_each_child_of_node_scoped(np, nand_np) {
+ struct atmel_nand *nand;
+
+ nand = atmel_nand_create(nc, nand_np, reg_cells);
+--
+2.51.0
+
--- /dev/null
+From fe7a71406a6d220629b489ed324e65392c779ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:22:43 +0000
+Subject: nbd: restrict sockets to TCP and UDP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
+
+Recently, syzbot started to abuse NBD with all kinds of sockets.
+
+Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
+made sure the socket supported a shutdown() method.
+
+Explicitely accept TCP and UNIX stream sockets.
+
+Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
+Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Richard W.M. Jones <rjones@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Yu Kuai <yukuai1@huaweicloud.com>
+Cc: linux-block@vger.kernel.org
+Cc: nbd@other.debian.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index c705acc4d6f4b..de692eed98740 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1156,6 +1156,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (!sock)
+ return NULL;
+
++ if (!sk_is_tcp(sock->sk) &&
++ !sk_is_stream_unix(sock->sk)) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
++ *err = -EINVAL;
++ sockfd_put(sock);
++ return NULL;
++ }
++
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From fb1560ac0f018e2e31e2e9004c02ae393411adb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 2c1b551e14423..92856cf387c76 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From 391556b67d9bcbdbc779956c3d8da5d169b5eb73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 60fb35ec4b15a..0b2e257b591f0 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From 384b815e1e96e4ac5d508b7b5833257950e17c51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:09 +0300
+Subject: net/mlx5: fw reset, add reset timeout work
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
+
+Add sync reset timeout to stop poll_sync_reset in case there was no
+reset done or abort event within timeout. Otherwise poll sync reset will
+just continue and in case of fw fatal error no health reporting will be
+done.
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 516df7f1997eb..35d2fe08c0fb5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
+ struct work_struct reset_reload_work;
+ struct work_struct reset_now_work;
+ struct work_struct reset_abort_work;
++ struct delayed_work reset_timeout_work;
+ unsigned long reset_flags;
+ u8 reset_method;
+ struct timer_list timer;
+@@ -258,6 +259,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
+ return -EALREADY;
+ }
+
++ if (current_work() != &fw_reset->reset_timeout_work.work)
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ mlx5_stop_sync_reset_poll(dev);
+ if (poll_health)
+ mlx5_start_health_poll(dev);
+@@ -328,6 +331,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+ }
+ mlx5_stop_health_poll(dev, true);
+ mlx5_start_sync_reset_poll(dev);
++
++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
++ &fw_reset->reset_flags))
++ schedule_delayed_work(&fw_reset->reset_timeout_work,
++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
+ return 0;
+ }
+
+@@ -728,6 +736,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
+ }
+ }
+
++static void mlx5_sync_reset_timeout_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_fw_reset *fw_reset =
++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
++ struct mlx5_core_dev *dev = fw_reset->dev;
++
++ if (mlx5_sync_reset_clear_reset_requested(dev, true))
++ return;
++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
++}
++
+ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+@@ -811,6 +832,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
+ cancel_work_sync(&fw_reset->reset_reload_work);
+ cancel_work_sync(&fw_reset->reset_now_work);
+ cancel_work_sync(&fw_reset->reset_abort_work);
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ }
+
+ static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
+@@ -854,6 +876,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
+ INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
+ INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
++ mlx5_sync_reset_timeout_work);
+
+ init_completion(&fw_reset->done);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 1aca7f06a3d668ea874b0869c8c78846dee2d3a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:08 +0300
+Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
+ teardown
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
+
+The reclaim_pages_cmd() function sends a command to the firmware to
+reclaim pages if the command interface is active.
+
+A race condition can occur if the command interface goes down (e.g., due
+to a PCI error) while the mlx5_cmd_do() call is in flight. In this
+case, mlx5_cmd_do() will return an error. The original code would
+propagate this error immediately, bypassing the software-based page
+reclamation logic that is supposed to run when the command interface is
+down.
+
+Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
+that command interface is down. If this is the case, fall through to
+the software reclamation path. If the command failed for any another
+reason, or finished successfully, return as before.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 9bc9bd83c2324..cd68c4b2c0bf9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
++ int err;
+
+- if (!mlx5_cmd_is_down(dev))
+- return mlx5_cmd_do(dev, in, in_size, out, out_size);
++ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
++ if (err != -ENXIO)
++ return err;
+
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+--
+2.51.0
+
--- /dev/null
+From 62210f219ddbe35d04a7abc2b175720de6f1a033 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:07 +0300
+Subject: net/mlx5: Stop polling for command response if interface goes down
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
+
+Stop polling on firmware response to command in polling mode if the
+command interface got down. This situation can occur, for example, if a
+firmware fatal error is detected during polling.
+
+This change halts the polling process when the command interface goes
+down, preventing unnecessary waits.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 5bb4940da59d4..b51c006277598 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+ return;
+ }
+ cond_resched();
++ if (mlx5_cmd_is_down(dev)) {
++ ent->ret = -ENXIO;
++ return;
++ }
+ } while (time_before(jiffies, poll_end));
+
+ ent->ret = -ETIMEDOUT;
+@@ -1066,7 +1070,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ae069485c3b2b5882ba390b828cd0ede0a642eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index ddff6f19ff98e..92add3daadbb1 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 7b724ae389cee66b045f390afd6e2487fadaa541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 5251524b96afa..5e4453e9ef8e7 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -63,7 +63,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From b03db210155879ff1c4b2e6a9cb808da8f61f625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:40:43 +0200
+Subject: netfilter: nfnetlink: reset nlh pointer during batch replay
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ]
+
+During a batch replay, the nlh pointer is not reset until the parsing of
+the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle
+ACK flags for batch messages") that is problematic as the condition to
+add an ACK for batch begin will evaluate to true even if NLM_F_ACK
+wasn't used for batch begin message.
+
+If there is an error during the command processing, netlink is sending
+an ACK despite that. This misleads userspace tools which think that the
+return code was 0. Reset the nlh pointer to the original one when a
+replay is triggered.
+
+Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nfnetlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 7784ec094097b..f12d0d229aaa5 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ const struct nfnetlink_subsystem *ss;
+ const struct nfnl_callback *nc;
+ struct netlink_ext_ack extack;
++ struct nlmsghdr *onlh = nlh;
+ LIST_HEAD(err_list);
+ u32 status;
+ int err;
+@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ status = 0;
+ replay_abort:
+ skb = netlink_skb_clone(oskb, GFP_KERNEL);
++ nlh = onlh;
+ if (!skb)
+ return netlink_ack(oskb, nlh, -ENOMEM, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From 16600aa1c3b118c58c48bcecb22d26fb59b39e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index fbca8d0efd858..37a46596268a0 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From f86d95dc1cbb2932accbcd5e6fb4748fcd99879d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index ea92483d5e71e..c21e63027fc0e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9393,7 +9393,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 45ca99b725d73a3a18b1f5269073a4981783e67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:07:32 +0800
+Subject: null_blk: Fix the description of the cache_size module argument
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
+
+When executing modinfo null_blk, there is an error in the description
+of module parameter mbps, and the output information of cache_size is
+incomplete.The output of modinfo before and after applying this patch
+is as follows:
+
+Before:
+[...]
+parm: cache_size:ulong
+[...]
+parm: mbps:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (uint)
+[...]
+
+After:
+[...]
+parm: cache_size:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (ulong)
+[...]
+parm: mbps:Limit maximum bandwidth (in MiB/s).
+ Default: 0 (no limit) (uint)
+[...]
+
+Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index f10369ad90f76..ceb7aeca5d9bd 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
+
+ static unsigned long g_cache_size;
+ module_param_named(cache_size, g_cache_size, ulong, 0444);
+-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+
+ static bool g_fua = true;
+ module_param_named(fua, g_fua, bool, 0444);
+--
+2.51.0
+
--- /dev/null
+From d06a55625aa73e5f0f7d34fb8c48fff27b92c522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index ef8c5961e10c8..0ade23610ae64 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1412,7 +1412,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 03ac265131f828d93649eeca5a9797d586f9dcb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 77edcd70f72c2..c5236b3ed168f 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 7e7a425d46b4a4ce22d7bf9a2d2fe6dadafc2615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 19:29:10 +0800
+Subject: once: fix race by moving DO_ONCE to separate section
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
+
+The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
+DO_ONCE's ___done variable to .data.once section, which conflicts with
+DO_ONCE_LITE() that also uses the same section.
+
+This creates a race condition when clear_warn_once is used:
+
+Thread 1 (DO_ONCE) Thread 2 (DO_ONCE)
+__do_once_start
+ read ___done (false)
+ acquire once_lock
+execute func
+__do_once_done
+ write ___done (true) __do_once_start
+ release once_lock // Thread 3 clear_warn_once reset ___done
+ read ___done (false)
+ acquire once_lock
+ execute func
+schedule once_work __do_once_done
+once_deferred: OK write ___done (true)
+static_branch_disable release once_lock
+ schedule once_work
+ once_deferred:
+ BUG_ON(!static_key_enabled)
+
+DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
+macros. Keep its ___done flag in the .data..once section and allow resetting
+by clear_warn_once, as originally intended.
+
+In contrast, DO_ONCE() is used for functions like get_random_once() and
+relies on its ___done flag for internal synchronization. We should not reset
+DO_ONCE() by clear_warn_once.
+
+Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
+shielding it from clear_warn_once.
+
+Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 1 +
+ include/linux/once.h | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 23b358a1271cd..3c75199947f09 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -354,6 +354,7 @@
+ __start_once = .; \
+ *(.data..once) \
+ __end_once = .; \
++ *(.data..do_once) \
+ STRUCT_ALIGN(); \
+ *(__tracepoints) \
+ /* implement dynamic printk debug */ \
+diff --git a/include/linux/once.h b/include/linux/once.h
+index 30346fcdc7995..449a0e34ad5ad 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ unsigned long ___flags; \
+@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE_SLEEPABLE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ ___ret = __do_once_sleepable_start(&___done); \
+--
+2.51.0
+
--- /dev/null
+From f3c965c6d918e9efe054cf7e9be2eb59fcfd301b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 14:46:42 -0700
+Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]
+
+pci_acpi_preserve_config() leaks memory by returning early without freeing
+the ACPI object on success. Fix that by always freeing the obj, which is
+not needed by the caller.
+
+Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-acpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 99c58ee09fbb0..0cd8a75e22580 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
+
+ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ {
++ bool ret = false;
++
+ if (ACPI_HANDLE(&host_bridge->dev)) {
+ union acpi_object *obj;
+
+@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ 1, DSM_PCI_PRESERVE_BOOT_CONFIG,
+ NULL, ACPI_TYPE_INTEGER);
+ if (obj && obj->integer.value == 0)
+- return true;
++ ret = true;
+ ACPI_FREE(obj);
+ }
+
+- return false;
++ return ret;
+ }
+
+ /* _HPX PCI Setting Record (Type 0); same as _HPP */
+--
+2.51.0
+
--- /dev/null
+From 780e2f629f5a3073c5550f83d9d33b8ac911f2a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 14:14:34 -0700
+Subject: PCI: j721e: Fix incorrect error message in probe()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]
+
+The probe() function prints "pm_runtime_get_sync failed" when
+j721e_pcie_ctrl_init() returns an error. This is misleading since
+the failure is not from pm_runtime, but from the controller init
+routine. Update the error message to correctly reflect the source.
+
+No functional changes.
+
+Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index bae829ac759e1..eb772c18d44ed 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -531,7 +531,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+
+ ret = j721e_pcie_ctrl_init(pcie);
+ if (ret < 0) {
+- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
+ goto err_get_sync;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a42a99d6d769a22ffa53a21f4af809cda9d34571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:45:58 +0200
+Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
+Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
+domain, after reset has been asserted by writing a matching reset bit into
+register SRCR, it is mandatory to wait 1ms.
+
+Because it is the controller driver which can determine whether or not the
+controller is in HSC domain based on its compatible string, add the missing
+delay in the controller driver.
+
+This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
+whether S4 is affected as well. This patch does apply the extra delay on
+R-Car S4 as well.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+[mani: added the missing r-b tag from Krzysztof]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 5d77a01648606..5382008e366ec 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ return ret;
+ }
+
+- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
+ reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ /*
++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
++ * indicates that for peripherals in HSC domain, after
++ * reset has been asserted by writing a matching reset bit
++ * into register SRCR, it is mandatory to wait 1ms.
++ */
++ fsleep(1000);
++ }
+
+ val = readl(rcar->base + PCIEMSR0);
+ if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
+--
+2.51.0
+
--- /dev/null
+From 7322e6e08e489a2e0bd936b23472696aa33968af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 02:55:45 +0200
+Subject: PCI: rcar-gen4: Assure reset occurs before DBI access
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]
+
+Assure the reset is latched and the core is ready for DBI access. On R-Car
+V4H, the PCIe reset is asynchronous and does not take effect immediately,
+but needs a short time to complete. In case DBI access happens in that
+short time, that access generates an SError. Make sure that condition can
+never happen, read back the state of the reset, which should turn the
+asynchronous reset into a synchronous one, and wait a little over 1ms to
+add additional safety margin.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 5382008e366ec..30d16f85f6465 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ if (ret)
+ goto err_unprepare;
+
++ /*
++ * Assure the reset is latched and the core is ready for DBI access.
++ * On R-Car V4H, the PCIe reset is asynchronous and does not take
++ * effect immediately, but needs a short time to complete. In case
++ * DBI access happens in that short time, that access generates an
++ * SError. To make sure that condition can never happen, read back the
++ * state of the reset, which should turn the asynchronous reset into
++ * synchronous one, and wait a little over 1ms to add additional
++ * safety margin.
++ */
++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ fsleep(1000);
++
+ if (rcar->drvdata->additional_common_init)
+ rcar->drvdata->additional_common_init(rcar);
+
+--
+2.51.0
+
--- /dev/null
+From befacbcc4e840716533156b11c60f5fc7dcdb18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 01:58:40 +0200
+Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
+Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
+figure indicates that register 0xf8 should be polled until bit 18 becomes
+set to 1.
+
+Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
+set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
+break condition is inverted and returns when register 0xf8, bit 18 is set
+to 0, which in most cases means immediately. In case
+CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
+readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
+afterward never read register 0xf8, bit 18 as 0, which leads to timeout
+and failure to start the PCIe controller.
+
+Fix this by inverting the poll condition to match the reference manual
+initialization sequence.
+
+Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 30d16f85f6465..14f69efa243c3 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
+ val &= ~APP_HOLD_PHY_RST;
+ writel(val, rcar->base + PCIERSTCTRL1);
+
+- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
+ if (ret < 0)
+ return ret;
+
+--
+2.51.0
+
--- /dev/null
+From 3d4fa57a3c41ab1312e39c7907870921340e59f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index d7517c3976e7f..4f70b7f2ded9c 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From fabf625486eff836c5b054bd6fd7b7ac22b45756 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 11:30:22 +0200
+Subject: PCI: tegra194: Fix duplicate PLL disable in
+ pex_ep_event_pex_rst_assert()
+
+From: Nagarjuna Kristam <nkristam@nvidia.com>
+
+[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
+
+During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
+called twice.
+
+pex_ep_event_pex_rst_assert() should do the opposite of
+pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
+tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
+tegra_pcie_bpmp_set_pll_state() call should instead be a call to
+tegra_pcie_bpmp_set_ctrl_state().
+
+With this, the uninitialization sequence also matches that of
+tegra_pcie_unconfig_controller().
+
+Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
+Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
+[cassel: improve commit log]
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index ced3b7e7bdade..815599ef72db8 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1721,9 +1721,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
+ ret);
+ }
+
+- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
+ if (ret)
+- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
+
+ pcie->ep_state = EP_STATE_DISABLED;
+ dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
+--
+2.51.0
+
--- /dev/null
+From 8a60113fecc9d29b1d456dec0eed46d01a09ffdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 3569050f9cf37..abd23430dc033 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -96,7 +96,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From b6340a4638fa75f3a4e501ea83a4de6214894f79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 07:23:22 +0000
+Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
+
+The boot firmware may disable the U3 port early during boot and leave it
+up to the controller or PHY driver to re-enable U3 when needed.
+
+The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
+something the Rockchip Naneng Combo PHY driver never does for RK3568.
+This may result in USB 3.0 ports being limited to only using USB 2.0 or
+in special cases not working at all on RK3568.
+
+Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
+when a PHY with PHY_TYPE_USB3 mode is used.
+
+Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+index 1ef6d9630f7e0..fbaeb7ca600d1 100644
+--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg {
+ struct combphy_reg pipe_xpcs_phy_ready;
+ struct combphy_reg pipe_pcie1l0_sel;
+ struct combphy_reg pipe_pcie1l1_sel;
++ struct combphy_reg u3otg0_port_en;
++ struct combphy_reg u3otg1_port_en;
+ };
+
+ struct rockchip_combphy_cfg {
+@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
++ switch (priv->id) {
++ case 0:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
++ break;
++ case 1:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
++ break;
++ }
+ break;
+
+ case PHY_TYPE_SATA:
+@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
+ /* pipe-grf */
+ .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 },
+ .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 },
++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 },
++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 },
+ };
+
+ static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
+--
+2.51.0
+
--- /dev/null
+From f3b9a4890ee3c009cce443d2e1362dac9642eb87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 9171de657f978..a75762e4d2641 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From caf1c74d6309e73092e0bcf81021855185885ef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 17:08:13 +0100
+Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in
+ rzg3s_oen_read()
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]
+
+rzg3s_oen_read() returns a u32 value, but previously propagated a negative
+error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
+positive value due to unsigned conversion. This caused incorrect
+output-enable reporting for certain pins.
+
+Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
+as "output enabled" in the pinconf-pins debugfs file. With this fix, only
+P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
+hardware manual.
+
+Fix this by returning 0 when the OEN bit lookup fails, treating the pin
+as output-disabled by default.
+
+Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index bde58f5a743cb..698ab8cc970a6 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1074,7 +1074,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
+
+ bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
+ if (bit < 0)
+- return bit;
++ return 0;
+
+ return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
+ }
+--
+2.51.0
+
--- /dev/null
+From f077c9d8b0a06c9623b0b1753207e4a58cdc8207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index 29d16c9c1bd19..3a742f74ecd1d 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From 0b588ff056b6e161f96828e64db03ac8d8da1658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:58:23 +0300
+Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
+ probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
+
+The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
+would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
+that the pointer is valid.
+
+Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
+index 7ad5225b0381d..6e608d92f7e66 100644
+--- a/drivers/devfreq/mtk-cci-devfreq.c
++++ b/drivers/devfreq/mtk-cci-devfreq.c
+@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
+ out_free_resources:
+ if (regulator_is_enabled(drv->proc_reg))
+ regulator_disable(drv->proc_reg);
+- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
++ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
++ regulator_is_enabled(drv->sram_reg))
+ regulator_disable(drv->sram_reg);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 5b660d58f495f70b3d0ee872160add49126e896e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 15:38:08 +0200
+Subject: PM / devfreq: rockchip-dfi: double count on RK3588
+
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+
+[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]
+
+On RK3588 with LPDDR4X memory, the cycle count as returned by
+
+ perf stat -a -e rockchip_ddr/cycles/ sleep 1
+
+consistently reads half as much as what the actual DDR frequency is at.
+For a LPDDR4X module running at 2112MHz, I get more like 1056059916
+cycles per second, which is almost bang-on half what it should be. No,
+I'm not mixing up megatransfers and megahertz.
+
+Consulting the downstream driver, this appears to be because the RK3588
+hardware specifically (and RK3528 as well, for future reference) needs a
+multiplier of 2 to get to the correct frequency with everything but
+LPDDR5.
+
+The RK3588's actual memory bandwidth measurements in MB/s are correct
+however, as confirmed with stress-ng --stream. This makes me think the
+access counters are not affected in the same way. This tracks with the
+vendor kernel not multiplying the access counts either.
+
+Solve this by adding a new member to the dfi struct, which each SoC can
+set to whatever they want, but defaults to 1 if left unset by the SoC
+init functions. The event_get_count op can then use this multiplier if
+the cycle count is requested.
+
+The cycle multiplier is not used in rockchip_dfi_get_event because the
+vendor driver doesn't use it there either, and we don't do other actual
+bandwidth unit conversion stuff in there anyway.
+
+Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
+index e2a1e4463b6f5..712df781436ce 100644
+--- a/drivers/devfreq/event/rockchip-dfi.c
++++ b/drivers/devfreq/event/rockchip-dfi.c
+@@ -116,6 +116,7 @@ struct rockchip_dfi {
+ int buswidth[DMC_MAX_CHANNELS];
+ int ddrmon_stride;
+ bool ddrmon_ctrl_single;
++ unsigned int count_multiplier; /* number of data clocks per count */
+ };
+
+ static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
+@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
+
+ switch (event->attr.config) {
+ case PERF_EVENT_CYCLES:
+- count = total.c[0].clock_cycles;
++ count = total.c[0].clock_cycles * dfi->count_multiplier;
+ break;
+ case PERF_EVENT_READ_BYTES:
+ for (i = 0; i < dfi->max_channels; i++)
+@@ -656,6 +657,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
+ break;
+ }
+
++ if (!dfi->count_multiplier)
++ dfi->count_multiplier = 1;
++
+ ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
+ if (ret)
+ return ret;
+@@ -752,6 +756,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
+ dfi->max_channels = 4;
+
+ dfi->ddrmon_stride = 0x4000;
++ dfi->count_multiplier = 2;
+
+ return 0;
+ };
+--
+2.51.0
+
--- /dev/null
+From e6682851845ed16047956e5a03a4d5a89b09ae71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index faf4cdec23f04..abb16a5bb7967 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -628,8 +628,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From abbd864b84f796e250d7b32d8c75fd0a926216bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 20:32:59 +0800
+Subject: power: supply: cw2015: Fix a alignment coding style issue
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
+
+Fix the checkpatch warning:
+CHECK: Alignment should match open parenthesis
+
+Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index f63c3c4104515..382dff8805c62 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
+ if (!cw_bat->battery_workqueue)
+ return -ENOMEM;
+
+- devm_delayed_work_autocancel(&client->dev,
+- &cw_bat->battery_delay_work, cw_bat_work);
++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ queue_delayed_work(cw_bat->battery_workqueue,
+ &cw_bat->battery_delay_work, msecs_to_jiffies(10));
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 277d9bd0543597178c84a983c1fb78bd5c15212c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 08:30:18 +0200
+Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]
+
+Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
+PGDIRs and preallocate execmem page tables") was supposed to extend
+to powerpc 603 the copy of kernel PGD entries into all PGDIRs
+implemented in a previous patch on the 8xx. But 603 is book3s/32 and
+uses a duplicate of pgd_alloc() defined in another header.
+
+So really do the copy at the correct place for the 603.
+
+Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
+ arch/powerpc/include/asm/nohash/pgalloc.h | 2 +-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+index dd4eb30631758..f4390704d5ba2 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+@@ -7,8 +7,14 @@
+
+ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+- pgtable_gfp_flags(mm, GFP_KERNEL));
++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
++ pgtable_gfp_flags(mm, GFP_KERNEL));
++
++#ifdef CONFIG_PPC_BOOK3S_603
++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
++#endif
++ return pgd;
+ }
+
+ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
+index bb5f3e8ea912d..4ef780b291bc3 100644
+--- a/arch/powerpc/include/asm/nohash/pgalloc.h
++++ b/arch/powerpc/include/asm/nohash/pgalloc.h
+@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
+
+-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
++#ifdef CONFIG_PPC_8xx
+ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
+ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+ #endif
+--
+2.51.0
+
--- /dev/null
+From baada0017c55b94cb18393ba2fb18c1416d10b32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 18:33:26 +0200
+Subject: powerpc/8xx: Remove left-over instruction and comments in
+ DataStoreTLBMiss handler
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]
+
+Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
+DTLB misses") removed the test that needed the valeur in SPRN_EPN but
+failed to remove the read.
+
+Remove it.
+
+And remove related comments, including the very same comment
+in InstructionTLBMiss that should have been removed by
+commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
+ITLB misses").
+
+Also update the comment about absence of a second level table which
+has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
+remove tests on PGDIR entry validity").
+
+Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 56c5ebe21b99a..613606400ee99 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -162,7 +162,7 @@ instruction_counter:
+ * For the MPC8xx, this is a software tablewalk to load the instruction
+ * TLB. The task switch loads the M_TWB register with the pointer to the first
+ * level table.
+- * If we discover there is no second level table (value is zero) or if there
++ * If there is no second level table (value is zero) or if there
+ * is an invalid pte, we load that into the TLB, which causes another fault
+ * into the TLB Error interrupt where we can handle such problems.
+ * We have to use the MD_xxx registers for the tablewalk because the
+@@ -183,9 +183,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+ mfspr r10, SPRN_SRR0 /* Get effective address of fault */
+ INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
+ mtspr SPRN_MD_EPN, r10
+@@ -228,10 +225,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+- mfspr r10, SPRN_MD_EPN
+ mfspr r10, SPRN_M_TWB /* Get level 1 table */
+ lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */
+
+--
+2.51.0
+
--- /dev/null
+From 71518fcc5def8ff9581f59034d6860eced4de10e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index 9463232af8d2e..c6b8b64782761 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From 55910d674a756cddc8e108aefc24a93cf8d3dd7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:29:08 +0530
+Subject: ptp: Add a upper bound on max_vclocks
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]
+
+syzbot reported WARNING in max_vclocks_store.
+
+This occurs when the argument max is too large for kcalloc to handle.
+
+Extend the guard to guard against values that are too large for
+kcalloc
+
+Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
+Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_private.h | 1 +
+ drivers/ptp/ptp_sysfs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
+index b352df4cd3f97..f329263f33aa1 100644
+--- a/drivers/ptp/ptp_private.h
++++ b/drivers/ptp/ptp_private.h
+@@ -22,6 +22,7 @@
+ #define PTP_MAX_TIMESTAMPS 128
+ #define PTP_BUF_TIMESTAMPS 30
+ #define PTP_DEFAULT_MAX_VCLOCKS 20
++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
+ #define PTP_MAX_CHANNELS 2048
+
+ enum {
+diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
+index 6b1b8f57cd951..200eaf5006968 100644
+--- a/drivers/ptp/ptp_sysfs.c
++++ b/drivers/ptp/ptp_sysfs.c
+@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
+ size_t size;
+ u32 max;
+
+- if (kstrtou32(buf, 0, &max) || max == 0)
++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
+ return -EINVAL;
+
+ if (max == ptp->max_vclocks)
+--
+2.51.0
+
--- /dev/null
+From 3fe394b7e2cc49ce0b4dd83f8285357fb4f20dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:00:59 +0200
+Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]
+
+The pwm driver calls pm_runtime_get_sync() when the hardware becomes
+enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
+state is kept when a consumer goes away, so the call to
+pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
+a non-functional device and a reference underlow for the second consumer.
+
+The easiest fix for that issue is to just not drop the runtime PM
+reference in .free(), so do that.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 0125e73b98dfb..5e674a7bbf3be 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- if (pwm_is_enabled(pwm)) {
+- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
+- pm_runtime_put_sync(pwmchip_parent(chip));
+- }
+-
+ /* set period value to zero on free */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2d5be7f51f58e459525d0da8d5c82789592d060f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a23e48b8523db..7a86cb090f76f 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(pwmchip_parent(chip), "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From a4e3b013ec3ff2b3018dd7b2165c34a5af96a9d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:01 +0200
+Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
+ calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]
+
+In Up-Count Mode the timer is reset to zero one tick after it reaches
+TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
+the documentation and measurements. So the value written to the TBPRD has
+to be one less than the calculated period_cycles value.
+
+A complication here is that for a 100% relative duty-cycle the value
+written to the CMPx register has to be TBPRD + 1 which might overflow if
+TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
+has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
+be skipped.
+
+Additionally the AQCTL_PRD register field has to be 0 because that defines
+the hardware's action when the maximal counter value is reached, which is
+(as above) one clock tick before the period's end. The period start edge
+has to happen when the counter is reset and so is defined in the AQCTL_ZRO
+field.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
+ 1 file changed, 58 insertions(+), 85 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a94b1e387b924..a23e48b8523db 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -36,7 +36,7 @@
+
+ #define CLKDIV_MAX 7
+ #define HSPCLKDIV_MAX 7
+-#define PERIOD_MAX 0xFFFF
++#define PERIOD_MAX 0x10000
+
+ /* compare module registers */
+ #define CMPA 0x12
+@@ -65,14 +65,10 @@
+ #define AQCTL_ZRO_FRCHIGH BIT(1)
+ #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0))
+
+-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
+-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
+
+ #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6))
+ #define AQSFRC_RLDCSF_ZRO 0
+@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
+ unsigned long clk_rate;
+ void __iomem *mmio_base;
+ unsigned long period_cycles[NUM_PWM_CHANNEL];
+- enum pwm_polarity polarity[NUM_PWM_CHANNEL];
+ struct clk *tbclk;
+ struct ehrpwm_context ctx;
+ };
+@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+ return 1;
+ }
+
+-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
+-{
+- u16 aqctl_val, aqctl_mask;
+- unsigned int aqctl_reg;
+-
+- /*
+- * Configure PWM output to HIGH/LOW level on counter
+- * reaches compare register value and LOW/HIGH level
+- * on counter value reaches period register value and
+- * zero value on counter
+- */
+- if (chan == 1) {
+- aqctl_reg = AQCTLB;
+- aqctl_mask = AQCTL_CBU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANB_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANB_POLNORMAL;
+- } else {
+- aqctl_reg = AQCTLA;
+- aqctl_mask = AQCTL_CAU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANA_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANA_POLNORMAL;
+- }
+-
+- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
+- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
+-}
+-
+ /*
+ * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
+ * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
+ */
+ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+- u64 duty_ns, u64 period_ns)
++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+ u32 period_cycles, duty_cycles;
+ u16 ps_divval, tb_divval;
+ unsigned int i, cmp_reg;
+ unsigned long long c;
++ u16 aqctl_val, aqctl_mask;
++ unsigned int aqctl_reg;
+
+ if (period_ns > NSEC_PER_SEC)
+ return -ERANGE;
+@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ do_div(c, NSEC_PER_SEC);
+ period_cycles = (unsigned long)c;
+
+- if (period_cycles < 1) {
+- period_cycles = 1;
+- duty_cycles = 1;
+- } else {
+- c = pc->clk_rate;
+- c = c * duty_ns;
+- do_div(c, NSEC_PER_SEC);
+- duty_cycles = (unsigned long)c;
+- }
++ c = pc->clk_rate;
++ c = c * duty_ns;
++ do_div(c, NSEC_PER_SEC);
++ duty_cycles = (unsigned long)c;
+
+ /*
+ * Period values should be same for multiple PWM channels as IP uses
+@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ return -EINVAL;
+ }
+
+- pm_runtime_get_sync(pwmchip_parent(chip));
+-
+- /* Update clock prescaler values */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+-
+ /* Update period & duty cycle with presacler division */
+ period_cycles = period_cycles / ps_divval;
+ duty_cycles = duty_cycles / ps_divval;
+
+- /* Configure shadow loading on Period register */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++ if (period_cycles < 1)
++ period_cycles = 1;
+
+- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
++ pm_runtime_get_sync(pwmchip_parent(chip));
+
+- /* Configure ehrpwm counter for up-count mode */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
+- TBCTL_CTRMODE_UP);
++ /* Update clock prescaler values */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+
+- if (pwm->hwpwm == 1)
++ if (pwm->hwpwm == 1) {
+ /* Channel 1 configured with compare B register */
+ cmp_reg = CMPB;
+- else
++
++ aqctl_reg = AQCTLB;
++ aqctl_mask = AQCTL_CBU_MASK;
++
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANB_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANB_POLNORMAL;
++
++ /* if duty_cycle is big, don't toggle on CBU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CBU_MASK;
++
++ } else {
+ /* Channel 0 configured with compare A register */
+ cmp_reg = CMPA;
+
+- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
++ aqctl_reg = AQCTLA;
++ aqctl_mask = AQCTL_CAU_MASK;
+
+- pm_runtime_put_sync(pwmchip_parent(chip));
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANA_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANA_POLNORMAL;
+
+- return 0;
+-}
++ /* if duty_cycle is big, don't toggle on CAU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CAU_MASK;
++ }
+
+-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
+- struct pwm_device *pwm,
+- enum pwm_polarity polarity)
+-{
+- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
++
++ /* Configure shadow loading on Period register */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++
++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
++
++ /* Configure ehrpwm counter for up-count mode */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
++ TBCTL_CTRMODE_UP);
++
++ if (!(duty_cycles > period_cycles))
++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
+
+- /* Configuration of polarity in hardware delayed, do at enable */
+- pc->polarity[pwm->hwpwm] = polarity;
++ pm_runtime_put_sync(pwmchip_parent(chip));
+
+ return 0;
+ }
+@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+
+- /* Channels polarity can be configured from action qualifier module */
+- configure_polarity(pc, pwm->hwpwm);
+-
+ /* Enable TBCLK */
+ ret = clk_enable(pc->tbclk);
+ if (ret) {
+@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ ehrpwm_pwm_disable(chip, pwm);
+ enabled = false;
+ }
+-
+- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
+- if (err)
+- return err;
+ }
+
+ if (!state->enabled) {
+@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ return 0;
+ }
+
+- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
+ if (err)
+ return err;
+
+--
+2.51.0
+
--- /dev/null
+From bbc3cd61e4cdd59687ebb9bf9f8bac9037e104f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:00 +0200
+Subject: pwm: tiehrpwm: Make code comment in .free() more useful
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]
+
+Instead of explaining trivia to everyone who can read C describe the
+higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.
+
+Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 5e674a7bbf3be..a94b1e387b924 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- /* set period value to zero on free */
++ /* Don't let a pwm without consumer block requests to the other channel */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5fc6bbc184eb8cf7b1cfc5418bba780be3f4830e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index d45e3909dafe1..50bb3c43f40bf 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From eda3de897b24a2840002f2cc4d00549424452b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index be0743dac3fff..929e89841c12a 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f4e857fa0de006331a50a40340491f125f449df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:39:56 +0300
+Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Or Har-Toov <ohartoov@nvidia.com>
+
+[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]
+
+The mlx5 driver currently derives max_qp_wr directly from the
+log_max_qp_sz HCA capability:
+
+ props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+
+However, this value represents the number of WQEs in units of Basic
+Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size
+of a WQE can vary depending on transport type and features (e.g., atomic
+operations, UMR, LSO), the actual number of WQEs can be significantly
+smaller than the WQEBB count suggests.
+
+This patch introduces a conservative estimation of the worst-case WQE size
+— considering largest segments possible with 1 SGE and no inline data or
+special features. It uses this to derive a more accurate max_qp_wr value.
+
+Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
+Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org
+Reported-by: Chuck Lever <cel@kernel.org>
+Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/
+Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 435c456a4fd5b..29d0bc583169b 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -13,6 +13,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ #include <linux/bitmap.h>
++#include <linux/log2.h>
+ #include <linux/sched.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/task.h>
+@@ -865,6 +866,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
+ resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
+ }
+
++/*
++ * Calculate maximum SQ overhead across all QP types.
++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
++ * have smaller overhead than the types calculated below,
++ * so they are implicitly included.
++ */
++static u32 mlx5_ib_calc_max_sq_overhead(void)
++{
++ u32 max_overhead_xrc, overhead_ud_lso, a, b;
++
++ /* XRC_INI */
++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
++ a = sizeof(struct mlx5_wqe_atomic_seg) +
++ sizeof(struct mlx5_wqe_raddr_seg);
++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
++ sizeof(struct mlx5_mkey_seg) +
++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
++ max_overhead_xrc += max(a, b);
++
++ /* UD with LSO */
++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
++
++ return max(max_overhead_xrc, overhead_ud_lso);
++}
++
++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
++{
++ struct mlx5_core_dev *mdev = dev->mdev;
++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ u32 max_wqe_size;
++ /* max QP overhead + 1 SGE, no inline, no special features */
++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
++ sizeof(struct mlx5_wqe_data_seg);
++
++ max_wqe_size = roundup_pow_of_two(max_wqe_size);
++
++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
++
++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
++}
++
+ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ struct ib_device_attr *props,
+ struct ib_udata *uhw)
+@@ -1023,7 +1069,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ props->max_mr_size = ~0ull;
+ props->page_size_cap = ~(min_page_size - 1);
+ props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
+- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
+ max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
+ sizeof(struct mlx5_wqe_data_seg);
+ max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
+--
+2.51.0
+
--- /dev/null
+From 72cd2f492edbdba796acfe0567940a5ec28f7852 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:41:19 +0300
+Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
+
+Previously loopback for MPV was supposed to be permanently enabled,
+however other driver flows were able to over-ride that configuration and
+disable it.
+
+Add force_lb parameter that indicates that loopback should always be
+enabled which prevents all other driver flows from disabling it.
+
+Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
+Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++----
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 29d0bc583169b..f3e58797705d7 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1813,7 +1813,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
+ }
+
+ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ int err;
+
+@@ -1825,6 +1826,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ if (err)
+ goto out;
+
++ lb_state->force_enable = true;
+ return 0;
+
+ out:
+@@ -1833,16 +1835,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ }
+
+ static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ mlx5_nic_vport_update_local_lb(slave, false);
+ mlx5_nic_vport_update_local_lb(master, false);
++
++ lb_state->force_enable = false;
+ }
+
+ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
+ int err = 0;
+
++ if (dev->lb.force_enable)
++ return 0;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td++;
+@@ -1864,6 +1872,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+
+ void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
++ if (dev->lb.force_enable)
++ return;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td--;
+@@ -3521,7 +3532,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
+
+ lockdep_assert_held(&mlx5_ib_multiport_mutex);
+
+- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+
+ mlx5_core_mp_event_replay(ibdev->mdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
+@@ -3618,7 +3629,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_DONE,
+ &key);
+
+- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+ if (err)
+ goto unbind;
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 29bde64ea1eac..f49cb588a856d 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1083,6 +1083,7 @@ struct mlx5_ib_lb_state {
+ u32 user_td;
+ int qps;
+ bool enabled;
++ bool force_enable;
+ };
+
+ struct mlx5_ib_pf_eq {
+--
+2.51.0
+
--- /dev/null
+From ba1c61e85c4f22266ffdb92c30e2104a76e0cd14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 02:52:12 +0000
+Subject: RDMA/rxe: Fix race in do_task() when draining
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
+
+When do_task() exhausts its iteration budget (!ret), it sets the state
+to TASK_STATE_IDLE to reschedule, without a secondary check on the
+current task->state. This can overwrite the TASK_STATE_DRAINING state
+set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
+
+While state changes are protected by a spinlock, both rxe_cleanup_task()
+and rxe_disable_task() release the lock while waiting for the task to
+finish draining in the while(!is_done(task)) loop. The race occurs if
+do_task() hits its iteration limit and acquires the lock in this window.
+The cleanup logic may then proceed while the task incorrectly
+reschedules itself, leading to a potential use-after-free.
+
+This bug was introduced during the migration from tasklets to workqueues,
+where the special handling for the draining case was lost.
+
+Fix this by restoring the original pre-migration behavior. If the state is
+TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
+force a new loop iteration. This allows the task to finish its work, so
+that a subsequent iteration can reach the switch statement and correctly
+transition the state to TASK_STATE_DRAINED, stopping the task as intended.
+
+Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 80332638d9e3a..be6cd8ce4d97e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
+ * yield the cpu and reschedule the task
+ */
+ if (!ret) {
+- task->state = TASK_STATE_IDLE;
+- resched = 1;
++ if (task->state != TASK_STATE_DRAINING) {
++ task->state = TASK_STATE_IDLE;
++ resched = 1;
++ } else {
++ cont = 1;
++ }
+ goto exit;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4dfe9fa8a4c5abdf508d0e4f641e7be86a9b550c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 7ca0297d68a4a..d0c0cde09f118 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -773,7 +773,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -959,9 +959,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -986,15 +994,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 493272f0e756c6465547e97e44e499f0dba99e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index de4e2f3db942a..66b3840bd96e3 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -828,7 +828,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+ if (config->reg_update_bits)
+ map->reg_update_bits = config->reg_update_bits;
+--
+2.51.0
+
--- /dev/null
+From 730ca5c191e6780cb3cad75f15ec29902a414dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index 9df726f10ad12..6d609c42e4793 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 69e8a45fc6a14536a5dcd394941a13554b17429f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 4ee5e67a9f03f..769c6d6d6a731 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From 40e2d0b05ab95902b368442c31954df829461875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index 66d276a1be836..f4a19ffbb641c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index de2327ffb0f78..4a2f58a9d7066 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -47,7 +47,6 @@
+ #include "en.h"
+ #include "en/dim.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2918,11 +2917,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2932,18 +2929,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From abf2014fd63d0695a0d13607f4d0fdad389faf8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 1002fa51a25aa..f377725a12128 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1199,19 +1199,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command) {
+--
+2.51.0
+
--- /dev/null
+From 699b849dbe3684035a00a579ebf99e1759d90406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 01:24:48 +0000
+Subject: riscv, bpf: Sign extend struct ops return values properly
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]
+
+The ns_bpf_qdisc selftest triggers a kernel panic:
+
+ Unable to handle kernel paging request at virtual address ffffffffa38dbf58
+ Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
+ [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
+ Oops [#1]
+ Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
+ CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE
+ Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+ Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
+ epc : __qdisc_run+0x82/0x6f0
+ ra : __qdisc_run+0x6e/0x6f0
+ epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
+ gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
+ t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
+ s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
+ a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
+ a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
+ s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
+ s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
+ s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
+ s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
+ t5 : 0000000000000000 t6 : ff60000093a6a8b6
+ status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
+ [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
+ [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
+ [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
+ [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
+ [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
+ [<ffffffff80d31446>] ip6_output+0x5e/0x178
+ [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
+ [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
+ [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
+ [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
+ [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
+ [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
+ [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
+ [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
+ [<ffffffff80b42bee>] __sys_connect+0x96/0xc8
+ [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
+ [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
+ [<ffffffff80e69af2>] handle_exception+0x14a/0x156
+ Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
+ ---[ end trace 0000000000000000 ]---
+
+The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
+is treated as a 32bit value and sign extend to 64bit in epilogue. This
+behavior is right for most bpf prog types but wrong for struct ops which
+requires RISC-V ABI.
+
+So let's sign extend struct ops return values according to the function
+model and RISC-V ABI([0]).
+
+ [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
+
+Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Pu Lehui <pulehui@huawei.com>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 563425b4963c9..497945aa3e2c4 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -559,6 +559,39 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64,
+ }
+ }
+
++/*
++ * Sign-extend the register if necessary
++ */
++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
++{
++ if (!sign && (sz == 1 || sz == 2)) {
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ return 0;
++ }
++
++ switch (sz) {
++ case 1:
++ emit_sextb(rd, rs, ctx);
++ break;
++ case 2:
++ emit_sexth(rd, rs, ctx);
++ break;
++ case 4:
++ emit_sextw(rd, rs, ctx);
++ break;
++ case 8:
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ break;
++ default:
++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0)
+ #define BPF_FIXUP_REG_MASK GENMASK(31, 27)
+ #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */
+@@ -1020,8 +1053,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
+
+ if (save_ret) {
+- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
+ emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
++ if (is_struct_ops) {
++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
++ if (ret)
++ goto out;
++ } else {
++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
++ }
+ }
+
+ emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
+--
+2.51.0
+
--- /dev/null
+From 882dd701c2d8315a4578bc4c9e860b155f90a8e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:29 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
+
+The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
+as follows:
+
+ entry()
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+
+entry() copies its tail call counter to the subprog_tail()'s frame,
+which then increments it. However, the incremented result is discarded,
+leading to an astronomically large number of tail calls.
+
+Fix by writing the incremented counter back to the entry()'s frame.
+
+Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index ead8d9ba9032c..a88d53fe87743 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1775,13 +1775,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ jit->seen |= SEEN_FUNC;
+ /*
+ * Copy the tail call counter to where the callee expects it.
+- *
+- * Note 1: The callee can increment the tail call counter, but
+- * we do not load it back, since the x86 JIT does not do this
+- * either.
+- *
+- * Note 2: We assume that the verifier does not let us call the
+- * main program, which clears the tail call counter on entry.
+ */
+ /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
+ _EMIT6(0xd203f000 | STK_OFF_TCCNT,
+@@ -1807,6 +1800,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ call_r1(jit);
+ /* lgr %b0,%r2: load return value into %b0 */
+ EMIT4(0xb9040000, BPF_REG_0, REG_2);
++
++ /*
++ * Copy the potentially updated tail call counter back.
++ */
++
++ if (insn->src_reg == BPF_PSEUDO_CALL)
++ /*
++ * mvc frame_off+tail_call_cnt(%r15),
++ * tail_call_cnt(4,%r15)
++ */
++ _EMIT6(0xd203f000 | (jit->frame_off +
++ offsetof(struct prog_frame,
++ tail_call_cnt)),
++ 0xf000 | offsetof(struct prog_frame,
++ tail_call_cnt));
++
+ break;
+ }
+ case BPF_JMP | BPF_TAIL_CALL: {
+--
+2.51.0
+
--- /dev/null
+From d40209feea67fcabbea45b180dc3afdba8ba225b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:30 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
+
+The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
+graph is as follows:
+
+ entry()
+ subprog_tail()
+ trampoline()
+ fentry()
+ the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG
+ return to entry()
+
+The problem is that the rest of subprog_tail() increments the tail call
+counter, but the trampoline discards the incremented value. This
+results in an astronomically large number of tail calls.
+
+Fix by making the trampoline write the incremented tail call counter
+back.
+
+Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index a88d53fe87743..c15be6955cc7f 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -2808,6 +2808,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ /* stg %r2,retval_off(%r15) */
+ EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
+ tjit->retval_off);
++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
++ _EMIT6(0xd203f000 | tjit->tccnt_off,
++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt));
+
+ im->ip_after_call = jit->prg_buf + jit->prg;
+
+--
+2.51.0
+
--- /dev/null
+From 5424ec409e0b866c9440787877f17c68bed5c929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index d84413b77d849..421db8996927b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From 8740cdd296352faab3fa0e00855d6d1ba74cdd81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 1469d0c54e455..5a02fd3bc6c9e 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From 416fb1857e72ed8b4c76261713abdb5a11d3827e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index a9d6dac413346..4daab8b6d6752 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From 064c7c2d6b6b068a0232ba52bae5fa815e53dc2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index dcde55c8ee5de..be20e2c457b8e 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 0309c1683a97e979ad07857c64257e7dd10729ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:45 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ qla_nvme_xmt_ls_rsp()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
+
+Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
+align with qla2x00_start_sp() returning negative error codes or
+QLA_SUCCESS, preventing logical errors.
+
+Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 8ee2e337c9e1b..316594aa40cc5 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(PURLS_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < PURLS_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 3d8d516328aba3be0673ede2383d8bc402767e6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 79cdfec2bca35..8bd4aa935e22b 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 80d0039f388e835a092856b3bedf0c0047327a2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 18:31:18 +0200
+Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
+ fast
+
+From: Johannes Nixdorf <johannes@nixdorf.dev>
+
+[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
+
+Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
+event to the tracer, and starts to wait interruptibly. With
+SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
+message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
+and is subsequently interrupted, the tracee begins to wait again
+uninterruptibly (but killable).
+
+This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
+is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
+condition to begin waiting again. In this case the tracee is interrupted
+even though the tracer already acted on its behalf. This breaks the
+assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
+namely that the tracer can be sure the syscall is not interrupted or
+restarted on the tracee after it is received on the tracer. Fix this
+by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
+switch to uninterruptible waiting.
+
+With the condition changed the loop in seccomp_do_user_notification()
+would exit immediately after deciding that noninterruptible waiting
+is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
+skipping the code that processes pending addfd commands first. Prevent
+this by executing the remaining loop body one last time in this case.
+
+Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
+Reported-by: Ali Polatel <alip@chesswob.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
+Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
+Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 0cd1f8b5a102e..267b00005eaf2 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1124,7 +1124,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
+ static bool should_sleep_killable(struct seccomp_filter *match,
+ struct seccomp_knotif *n)
+ {
+- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
+ }
+
+ static int seccomp_do_user_notification(int this_syscall,
+@@ -1171,13 +1171,11 @@ static int seccomp_do_user_notification(int this_syscall,
+
+ if (err != 0) {
+ /*
+- * Check to see if the notifcation got picked up and
+- * whether we should switch to wait killable.
++ * Check to see whether we should switch to wait
++ * killable. Only return the interrupted error if not.
+ */
+- if (!wait_killable && should_sleep_killable(match, &n))
+- continue;
+-
+- goto interrupted;
++ if (!(!wait_killable && should_sleep_killable(match, &n)))
++ goto interrupted;
+ }
+
+ addfd = list_first_entry_or_null(&n.addfd,
+--
+2.51.0
+
--- /dev/null
+From 5dda8fe41090378fc9be57bc413c1935eb7f8f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From d3fb5db132f2c477077737ed00f76e5f673a5d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 22:12:22 +0200
+Subject: selftests/nolibc: fix EXPECT_NZ macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
+
+The expect non-zero macro was incorrect and never used. Fix its
+definition.
+
+Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
+index 6fba7025c5e3c..d73bff23c61e7 100644
+--- a/tools/testing/selftests/nolibc/nolibc-test.c
++++ b/tools/testing/selftests/nolibc/nolibc-test.c
+@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
+ }
+
+
+-#define EXPECT_NZ(cond, expr, val) \
+- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
++#define EXPECT_NZ(cond, expr) \
++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
+
+ static __attribute__((unused))
+ int expect_nz(int expr, int llen)
+--
+2.51.0
+
--- /dev/null
+From 87942a3c38219483b142cc85e39ae48f1bbce358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:02 +0200
+Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]
+
+The _rval register variable is meant to be an output operand of the asm
+statement but is instead used as input operand.
+clang 20.1 notices this and triggers -Wuninitialized warnings:
+
+tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
+ 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
+ 59 | : "r" (_rval) \
+ | ^~~~~
+tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
+tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
+ 47 | register long _rval asm ("r3"); \
+ | ^
+
+It seems the list of input and output operands have been switched around.
+However as the argument registers are not always initialized they can not
+be marked as pure inputs as that would trigger -Wuninitialized warnings.
+Adding _rval as another input and output operand does also not work as it
+would collide with the existing _r3 variable.
+
+Instead reuse _r3 for both the argument and the return value.
+
+Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de
+Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
+index bb237d771051b..e7205584cbdca 100644
+--- a/tools/testing/selftests/vDSO/vdso_call.h
++++ b/tools/testing/selftests/vDSO/vdso_call.h
+@@ -44,7 +44,6 @@
+ register long _r6 asm ("r6"); \
+ register long _r7 asm ("r7"); \
+ register long _r8 asm ("r8"); \
+- register long _rval asm ("r3"); \
+ \
+ LOADARGS_##nr(fn, args); \
+ \
+@@ -54,13 +53,13 @@
+ " bns+ 1f\n" \
+ " neg 3, 3\n" \
+ "1:" \
+- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \
++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \
+ "+r" (_r6), "+r" (_r7), "+r" (_r8) \
+- : "r" (_rval) \
++ : \
+ : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \
+ "cr6", "cr7", "xer", "lr", "ctr", "memory" \
+ ); \
+- _rval; \
++ _r3; \
+ })
+
+ #else
+--
+2.51.0
+
--- /dev/null
+From 18023e10a99913d3b239788cc008dc1bbbfa3f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:03 +0200
+Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with
+ missing vDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]
+
+If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
+Currently this results in the following output:
+
+ TAP version 13
+ 1..16
+ # AT_SYSINFO_EHDR is not present!
+
+This output is incorrect, as "1..16" still requires the subtest lines to
+be printed, which isn't done however.
+
+Switch to the correct skipping functions, so the output now correctly
+indicates that no subtests are being run:
+
+ TAP version 13
+ 1..0 # SKIP AT_SYSINFO_EHDR is not present!
+
+Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
+index a54424e2336f4..67cbfc56e4e1b 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
+@@ -182,12 +182,11 @@ int main(int argc, char **argv)
+ unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
+
+ ksft_print_header();
+- ksft_set_plan(VDSO_TEST_PLAN);
+
+- if (!sysinfo_ehdr) {
+- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
+- return KSFT_SKIP;
+- }
++ if (!sysinfo_ehdr)
++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
++
++ ksft_set_plan(VDSO_TEST_PLAN);
+
+ version = versions[VDSO_VERSION];
+ name = (const char **)&names[VDSO_NAMES];
+--
+2.51.0
+
--- /dev/null
+From 159e675e06201f1c69991c9531a8a386d132e686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index a1f506ba55786..4f09c5db0c7f3 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 6e0fd1aecd2510613741550bde4804877eee07ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 35369a2f77b29..2f8e3ea4fe128 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1641,6 +1641,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regcfg_i2c.name = max310x_regmap_name(i);
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+--
+2.51.0
+
--- /dev/null
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
+powerpc-8xx-remove-left-over-instruction-and-comment.patch
+powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
+uprobes-uprobe_warn-should-use-passed-task.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+smb-server-fix-ird-ord-negotiation-with-the-client.patch
+edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+lsm-config_lsm-can-depend-on-config_security.patch
+btrfs-return-any-hit-error-from-extent_writepage_io.patch
+pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
+arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+bpf-selftests-fix-test_tcpnotify_user.patch
+bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+libbpf-fix-reuse-of-devmap.patch
+arm-dts-renesas-porter-fix-can-pin-group.patch
+leds-flash-leds-qcom-flash-update-torch-current-clam.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
+arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
+arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
+arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+selftests-nolibc-fix-expect_nz-macro.patch
+leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+vdso-add-struct-__kernel_old_timeval-forward-declara.patch
+arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
+arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
+arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
+pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+null_blk-fix-the-description-of-the-cache_size-modul.patch
+selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
+selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
+arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
+nbd-restrict-sockets-to-tcp-and-udp.patch
+pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
+cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
+arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
+mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
+arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
+arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
+pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
+pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+acpica-fix-largest-possible-resource-descriptor-inde.patch
+riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+i3c-master-svc-use-manual-response-for-ibi-events.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+spi-fix-return-code-when-spi-device-has-too-many-chi.patch
+bpf-mark-kfuncs-as-__noclone.patch
+once-fix-race-by-moving-do_once-to-separate-section.patch
+hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
+bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+f2fs-fix-condition-in-__allow_reserved_blocks.patch
+drm-bridge-it6505-select-regmap_i2c.patch
+media-zoran-remove-zoran_fh-structure.patch
+phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
+serial-max310x-add-error-checking-in-probe.patch
+drm-amd-display-remove-redundant-semicolons.patch
+crypto-keembay-add-missing-check-after-sg_nents_for_.patch
+hwrng-nomadik-add-arm_amba-dependency.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
+rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
+pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+media-st-delta-avoid-excessive-stack-usage.patch
+crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+crypto-hisilicon-qm-check-whether-the-input-function.patch
+inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
+coresight-only-register-perf-symlink-for-sinks-with-.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+drm-amd-pm-fix-si_upload_smc_data-v3.patch
+drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+wifi-iwlwifi-remove-redundant-header-files.patch
+idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+drm-msm-dpu-fix-incorrect-type-for-ret.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
+iio-consumers-fix-handling-of-negative-channel-scale.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+ipvs-use-read_once-write_once-for-ipvs-enable.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
+wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
+wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
+f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
+f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
+f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
+alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
+hid-hidraw-tighten-ioctl-command-parsing.patch
+f2fs-fix-zero-sized-extent-for-precache-extents.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
+wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-31255
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-27521
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16389
+vfio-pds-replace-bitmap_free-with-vfree.patch
+crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+rdma-rxe-fix-race-in-do_task-when-draining.patch
+wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
+coresight-etm4x-conditionally-access-register-trcext.patch
+coresight-tmc-support-atclk.patch
+coresight-catu-support-atclk.patch
+coresight-etm4x-support-atclk.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
+coresight-fix-incorrect-handling-for-return-value-of.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
+pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
+pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
+iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+ptp-add-a-upper-bound-on-max_vclocks.patch
+vhost-vringh-fix-copy_to_iter-return-value-check.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+bluetooth-iso-free-rx_skb-if-not-consumed.patch
+bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
+mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+pci-j721e-fix-incorrect-error-message-in-probe.patch
+idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+net-mlx5-stop-polling-for-command-response-if-interf.patch
+net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+net-mlx5-fw-reset-add-reset-timeout-work.patch
+smb-client-fix-crypto-buffers-in-non-linear-memory.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+vhost-vringh-modify-the-return-value-check.patch
+bpf-reject-negative-offsets-for-alu-ops.patch
--- /dev/null
+From f29d92a601356c5ed820971021bc18834b1e1bba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 12:10:33 -0300
+Subject: smb: client: fix crypto buffers in non-linear memory
+
+From: Enzo Matsumiya <ematsumiya@suse.de>
+
+[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
+
+The crypto API, through the scatterlist API, expects input buffers to be
+in linear memory. We handle this with the cifs_sg_set_buf() helper
+that converts vmalloc'd memory to their corresponding pages.
+
+However, when we allocate our aead_request buffer (@creq in
+smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
+puts aead_request->__ctx in vmalloc area.
+
+AEAD algorithm then uses ->__ctx for its private/internal data and
+operations, and uses sg_set_buf() for such data on a few places.
+
+This works fine as long as @creq falls into kmalloc zone (small
+requests) or vmalloc'd memory is still within linear range.
+
+Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
+many tasks will increment the base stacks' addresses to a point where
+virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
+happens.
+
+In practice: too many parallel reads and writes on an encrypted mount
+will trigger this bug.
+
+To fix this, always alloc @creq with kmalloc() instead.
+Also drop the @sensitive_size variable/arguments since
+kfree_sensitive() doesn't need it.
+
+Backtrace:
+
+[ 945.272081] ------------[ cut here ]------------
+[ 945.272774] kernel BUG at include/linux/scatterlist.h:209!
+[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
+[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
+[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
+[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
+[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
+[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
+[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
+[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
+[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
+[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
+[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
+[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
+[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
+[ 945.286683] Call Trace:
+[ 945.286952] <TASK>
+[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs]
+[ 945.287719] crypto_gcm_encrypt+0x36/0xe0
+[ 945.288152] crypt_message+0x54a/0xad0 [cifs]
+[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs]
+[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs]
+[ 945.289944] cifs_call_async+0x178/0x340 [cifs]
+[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
+[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs]
+[ 945.291759] ? find_held_lock+0x32/0x90
+[ 945.292212] ? netfs_advance_write+0xf2/0x310
+[ 945.292723] netfs_advance_write+0xf2/0x310
+[ 945.293210] netfs_write_folio+0x346/0xcc0
+[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10
+[ 945.294250] netfs_writepages+0x117/0x460
+[ 945.294724] do_writepages+0xbe/0x170
+[ 945.295152] ? find_held_lock+0x32/0x90
+[ 945.295600] ? kvm_sched_clock_read+0x11/0x20
+[ 945.296103] __writeback_single_inode+0x56/0x4b0
+[ 945.296643] writeback_sb_inodes+0x229/0x550
+[ 945.297140] __writeback_inodes_wb+0x4c/0xe0
+[ 945.297642] wb_writeback+0x2f1/0x3f0
+[ 945.298069] wb_workfn+0x300/0x490
+[ 945.298472] process_one_work+0x1fe/0x590
+[ 945.298949] worker_thread+0x1ce/0x3c0
+[ 945.299397] ? __pfx_worker_thread+0x10/0x10
+[ 945.299900] kthread+0x119/0x210
+[ 945.300285] ? __pfx_kthread+0x10/0x10
+[ 945.300729] ret_from_fork+0x119/0x1b0
+[ 945.301163] ? __pfx_kthread+0x10/0x10
+[ 945.301601] ret_from_fork_asm+0x1a/0x30
+[ 945.302055] </TASK>
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index ab911a9672465..c946c3a09245c 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4223,7 +4223,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+ struct aead_request **req, struct sg_table *sgt,
+- unsigned int *num_sgs, size_t *sensitive_size)
++ unsigned int *num_sgs)
+ {
+ unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
+ unsigned int iv_size = crypto_aead_ivsize(tfm);
+@@ -4240,9 +4240,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+ len += req_size;
+ len = ALIGN(len, __alignof__(struct scatterlist));
+ len += array_size(*num_sgs, sizeof(struct scatterlist));
+- *sensitive_size = len;
+
+- p = kvzalloc(len, GFP_NOFS);
++ p = kzalloc(len, GFP_NOFS);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -4256,16 +4255,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+
+ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+- struct aead_request **req, struct scatterlist **sgl,
+- size_t *sensitive_size)
++ struct aead_request **req, struct scatterlist **sgl)
+ {
+ struct sg_table sgtable = {};
+ unsigned int skip, num_sgs, i, j;
+ ssize_t rc;
+ void *p;
+
+- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
+- &num_sgs, sensitive_size);
++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
+ if (IS_ERR(p))
+ return ERR_CAST(p);
+
+@@ -4354,7 +4351,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ DECLARE_CRYPTO_WAIT(wait);
+ unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+ void *creq;
+- size_t sensitive_size;
+
+ rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
+ if (rc) {
+@@ -4380,8 +4376,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ return rc;
+ }
+
+- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
+- &sensitive_size);
++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
+ if (IS_ERR(creq))
+ return PTR_ERR(creq);
+
+@@ -4411,7 +4406,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ if (!rc && enc)
+ memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
+
+- kvfree_sensitive(creq, sensitive_size);
++ kfree_sensitive(creq);
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a15bbd49a291ac140f978ab0e6526cc16098a403 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:34:58 +0200
+Subject: smb: server: fix IRD/ORD negotiation with the client
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
+
+Already do real negotiation in smb_direct_handle_connect_request()
+where we see the requested initiator_depth and responder_resources
+from the client.
+
+We should detect legacy iwarp clients using MPA v1
+with the custom IRD/ORD negotiation.
+
+We need to send the custom IRD/ORD in big endian,
+but we need to try to let clients with broken requests
+using little endian (older cifs.ko) to work.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
+ 1 file changed, 85 insertions(+), 14 deletions(-)
+
+diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
+index d059c890d1428..05dfef7ad67f5 100644
+--- a/fs/smb/server/transport_rdma.c
++++ b/fs/smb/server/transport_rdma.c
+@@ -152,6 +152,10 @@ struct smb_direct_transport {
+ struct work_struct disconnect_work;
+
+ bool negotiation_requested;
++
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ };
+
+ #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
+@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
+ t->cm_id = cm_id;
+ cm_id->context = t;
+
++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
++ t->responder_resources = 1;
++
+ t->status = SMB_DIRECT_CS_NEW;
+ init_waitqueue_head(&t->wait_status);
+
+@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
+ static int smb_direct_accept_client(struct smb_direct_transport *t)
+ {
+ struct rdma_conn_param conn_param;
+- struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+ int ret;
+
++ /*
++ * smb_direct_handle_connect_request()
++ * already negotiated t->initiator_depth
++ * and t->responder_resources
++ */
+ memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
+- SMB_DIRECT_CM_INITIATOR_DEPTH);
+- conn_param.responder_resources = 0;
+-
+- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
+- t->cm_id->port_num,
+- &port_immutable);
+- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = conn_param.responder_resources;
+- ird_ord_hdr[1] = 1;
++ conn_param.initiator_depth = t->initiator_depth;
++ conn_param.responder_resources = t->responder_resources;
++
++ if (t->legacy_iwarp) {
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
+ return true;
+ }
+
+-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
++ struct rdma_cm_event *event)
+ {
+ struct smb_direct_transport *t;
+ struct task_struct *handler;
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+ int ret;
+
+ if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
+@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+ if (!t)
+ return -ENOMEM;
+
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ t->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * First set what the we as server are able to support
++ */
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ new_cm_id->device->attrs.max_qp_rd_atom);
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ t->responder_resources = min_t(u8, t->responder_resources,
++ peer_responder_resources);
++
+ ret = smb_direct_connect(t);
+ if (ret)
+ goto out_err;
+@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
+ {
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST: {
+- int ret = smb_direct_handle_connect_request(cm_id);
++ int ret = smb_direct_handle_connect_request(cm_id, event);
+
+ if (ret) {
+ pr_err("Can't create transport: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From e2b4532ea3bdb7fbe1e24f027bd271ea21ab5112 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index f25e20617b7eb..fa6faf50fb43b 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -891,16 +891,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 1ac3e8e688347874959b77a24e723260b597ac35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:50 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index 9a91298c12539..cf9f5e6af6472 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2167,6 +2167,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
+ return dev;
+ }
+
++static void svs_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+@@ -2218,11 +2225,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ dev = svs_add_device_link(svsp, "thermal-sensor");
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get thermal device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2232,6 +2241,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2248,6 +2258,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From add5c99117f55dd9518af0a6f7f25dda53e5f3a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:51 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index cf9f5e6af6472..4cb8169aec6b5 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2178,6 +2178,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst");
+ if (IS_ERR(svsp->rst))
+@@ -2188,6 +2189,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get lvts device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2197,6 +2199,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2216,6 +2219,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From d8f1deb29c7ba3dd161ddde0d991fa57d21fe26e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 641f29a98cbd2..cc72a31a450e4 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
+--
+2.51.0
+
--- /dev/null
+From 5797865b0a49b466297f01aec4f0fac88afd4dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index 635398ec7540e..154fbd35400ca 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 5f032eef236826ebc7940e26b1e0dcd463881915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From 94f59ff2e43e43713c5e997f468dc2893ed753a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index ee51c12306894..bbd3ea0a64822 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -79,8 +79,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From afc36dc0a5791c80ec89254ef030457e4c7b028b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From 5d9a544bd9f8ec6f0ee9dd253754dcbd75d7e07a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From d8318879df80e1feabfb290c63998f7ae348b93f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 20:37:19 +0200
+Subject: spi: fix return code when spi device has too many chipselects
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]
+
+Don't return a positive value when there are too many chipselects.
+
+Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 8d6341b0d8668..5ad9f4a2148fa 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2462,7 +2462,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
+ if (rc > ctlr->num_chipselect) {
+ dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
+ nc, rc);
+- return rc;
++ return -EINVAL;
+ }
+ if ((of_property_read_bool(nc, "parallel-memories")) &&
+ (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
+--
+2.51.0
+
--- /dev/null
+From 1146b9ce7f5b4f82f4b5254f49d372b5099a3256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 988992ff898b3..739931aabb4e3 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3058,8 +3058,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -3078,11 +3078,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4b4fe08ae99def1f98e63cab8f2d64adc227132f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index d2d49264cf83a..7c299184c59b1 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From dfaa57dc93ee61478a3df701afa5b650af021171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index 2c7f3f9a26ebb..a6bb01082ec69 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From 53b73dd411a4230aa47babd03fc521e25db8bbb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index a9d8b5b51f37f..f24953f8b949c 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -33,6 +33,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From 4d2559254777f5d2c0d7c20dc80e4c670b88d7d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:26:56 +0300
+Subject: tty: n_gsm: Don't block input queue by waiting MSC
+
+From: Seppo Takalo <seppo.takalo@nordicsemi.no>
+
+[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
+
+Currently gsm_queue() processes incoming frames and when opening
+a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
+If basic mode is used it calls gsm_modem_upd_via_msc() and it
+cannot block the input queue by waiting the response to come
+into the same input queue.
+
+Instead allow sending Modem Status Command without waiting for remote
+end to respond. Define a new function gsm_modem_send_initial_msc()
+for this purpose. As MSC is only valid for basic encoding, it does
+not do anything for advanced or when convergence layer type 2 is used.
+
+Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
+Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
+Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 252849910588f..c917fc20b469a 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
+ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
+ static void gsmld_write_trigger(struct gsm_mux *gsm);
+ static void gsmld_write_task(struct work_struct *work);
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
+
+ /**
+ * gsm_fcs_add - update FCS
+@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
+ pr_debug("DLCI %d goes open.\n", dlci->addr);
+ /* Send current modem state */
+ if (dlci->addr) {
+- gsm_modem_update(dlci, 0);
++ gsm_modem_send_initial_msc(dlci);
+ } else {
+ /* Start keep-alive control */
+ gsm->ka_num = 0;
+@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
+ return gsm_control_wait(dlci->gsm, ctrl);
+ }
+
++/**
++ * gsm_modem_send_initial_msc - Send initial modem status message
++ *
++ * @dlci channel
++ *
++ * Send an initial MSC message after DLCI open to set the initial
++ * modem status lines. This is only done for basic mode.
++ * Does not wait for a response as we cannot block the input queue
++ * processing.
++ */
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
++{
++ u8 modembits[2];
++
++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
++ return 0;
++
++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
++}
++
+ /**
+ * gsm_modem_update - send modem status line state
+ * @dlci: channel
+--
+2.51.0
+
--- /dev/null
+From f16ae291793d1688d90052cede179a0152b1139e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 22:34:21 -0500
+Subject: uprobes: uprobe_warn should use passed task
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ]
+
+uprobe_warn() is passed a task structure, yet its using current. For
+the most part this shouldn't matter, but since a task structure is
+provided, lets use it.
+
+Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances")
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index e60f5e71e35df..c00981cc6fe5b 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -114,7 +114,7 @@ struct xol_area {
+
+ static void uprobe_warn(struct task_struct *t, const char *msg)
+ {
+- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg);
++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From b9abbc6b2aa3025b65dcb95246878a8aea822045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 1b4d0056f1d08..82282373c786b 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From d240572cf9bfbbcc4117df554606280b4b0779ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index dcf31a592f5d1..4b5f03f683f77 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From 6ea40cd492c5408c21d36f63fe4a949450e55690 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:31:32 +0530
+Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
+
+From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+
+[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
+
+EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
+as read-only for operating system running at EL1, enforcing access
+restrictions that prohibit direct memory-mapped writes via writel().
+
+Attempts to write to this region from HLOS can result in silent failures
+or memory access violations, particularly when toggling EUD (Embedded
+USB Debugger) state. To ensure secure register access, modify the driver
+to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
+Secure Channel Monitor (SCM). SCM has the necessary permissions to access
+protected memory regions, enabling reliable control over EUD state.
+
+SC7280, the only user of EUD is also affected, indicating that this could
+never have worked on a properly fused device.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/Kconfig | 1 +
+ drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
+ 2 files changed, 25 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
+index 6497c4e81e951..9bf8fc6247bac 100644
+--- a/drivers/usb/misc/Kconfig
++++ b/drivers/usb/misc/Kconfig
+@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
+ config USB_QCOM_EUD
+ tristate "QCOM Embedded USB Debugger(EUD) Driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ select USB_ROLE_SWITCH
+ help
+ This module enables support for Qualcomm Technologies, Inc.
+diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
+index 19906301a4eb8..012e3b9d9bcc8 100644
+--- a/drivers/usb/misc/qcom_eud.c
++++ b/drivers/usb/misc/qcom_eud.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/sysfs.h>
+ #include <linux/usb/role.h>
++#include <linux/firmware/qcom/qcom_scm.h>
+
+ #define EUD_REG_INT1_EN_MASK 0x0024
+ #define EUD_REG_INT_STATUS_1 0x0044
+@@ -34,7 +35,7 @@ struct eud_chip {
+ struct device *dev;
+ struct usb_role_switch *role_sw;
+ void __iomem *base;
+- void __iomem *mode_mgr;
++ phys_addr_t mode_mgr;
+ unsigned int int_status;
+ int irq;
+ bool enabled;
+@@ -43,18 +44,29 @@ struct eud_chip {
+
+ static int enable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
++ if (ret)
++ return ret;
++
+ writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
+ writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
+ priv->base + EUD_REG_INT1_EN_MASK);
+- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+
+ return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
+ }
+
+-static void disable_eud(struct eud_chip *priv)
++static int disable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
++ if (ret)
++ return ret;
++
+ writel(0, priv->base + EUD_REG_CSR_EUD_EN);
+- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
++ return 0;
+ }
+
+ static ssize_t enable_show(struct device *dev,
+@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
+ chip->enabled = enable;
+ else
+ disable_eud(chip);
++
+ } else {
+- disable_eud(chip);
++ ret = disable_eud(chip);
+ }
+
+- return count;
++ return ret < 0 ? ret : count;
+ }
+
+ static DEVICE_ATTR_RW(enable);
+@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
+ static int eud_probe(struct platform_device *pdev)
+ {
+ struct eud_chip *chip;
++ struct resource *res;
+ int ret;
+
+ chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
+ if (IS_ERR(chip->base))
+ return PTR_ERR(chip->base);
+
+- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
+- if (IS_ERR(chip->mode_mgr))
+- return PTR_ERR(chip->mode_mgr);
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res)
++ return -ENODEV;
++ chip->mode_mgr = res->start;
+
+ chip->irq = platform_get_irq(pdev, 0);
+ if (chip->irq < 0)
+--
+2.51.0
+
--- /dev/null
+From 8e78447426577abca3fba619f130301389ffa4f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index da09cff55abce..0e732cd53b629 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From bce4126a9fcec9bb7fc760d6680699bcc5f6911e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 8dac1edc74d4e..a793e30d46b78 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From a65ec2a88cb9eb206642a8833c8240a55e8ab573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:41:10 +0200
+Subject: vdso: Add struct __kernel_old_timeval forward declaration to
+ gettime.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]
+
+The prototype of __vdso_gettimeofday() uses this struct. However
+gettime.h's own includes do not provide a definition for it.
+
+Add a forward declaration, similar to other used structs.
+
+Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/vdso/gettime.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
+index c50d152e7b3e0..9ac161866653a 100644
+--- a/include/vdso/gettime.h
++++ b/include/vdso/gettime.h
+@@ -5,6 +5,7 @@
+ #include <linux/types.h>
+
+ struct __kernel_timespec;
++struct __kernel_old_timeval;
+ struct timezone;
+
+ #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
+--
+2.51.0
+
--- /dev/null
+From 8b65358592cb378c787031510cce28f8f6b3fba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:31:54 +0000
+Subject: vfio/pds: replace bitmap_free with vfree
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
+
+host_seq_bmp is allocated with vzalloc but is currently freed with
+bitmap_free, which uses kfree internally. This mismach prevents the
+resource from being released properly and may result in memory leaks
+or other issues.
+
+Fix this by freeing host_seq_bmp with vfree to match the vzalloc
+allocation.
+
+Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/pds/dirty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
+index c51f5e4c3dd6d..481992142f790 100644
+--- a/drivers/vfio/pci/pds/dirty.c
++++ b/drivers/vfio/pci/pds/dirty.c
+@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
+
+ host_ack_bmp = vzalloc(bytes);
+ if (!host_ack_bmp) {
+- bitmap_free(host_seq_bmp);
++ vfree(host_seq_bmp);
+ return -ENOMEM;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3c9d4bf59785f0281c52c9e53cb7abcc7bed2535 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:04:08 -0400
+Subject: vhost: vringh: Fix copy_to_iter return value check
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
+
+The return value of copy_to_iter can't be negative, check whether the
+copied length is equal to the requested length instead of checking for
+negative values.
+
+Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 73e153f9b4495..0db4f3babe961 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
+ len - total_translated, &translated,
+@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_to_iter(src, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_to_iter(src, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From f77aead14f84cbba197fce4dcf131ae11dc60c82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:17:38 +0800
+Subject: vhost: vringh: Modify the return value check
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
+
+The return value of copy_from_iter and copy_to_iter can't be negative,
+check whether the copied lengths are equal.
+
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Cc: "Stefano Garzarella" <sgarzare@redhat.com>
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 0db4f3babe961..781731eb95cfe 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
+ len - total_translated, &translated,
+@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_from_iter(dst, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_from_iter(dst, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From 5343f2487b361e0b4b473bf9c597450545c83651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 867f9f3113797..a4b497ecfa205 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From bbb0df5ec09deab540c52bb013f4d3c4cac7a280 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 09066e6aca402..fdab67a56e438 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From 27ea6ac357d8495f5ee4c5c339ae7d3b06eb4179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:44:57 +0800
+Subject: wifi: ath12k: fix wrong logging ID used for CE
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ]
+
+ATH12K_DBG_AHB is used for CE logging which is not proper. Add
+ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it.
+
+Compile tested only.
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/ce.c | 2 +-
+ drivers/net/wireless/ath/ath12k/debug.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
+index b66d23d6b2bd9..bd21e8fe9c90b 100644
+--- a/drivers/net/wireless/ath/ath12k/ce.c
++++ b/drivers/net/wireless/ath/ath12k/ce.c
+@@ -388,7 +388,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe)
+ }
+
+ while ((skb = __skb_dequeue(&list))) {
+- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n",
++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n",
+ pipe->pipe_num, skb->len);
+ pipe->recv_cb(ab, skb);
+ }
+diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h
+index f7005917362c6..ea711e02ca03c 100644
+--- a/drivers/net/wireless/ath/ath12k/debug.h
++++ b/drivers/net/wireless/ath/ath12k/debug.h
+@@ -26,6 +26,7 @@ enum ath12k_debug_mask {
+ ATH12K_DBG_DP_TX = 0x00002000,
+ ATH12K_DBG_DP_RX = 0x00004000,
+ ATH12K_DBG_WOW = 0x00008000,
++ ATH12K_DBG_CE = 0x00010000,
+ ATH12K_DBG_ANY = 0xffffffff,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From c7a40804870e1e14c7697323417fc3738b23b191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:11:51 +0800
+Subject: wifi: iwlwifi: Remove redundant header files
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]
+
+The header file "fw/img.h" is already included on line 9. Remove the
+redundant include.
+
+Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+index 81787501d4a4f..11704163876b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+@@ -12,7 +12,6 @@
+ #include "fw/api/phy.h"
+ #include "fw/api/config.h"
+ #include "fw/api/nvm-reg.h"
+-#include "fw/img.h"
+ #include "iwl-trans.h"
+
+ #define BIOS_SAR_MAX_PROFILE_NUM 4
+--
+2.51.0
+
--- /dev/null
+From c3c1f5439a932172a2503bb40d0dd07c43bec3c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 12:42:03 +0530
+Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
+ available
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
+
+In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
+information, an attempt is made to find the station using the address 2
+(source address) field in the header. Since pubsta is missing, link
+information such as link_valid and link_id is also unavailable. Now if such
+a situation comes, and if a matching ML station entry is found based on
+the source address, currently the packet is dropped due to missing link ID
+in the status field which is not correct.
+
+Hence, to fix this issue, if link_valid is not set and the station is an
+ML station, make an attempt to find a link station entry using the source
+address. If a valid link station is found, derive the link ID and proceed
+with packet processing. Otherwise, drop the packet as per the existing
+flow.
+
+Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
+Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 8c0d91dfd7e2b..538c6eea645f2 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5280,12 +5280,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ continue;
++
++ link_id = link_sta->link_id;
++ }
++
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
+- continue;
+-
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+
+ prev_sta = sta;
+@@ -5293,10 +5301,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+- goto out;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
++ link_id = link_sta->link_id;
++ }
++
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+--
+2.51.0
+
--- /dev/null
+From de3cb7769487b3a645e125212df50fb9c1eb36b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index ec02148a7f1f7..2ee8a6e1e310e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a723d3010734596fd645b594c3db835cbf0ef9c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 14:48:24 +0800
+Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration
+
+From: Zhi-Jun You <hujy652@gmail.com>
+
+[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]
+
+In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
+although the chip doesn't support it.
+
+mt76 doesn't take this into account which results in reading from the
+incorrect offset.
+
+For devices with precal, this would lead to lower bitrate.
+
+Fix this by aligning groupcal size with vendor driver and switch to
+freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.
+
+Below are iwinfo of the test device with two clients connected
+(iPhone 16, Intel AX210).
+Before :
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 612.4 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+After:
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 900.6 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+Tested-on: mt7981 20240823
+
+Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
+Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
+Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++--
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++--------------
+ 2 files changed, 10 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+index 509fb43d8a688..2908e8113e48a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT)
+ #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT)
+-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */
+
+ #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_BAND_SEL GENMASK(7, 6)
+@@ -179,6 +179,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
+ return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
+ MT_EE_CAL_GROUP_SIZE_7916;
++ } else if (is_mt7981(&dev->mt76)) {
++ return MT_EE_CAL_GROUP_SIZE_7981;
+ } else if (mt7915_check_adie(dev, false)) {
+ return MT_EE_CAL_GROUP_SIZE_7976;
+ } else {
+@@ -191,8 +193,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
+ {
+ if (is_mt7915(&dev->mt76))
+ return MT_EE_CAL_DPD_SIZE_V1;
+- else if (is_mt7981(&dev->mt76))
+- return MT_EE_CAL_DPD_SIZE_V2_7981;
+ else
+ return MT_EE_CAL_DPD_SIZE_V2;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 3398c25cb03c0..7b481aea76b6c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -3004,30 +3004,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ /* 5G BW160 */
+ 5250, 5570, 5815
+ };
+- static const u16 freq_list_v2_7981[] = {
+- /* 5G BW20 */
+- 5180, 5200, 5220, 5240,
+- 5260, 5280, 5300, 5320,
+- 5500, 5520, 5540, 5560,
+- 5580, 5600, 5620, 5640,
+- 5660, 5680, 5700, 5720,
+- 5745, 5765, 5785, 5805,
+- 5825, 5845, 5865, 5885,
+- /* 5G BW160 */
+- 5250, 5570, 5815
+- };
+- const u16 *freq_list = freq_list_v1;
+- int n_freqs = ARRAY_SIZE(freq_list_v1);
+- int idx;
++ const u16 *freq_list;
++ int idx, n_freqs;
+
+ if (!is_mt7915(&dev->mt76)) {
+- if (is_mt7981(&dev->mt76)) {
+- freq_list = freq_list_v2_7981;
+- n_freqs = ARRAY_SIZE(freq_list_v2_7981);
+- } else {
+- freq_list = freq_list_v2;
+- n_freqs = ARRAY_SIZE(freq_list_v2);
+- }
++ freq_list = freq_list_v2;
++ n_freqs = ARRAY_SIZE(freq_list_v2);
++ } else {
++ freq_list = freq_list_v1;
++ n_freqs = ARRAY_SIZE(freq_list_v1);
+ }
+
+ if (freq < 4000) {
+--
+2.51.0
+
--- /dev/null
+From 121d8855b5543ac3b9e8adb0b499d6a7c565b656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:19 +0200
+Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]
+
+Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
+break endianness
+
+Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++---
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index c550385541143..91b7d35bdb431 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -679,6 +679,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
+ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
+ struct mt7996_wed_rro_addr *addr;
+@@ -718,7 +719,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+
+ addr = dev->wed_rro.addr_elem[i].ptr;
+ for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -736,7 +737,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ dev->wed_rro.session.ptr = ptr;
+ addr = dev->wed_rro.session.ptr;
+ for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -836,6 +837,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+ static void mt7996_wed_rro_work(struct work_struct *work)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mt7996_dev *dev;
+ LIST_HEAD(list);
+
+@@ -872,7 +874,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
+ MT7996_RRO_WINDOW_MAX_LEN;
+ reset:
+ elem = ptr + elem_id * sizeof(*elem);
+- elem->signature = 0xff;
++ elem->data |= cpu_to_le32(val);
+ }
+ mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
+ out:
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index 425fd030bee00..29e7289c3a169 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -194,13 +194,12 @@ struct mt7996_hif {
+ int irq;
+ };
+
++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24)
++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4)
++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0)
+ struct mt7996_wed_rro_addr {
+- u32 head_low;
+- u32 head_high : 4;
+- u32 count: 11;
+- u32 oor: 1;
+- u32 rsv : 8;
+- u32 signature : 8;
++ __le32 head_low;
++ __le32 data;
+ };
+
+ struct mt7996_wed_rro_session_id {
+--
+2.51.0
+
--- /dev/null
+From 2ad41f05a85f52d126fcedea49cad0826620f719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:17 +0200
+Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED
+ device
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]
+
+In order to properly set the number of rx packets for primary WED device
+if hif device is available, move hif pointer initialization before
+running mt7996_mmio_wed_init routine.
+
+Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+index 04056181368a6..dbd05612f2e4a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+@@ -132,6 +132,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+ mdev = &dev->mt76;
+ mt7996_wfsys_reset(dev);
+ hif2 = mt7996_pci_init_hif2(pdev);
++ dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
+ if (ret < 0)
+@@ -156,7 +157,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+
+ if (hif2) {
+ hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
+- dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From b40b51f4a25242bf891592c905823ae9c16fa007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 59bea82eab294..8801b93eacd42 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From d846e3904ba53e5f5b6fd8dc6365e524ca1b93a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:50 +0300
+Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
+
+Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
+scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
+wiphy lock inside. However, this workqueue can be flushed when e.g.
+closing the interface and wiphy lock is already taken in that case.
+
+Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
+the global workqueue.
+
+[1]:
+
+ WARNING: possible circular locking dependency detected
+ 6.17.0-rc2 #17 Not tainted
+ ------------------------------------------------------
+ kworker/u32:1/61 is trying to acquire lock:
+ ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
+
+ but task is already holding lock:
+ ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
+ process_one_work+0x7c6/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
+ touch_wq_lockdep_map+0x8e/0x180
+ __flush_workqueue+0x129/0x10d0
+ ieee80211_stop_device+0xa8/0x110
+ ieee80211_do_stop+0x14ce/0x2880
+ ieee80211_stop+0x13a/0x2c0
+ __dev_close_many+0x18f/0x510
+ __dev_change_flags+0x25f/0x670
+ netif_change_flags+0x7b/0x160
+ do_setlink.isra.0+0x1640/0x35d0
+ rtnl_newlink+0xd8c/0x1d30
+ rtnetlink_rcv_msg+0x700/0xb80
+ netlink_rcv_skb+0x11d/0x350
+ netlink_unicast+0x49a/0x7a0
+ netlink_sendmsg+0x759/0xc20
+ ____sys_sendmsg+0x812/0xa00
+ ___sys_sendmsg+0xf7/0x180
+ __sys_sendmsg+0x11f/0x1b0
+ do_syscall_64+0xbb/0x360
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock((wq_completion)phy0);
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock(&rdev->wiphy.mtx);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u32:1/61:
+ #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
+ #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
+ Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ print_circular_bug.cold+0x178/0x1be
+ check_noncircular+0x14c/0x170
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index c0f0e3d71f5f5..2a303a758e276 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
+
+ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ {
+- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ struct ser_msg *msg = NULL;
+
+ if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
+@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ list_add(&msg->list, &ser->msg_q);
+ spin_unlock_irq(&ser->msg_q_lock);
+
+- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
++ schedule_work(&ser->ser_hdl_work);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4fdb37f55bfcdf6eb333fa96705c87e60c0d768b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 9d6411c659205..00cefbb59fa98 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 26e5a0102eafd8515f8836d038658e4a1306ed5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:39:17 +0800
+Subject: accel/amdxdna: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ]
+
+Change the 'ret' variable from u32 to int to store -EINVAL. Storing the
+negative error codes in unsigned type, doesn't cause an issue at runtime
+but it's ugly as pants.
+
+Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may
+trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/aie2_ctx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
+index e04549f64d69e..842cf1f0aa1be 100644
+--- a/drivers/accel/amdxdna/aie2_ctx.c
++++ b/drivers/accel/amdxdna/aie2_ctx.c
+@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size)
+ {
+ struct amdxdna_sched_job *job = handle;
+ struct amdxdna_gem_obj *cmd_abo;
+- u32 ret = 0;
++ int ret = 0;
+ u32 status;
+
+ cmd_abo = job->cmd_bo;
+@@ -222,7 +222,7 @@ static int
+ aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size)
+ {
+ struct amdxdna_sched_job *job = handle;
+- u32 ret = 0;
++ int ret = 0;
+ u32 status;
+
+ if (unlikely(!data))
+@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size)
+ u32 fail_cmd_status;
+ u32 fail_cmd_idx;
+ u32 cmd_status;
+- u32 ret = 0;
++ int ret = 0;
+
+ cmd_abo = job->cmd_bo;
+ if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) {
+--
+2.51.0
+
--- /dev/null
+From e23e2ecdbad769c07b99656570daaf0d689d745d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ae035b93da087..3eb56b77cb6d9 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 593c49ce0932512d12f64858e203183fa1bfa5e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 2c2dc559e0f8d..d0fc045a8d310 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 50c5564fc569e31f1fb8d9823142cc62c2735123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 21:55:35 +0200
+Subject: ACPICA: Apply ACPI_NONSTRING
+
+From: Ahmed Salem <x0rw3ll@gmail.com>
+
+[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ]
+
+Add ACPI_NONSTRING for destination char arrays without a terminating NUL
+character.
+
+This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
+where a few more destination arrays were missed.
+
+Link: https://github.com/acpica/acpica/commit/f359e5ed
+Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
+Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/actbl.h | 2 +-
+ tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
+index 243097a3da636..8a67d4ea6e3fe 100644
+--- a/include/acpi/actbl.h
++++ b/include/acpi/actbl.h
+@@ -73,7 +73,7 @@ struct acpi_table_header {
+ char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM identification */
+ char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM table identification */
+ u32 oem_revision; /* OEM revision number */
+- char asl_compiler_id[ACPI_NAMESEG_SIZE]; /* ASCII ASL compiler vendor ID */
++ char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; /* ASCII ASL compiler vendor ID */
+ u32 asl_compiler_revision; /* ASL compiler version */
+ };
+
+diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+index 9741e7503591c..de93067a5da32 100644
+--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
++++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory)
+ {
+ void *table_dir;
+ u32 instance;
+- char temp_name[ACPI_NAMESEG_SIZE];
++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
+ char *filename;
+ acpi_status status = AE_OK;
+
+@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname,
+ {
+ void *table_dir;
+ u32 current_instance = 0;
+- char temp_name[ACPI_NAMESEG_SIZE];
++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
+ char table_filename[PATH_MAX];
+ char *filename;
+ acpi_status status;
+--
+2.51.0
+
--- /dev/null
+From 9c0b93aed4ff35ccbbd2ac767cbd5f8b441f0d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:03:16 +0200
+Subject: ACPICA: Fix largest possible resource descriptor index
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
+
+ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
+used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
+
+Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
+clamped incorrectly and resulting value may issue an out-of-bounds
+access for 'acpi_gbl_resource_types' array. Compile tested only.
+
+Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
+Link: https://github.com/acpica/acpica/commit/cf00116c
+Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/aclocal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
+index 0c41f0097e8d7..f98640086f4ef 100644
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -1141,7 +1141,7 @@ struct acpi_port_info {
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92
+ #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93
+-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94
++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93
+
+ /*****************************************************************************
+ *
+--
+2.51.0
+
--- /dev/null
+From 9872975a5204d7aeb1e0be40a8ac443a35c2d5de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index 9d95ecb299aed..a99acd1125e74 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 73ebac0788971cc0080e32739a37dd478d986cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:28:51 +0200
+Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
+ PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]
+
+snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
+via spin_lock_irq(). This also implicitly disables the handling of
+softirqs such as TIMER_SOFTIRQ.
+On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
+disable them. That means a timer can be invoked during spin_lock_irq()
+on the same CPU. Due to synchronisations reasons local_bh_disable() has
+a per-CPU lock named softirq_ctrl.lock which synchronizes individual
+softirq against each other.
+syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
+acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
+is a possible deadlock.
+
+The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
+would lead to too much synchronisation against individual threads on the
+system. To avoid the possible deadlock, softirqs must be manually
+disabled before the lock is acquired.
+
+Disable softirqs before the lock is acquired on PREEMPT_RT.
+
+Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com
+Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_native.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index ecb71bf1859d4..1a9abf0342c20 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
+ }
+
+ /* define group lock helpers */
+-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
+ static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
+ { \
+- if (nonatomic) \
++ if (nonatomic) { \
+ mutex_ ## mutex_action(&group->mutex); \
+- else \
+- spin_ ## action(&group->lock); \
+-}
+-
+-DEFINE_PCM_GROUP_LOCK(lock, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock, unlock);
+-DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
++ } else { \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \
++ local_bh_disable(); \
++ spin_ ## action(&group->lock); \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
++ local_bh_enable(); \
++ } \
++}
++
++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
+
+ /**
+ * snd_pcm_stream_lock - Lock the PCM stream
+--
+2.51.0
+
--- /dev/null
+From fcec9ea33d8777bdb31fa36bd718219d782e685c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 15:09:52 +0200
+Subject: arch: copy_thread: pass clone_flags as u64
+
+From: Simon Schuster <schuster.simon@siemens-energy.com>
+
+[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ]
+
+With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
+clone3") the effective bit width of clone_flags on all architectures was
+increased from 32-bit to 64-bit, with a new type of u64 for the flags.
+However, for most consumers of clone_flags the interface was not
+changed from the previous type of unsigned long.
+
+While this works fine as long as none of the new 64-bit flag bits
+(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
+undesirable in terms of the principle of least surprise.
+
+Thus, this commit fixes all relevant interfaces of the copy_thread
+function that is called from copy_process to consistently pass
+clone_flags as u64, so that no truncation to 32-bit integers occurs on
+32-bit architectures.
+
+Signed-off-by: Simon Schuster <schuster.simon@siemens-energy.com>
+Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com
+Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread")
+Acked-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
+Acked-by: Andreas Larsson <andreas@gaisler.com> # sparc
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/kernel/process.c | 2 +-
+ arch/arc/kernel/process.c | 2 +-
+ arch/arm/kernel/process.c | 2 +-
+ arch/arm64/kernel/process.c | 2 +-
+ arch/csky/kernel/process.c | 2 +-
+ arch/hexagon/kernel/process.c | 2 +-
+ arch/loongarch/kernel/process.c | 2 +-
+ arch/m68k/kernel/process.c | 2 +-
+ arch/microblaze/kernel/process.c | 2 +-
+ arch/mips/kernel/process.c | 2 +-
+ arch/nios2/kernel/process.c | 2 +-
+ arch/openrisc/kernel/process.c | 2 +-
+ arch/parisc/kernel/process.c | 2 +-
+ arch/powerpc/kernel/process.c | 2 +-
+ arch/riscv/kernel/process.c | 2 +-
+ arch/s390/kernel/process.c | 2 +-
+ arch/sh/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_64.c | 2 +-
+ arch/um/kernel/process.c | 2 +-
+ arch/x86/include/asm/fpu/sched.h | 2 +-
+ arch/x86/include/asm/shstk.h | 4 ++--
+ arch/x86/kernel/fpu/core.c | 2 +-
+ arch/x86/kernel/process.c | 2 +-
+ arch/x86/kernel/shstk.c | 2 +-
+ arch/xtensa/kernel/process.c | 2 +-
+ 26 files changed, 27 insertions(+), 27 deletions(-)
+
+diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
+index 582d96548385d..06522451f018f 100644
+--- a/arch/alpha/kernel/process.c
++++ b/arch/alpha/kernel/process.c
+@@ -231,7 +231,7 @@ flush_thread(void)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ extern void ret_from_fork(void);
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index 186ceab661eb0..8166d09087130 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void);
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *c_regs; /* child's pt_regs */
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index e16ed102960cb..d7aa95225c70b 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long stack_start = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *thread = task_thread_info(p);
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 3e1baff5e88d9..01a20fb96b8c4 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -410,7 +410,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long stack_start = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
+index 0c6e4b17fe00f..a7a90340042a5 100644
+--- a/arch/csky/kernel/process.c
++++ b/arch/csky/kernel/process.c
+@@ -32,7 +32,7 @@ void flush_thread(void){}
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct switch_stack *childstack;
+diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
+index 2a77bfd756945..15b4992bfa298 100644
+--- a/arch/hexagon/kernel/process.c
++++ b/arch/hexagon/kernel/process.c
+@@ -52,7 +52,7 @@ void arch_cpu_idle(void)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c
+index 3582f591bab28..efd9edf65603c 100644
+--- a/arch/loongarch/kernel/process.c
++++ b/arch/loongarch/kernel/process.c
+@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ unsigned long childksp;
+ unsigned long tls = args->tls;
+ unsigned long usp = args->stack;
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ struct pt_regs *childregs, *regs = current_pt_regs();
+
+ childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
+diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
+index fda7eac23f872..f5a07a70e9385 100644
+--- a/arch/m68k/kernel/process.c
++++ b/arch/m68k/kernel/process.c
+@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct fork_frame {
+diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
+index 56342e11442d2..6cbf642d7b801 100644
+--- a/arch/microblaze/kernel/process.c
++++ b/arch/microblaze/kernel/process.c
+@@ -54,7 +54,7 @@ void flush_thread(void)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 02aa6a04a21da..29191fa1801e2 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
+index f84021303f6a8..151404139085c 100644
+--- a/arch/nios2/kernel/process.c
++++ b/arch/nios2/kernel/process.c
+@@ -101,7 +101,7 @@ void flush_thread(void)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
+index eef99fee2110c..73ffb9fa3118b 100644
+--- a/arch/openrisc/kernel/process.c
++++ b/arch/openrisc/kernel/process.c
+@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void);
+ int
+ copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *userregs;
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index ed93bd8c15453..e64ab5d2a40d6 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init);
+ int
+ copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *cregs = &(p->thread.regs);
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 855e098865032..eb23966ac0a9f 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ f = ret_from_kernel_user_thread;
+ } else {
+ struct pt_regs *regs = current_pt_regs();
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+
+ /* Copy registers */
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index a0a40889d79a5..31a392993cb45 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index 9637aee43c401..76a97283daaf7 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long new_stackp = args->stack;
+ unsigned long tls = args->tls;
+ struct fake_frame
+diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
+index 92b6649d49295..62f753a85b89c 100644
+--- a/arch/sh/kernel/process_32.c
++++ b/arch/sh/kernel/process_32.c
+@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void);
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
+index 9c7c662cb5659..5a28c0e91bf15 100644
+--- a/arch/sparc/kernel/process_32.c
++++ b/arch/sparc/kernel/process_32.c
+@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void);
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index 529adfecd58ca..25781923788a0 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *t = task_thread_info(p);
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 1be644de9e41e..9c9c66dc45f05 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -143,7 +143,7 @@ static void fork_handler(void)
+
+ int copy_thread(struct task_struct * p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ void (*handler)(void);
+diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
+index c060549c6c940..89004f4ca208d 100644
+--- a/arch/x86/include/asm/fpu/sched.h
++++ b/arch/x86/include/asm/fpu/sched.h
+@@ -11,7 +11,7 @@
+
+ extern void save_fpregs_to_fpstate(struct fpu *fpu);
+ extern void fpu__drop(struct task_struct *tsk);
+-extern int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
++extern int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
+ unsigned long shstk_addr);
+ extern void fpu_flush_thread(void);
+
+diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
+index ba6f2fe438488..0f50e01259430 100644
+--- a/arch/x86/include/asm/shstk.h
++++ b/arch/x86/include/asm/shstk.h
+@@ -16,7 +16,7 @@ struct thread_shstk {
+
+ long shstk_prctl(struct task_struct *task, int option, unsigned long arg2);
+ void reset_thread_features(void);
+-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags,
++unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags,
+ unsigned long stack_size);
+ void shstk_free(struct task_struct *p);
+ int setup_signal_shadow_stack(struct ksignal *ksig);
+@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option,
+ unsigned long arg2) { return -EINVAL; }
+ static inline void reset_thread_features(void) {}
+ static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p,
+- unsigned long clone_flags,
++ u64 clone_flags,
+ unsigned long stack_size) { return 0; }
+ static inline void shstk_free(struct task_struct *p) {}
+ static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index ea138583dd92a..a8ff319408363 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -606,7 +606,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp)
+ }
+
+ /* Clone current's FPU state on fork */
+-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
++int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
+ unsigned long ssp)
+ {
+ /*
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index a838be04f8749..1e57bcc795f31 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs,
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct inactive_task_frame *frame;
+diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
+index 2ddf23387c7ef..5eba6c5a67757 100644
+--- a/arch/x86/kernel/shstk.c
++++ b/arch/x86/kernel/shstk.c
+@@ -191,7 +191,7 @@ void reset_thread_features(void)
+ current->thread.features_locked = 0;
+ }
+
+-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags,
++unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags,
+ unsigned long stack_size)
+ {
+ struct thread_shstk *shstk = &tsk->thread.shstk;
+diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
+index 7bd66677f7b6d..94d43f44be131 100644
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp_thread_fn = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+--
+2.51.0
+
--- /dev/null
+From 713193dffe656106e3efccf99432db2fa327b49a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index e23b868340965..7e6c94f8edeef 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -904,7 +904,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCKx settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -980,7 +980,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From a1b118129010ffc3dd36fefe58fb3dbfdf568723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 23:59:57 +0200
+Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
+ property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
+
+The dtbs_check validation for am335x-cm-t335.dtb flags an error
+for an unevaluated 'num-serializer' property in the mcasp0 node.
+
+This property is obsolete; it is not defined in the davinci-mcasp-audio
+schema and is not used by the corresponding (or any) driver.
+
+Remove this unused property to fix the schema validation warning.
+
+Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+index 06767ea164b59..ece7f7854f6aa 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+@@ -483,8 +483,6 @@ &mcasp1 {
+
+ op-mode = <0>; /* MCASP_IIS_MODE */
+ tdm-slots = <2>;
+- /* 16 serializers */
+- num-serializer = <16>;
+ serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */
+ 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
+ >;
+--
+2.51.0
+
--- /dev/null
+From b87e7dda63bcf374ff1f41fc20fcbdef9134e267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 15:49:48 +0200
+Subject: ARM: dts: renesas: porter: Fix CAN pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
+
+According to the schematics, the CAN transceiver is connected to pins
+GP7_3 and GP7_4, which correspond to CAN0 data group B.
+
+Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+index f518eadd8b9cd..81b3c5d74e9b3 100644
+--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+@@ -289,7 +289,7 @@ vin0_pins: vin0 {
+ };
+
+ can0_pins: can0 {
+- groups = "can0_data";
++ groups = "can0_data_b";
+ function = "can0";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From d5a9bae0afe2562dd032cc1e4cdcb807cddc4591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 00:51:15 +0200
+Subject: ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ]
+
+The stm32-i2s binding inherits from the standard audio-graph-port
+schema for its 'port' subnode, audio-graph-port requires the use
+of the 'dai-format' property. The stm32mp151c-plyaqm dts file was
+using the non-standard name 'format'.
+
+Correct the property name to 'dai-format' to fix the dtbs_check
+validation error.
+
+Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
+index 39a3211c61337..55fe916740d7c 100644
+--- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
++++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
+@@ -239,7 +239,7 @@ &i2s1 {
+
+ i2s1_port: port {
+ i2s1_endpoint: endpoint {
+- format = "i2s";
++ dai-format = "i2s";
+ mclk-fs = <256>;
+ remote-endpoint = <&codec_endpoint>;
+ };
+--
+2.51.0
+
--- /dev/null
+From 439e7f6e087bc271e8c561f4b9755f48c44b8d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:25:30 +0200
+Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in
+ DTS to use correct boolean syntax
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
+
+The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
+schema, was incorrectly assigned a value (<1>) in the DTS file, causing
+a validation error: "size (4) error for type flag". The driver uses
+of_property_read_bool(), expecting a boolean. Remove the value to fix
+the dtbs_check error.
+
+Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
+Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+index ae2e8dffbe049..ea47f9960c356 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+@@ -269,7 +269,7 @@ &tps {
+ vcc7-supply = <&vbat>;
+ vccio-supply = <&vbat>;
+
+- ti,en-ck32k-xtal = <1>;
++ ti,en-ck32k-xtal;
+
+ regulators {
+ vrtc_reg: regulator@0 {
+--
+2.51.0
+
--- /dev/null
+From b4394cdf3be82232ebfc7b101ff0cd984acf7101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:50:52 +0200
+Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on
+ property to use correct boolean syntax in DTS
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
+
+The ti,keep-vref-on property, defined as a boolean flag in the Device
+Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
+causing a validation error: "size (4) error for type flag". Remove
+the value to match the schema and ensure compatibility with the driver
+using device_property_read_bool(). This fixes the dtbs_check error.
+
+Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+index a7f99ae0c1fe9..78c657429f641 100644
+--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+@@ -65,7 +65,7 @@ ads7846@0 {
+ ti,debounce-max = /bits/ 16 <10>;
+ ti,debounce-tol = /bits/ 16 <5>;
+ ti,debounce-rep = /bits/ 16 <1>;
+- ti,keep-vref-on = <1>;
++ ti,keep-vref-on;
+ ti,settle-delay-usec = /bits/ 16 <150>;
+
+ wakeup-source;
+--
+2.51.0
+
--- /dev/null
+From 409135b8398390f3d558d801f9049f66b35c2a14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 02:10:55 +0800
+Subject: arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset
+ setting
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ]
+
+The external Ethernet PHY has a reset pin that is connected to the SoC.
+It is missing from the original submission.
+
+Add it to complete the description.
+
+Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+index 8bc0f2c72a247..c57ecc420aed4 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+@@ -70,6 +70,9 @@ &mdio0 {
+ ext_rgmii_phy: ethernet-phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+ reg = <1>;
++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
++ reset-assert-us = <10000>;
++ reset-deassert-us = <150000>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From ada242ed6c76fecfd00ed4dc0b6a4b997d0243eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 02:10:57 +0800
+Subject: arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset
+ setting
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ]
+
+The external Ethernet PHY has a reset pin that is connected to the SoC.
+It is missing from the original submission.
+
+Add it to complete the description.
+
+Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+index 142177c1f737f..9a2f29201d3ce 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+@@ -80,6 +80,9 @@ &mdio0 {
+ ext_rgmii_phy: ethernet-phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+ reg = <1>;
++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
++ reset-assert-us = <10000>;
++ reset-deassert-us = <150000>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 8ec63d7a907fa4f81d8ba7466ad2a5cf6ea0f55d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:24:49 +0800
+Subject: arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ]
+
+When the board was added, its external 32.768 KHz crystal was described
+but not hooked up correctly. This meant the device had to fall back to
+the SoC's internal oscillator or divide a 32 KHz clock from the main
+oscillator, neither of which are accurate for the RTC. As a result the
+RTC clock will drift badly.
+
+Hook the crystal up to the RTC block and request the correct clock rate.
+
+Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+index 9a2f29201d3ce..6a07281e11007 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+@@ -304,6 +304,14 @@ &r_pio {
+ vcc-pm-supply = <®_aldo3>;
+ };
+
++&rtc {
++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
++ clock-names = "bus", "hosc", "ahb", "ext-osc32k";
++ assigned-clocks = <&rtc CLK_OSC32K>;
++ assigned-clock-rates = <32768>;
++};
++
+ &uart0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&uart0_pb_pins>;
+--
+2.51.0
+
--- /dev/null
+From 73ce2d8475b06e998da3378f029d072c4ed49a3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:44 +0200
+Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
+
+PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
+and disabled. Linux' PCI subsystem assigns the ethernet nic from
+`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
+disabled port as iommu. The `pcie0_dart_1` instance is disabled and
+probably fused off (it is on the M2 Pro Mac mini which has a disabled
+PCIe port as well).
+Without iommu the ethernet nic is not expected work.
+Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
+subsystem's bus number.
+
+Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
+index 152f95fd49a21..7089ccf3ce556 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
+@@ -21,6 +21,14 @@ aliases {
+ };
+ };
+
++/*
++ * Adjust pcie0's iommu-map to account for the disabled port01.
++ */
++&pcie0 {
++ iommu-map = <0x100 &pcie0_dart_0 1 1>,
++ <0x200 &pcie0_dart_2 1 1>;
++};
++
+ &bluetooth0 {
+ brcm,board-type = "apple,santorini";
+ };
+@@ -36,10 +44,10 @@ &wifi0 {
+ */
+
+ &port02 {
+- bus-range = <3 3>;
++ bus-range = <2 2>;
+ status = "okay";
+ ethernet0: ethernet@0,0 {
+- reg = <0x30000 0x0 0x0 0x0 0x0>;
++ reg = <0x20000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 00];
+ };
+--
+2.51.0
+
--- /dev/null
+From 45e2b0f1d8c36150f7a80f25fd9f6054753be443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:45 +0200
+Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator
+
+From: Annette Kobou <annette.kobou@kontron.de>
+
+[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]
+
+The regulator uses the wrong GPIO. Fix this.
+
+Signed-off-by: Annette Kobou <annette.kobou@kontron.de>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 89e97c604bd3e..9a9e5d0daf3ba 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -33,7 +33,9 @@ pwm-beeper {
+
+ reg_vcc_panel: regulator-vcc-panel {
+ compatible = "regulator-fixed";
+- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_reg_vcc_panel>;
++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+@@ -161,3 +163,11 @@ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+ };
++
++&iomuxc {
++ pinctrl_reg_vcc_panel: regvccpanelgrp {
++ fsl,pins = <
++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */
++ >;
++ };
++};
+--
+2.51.0
+
--- /dev/null
+From e211c5924bc8b621566e228ea9ebab8e376cf139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:46 +0200
+Subject: arm64: dts: imx93-kontron: Fix USB port assignment
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]
+
+The assignment of the USB ports is wrong and needs to be swapped.
+The OTG (USB-C) port is on the first port and the host port with
+the onboard hub is on the second port.
+
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -137,6 +137,16 @@ &tpm6 {
+ };
+
+ &usbotg1 {
++ adp-disable;
++ hnp-disable;
++ srp-disable;
++ disable-over-current;
++ dr_mode = "otg";
++ usb-role-switch;
++ status = "okay";
++};
++
++&usbotg2 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ disable-over-current;
+@@ -149,16 +159,6 @@ usb1@1 {
+ };
+ };
+
+-&usbotg2 {
+- adp-disable;
+- hnp-disable;
+- srp-disable;
+- disable-over-current;
+- dr_mode = "otg";
+- usb-role-switch;
+- status = "okay";
+-};
+-
+ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+--
+2.51.0
+
--- /dev/null
+From 9b163d2edac907b65ee89f39c0b25410692ba28d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:25:31 +0800
+Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
+
+From: Joy Zou <joy.zou@nxp.com>
+
+[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]
+
+According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
+and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.
+
+Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
+Signed-off-by: Joy Zou <joy.zou@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
+index 5aecdd9b62ff6..29227e80facc1 100644
+--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
+@@ -913,7 +913,7 @@ lpuart7: serial@42690000 {
+ interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART7>;
+ clock-names = "ipg";
+- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 {
+ interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART8>;
+ clock-names = "ipg";
+- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+--
+2.51.0
+
--- /dev/null
+From 0d4fe1c0d62f0f84da2f8ccebeed59dfc7233f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:52 +0200
+Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node
+ names
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
+
+The node names for "pmic", "regulators", "rtc", and "keys" are
+dictated by the PMIC MFD binding: change those to adhere to it.
+
+Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+index d89858c73ab1b..243afbffa21fd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+@@ -6,12 +6,12 @@
+ #include <dt-bindings/input/input.h>
+
+ &pwrap {
+- pmic: mt6331 {
++ pmic: pmic {
+ compatible = "mediatek,mt6331";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6331regulator: mt6331regulator {
++ mt6331regulator: regulators {
+ compatible = "mediatek,mt6331-regulator";
+
+ mt6331_vdvfs11_reg: buck-vdvfs11 {
+@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
+ };
+
+ mt6331_vdig18_reg: ldo-vdig18 {
+- regulator-name = "dvdd18_dig";
++ regulator-name = "vdig18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-ramp-delay = <0>;
+@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
+ };
+ };
+
+- mt6331rtc: mt6331rtc {
++ mt6331rtc: rtc {
+ compatible = "mediatek,mt6331-rtc";
+ };
+
+- mt6331keys: mt6331keys {
++ mt6331keys: keys {
+ compatible = "mediatek,mt6331-keys";
+ power {
+ linux,keycodes = <KEY_POWER>;
+--
+2.51.0
+
--- /dev/null
+From 9e10cc85ce75034ac61dfa2abc20de39e909ce61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:56 +0200
+Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
+
+Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
+actually used, the final value that gets written to the register
+field for DAT_LATCH_CK_SEL is just 0x4.
+
+This also fixes dtbs_check warnings.
+
+Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+index 91de920c22457..03cc48321a3f4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+@@ -212,7 +212,7 @@ proximity@48 {
+
+ &mmc0 {
+ /* eMMC controller */
+- mediatek,latch-ck = <0x14>; /* hs400 */
++ mediatek,latch-ck = <4>; /* hs400 */
+ mediatek,hs200-cmd-int-delay = <1>;
+ mediatek,hs400-cmd-int-delay = <1>;
+ mediatek,hs400-ds-dly3 = <0x1a>;
+--
+2.51.0
+
--- /dev/null
+From db21125995c3fae8a0790a700688274fe2015e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 17:01:34 +0800
+Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]
+
+The touchscreen controller used with the original Krabby design is the
+Elan eKTH6918, which is in the same family as eKTH6915, but supporting
+a larger screen size with more sense lines.
+
+OTOH, the touchscreen controller that actually shipped on the Tentacruel
+devices is the Elan eKTH6A12NAY. A compatible string was added for it
+specifically because it has different power sequencing timings.
+
+Fix up the touchscreen nodes for both these. This also includes adding
+a previously missing reset line. Also add "no-reset-on-power-off" since
+the power is always on, and putting it in reset would consume more
+power.
+
+Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++----
+ .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+index 7c971198fa956..72a2a2bff0a93 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+@@ -71,14 +71,14 @@ &i2c1 {
+ i2c-scl-internal-delay-ns = <10000>;
+
+ touchscreen: touchscreen@10 {
+- compatible = "hid-over-i2c";
++ compatible = "elan,ekth6915";
+ reg = <0x10>;
+ interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&touchscreen_pins>;
+- post-power-on-delay-ms = <10>;
+- hid-descr-addr = <0x0001>;
+- vdd-supply = <&pp3300_s3>;
++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
++ vcc33-supply = <&pp3300_s3>;
++ no-reset-on-power-off;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+index 26d3451a5e47c..24d9ede63eaa2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
+ CROS_STD_MAIN_KEYMAP
+ >;
+ };
++
++&touchscreen {
++ compatible = "elan,ekth6a12nay";
++};
+--
+2.51.0
+
--- /dev/null
+From 88245d7ba267411e7e5f44596c25eafdb902b76c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 17:59:59 +0800
+Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from
+ pcie0
+
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+
+[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
+
+When test suspend resume with 6.8 based kernel, system can't resume
+and I got below error which can be also reproduced with 6.16 rc6+
+kernel.
+
+mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
+mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
+mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
+
+After investigation, looks pcie0 has the same problem as pcie1 as
+decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
+Remove suspend-breaking reset from pcie1").
+
+Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
+Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index dd065b1bf94a3..50cf014522082 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 {
+
+ power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
+
+- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
+- reset-names = "mac";
+-
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+--
+2.51.0
+
--- /dev/null
+From 3e23a8c1a505430a587e8c65ce880771ba02b8ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:13 +0200
+Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator
+ nodes
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]
+
+All of the MT6360 regulator nodes were wrong and would not probe
+because the regulator names are supposed to be lower case, but
+they are upper case in this devicetree.
+
+Change all nodes to be lower case to get working regulators.
+
+Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+index 4985b65925a9e..d16f545cbbb27 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+@@ -352,7 +352,7 @@ regulator {
+ LDO_VIN2-supply = <&vsys>;
+ LDO_VIN3-supply = <&vsys>;
+
+- mt6360_buck1: BUCK1 {
++ mt6360_buck1: buck1 {
+ regulator-name = "emi_vdd2";
+ regulator-min-microvolt = <600000>;
+ regulator-max-microvolt = <1800000>;
+@@ -362,7 +362,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_buck2: BUCK2 {
++ mt6360_buck2: buck2 {
+ regulator-name = "emi_vddq";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1300000>;
+@@ -372,7 +372,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_ldo1: LDO1 {
++ mt6360_ldo1: ldo1 {
+ regulator-name = "mt6360_ldo1"; /* Test point */
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo2: LDO2 {
++ mt6360_ldo2: ldo2 {
+ regulator-name = "panel1_p1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo3: LDO3 {
++ mt6360_ldo3: ldo3 {
+ regulator-name = "vmc_pmu";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo5: LDO5 {
++ mt6360_ldo5: ldo5 {
+ regulator-name = "vmch_pmu";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo6: LDO6 {
++ mt6360_ldo6: ldo6 {
+ regulator-name = "mt6360_ldo6"; /* Test point */
+ regulator-min-microvolt = <500000>;
+ regulator-max-microvolt = <2100000>;
+@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo7: LDO7 {
++ mt6360_ldo7: ldo7 {
+ regulator-name = "emi_vmddr_en";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+--
+2.51.0
+
--- /dev/null
+From f77c47b71ab518444fca7af6af670e178592635c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 6df49391425ae1c653b69a8ac2c27a1f7f52d759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 13:19:53 +0100
+Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
+
+On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
+are deleting a wrong and nonexistent node. Fixing the wrong node would
+invoke a dtb warning message, as channel0 is a required property.
+Disable CAN-FD channel0 instead of deleting the node.
+
+Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+index 345b779e4f601..f3d7eff0d2f2a 100644
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+@@ -48,7 +48,10 @@ sound_card {
+ #if (SW_SCIF_CAN || SW_RSPI_CAN)
+ &canfd {
+ pinctrl-0 = <&can1_pins>;
+- /delete-node/ channel@0;
++
++ channel0 {
++ status = "disabled";
++ };
+ };
+ #else
+ &canfd {
+--
+2.51.0
+
--- /dev/null
+From f2a628c26e02df0a853317a596dcacb55b501630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 01:58:11 +0200
+Subject: arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on
+ EVTB1
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ]
+
+Invert the polarity of microSD voltage selector on Retronix R-Car V4H
+Sparrow Hawk board. The voltage selector was not populated on prototype
+EVTA1 boards, and is implemented slightly different on EVTB1 boards. As
+the EVTA1 boards are from a limited run and generally not available,
+update the DT to make it compatible with EVTB1 microSD voltage selector.
+
+Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+index 6955eafd8d6ab..3155a201ecd1a 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+@@ -178,7 +178,7 @@ vcc_sdhi: regulator-vcc-sdhi {
+ regulator-max-microvolt = <3300000>;
+ gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>;
+ gpios-states = <1>;
+- states = <3300000 0>, <1800000 1>;
++ states = <1800000 0>, <3300000 1>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a2ce048af8aa4234cf005b232d9fc3dafe0d48b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 21:28:04 +0200
+Subject: arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ]
+
+The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply
+for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the
+change in IO voltage. Since the VDDQ18_25_AVB power rail is shared,
+all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to
+be configured the same way. As the EVTA1 boards are from a limited run
+and generally not available, update the DT to make it compatible with
+EVTB1 IO voltage settings.
+
+Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+index 3155a201ecd1a..05ddd1c62ccdf 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+@@ -529,6 +529,10 @@ pins-mii {
+ drive-strength = <21>;
+ };
+
++ pins-vddq18-25-avb {
++ pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0";
++ power-source = <1800>;
++ };
+ };
+
+ /* Page 28 / CANFD_IF */
+--
+2.51.0
+
--- /dev/null
+From c409787664eaf2381435bd89691329bc7b7e7432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 22:01:11 +0530
+Subject: arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU
+ R5F cores
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ]
+
+The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi
+for its MCU domain, but it does not override the firmware-name property
+for its R5F cores. This causes the wrong firmware binaries to be
+referenced.
+
+Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the
+firmware-name property with correct names for J742s2.
+
+Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family")
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++
+ arch/arm64/boot/dts/ti/k3-j742s2.dtsi | 1 +
+ 2 files changed, 18 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+new file mode 100644
+index 0000000000000..61db2348d6a47
+--- /dev/null
++++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: GPL-2.0-only OR MIT
++/*
++ * Device Tree Source for J742S2 SoC Family
++ *
++ * TRM: https://www.ti.com/lit/pdf/spruje3
++ *
++ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/
++ *
++ */
++
++&mcu_r5fss0_core0 {
++ firmware-name = "j742s2-mcu-r5f0_0-fw";
++};
++
++&mcu_r5fss0_core1 {
++ firmware-name = "j742s2-mcu-r5f0_1-fw";
++};
+diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+index 7a72f82f56d68..d265df1abade1 100644
+--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+@@ -96,3 +96,4 @@ cpu3: cpu@3 {
+ };
+
+ #include "k3-j742s2-main.dtsi"
++#include "k3-j742s2-mcu-wakeup.dtsi"
+--
+2.51.0
+
--- /dev/null
+From b6d08893f4f9341435e236f7894290c7604dfc8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 62594e7966ab0..b384d38654e65 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -47,7 +47,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From 8099c9b9dfde84bb6dd9f447e2ae9efd807666b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 0f3b8f44e7011..bc846558480e4 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -68,7 +68,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From bda62e0d060f8f3c97e00538742371d6216b03a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 67c62844ca2a9..604a35d380e9a 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From c7d12eaf58b306956e0c6a5104c93560f5fba63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:48:53 +0800
+Subject: ASoC: Intel: hda-sdw-bpt: set persistent_buffer false
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ]
+
+The persistent_buffer agreement is false when hda_cl_prepare() is
+called. We should use the same value when hda_cl_cleanup() is called.
+
+Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
+Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-sdw-bpt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c
+index 1327f1cad0bcd..ff5abccf0d88b 100644
+--- a/sound/soc/sof/intel/hda-sdw-bpt.c
++++ b/sound/soc/sof/intel/hda-sdw-bpt.c
+@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream
+ u32 mask;
+ int ret;
+
+- ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream);
++ ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream);
+ if (ret < 0) {
+ dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n",
+ __func__);
+--
+2.51.0
+
--- /dev/null
+From a94ee84af9a9fe6549598105f70fc2025a1870a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:02:35 +0100
+Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]
+
+In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
+is not NULL before calling it.
+
+The original code assumed that if include_sidecar is true, the codec
+on that link has an add_sidecar callback. But there could be other
+codecs on the same link that do not have an add_sidecar callback.
+
+Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index c576ec5527f91..aed05b19ef5ae 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
+ (*codec_conf)++;
+ }
+
+- if (sof_end->include_sidecar) {
++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
+ ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 92f87fb1c59c5e9add3f6cd4f8e8a603371f0817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 24656980f4431..5c399ac562eae 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From b2d6bf4581c666580a27b909f7728d46606fb3da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 18:24:11 +0800
+Subject: blk-throttle: fix access race during throttle policy activation
+
+From: Han Guangjiang <hanguangjiang@lixiang.com>
+
+[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ]
+
+On repeated cold boots we occasionally hit a NULL pointer crash in
+blk_should_throtl() when throttling is consulted before the throttle
+policy is fully enabled for the queue. Checking only q->td != NULL is
+insufficient during early initialization, so blkg_to_pd() for the
+throttle policy can still return NULL and blkg_to_tg() becomes NULL,
+which later gets dereferenced.
+
+ Unable to handle kernel NULL pointer dereference
+ at virtual address 0000000000000156
+ ...
+ pc : submit_bio_noacct+0x14c/0x4c8
+ lr : submit_bio_noacct+0x48/0x4c8
+ sp : ffff800087f0b690
+ x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0
+ x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70
+ x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
+ x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff
+ x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c
+ x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60
+ x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002
+ x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500
+ x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a
+ Call trace:
+ submit_bio_noacct+0x14c/0x4c8
+ verity_map+0x178/0x2c8
+ __map_bio+0x228/0x250
+ dm_submit_bio+0x1c4/0x678
+ __submit_bio+0x170/0x230
+ submit_bio_noacct_nocheck+0x16c/0x388
+ submit_bio_noacct+0x16c/0x4c8
+ submit_bio+0xb4/0x210
+ f2fs_submit_read_bio+0x4c/0xf0
+ f2fs_mpage_readpages+0x3b0/0x5f0
+ f2fs_readahead+0x90/0xe8
+
+Tighten blk_throtl_activated() to also require that the throttle policy
+bit is set on the queue:
+
+ return q->td != NULL &&
+ test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
+
+This prevents blk_should_throtl() from accessing throttle group state
+until policy data has been attached to blkgs.
+
+Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration")
+Co-developed-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Han Guangjiang <hanguangjiang@lixiang.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 ------
+ block/blk-cgroup.h | 6 ++++++
+ block/blk-throttle.c | 6 +-----
+ block/blk-throttle.h | 18 +++++++++++-------
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 5936db7f8475b..754fdfcdfb4ff 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void)
+ return task_css(current, io_cgrp_id);
+ }
+
+-static bool blkcg_policy_enabled(struct request_queue *q,
+- const struct blkcg_policy *pol)
+-{
+- return pol && test_bit(pol->plid, q->blkcg_pols);
+-}
+-
+ static void blkg_free_workfn(struct work_struct *work)
+ {
+ struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 81868ad86330c..83367086cb6ae 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
+ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
+ }
+
++static inline bool blkcg_policy_enabled(struct request_queue *q,
++ const struct blkcg_policy *pol)
++{
++ return pol && test_bit(pol->plid, q->blkcg_pols);
++}
++
+ void blk_cgroup_bio_start(struct bio *bio);
+ void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta);
+ #else /* CONFIG_BLK_CGROUP */
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 397b6a410f9e5..cfa1cd60d2c5f 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk)
+ INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
+ throtl_service_queue_init(&td->service_queue);
+
+- /*
+- * Freeze queue before activating policy, to synchronize with IO path,
+- * which is protected by 'q_usage_counter'.
+- */
+ memflags = blk_mq_freeze_queue(disk->queue);
+ blk_mq_quiesce_queue(disk->queue);
+
+ q->td = td;
+ td->queue = q;
+
+- /* activate policy */
++ /* activate policy, blk_throtl_activated() will return true */
+ ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
+ if (ret) {
+ q->td = NULL;
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index 3b27755bfbff1..9d7a42c039a15 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk);
+
+ static inline bool blk_throtl_activated(struct request_queue *q)
+ {
+- return q->td != NULL;
++ /*
++ * q->td guarantees that the blk-throttle module is already loaded,
++ * and the plid of blk-throttle is assigned.
++ * blkcg_policy_enabled() guarantees that the policy is activated
++ * in the request_queue.
++ */
++ return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl);
+ }
+
+ static inline bool blk_should_throtl(struct bio *bio)
+@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio)
+ struct throtl_grp *tg;
+ int rw = bio_data_dir(bio);
+
+- /*
+- * This is called under bio_queue_enter(), and it's synchronized with
+- * the activation of blk-throtl, which is protected by
+- * blk_mq_freeze_queue().
+- */
+ if (!blk_throtl_activated(bio->bi_bdev->bd_queue))
+ return false;
+
+@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio)
+
+ static inline bool blk_throtl_bio(struct bio *bio)
+ {
+-
++ /*
++ * block throttling takes effect if the policy is activated
++ * in the bio's request_queue.
++ */
+ if (!blk_should_throtl(bio))
+ return false;
+
+--
+2.51.0
+
--- /dev/null
+From decb72d096d07d2d390b9dddc8e4af34b0cefc5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 15:55:39 +0800
+Subject: blk-throttle: fix throtl_data leak during disk release
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ]
+
+Tightening the throttle activation check in blk_throtl_activated() to
+require both q->td presence and policy bit set introduced a memory leak
+during disk release:
+
+blkg_destroy_all() clears the policy bit first during queue deactivation,
+causing subsequent blk_throtl_exit() to skip throtl_data cleanup when
+blk_throtl_activated() fails policy check.
+
+Idealy we should avoid modifying blk_throtl_exit() activation check because
+it's intuitive that blk-throtl start from blk_throtl_init() and end in
+blk_throtl_exit(). However, call blk_throtl_exit() before
+blkg_destroy_all() will make a long term deadlock problem easier to
+trigger[1], hence fix this problem by checking if q->td is NULL from
+blk_throtl_exit(), and remove policy deactivation as well since it's
+useless.
+
+[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t
+
+Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-throttle.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index cfa1cd60d2c5f..95bf175c2a135 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk)
+ {
+ struct request_queue *q = disk->queue;
+
+- if (!blk_throtl_activated(q))
++ /*
++ * blkg_destroy_all() already deactivate throtl policy, just check and
++ * free throtl data.
++ */
++ if (!q->td)
+ return;
+
+ timer_delete_sync(&q->td->service_queue.pending_timer);
+ throtl_shutdown_wq(q);
+- blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
+ kfree(q->td);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4e2f1a446647c50905372bc444c10d038a8f42e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 44dabc636a592..12648d7d37177 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -697,7 +697,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
+
+--
+2.51.0
+
--- /dev/null
+From d3925c8fe8b3f1340871bbf4b4fa30f9a148c457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 12:30:05 -0400
+Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
+ advertisements
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
+
+When creating an advertisement for BIG the address shall not be
+non-resolvable since in case of acting as BASS/Broadcast Assistant the
+address must be the same as the connection in order to use the PAST
+method and even when PAST/BASS are not in the picture a Periodic
+Advertisement can still be synchronized thus the same argument as to
+connectable advertisements still stand.
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 7ca544d7791f4..775a1bbdd0b15 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+ struct hci_rp_le_set_ext_adv_params rp;
+- bool connectable;
++ bool connectable, require_privacy;
+ u32 flags;
+ bdaddr_t random_addr;
+ u8 own_addr_type;
+@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ return -EPERM;
+
+ /* Set require_privacy to true only when non-connectable
+- * advertising is used. In that case it is fine to use a
+- * non-resolvable private address.
++ * advertising is used and it is not periodic.
++ * In that case it is fine to use a non-resolvable private address.
+ */
+- err = hci_get_random_address(hdev, !connectable,
++ require_privacy = !connectable && !(adv && adv->periodic);
++
++ err = hci_get_random_address(hdev, require_privacy,
+ adv_use_rpa(hdev, flags), adv,
+ &own_addr_type, &random_addr);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 944b744cf71891ba10b30a82e7b789b753759b43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:22 +0300
+Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
+
+For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
+skb is leaked.
+
+Free skb after copying its data.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 72060c087d1b8..d675ad9ad1581 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -2390,7 +2390,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+ skb->len);
+ conn->rx_len -= skb->len;
+- return;
++ break;
+
+ case ISO_END:
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+--
+2.51.0
+
--- /dev/null
+From 98fc8e02dc5edb3fcf38f26e51e06f02776966ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:27:51 -0400
+Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
+
+This attempt to fix similar issue to sco_conn_free where if the
+conn->sk is not set to NULL may lead to UAF on iso_conn_free.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index c21566e1494a9..361d89c0ff533 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk)
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ if (iso_pi(sk)->conn) {
++ iso_conn_lock(iso_pi(sk)->conn);
++ iso_pi(sk)->conn->sk = NULL;
++ iso_conn_unlock(iso_pi(sk)->conn);
++ }
++
+ /* Kill poor orphan */
+ bt_sock_unlink(&iso_sk_list, sk);
+ sock_set_flag(sk, SOCK_DEAD);
+--
+2.51.0
+
--- /dev/null
+From 6b76560cb85d0d1803917c9c7c3549ace2c99903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:21 +0300
+Subject: Bluetooth: ISO: free rx_skb if not consumed
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]
+
+If iso_conn is freed when RX is incomplete, free any leftover skb piece.
+
+Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 361d89c0ff533..72060c087d1b8 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
+ /* Ensure no more work items will run since hci_conn has been dropped */
+ disable_delayed_work_sync(&conn->timeout_work);
+
++ kfree_skb(conn->rx_skb);
++
+ kfree(conn);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b6c4dc492af39f83a7938361d30ddbc56a5d112c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 225140fcb3d6c..a3d16eece0d23 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ return -ENOMEM;
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev && hci_dev_le_state_simultaneous(hdev)) {
+--
+2.51.0
+
--- /dev/null
+From a31a6286cf75b7409e4af3b739c0023617d32042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:33:03 +0000
+Subject: bonding: fix xfrm offload feature setup on active-backup mode
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
+
+The active-backup bonding mode supports XFRM ESP offload. However, when
+a bond is added using command like `ip link add bond0 type bond mode 1
+miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is
+disabled. This occurs because, in bond_newlink(), we change bond link
+first and register bond device later. So the XFRM feature update in
+bond_option_mode_set() is not called as the bond device is not yet
+registered, leading to the offload feature not being set successfully.
+
+To resolve this issue, we can modify the code order in bond_newlink() to
+ensure that the bond device is registered first before changing the bond
+link parameters. This change will allow the XFRM ESP offload feature to be
+correctly enabled.
+
+Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 2 +-
+ drivers/net/bonding/bond_netlink.c | 16 +++++++++-------
+ include/net/bonding.h | 1 +
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index e23195dd74776..0f87aefcec297 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4394,7 +4394,7 @@ void bond_work_init_all(struct bonding *bond)
+ INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
+ }
+
+-static void bond_work_cancel_all(struct bonding *bond)
++void bond_work_cancel_all(struct bonding *bond)
+ {
+ cancel_delayed_work_sync(&bond->mii_work);
+ cancel_delayed_work_sync(&bond->arp_work);
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index ac5e402c34bc6..5024bd58c4fdd 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -568,20 +568,22 @@ static int bond_newlink(struct net_device *bond_dev,
+ struct rtnl_newlink_params *params,
+ struct netlink_ext_ack *extack)
+ {
++ struct bonding *bond = netdev_priv(bond_dev);
+ struct nlattr **data = params->data;
+ struct nlattr **tb = params->tb;
+ int err;
+
+- err = bond_changelink(bond_dev, tb, data, extack);
+- if (err < 0)
++ err = register_netdevice(bond_dev);
++ if (err)
+ return err;
+
+- err = register_netdevice(bond_dev);
+- if (!err) {
+- struct bonding *bond = netdev_priv(bond_dev);
++ netif_carrier_off(bond_dev);
++ bond_work_init_all(bond);
+
+- netif_carrier_off(bond_dev);
+- bond_work_init_all(bond);
++ err = bond_changelink(bond_dev, tb, data, extack);
++ if (err) {
++ bond_work_cancel_all(bond);
++ unregister_netdevice(bond_dev);
+ }
+
+ return err;
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index 95f67b308c19a..e9b7b283b1953 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -708,6 +708,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
+ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
+ void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
+ void bond_work_init_all(struct bonding *bond);
++void bond_work_cancel_all(struct bonding *bond);
+
+ #ifdef CONFIG_PROC_FS
+ void bond_create_proc_entry(struct bonding *bond);
+--
+2.51.0
+
--- /dev/null
+From aab4dfc575e7a3130d0c29d1fcbb7197b81136bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:26:53 +0000
+Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]
+
+The current implementation seems incorrect and does NOT match the
+comment above, use bpf_jit_binary_pack_finalize() instead.
+
+Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Acked-by: Song Liu <song@kernel.org>
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 58f838b310bc5..2e01a7fdb3fa9 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -2936,8 +2936,7 @@ void bpf_jit_free(struct bpf_prog *prog)
+ * before freeing it.
+ */
+ if (jit_data) {
+- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
+- sizeof(jit_data->header->size));
++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+ kfree(jit_data);
+ }
+ hdr = bpf_jit_binary_pack_hdr(prog);
+--
+2.51.0
+
--- /dev/null
+From c198a269c6821e71c40d17fb57db14eb25e2decc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 19:12:00 +0200
+Subject: bpf: Enforce expected_attach_type for tailcall compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
+
+Yinhao et al. recently reported:
+
+ Our fuzzer tool discovered an uninitialized pointer issue in the
+ bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
+ This leads to a NULL pointer dereference when a BPF program attempts to
+ deference the txq member of struct xdp_buff object.
+
+The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
+entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
+neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
+of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
+to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
+egress_ifindex, and the latter is only allowed to be accessed under mentioned
+expected_attach_type. progB is then inserted into the tailcall which progA
+calls.
+
+The underlying issue goes beyond XDP though. Another example are programs
+of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
+as sock_addr_func_proto() have different logic depending on the programs'
+expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
+should not be allowed doing a tailcall into a program which calls bpf_bind()
+out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
+
+In short, specifying expected_attach_type allows to open up additional
+functionality or restrictions beyond what the basic bpf_prog_type enables.
+The use of tailcalls must not violate these constraints. Fix it by enforcing
+expected_attach_type in __bpf_prog_map_compatible().
+
+Note that we only enforce this for tailcall maps, but not for BPF devmaps or
+cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
+cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
+these situations are not prone to this issue.
+
+Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
+Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
+Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index bcae876a2a603..e8f4a6efb053d 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -285,6 +285,7 @@ struct bpf_map_owner {
+ bool xdp_has_frags;
+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
+ const struct btf_type *attach_func_proto;
++ enum bpf_attach_type expected_attach_type;
+ };
+
+ struct bpf_map {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 17e5cf18da1ef..b9015a8322174 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2381,6 +2381,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ map->owner->type = prog_type;
+ map->owner->jited = fp->jited;
+ map->owner->xdp_has_frags = aux->xdp_has_frags;
++ map->owner->expected_attach_type = fp->expected_attach_type;
+ map->owner->attach_func_proto = aux->attach_func_proto;
+ for_each_cgroup_storage_type(i) {
+ map->owner->storage_cookie[i] =
+@@ -2392,6 +2393,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ ret = map->owner->type == prog_type &&
+ map->owner->jited == fp->jited &&
+ map->owner->xdp_has_frags == aux->xdp_has_frags;
++ if (ret &&
++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
++ map->owner->expected_attach_type != fp->expected_attach_type)
++ ret = false;
+ for_each_cgroup_storage_type(i) {
+ if (!ret)
+ break;
+--
+2.51.0
+
--- /dev/null
+From 3280f8d03541448ad679b64418ad3513c67e74df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 2c3196dadd54a..11533ce08c6b3 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -9275,13 +9275,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 24ce4afc7cadceddbe59eab541996a3c39d23057 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 10:14:26 +0200
+Subject: bpf: Mark kfuncs as __noclone
+
+From: Andrea Righi <arighi@nvidia.com>
+
+[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]
+
+Some distributions (e.g., CachyOS) support building the kernel with -O3,
+but doing so may break kfuncs, resulting in their symbols not being
+properly exported.
+
+In fact, with gcc -O3, some kfuncs may be optimized away despite being
+annotated as noinline. This happens because gcc can still clone the
+function during IPA optimizations, e.g., by duplicating or inlining it
+into callers, and then dropping the standalone symbol. This breaks BTF
+ID resolution since resolve_btfids relies on the presence of a global
+symbol for each kfunc.
+
+Currently, this is not an issue for upstream, because we don't allow
+building the kernel with -O3, but it may be safer to address it anyway,
+to prevent potential issues in the future if compilers become more
+aggressive with optimizations.
+
+Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
+cloned and remain distinct, globally visible symbols, regardless of
+the optimization level.
+
+Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
+Acked-by: David Vernet <void@manifault.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/btf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/btf.h b/include/linux/btf.h
+index b2983706292f7..de2bf13e71905 100644
+--- a/include/linux/btf.h
++++ b/include/linux/btf.h
+@@ -86,7 +86,7 @@
+ * as to avoid issues such as the compiler inlining or eliding either a static
+ * kfunc, or a global kfunc in an LTO build.
+ */
+-#define __bpf_kfunc __used __retain noinline
++#define __bpf_kfunc __used __retain __noclone noinline
+
+ #define __bpf_kfunc_start_defs() \
+ __diag_push(); \
+--
+2.51.0
+
--- /dev/null
+From 020c75d1162488593fb2edcf6bc5180ff154c813 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 23:04:33 +0800
+Subject: bpf: Reject negative offsets for ALU ops
+
+From: Yazhou Tang <tangyazhou518@outlook.com>
+
+[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
+
+When verifying BPF programs, the check_alu_op() function validates
+instructions with ALU operations. The 'offset' field in these
+instructions is a signed 16-bit integer.
+
+The existing check 'insn->off > 1' was intended to ensure the offset is
+either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
+signed, this check incorrectly accepts all negative values (e.g., -1).
+
+This commit tightens the validation by changing the condition to
+'(insn->off != 0 && insn->off != 1)'. This ensures that any value
+other than the explicitly permitted 0 and 1 is rejected, hardening the
+verifier against malformed BPF programs.
+
+Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
+Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a6338936085ae..48b3765456553 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15521,7 +15521,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ } else { /* all other ALU ops: and, sub, xor, add, ... */
+
+ if (BPF_SRC(insn->code) == BPF_X) {
+- if (insn->imm != 0 || insn->off > 1 ||
++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+@@ -15531,7 +15531,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ if (err)
+ return err;
+ } else {
+- if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 3eec35b2d1cf2a0c978728246211201d5868f6b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:14:29 +0800
+Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
+
+Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
+called all the way from graph tracer, which disables preemption in
+function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
+need to use migrate_disable. As a result, some overhead may will be reduced.
+And add cant_sleep check for __this_cpu_inc_return.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 132c8be6f635c..60e89f56dec3f 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2703,20 +2703,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ struct pt_regs *regs;
+ int err;
+
++ /*
++ * graph tracer framework ensures we won't migrate, so there is no need
++ * to use migrate_disable for bpf_prog_run again. The check here just for
++ * __this_cpu_inc_return.
++ */
++ cant_sleep();
++
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+ bpf_prog_inc_misses_counter(link->link.prog);
+ err = 1;
+ goto out;
+ }
+
+- migrate_disable();
+ rcu_read_lock();
+ regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr());
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
+ rcu_read_unlock();
+- migrate_enable();
+
+ out:
+ __this_cpu_dec(bpf_prog_active);
+--
+2.51.0
+
--- /dev/null
+From ef4d8037927f36260b36df8570f884e6cfffb5db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:12:14 +0000
+Subject: bpf/selftests: Fix test_tcpnotify_user
+
+From: Matt Bobrowski <mattbobrowski@google.com>
+
+[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
+
+Based on a bisect, it appears that commit 7ee988770326 ("timers:
+Implement the hierarchical pull model") has somehow inadvertently
+broken BPF selftest test_tcpnotify_user. The error that is being
+generated by this test is as follows:
+
+ FAILED: Wrong stats Expected 10 calls, got 8
+
+It looks like the change allows timer functions to be run on CPUs
+different from the one they are armed on. The test had pinned itself
+to CPU 0, and in the past the retransmit attempts also occurred on CPU
+0. The test had set the max_entries attribute for
+BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
+bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
+likely to be in range. With the change to allow timers to run on other
+CPUs, the current CPU tasked with performing the retransmit might be
+bumped and in turn fall out of range, as the event will be filtered
+out via __bpf_perf_event_output() using:
+
+ if (unlikely(index >= array->map.max_entries))
+ return -E2BIG;
+
+A possible change would be to explicitly set the max_entries attribute
+for perf_event_map in test_tcpnotify_kern.c to a value that's at least
+as large as the number of CPUs. As it turns out however, if the field
+is left unset, then the libbpf will determine the number of CPUs available
+on the underlying system and update the max_entries attribute accordingly
+in map_set_def_max_entries().
+
+A further problem with the test is that it has a thread that continues
+running up until the program exits. The main thread cleans up some
+LIBBPF data structures, while the other thread continues to use them,
+which inevitably will trigger a SIGSEGV. This can be dealt with by
+telling the thread to run for as long as necessary and doing a
+pthread_join on it before exiting the program.
+
+Finally, I don't think binding the process to CPU 0 is meaningful for
+this test any more, so get rid of that.
+
+Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
+Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
+ .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+index 540181c115a85..ef00d38b0a8d2 100644
+--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+@@ -23,7 +23,6 @@ struct {
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+- __uint(max_entries, 2);
+ __type(key, int);
+ __type(value, __u32);
+ } perf_event_map SEC(".maps");
+diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+index 595194453ff8f..35b4893ccdf8a 100644
+--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+@@ -15,20 +15,18 @@
+ #include <bpf/libbpf.h>
+ #include <sys/ioctl.h>
+ #include <linux/rtnetlink.h>
+-#include <signal.h>
+ #include <linux/perf_event.h>
+-#include <linux/err.h>
+
+-#include "bpf_util.h"
+ #include "cgroup_helpers.h"
+
+ #include "test_tcpnotify.h"
+-#include "trace_helpers.h"
+ #include "testing_helpers.h"
+
+ #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+
+ pthread_t tid;
++static bool exit_thread;
++
+ int rx_callbacks;
+
+ static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
+@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
+ {
+ int err;
+
+- while (1) {
++ while (!exit_thread) {
+ err = perf_buffer__poll(pb, 100);
+ if (err < 0 && err != -EINTR) {
+ printf("failed perf_buffer__poll: %d\n", err);
+@@ -78,15 +76,10 @@ int main(int argc, char **argv)
+ int error = EXIT_FAILURE;
+ struct bpf_object *obj;
+ char test_script[80];
+- cpu_set_t cpuset;
+ __u32 key = 0;
+
+ libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(0, &cpuset);
+- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
+-
+ cg_fd = cgroup_setup_and_join(cg_path);
+ if (cg_fd < 0)
+ goto err;
+@@ -151,6 +144,13 @@ int main(int argc, char **argv)
+
+ sleep(10);
+
++ exit_thread = true;
++ int ret = pthread_join(tid, NULL);
++ if (ret) {
++ printf("FAILED: pthread_join\n");
++ goto err;
++ }
++
+ if (verify_result(&g)) {
+ printf("FAILED: Wrong stats Expected %d calls, got %d\n",
+ g.ncalls, rx_callbacks);
+--
+2.51.0
+
--- /dev/null
+From 9bf89434aae0c7b45b0f4383b635a0dde76200ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:58:20 +0200
+Subject: bpf: Tidy verifier bug message
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ]
+
+Yonghong noticed that error messages for potential verifier bugs often
+have a '(1)' at the end. This is happening because verifier_bug_if(cond,
+env, fmt, args...) prints "(" #cond ")\n" as part of the message and
+verifier_bug() is defined as:
+
+ #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
+
+Hence, verifier_bug() always ends up displaying '(1)'. This small patch
+fixes it by having verifier_bug_if conditionally call verifier_bug
+instead of the other way around.
+
+Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs")
+Reported-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf_verifier.h | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 256274acb1d86..e824d091ad2b0 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -846,13 +846,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
+ #define verifier_bug_if(cond, env, fmt, args...) \
+ ({ \
+ bool __cond = (cond); \
+- if (unlikely(__cond)) { \
+- BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args); \
+- bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args); \
+- } \
++ if (unlikely(__cond)) \
++ verifier_bug(env, fmt " (" #cond ")", ##args); \
+ (__cond); \
+ })
+-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
++#define verifier_bug(env, fmt, args...) \
++ ({ \
++ BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args); \
++ bpf_log(&env->log, "verifier bug: " fmt "\n", ##args); \
++ })
+
+ static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env)
+ {
+--
+2.51.0
+
--- /dev/null
+From b671c0817fec5f7295f7ff928589f1014a266b46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 08:40:45 +0930
+Subject: btrfs: return any hit error from extent_writepage_io()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]
+
+Since the support of bs < ps support, extent_writepage_io() will submit
+multiple blocks inside the folio.
+
+But if we hit error submitting one sector, but the next sector can still
+be submitted successfully, the function extent_writepage_io() will still
+return 0.
+
+This will make btrfs to silently ignore the error without setting error
+flag for the filemap.
+
+Fix it by recording the first error hit, and always return that value.
+
+Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
+Reviewed-by: Daniel Vacek <neelx@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index b843db855f402..40ec2e0a14c9f 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1622,7 +1622,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ unsigned long range_bitmap = 0;
+ bool submitted_io = false;
+- bool error = false;
++ int found_error = 0;
+ const u64 folio_start = folio_pos(folio);
+ const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio);
+ u64 cur;
+@@ -1682,7 +1682,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ */
+ btrfs_mark_ordered_io_finished(inode, folio, cur,
+ fs_info->sectorsize, false);
+- error = true;
++ if (!found_error)
++ found_error = ret;
+ continue;
+ }
+ submitted_io = true;
+@@ -1699,11 +1700,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ * If we hit any error, the corresponding sector will have its dirty
+ * flag cleared and writeback finished, thus no need to handle the error case.
+ */
+- if (!submitted_io && !error) {
++ if (!submitted_io && !found_error) {
+ btrfs_folio_set_writeback(fs_info, folio, start, len);
+ btrfs_folio_clear_writeback(fs_info, folio, start, len);
+ }
+- return ret;
++ return found_error;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 264f0a08cec5552d555d96f524d1816f3469cce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 13:19:35 +0200
+Subject: clocksource/drivers/tegra186: Avoid 64-bit division
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ]
+
+The newly added function causes a build failure on 32-bit targets with
+older compiler version such as gcc-10:
+
+arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft':
+timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod'
+
+The calculation can trivially be changed to avoid the division entirely,
+as USEC_PER_SEC is a multiple of 5. Change both such calculation for
+consistency, even though gcc apparently managed to optimize the other one
+properly already.
+
+[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ]
+
+Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-tegra186.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
+index 7b506de654386..47bdb1e320af9 100644
+--- a/drivers/clocksource/timer-tegra186.c
++++ b/drivers/clocksource/timer-tegra186.c
+@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt)
+ tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR);
+
+ /* configure timer (system reset happens on the fifth expiration) */
+- value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) |
++ value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) |
+ TMRCR_PERIODIC | TMRCR_ENABLE;
+ tmr_writel(wdt->tmr, value, TMRCR);
+
+--
+2.51.0
+
--- /dev/null
+From b7a4ae2f9ca2850f01bed1b1b4b6692f44e4253b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 10:55:55 -0700
+Subject: clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ]
+
+Building the driver on xtensa fails with
+
+tensa-linux-ld: drivers/clocksource/timer-tegra186.o:
+ in function `tegra186_timer_remove':
+timer-tegra186.c:(.text+0x350):
+ undefined reference to `__udivdi3'
+
+Avoid the problem by rearranging the offending code to avoid the 64-bit
+divide operation.
+
+Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Cc: Pohsun Su <pohsuns@nvidia.com>
+Cc: Robert Lin <robelin@nvidia.com>
+Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-tegra186.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
+index e5394f98a02e6..7b506de654386 100644
+--- a/drivers/clocksource/timer-tegra186.c
++++ b/drivers/clocksource/timer-tegra186.c
+@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd)
+ * counter value to the time of the counter expirations that
+ * remain.
+ */
+- timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration);
++ timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration);
+
+ /*
+ * Convert the current counter value to seconds,
+--
+2.51.0
+
--- /dev/null
+From f22c0c167019dec23469f07e06de773d99b073b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:40 +0100
+Subject: coresight: Appropriately disable programming clocks
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ]
+
+Some CoreSight components have programming clocks (pclk) and are enabled
+using clk_get() and clk_prepare_enable(). However, in many cases, these
+clocks are not disabled when modules exit and only released by clk_put().
+
+To fix the issue, this commit refactors programming clock by replacing
+clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled()
+for enabling APB clock. If the "apb_pclk" clock is not found, a NULL
+pointer is returned, and the function proceeds to attempt enabling the
+"apb" clock.
+
+Since ACPI platforms rely on firmware to manage clocks, returning a NULL
+pointer in this case leaves clock management to the firmware rather than
+the driver. This effectively avoids a clock imbalance issue during
+module removal - where the clock could be disabled twice: once during
+the ACPI runtime suspend and again during the devm resource release.
+
+Callers are updated to reuse the returned error value.
+
+With the change, programming clocks are managed as resources in driver
+model layer, allowing clock cleanup to be handled automatically. As a
+result, manual cleanup operations are no longer needed and are removed
+from the Coresight drivers.
+
+Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 9 ++------
+ .../hwtracing/coresight/coresight-cpu-debug.c | 6 +----
+ .../hwtracing/coresight/coresight-ctcu-core.c | 10 ++-------
+ .../coresight/coresight-etm4x-core.c | 9 ++------
+ .../hwtracing/coresight/coresight-funnel.c | 6 +----
+ .../coresight/coresight-replicator.c | 6 +----
+ drivers/hwtracing/coresight/coresight-stm.c | 4 +---
+ .../hwtracing/coresight/coresight-tmc-core.c | 4 +---
+ drivers/hwtracing/coresight/coresight-tpiu.c | 4 +---
+ include/linux/coresight.h | 22 ++++++++-----------
+ 10 files changed, 21 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index af2a55f0c907c..4c345ff2cff14 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ pm_runtime_get_noresume(&pdev->dev);
+ pm_runtime_set_active(&pdev->dev);
+@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev)
+ dev_set_drvdata(&pdev->dev, drvdata);
+ ret = __catu_probe(&pdev->dev, res);
+ pm_runtime_put(&pdev->dev);
+- if (ret) {
++ if (ret)
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+- }
+
+ return ret;
+ }
+@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev)
+
+ __catu_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+index a871d997330b0..e39dfb886688e 100644
+--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+ pm_runtime_get_noresume(&pdev->dev);
+@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev)
+ if (ret) {
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+ return ret;
+ }
+@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev)
+
+ __debug_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c
+index c6bafc96db963..de279efe34058 100644
+--- a/drivers/hwtracing/coresight/coresight-ctcu-core.c
++++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c
+@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev)
+
+ drvdata->apb_clk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->apb_clk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->apb_clk);
+
+ cfgs = of_device_get_match_data(dev);
+ if (cfgs) {
+@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev)
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
+- clk_put(drvdata->apb_clk);
+-
++ if (IS_ERR(drvdata->csdev))
+ return PTR_ERR(drvdata->csdev);
+- }
+
+ return 0;
+ }
+@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev)
+
+ ctcu_remove(pdev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
+- clk_put(drvdata->apb_clk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 81f20a167e001..4b98a7bf4cb73 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ if (res) {
+ drvdata->base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(drvdata->base)) {
+- clk_put(drvdata->pclk);
++ if (IS_ERR(drvdata->base))
+ return PTR_ERR(drvdata->base);
+- }
+ }
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev)
+ if (drvdata)
+ etm4_remove_dev(drvdata);
+ pm_runtime_disable(&pdev->dev);
+-
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ static const struct amba_id etm4_ids[] = {
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
+index b1922dbe9292b..36fc4e991458c 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ /*
+ * Map the device base for dynamic-funnel, which has been
+@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ out_disable_clk:
+ if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+ clk_disable_unprepare(drvdata->atclk);
+- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
+ return ret;
+ }
+
+@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev)
+
+ funnel_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ static const struct of_device_id funnel_match[] = {
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
+index 06efd2b01a0f7..6dd24eb10a94b 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ /*
+ * Map the device base for dynamic-replicator, which has been
+@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ out_disable_clk:
+ if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+ clk_disable_unprepare(drvdata->atclk);
+- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
+ return ret;
+ }
+
+@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev)
+
+ replicator_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
+index e45c6c7204b44..88ee453b28154 100644
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+ dev_set_drvdata(dev, drvdata);
+
+ base = devm_ioremap_resource(dev, res);
+@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev)
+
+ __stm_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 0b5e7635a084d..e867198b03e82 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+ pm_runtime_get_noresume(&pdev->dev);
+@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev)
+
+ __tmc_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index 3e01592884280..b2559c6fac6d2 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+ dev_set_drvdata(dev, drvdata);
+
+ /* Validity for the resource is already checked by the AMBA core */
+@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev)
+
+ __tpiu_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/include/linux/coresight.h b/include/linux/coresight.h
+index 4ac65c68bbf44..1e652e1578419 100644
+--- a/include/linux/coresight.h
++++ b/include/linux/coresight.h
+@@ -6,6 +6,7 @@
+ #ifndef _LINUX_CORESIGHT_H
+ #define _LINUX_CORESIGHT_H
+
++#include <linux/acpi.h>
+ #include <linux/amba/bus.h>
+ #include <linux/clk.h>
+ #include <linux/device.h>
+@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base)
+ * Returns:
+ *
+ * clk - Clock is found and enabled
+- * NULL - clock is not found
++ * NULL - Clock is controlled by firmware (ACPI device only)
+ * ERROR - Clock is found but failed to enable
+ */
+ static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
+ {
+ struct clk *pclk;
+- int ret;
+
+- pclk = clk_get(dev, "apb_pclk");
+- if (IS_ERR(pclk)) {
+- pclk = clk_get(dev, "apb");
+- if (IS_ERR(pclk))
+- return NULL;
+- }
++ /* Firmware controls clocks for an ACPI device. */
++ if (has_acpi_companion(dev))
++ return NULL;
++
++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
++ if (!pclk)
++ pclk = devm_clk_get_optional_enabled(dev, "apb");
+
+- ret = clk_prepare_enable(pclk);
+- if (ret) {
+- clk_put(pclk);
+- return ERR_PTR(ret);
+- }
+ return pclk;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0dcd0ffe1b7392820aeca3c4c0d8c5b40faad624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:41 +0100
+Subject: coresight: Appropriately disable trace bus clocks
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ]
+
+Some CoreSight components have trace bus clocks 'atclk' and are enabled
+using clk_prepare_enable(). These clocks are not disabled when modules
+exit.
+
+As atclk is optional, use devm_clk_get_optional_enabled() to manage it.
+The benefit is the driver model layer can automatically disable and
+release clocks.
+
+Check the returned value with IS_ERR() to detect errors but leave the
+NULL pointer case if the clock is not found. And remove the error
+handling codes which are no longer needed.
+
+Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etb10.c | 10 +++---
+ .../coresight/coresight-etm3x-core.c | 9 ++---
+ .../hwtracing/coresight/coresight-funnel.c | 36 ++++++-------------
+ .../coresight/coresight-replicator.c | 34 ++++++------------
+ drivers/hwtracing/coresight/coresight-stm.c | 9 ++---
+ drivers/hwtracing/coresight/coresight-tpiu.c | 10 ++----
+ 6 files changed, 34 insertions(+), 74 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index d5efb085b30d3..8e81b41eb2226 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ dev_set_drvdata(dev, drvdata);
+
+ /* validity for the resource is already checked by the AMBA core */
+diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+index 1c6204e144221..baba2245b1dfb 100644
+--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
+
+ spin_lock_init(&drvdata->spinlock);
+
+- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->cpu = coresight_get_cpu(dev);
+ if (drvdata->cpu < 0)
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
+index 36fc4e991458c..b044a4125310b 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel);
+
+ static int funnel_probe(struct device *dev, struct resource *res)
+ {
+- int ret;
+ void __iomem *base;
+ struct coresight_platform_data *pdata = NULL;
+ struct funnel_drvdata *drvdata;
+@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ */
+ if (res) {
+ base = devm_ioremap_resource(dev, res);
+- if (IS_ERR(base)) {
+- ret = PTR_ERR(base);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(base))
++ return PTR_ERR(base);
+ drvdata->base = base;
+ desc.groups = coresight_funnel_groups;
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ dev_set_drvdata(dev, drvdata);
+
+ pdata = coresight_get_platform_data(dev);
+- if (IS_ERR(pdata)) {
+- ret = PTR_ERR(pdata);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(pdata))
++ return PTR_ERR(pdata);
++
+ dev->platform_data = pdata;
+
+ raw_spin_lock_init(&drvdata->spinlock);
+@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ desc.pdata = pdata;
+ desc.dev = dev;
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- ret = PTR_ERR(drvdata->csdev);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(drvdata->csdev))
++ return PTR_ERR(drvdata->csdev);
+
+- ret = 0;
+-
+-out_disable_clk:
+- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+- clk_disable_unprepare(drvdata->atclk);
+- return ret;
++ return 0;
+ }
+
+ static int funnel_remove(struct device *dev)
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
+index 6dd24eb10a94b..9e8bd36e7a9a2 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = {
+
+ static int replicator_probe(struct device *dev, struct resource *res)
+ {
+- int ret = 0;
+ struct coresight_platform_data *pdata = NULL;
+ struct replicator_drvdata *drvdata;
+ struct coresight_desc desc = { 0 };
+@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ */
+ if (res) {
+ base = devm_ioremap_resource(dev, res);
+- if (IS_ERR(base)) {
+- ret = PTR_ERR(base);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(base))
++ return PTR_ERR(base);
+ drvdata->base = base;
+ desc.groups = replicator_groups;
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ dev_set_drvdata(dev, drvdata);
+
+ pdata = coresight_get_platform_data(dev);
+- if (IS_ERR(pdata)) {
+- ret = PTR_ERR(pdata);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(pdata))
++ return PTR_ERR(pdata);
+ dev->platform_data = pdata;
+
+ raw_spin_lock_init(&drvdata->spinlock);
+@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ desc.dev = dev;
+
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- ret = PTR_ERR(drvdata->csdev);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(drvdata->csdev))
++ return PTR_ERR(drvdata->csdev);
+
+ replicator_reset(drvdata);
+-
+-out_disable_clk:
+- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+- clk_disable_unprepare(drvdata->atclk);
+- return ret;
++ return 0;
+ }
+
+ static int replicator_remove(struct device *dev)
+diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
+index 88ee453b28154..57fbe3ad0fb20 100644
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index b2559c6fac6d2..8d6179c83e5d3 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = {
+
+ static int __tpiu_probe(struct device *dev, struct resource *res)
+ {
+- int ret;
+ void __iomem *base;
+ struct coresight_platform_data *pdata = NULL;
+ struct tpiu_drvdata *drvdata;
+@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
+
+ spin_lock_init(&drvdata->spinlock);
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+--
+2.51.0
+
--- /dev/null
+From 20525270cadf81e404a6c3f6b872ed71abd6a2f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:42 +0100
+Subject: coresight: Avoid enable programming clock duplicately
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ]
+
+The programming clock is enabled by AMBA bus driver before a dynamic
+probe. As a result, a CoreSight driver may redundantly enable the same
+clock.
+
+To avoid this, add a check for device type and skip enabling the
+programming clock for AMBA devices. The returned NULL pointer will be
+tolerated by the drivers.
+
+Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/coresight.h | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/coresight.h b/include/linux/coresight.h
+index 1e652e1578419..bb49080ec8f96 100644
+--- a/include/linux/coresight.h
++++ b/include/linux/coresight.h
+@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base)
+ * Returns:
+ *
+ * clk - Clock is found and enabled
+- * NULL - Clock is controlled by firmware (ACPI device only)
++ * NULL - Clock is controlled by firmware (ACPI device only) or when managed
++ * by the AMBA bus driver instead
+ * ERROR - Clock is found but failed to enable
+ */
+ static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
+ {
+- struct clk *pclk;
++ struct clk *pclk = NULL;
+
+ /* Firmware controls clocks for an ACPI device. */
+ if (has_acpi_companion(dev))
+ return NULL;
+
+- pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
+- if (!pclk)
+- pclk = devm_clk_get_optional_enabled(dev, "apb");
++ if (!dev_is_amba(dev)) {
++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
++ if (!pclk)
++ pclk = devm_clk_get_optional_enabled(dev, "apb");
++ }
+
+ return pclk;
+ }
+--
+2.51.0
+
--- /dev/null
+From 08af03eaac810667dd2fdbfbc4da2b49469232f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:38 +0100
+Subject: coresight: catu: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]
+
+The atclk is an optional clock for the CoreSight CATU, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the CATU driver, and dynamically
+control the clock during suspend and resume.
+
+The checks for driver data and clocks in suspend and resume are not
+needed, remove them. Add error handling in the resume function.
+
+Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-catu.h | 1 +
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index 5058432233da1..af2a55f0c907c 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
+ struct coresight_platform_data *pdata = NULL;
+ void __iomem *base;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
+ if (!catu_desc.name)
+ return -ENOMEM;
+@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int catu_runtime_resume(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
+index 755776cd19c5b..6e6b7aac206dc 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.h
++++ b/drivers/hwtracing/coresight/coresight-catu.h
+@@ -62,6 +62,7 @@
+
+ struct catu_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ int irq;
+--
+2.51.0
+
--- /dev/null
+From 67b7702cb9904b701acf991b4c442f39e61e5826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 01:24:45 -0700
+Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
+
+From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+
+[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
+
+The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
+To avoid invalid accesses, introduce a check on numextinsel
+(derived from TRCIDR5[11:9]) before reading or writing to this register.
+
+Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
+Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index cbea200489c8f..b4f1834a1af1e 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+ etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
+@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info)
+ etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
+ /* NUMEXTIN, bits[8:0] number of external inputs implemented */
+ drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
+ /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
+ drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
+ /* ATBTRIG, bit[22] implementation can support ATB triggers? */
+@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
+- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
++
++ if (drvdata->numextinsel)
++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
+@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index ac649515054d9..823914fefa90a 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -162,6 +162,7 @@
+ #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
+
+ #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
+ #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
+ #define TRCIDR5_ATBTRIG BIT(22)
+ #define TRCIDR5_LPOVERRIDE BIT(23)
+@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
+ u8 nr_cntr;
+ u8 nr_ext_inp;
+ u8 numcidc;
++ u8 numextinsel;
+ u8 numvmidc;
+ u8 nrseqstate;
+ u8 nr_event;
+--
+2.51.0
+
--- /dev/null
+From c530e16abcd268e0a2e10a44cb9bbb657da3d0c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:39 +0100
+Subject: coresight: etm4x: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
+
+The atclk is an optional clock for the CoreSight ETMv4, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the ETMv4 driver, and dynamically
+control the clock during suspend and resume.
+
+No need to check the driver data and clock pointer in the runtime
+suspend and resume, so remove checks. And add error handling in the
+resume function.
+
+Add a minor fix to the comment format when adding the atclk field.
+
+Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++-
+ 2 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index b4f1834a1af1e..81f20a167e001 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev)
+ if (WARN_ON(!drvdata))
+ return -ENOMEM;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
+ pm_save_enable = coresight_loses_context_with_cpu(dev) ?
+ PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
+@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
+
+ return 0;
+ }
+@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev)
+ static int etm4_runtime_resume(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
+
+- return 0;
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 823914fefa90a..13ec9ecef46f5 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -920,7 +920,8 @@ struct etmv4_save_state {
+
+ /**
+ * struct etm4_drvdata - specifics associated to an ETM component
+- * @pclk APB clock if present, otherwise NULL
++ * @pclk: APB clock if present, otherwise NULL
++ * @atclk: Optional clock for the core parts of the ETMv4.
+ * @base: Memory mapped base address for this component.
+ * @csdev: Component vitals needed by the framework.
+ * @spinlock: Only one at a time pls.
+@@ -989,6 +990,7 @@ struct etmv4_save_state {
+ */
+ struct etmv4_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ raw_spinlock_t spinlock;
+--
+2.51.0
+
--- /dev/null
+From 8d2d40924113a0320fd0149fdf6abd56c71710b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 20:20:22 +0800
+Subject: coresight: Fix incorrect handling for return value of devm_kzalloc
+
+From: Lin Yujun <linyujun809@h-partners.com>
+
+[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]
+
+The return value of devm_kzalloc could be an null pointer,
+use "!desc.pdata" to fix incorrect handling return value
+of devm_kzalloc.
+
+Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
+Signed-off-by: Lin Yujun <linyujun809@h-partners.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 3dd2e1b4809dc..43643d2c5bdd0 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
+ * into the device for that purpose.
+ */
+ desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
+- if (IS_ERR(desc.pdata))
++ if (!desc.pdata)
+ goto cpu_clear;
+
+ desc.type = CORESIGHT_DEV_TYPE_SINK;
+--
+2.51.0
+
--- /dev/null
+From 9a7c9606be1ac38293b5eeaff6536957995da309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 11:30:25 +0100
+Subject: coresight: fix indentation error in
+ cscfg_remove_owned_csdev_configs()
+
+From: Yeoreum Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ]
+
+Fix wrong indentation in cscfg_remove_owned_csdev_configs()
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/
+Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev")
+Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-syscfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
+index 83dad24e0116d..6836b05986e80 100644
+--- a/drivers/hwtracing/coresight/coresight-syscfg.c
++++ b/drivers/hwtracing/coresight/coresight-syscfg.c
+@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi
+ if (list_empty(&csdev->config_csdev_list))
+ return;
+
+- guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
++ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
+
+ list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) {
+ if (config_csdev->config_desc->load_owner == load_owner)
+--
+2.51.0
+
--- /dev/null
+From 6c9a601db68ed3ea1c68a1706f5674b279574f7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 10:55:27 +0100
+Subject: coresight: Fix missing include for FIELD_GET
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ]
+
+Include the header for FIELD_GET which is only sometimes transitively
+included on some configs and kernel releases.
+
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/
+Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 1 +
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
+ drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 +
+ drivers/hwtracing/coresight/ultrasoc-smb.h | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index fa758cc218275..c2db94f2ab237 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -3,6 +3,7 @@
+ * Copyright (c) 2012, The Linux Foundation. All rights reserved.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/build_bug.h>
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 42e5d37403add..cbea200489c8f 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/acpi.h>
++#include <linux/bitfield.h>
+ #include <linux/bitops.h>
+ #include <linux/kernel.h>
+ #include <linux/kvm_host.h>
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+index ab251865b893d..e9eeea6240d55 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+@@ -4,6 +4,7 @@
+ * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/coresight.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/pm_runtime.h>
+diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h
+index c4c111275627b..323f0ccb6878c 100644
+--- a/drivers/hwtracing/coresight/ultrasoc-smb.h
++++ b/drivers/hwtracing/coresight/ultrasoc-smb.h
+@@ -7,6 +7,7 @@
+ #ifndef _ULTRASOC_SMB_H
+ #define _ULTRASOC_SMB_H
+
++#include <linux/bitfield.h>
+ #include <linux/miscdevice.h>
+ #include <linux/spinlock.h>
+
+--
+2.51.0
+
--- /dev/null
+From c12c33020f31d8fadb7e4cf5b217fa7eae4e15ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:26:19 +0800
+Subject: coresight: Only register perf symlink for sinks with alloc_buffer
+
+From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+
+[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
+
+Ensure that etm_perf_add_symlink_sink() is only called for devices
+that implement the alloc_buffer operation. This prevents invalid
+symlink creation for dummy sinks that do not implement alloc_buffer.
+
+Without this check, perf may attempt to use a dummy sink that lacks
+alloc_buffer operationsu to initialise perf's ring buffer, leading
+to runtime failures.
+
+Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
+Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index c2db94f2ab237..1accd7cbd54bf 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
+ goto out_unlock;
+ }
+
+- if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
++ sink_ops(csdev)->alloc_buffer) {
+ ret = etm_perf_add_symlink_sink(csdev);
+
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 47c03bf665153fdbe3a4a980ce63cbe0d3cf7b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:37 +0100
+Subject: coresight: tmc: Support atclk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]
+
+The atclk is an optional clock for the CoreSight TMC, but the driver
+misses to initialize it. In most cases, TMC shares the atclk clock with
+other CoreSight components. Since these components enable the clock
+before the TMC device is initialized, the TMC continues properly,
+which is why we don’t observe any lockup issues.
+
+This change enables atclk in probe of the TMC driver. Given the clock
+is optional, it is possible to return NULL if the clock does not exist.
+IS_ERR() is tolerant for this case.
+
+Dynamically disable and enable atclk during suspend and resume. The
+clock pointers will never be error values if the driver has successfully
+probed, and the case of a NULL pointer case will be handled by the clock
+core layer. The driver data is always valid after probe. Therefore,
+remove the related checks. Also in the resume flow adds error handling.
+
+Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-tmc.h | 2 ++
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 88afb16bb6bec..0b5e7635a084d 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
+ struct coresight_desc desc = { 0 };
+ struct coresight_dev_list *dev_list = NULL;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ ret = -ENOMEM;
+
+ /* Validity for the resource is already checked by the AMBA core */
+@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int tmc_runtime_resume(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
+index 6541a27a018e6..cbb4ba4391585 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.h
++++ b/drivers/hwtracing/coresight/coresight-tmc.h
+@@ -210,6 +210,7 @@ struct tmc_resrv_buf {
+
+ /**
+ * struct tmc_drvdata - specifics associated to an TMC component
++ * @atclk: optional clock for the core parts of the TMC.
+ * @pclk: APB clock if present, otherwise NULL
+ * @base: memory mapped base address for this component.
+ * @csdev: component vitals needed by the framework.
+@@ -244,6 +245,7 @@ struct tmc_resrv_buf {
+ * Used by ETR/ETF.
+ */
+ struct tmc_drvdata {
++ struct clk *atclk;
+ struct clk *pclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+--
+2.51.0
+
--- /dev/null
+From 1a902c3b480ae7c5a3be856c3917001351cf3f18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 07:53:04 +0800
+Subject: coresight: tpda: fix the logic to setup the element size
+
+From: Jie Gan <jie.gan@oss.qualcomm.com>
+
+[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]
+
+Some TPDM devices support both CMB and DSB datasets, requiring
+the system to enable the port with both corresponding element sizes.
+
+Currently, the logic treats tpdm_read_element_size as successful if
+the CMB element size is retrieved correctly, regardless of whether
+the DSB element size is obtained. This behavior causes issues
+when parsing data from TPDM devices that depend on both element sizes.
+
+To address this, the function should explicitly fail if the DSB
+element size cannot be read correctly.
+
+Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
+index 0633f04beb240..333b3cb236859 100644
+--- a/drivers/hwtracing/coresight/coresight-tpda.c
++++ b/drivers/hwtracing/coresight/coresight-tpda.c
+@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+ if (tpdm_data->dsb) {
+ rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+ "qcom,dsb-element-bits", &drvdata->dsb_esize);
++ if (rc)
++ goto out;
+ }
+
+ if (tpdm_data->cmb) {
+@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+ "qcom,cmb-element-bits", &drvdata->cmb_esize);
+ }
+
++out:
+ if (rc)
+ dev_warn_once(&csdev->dev,
+ "Failed to read TPDM Element size: %d\n", rc);
+--
+2.51.0
+
--- /dev/null
+From 20743beaee4e3272a6bc17140cec9fdc53ba2df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 11:19:05 +0100
+Subject: coresight: trbe: Add ISB after TRBLIMITR write
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ]
+
+DEN0154 states that hardware will be allowed to ignore writes to TRB*
+registers while the trace buffer is enabled. Add an ISB to ensure that
+it's disabled before clearing the other registers.
+
+This is purely defensive because it's expected that arm_trbe_disable()
+would be called before teardown which has the required ISB.
+
+Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 8f426f94e32a1..f78c9b9dc0087 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata)
+ static void trbe_reset_local(struct trbe_cpudata *cpudata)
+ {
+ write_sysreg_s(0, SYS_TRBLIMITR_EL1);
++ isb();
+ trbe_drain_buffer();
+ write_sysreg_s(0, SYS_TRBPTR_EL1);
+ write_sysreg_s(0, SYS_TRBBASER_EL1);
+--
+2.51.0
+
--- /dev/null
+From 07309267ba1f574119a3a693871c940f5a951bcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 8267dd1a2130d..8f426f94e32a1 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -23,7 +23,8 @@
+ #include "coresight-self-hosted-trace.h"
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From 6fb2315b34bfae66edc60821c18cedf626accec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index f78c9b9dc0087..3dd2e1b4809dc 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From 3afa6de133b3aa596de54a40cd775d317133a108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index ef078426bfd51..38c165d526d14 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/pm_qos.h>
+ #include <linux/slab.h>
+@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3ec92c313a1d3fee4e397bb23e87c6771a2d0ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 17:22:12 +0200
+Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
+
+Make sure to drop the reference to the saw device taken by
+of_find_device_by_node() after retrieving its driver data during
+probe().
+
+Also drop the reference to the CPU node sooner to avoid leaking it in
+case there is no saw node or device.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index 5f386761b1562..f60a4cf536423 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
+ return -ENODEV;
+
+ saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++ of_node_put(cpu_node);
+ if (!saw_node)
+ return -ENODEV;
+
+ pdev = of_find_device_by_node(saw_node);
+ of_node_put(saw_node);
+- of_node_put(cpu_node);
+ if (!pdev)
+ return -ENODEV;
+
+ data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ put_device(&pdev->dev);
+ return -ENOMEM;
++ }
+
+ data->spm = dev_get_drvdata(&pdev->dev);
++ put_device(&pdev->dev);
+ if (!data->spm)
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From 9a90f37fbf162324e12134e501e439b413f34cad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:12:26 +0000
+Subject: cpuset: fix failure to enable isolated partition when containing
+ isolcpus
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ]
+
+The 'isolcpus' parameter specified at boot time can be assigned to an
+isolated partition. While it is valid put the 'isolcpus' in an isolated
+partition, attempting to change a member cpuset to an isolated partition
+will fail if the cpuset contains any 'isolcpus'.
+
+For example, the system boots with 'isolcpus=9', and the following
+configuration works correctly:
+
+ # cd /sys/fs/cgroup/
+ # mkdir test
+ # echo 1 > test/cpuset.cpus
+ # echo isolated > test/cpuset.cpus.partition
+ # cat test/cpuset.cpus.partition
+ isolated
+ # echo 9 > test/cpuset.cpus
+ # cat test/cpuset.cpus.partition
+ isolated
+ # cat test/cpuset.cpus
+ 9
+
+However, the following steps to convert a member cpuset to an isolated
+partition will fail:
+
+ # cd /sys/fs/cgroup/
+ # mkdir test
+ # echo 9 > test/cpuset.cpus
+ # echo isolated > test/cpuset.cpus.partition
+ # cat test/cpuset.cpus.partition
+ isolated invalid (partition config conflicts with housekeeping setup)
+
+The issue occurs because the new partition state (new_prs) is used for
+validation against housekeeping constraints before it has been properly
+updated. To resolve this, move the assignment of new_prs before the
+housekeeping validation check when enabling a root partition.
+
+Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Reviewed-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index f9d7799c5c947..9e1fc18549059 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
+ xcpus = tmp->delmask;
+ if (compute_effective_exclusive_cpumask(cs, xcpus, NULL))
+ WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus));
++ new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
+
+ /*
+ * Enabling partition root is not allowed if its
+@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
+
+ deleting = true;
+ subparts_delta++;
+- new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
+ } else if (cmd == partcmd_disable) {
+ /*
+ * May need to add cpus back to parent's effective_cpus
+--
+2.51.0
+
--- /dev/null
+From f91dbbd9af48c04447a7e984c5de77a16838601a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:06 +0800
+Subject: crypto: hisilicon - check the sva module status while enabling or
+ disabling address prefetch
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ]
+
+After enabling address prefetch, check the sva module status. If all
+previous prefetch requests from the sva module are not completed, then
+disable the address prefetch to ensure normal execution of new task
+operations. After disabling address prefetch, check if all requests
+from the sva module have been completed.
+
+Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++----
+ drivers/crypto/hisilicon/sec2/sec_main.c | 48 +++++++++++++-
+ drivers/crypto/hisilicon/zip/zip_main.c | 79 +++++++++++++++++++----
+ 3 files changed, 164 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 34f84978180f0..7b60e89015bdf 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -78,6 +78,11 @@
+ #define HPRE_PREFETCH_ENABLE (~(BIT(0) | BIT(30)))
+ #define HPRE_PREFETCH_DISABLE BIT(30)
+ #define HPRE_SVA_DISABLE_READY (BIT(4) | BIT(8))
++#define HPRE_SVA_PREFTCH_DFX4 0x301144
++#define HPRE_WAIT_SVA_READY 500000
++#define HPRE_READ_SVA_STATUS_TIMES 3
++#define HPRE_WAIT_US_MIN 10
++#define HPRE_WAIT_US_MAX 20
+
+ /* clock gate */
+ #define HPRE_CLKGATE_CTL 0x301a10
+@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type)
+ return NULL;
+ }
+
++static int hpre_wait_sva_ready(struct hisi_qm *qm)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4);
++ if (val)
++ count = 0;
++ else if (++count == HPRE_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX);
++ } while (++try_times < HPRE_WAIT_SVA_READY);
++
++ if (try_times == HPRE_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static void hpre_config_pasid(struct hisi_qm *qm)
+ {
+ u32 val1, val2;
+@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm)
+ writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE);
+ }
+
+-static void hpre_open_sva_prefetch(struct hisi_qm *qm)
++static void hpre_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+- /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
+- val &= HPRE_PREFETCH_ENABLE;
++ val |= HPRE_PREFETCH_DISABLE;
+ writel(val, qm->io_base + HPRE_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
+- val, !(val & HPRE_PREFETCH_DISABLE),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
++ val, !(val & HPRE_SVA_DISABLE_READY),
+ HPRE_REG_RD_INTVRL_US,
+ HPRE_REG_RD_TMOUT_US);
+ if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)hpre_wait_sva_ready(qm);
+ }
+
+-static void hpre_close_sva_prefetch(struct hisi_qm *qm)
++static void hpre_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
++ /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
+- val |= HPRE_PREFETCH_DISABLE;
++ val &= HPRE_PREFETCH_ENABLE;
+ writel(val, qm->io_base + HPRE_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
+- val, !(val & HPRE_SVA_DISABLE_READY),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
++ val, !(val & HPRE_PREFETCH_DISABLE),
+ HPRE_REG_RD_INTVRL_US,
+ HPRE_REG_RD_TMOUT_US);
++ if (ret) {
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ hpre_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = hpre_wait_sva_ready(qm);
+ if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ hpre_close_sva_prefetch(qm);
+ }
+
+ static void hpre_enable_clock_gate(struct hisi_qm *qm)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index ddb20f380b546..348f1f52956dc 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -93,6 +93,16 @@
+ #define SEC_PREFETCH_ENABLE (~(BIT(0) | BIT(1) | BIT(11)))
+ #define SEC_PREFETCH_DISABLE BIT(1)
+ #define SEC_SVA_DISABLE_READY (BIT(7) | BIT(11))
++#define SEC_SVA_PREFETCH_INFO 0x301ED4
++#define SEC_SVA_STALL_NUM GENMASK(23, 8)
++#define SEC_SVA_PREFETCH_NUM GENMASK(2, 0)
++#define SEC_WAIT_SVA_READY 500000
++#define SEC_READ_SVA_STATUS_TIMES 3
++#define SEC_WAIT_US_MIN 10
++#define SEC_WAIT_US_MAX 20
++#define SEC_WAIT_QP_US_MIN 1000
++#define SEC_WAIT_QP_US_MAX 2000
++#define SEC_MAX_WAIT_TIMES 2000
+
+ #define SEC_DELAY_10_US 10
+ #define SEC_POLL_TIMEOUT_US 1000
+@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + offset);
++ if (val & mask)
++ count = 0;
++ else if (++count == SEC_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX);
++ } while (++try_times < SEC_WAIT_SVA_READY);
++
++ if (try_times == SEC_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static void sec_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm)
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+ if (ret)
+ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM);
+ }
+
+ static void sec_open_sva_prefetch(struct hisi_qm *qm)
+@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm)
+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+ val, !(val & SEC_PREFETCH_DISABLE),
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
++ if (ret) {
+ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ sec_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM);
++ if (ret)
++ sec_close_sva_prefetch(qm);
+ }
+
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 480fa590664a8..341c4564e21aa 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -95,10 +95,16 @@
+ #define HZIP_PREFETCH_ENABLE (~(BIT(26) | BIT(17) | BIT(0)))
+ #define HZIP_SVA_PREFETCH_DISABLE BIT(26)
+ #define HZIP_SVA_DISABLE_READY (BIT(26) | BIT(30))
++#define HZIP_SVA_PREFETCH_NUM GENMASK(18, 16)
++#define HZIP_SVA_STALL_NUM GENMASK(15, 0)
+ #define HZIP_SHAPER_RATE_COMPRESS 750
+ #define HZIP_SHAPER_RATE_DECOMPRESS 140
+-#define HZIP_DELAY_1_US 1
+-#define HZIP_POLL_TIMEOUT_US 1000
++#define HZIP_DELAY_1_US 1
++#define HZIP_POLL_TIMEOUT_US 1000
++#define HZIP_WAIT_SVA_READY 500000
++#define HZIP_READ_SVA_STATUS_TIMES 3
++#define HZIP_WAIT_US_MIN 10
++#define HZIP_WAIT_US_MAX 20
+
+ /* clock gating */
+ #define HZIP_PEH_CFG_AUTO_GATE 0x3011A8
+@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ }
+
+-static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
++static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + offset);
++ if (val & mask)
++ count = 0;
++ else if (++count == HZIP_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX);
++ } while (++try_times < HZIP_WAIT_SVA_READY);
++
++ if (try_times == HZIP_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
++static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+- /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
+- val &= HZIP_PREFETCH_ENABLE;
++ val |= HZIP_SVA_PREFETCH_DISABLE;
+ writel(val, qm->io_base + HZIP_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
+- val, !(val & HZIP_SVA_PREFETCH_DISABLE),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
++ val, !(val & HZIP_SVA_DISABLE_READY),
+ HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
+ if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM);
+ }
+
+-static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
++static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
++ /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
+- val |= HZIP_SVA_PREFETCH_DISABLE;
++ val &= HZIP_PREFETCH_ENABLE;
+ writel(val, qm->io_base + HZIP_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
+- val, !(val & HZIP_SVA_DISABLE_READY),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
++ val, !(val & HZIP_SVA_PREFETCH_DISABLE),
+ HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
++ if (ret) {
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ hisi_zip_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM);
+ if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ hisi_zip_close_sva_prefetch(qm);
+ }
+
+ static void hisi_zip_enable_clock_gate(struct hisi_qm *qm)
+@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ void __iomem *base = qm->io_base;
+ u32 dcomp_bm, comp_bm;
+ u32 zip_core_en;
++ int ret;
+
+ /* qm user domain */
+ writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1);
+@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+- return hisi_dae_set_user_domain(qm);
++ ret = hisi_dae_set_user_domain(qm);
++ if (ret)
++ goto close_sva_prefetch;
++
++ return 0;
++
++close_sva_prefetch:
++ hisi_zip_close_sva_prefetch(qm);
++ return ret;
+ }
+
+ static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable)
+--
+2.51.0
+
--- /dev/null
+From 34143e1dd1528ff8c990d72418999d44e9773070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:07 +0800
+Subject: crypto: hisilicon/qm - check whether the input function and PF are on
+ the same device
+
+From: Zhushuai Yin <yinzhushuai@huawei.com>
+
+[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
+
+Function rate limiting is set through physical function driver.
+Users configure by providing function information and rate limit values.
+Before configuration, it is necessary to check whether the
+provided function and PF belong to the same device.
+
+Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
+Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 2b7b4b2033de4..56d80fc943bee 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3827,6 +3827,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
+ }
+
+ pdev = container_of(dev, struct pci_dev, dev);
++ if (pci_physfn(pdev) != qm->pdev) {
++ pci_err(qm->pdev, "the pdev input does not match the pf!\n");
++ return -EINVAL;
++ }
+
+ *fun_index = pdev->devfn;
+
+--
+2.51.0
+
--- /dev/null
+From 3be5fe6c71604a53996d8868964fdbf4a8227a88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:08 +0800
+Subject: crypto: hisilicon/qm - request reserved interrupt for virtual
+ function
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ]
+
+The device interrupt vector 3 is an error interrupt for
+physical function and a reserved interrupt for virtual function.
+However, the driver has not registered the reserved interrupt for
+virtual function. When allocating interrupts, the number of interrupts
+is allocated based on powers of two, which includes this interrupt.
+When the system enables GICv4 and the virtual function passthrough
+to the virtual machine, releasing the interrupt in the driver
+triggers a warning.
+
+The WARNING report is:
+WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4
+
+Therefore, register a reserved interrupt for VF and set the
+IRQF_NO_AUTOEN flag to avoid that warning.
+
+Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 56d80fc943bee..4f97806f6241b 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4733,6 +4733,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev)
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_reset_done);
+
++static irqreturn_t qm_rsvd_irq(int irq, void *data)
++{
++ struct hisi_qm *qm = data;
++
++ dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n");
++
++ return IRQ_HANDLED;
++}
++
+ static irqreturn_t qm_abnormal_irq(int irq, void *data)
+ {
+ struct hisi_qm *qm = data;
+@@ -5016,7 +5025,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
+ struct pci_dev *pdev = qm->pdev;
+ u32 irq_vector, val;
+
+- if (qm->fun_type == QM_HW_VF)
++ if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3)
+ return;
+
+ val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
+@@ -5033,17 +5042,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
+ u32 irq_vector, val;
+ int ret;
+
+- if (qm->fun_type == QM_HW_VF)
+- return 0;
+-
+ val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
+ if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ return 0;
+-
+ irq_vector = val & QM_IRQ_VECTOR_MASK;
++
++ /* For VF, this is a reserved interrupt in V3 version. */
++ if (qm->fun_type == QM_HW_VF) {
++ if (qm->ver < QM_HW_V3)
++ return 0;
++
++ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq,
++ IRQF_NO_AUTOEN, qm->dev_name, qm);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret);
++ return ret;
++ }
++ return 0;
++ }
++
+ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm);
+ if (ret)
+- dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret);
++ dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret);
+
+ return ret;
+ }
+@@ -5409,6 +5429,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm)
+ pci_set_master(pdev);
+
+ num_vec = qm_get_irq_num(qm);
++ if (!num_vec) {
++ dev_err(dev, "Device irq num is zero!\n");
++ ret = -EINVAL;
++ goto err_get_pci_res;
++ }
++ num_vec = roundup_pow_of_two(num_vec);
+ ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI);
+ if (ret < 0) {
+ dev_err(dev, "Failed to enable MSI vectors!\n");
+--
+2.51.0
+
--- /dev/null
+From 8bf2673e9d899b8be6d9d60150277a840d1fdd35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:54 +0800
+Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
+
+When the initialization of qm->debug.acc_diff_reg fails,
+the probe process does not exit. However, after qm->debug.qm_diff_regs is
+freed, it is not set to NULL. This can lead to a double free when the
+remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
+should be set to NULL after it is freed.
+
+Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+index 45e130b901eb5..17eb236e9ee4d 100644
+--- a/drivers/crypto/hisilicon/debugfs.c
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
+ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ ret = PTR_ERR(qm->debug.acc_diff_regs);
+ qm->debug.acc_diff_regs = NULL;
++ qm->debug.qm_diff_regs = NULL;
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d491e8033750daf3b9bd6daa7b63703561385703 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:05 +0800
+Subject: crypto: hisilicon - re-enable address prefetch after device resuming
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
+
+When the device resumes from a suspended state, it will revert to its
+initial state and requires re-enabling. Currently, the address prefetch
+function is not re-enabled after device resuming. Move the address prefetch
+enable to the initialization process. In this way, the address prefetch
+can be enabled when the device resumes by calling the initialization
+process.
+
+Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
+ drivers/crypto/hisilicon/qm.c | 3 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
+ 4 files changed, 43 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index f5b47e5ff48a4..34f84978180f0 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+
+ /* Config data buffer pasid needed by Kunpeng 920 */
+ hpre_config_pasid(qm);
++ hpre_open_sva_prefetch(qm);
+
+ hpre_enable_clock_gate(qm);
+
+@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ if (ret)
+ return ret;
+
+- hpre_open_sva_prefetch(qm);
+-
+ hisi_qm_dev_err_init(qm);
+ ret = hpre_show_last_regs_init(qm);
+ if (ret)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 7c41f9593d039..2b7b4b2033de4 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4448,9 +4448,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
+ {
+ u32 value;
+
+- if (qm->err_ini->open_sva_prefetch)
+- qm->err_ini->open_sva_prefetch(qm);
+-
+ if (qm->ver >= QM_HW_V3)
+ return;
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 72cf48d1f3ab8..ddb20f380b546 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static void sec_close_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val |= SEC_PREFETCH_DISABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
++ val, !(val & SEC_SVA_DISABLE_READY),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++}
++
++static void sec_open_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ /* Enable prefetch */
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val &= SEC_PREFETCH_ENABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
++ val, !(val & SEC_PREFETCH_DISABLE),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++}
++
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+ {
+ u32 reg;
+@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base +
+ SEC_INTERFACE_USER_CTRL1_REG);
+ }
+-}
+-
+-static void sec_open_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- /* Enable prefetch */
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val &= SEC_PREFETCH_ENABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+- val, !(val & SEC_PREFETCH_DISABLE),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
+-}
+-
+-static void sec_close_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val |= SEC_PREFETCH_DISABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+- val, !(val & SEC_SVA_DISABLE_READY),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ sec_open_sva_prefetch(qm);
+ }
+
+ static void sec_enable_clock_gate(struct hisi_qm *qm)
+@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ if (ret)
+ return ret;
+
+- sec_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ sec_debug_regs_clear(qm);
+ ret = sec_show_last_regs_init(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index fb7b19927dd32..480fa590664a8 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
+ writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
+ }
++ hisi_zip_open_sva_prefetch(qm);
+
+ /* let's open all compression/decompression cores */
+
+@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
+ FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+
++ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+ return hisi_dae_set_user_domain(qm);
+@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- hisi_zip_set_high_perf(qm);
+-
+- hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ hisi_zip_debug_regs_clear(qm);
+
+--
+2.51.0
+
--- /dev/null
+From b3e79420f39b4e5ae75ba5a09c79453aa7f895a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:04 +0800
+Subject: crypto: hisilicon/zip - remove unnecessary validation for
+ high-performance mode configurations
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
+
+When configuring the high-performance mode register, there is no
+need to verify whether the register has been successfully
+enabled, as there is no possibility of a write failure for this
+register.
+
+Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index d8ba23b7cc7dd..fb7b19927dd32 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ return false;
+ }
+
+-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ {
+ u32 val;
+- int ret;
+
+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ if (perf_mode == HZIP_HIGH_COMP_PERF)
+@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+
+ /* Set perf mode */
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
+- val, val == perf_mode, HZIP_DELAY_1_US,
+- HZIP_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to set perf mode\n");
+-
+- return ret;
+ }
+
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- ret = hisi_zip_set_high_perf(qm);
+- if (ret)
+- return ret;
++ hisi_zip_set_high_perf(qm);
+
+ hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+--
+2.51.0
+
--- /dev/null
+From 117e481df8d43017446133478cca12f38de23749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 14:03:30 +0200
+Subject: crypto: keembay - Add missing check after sg_nents_for_len()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
+
+sg_nents_for_len() returns an int which is negative in case of error.
+
+Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+index 8f9e21ced0fe1..48281d8822603 100644
+--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ struct device *dev = rctx->hcu_dev->dev;
+ unsigned int remainder = 0;
+ unsigned int total;
+- size_t nents;
++ int nents;
+ size_t count;
+ int rc;
+ int i;
+@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ /* Determine the number of scatter gather list entries to process. */
+ nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
+
++ if (nents < 0)
++ return nents;
++
+ /* If there are entries to process, map them. */
+ if (nents) {
+ rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
+--
+2.51.0
+
--- /dev/null
+From 09d4f409fd6d302971b34a3b54c0803ad76a28fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:24:57 +0200
+Subject: crypto: octeontx2 - Call strscpy() with correct size argument
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]
+
+In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
+of the source string rather than the size of the destination buffer.
+
+This is fine as long as the destination buffer is larger than the source
+string, but we should still use the destination buffer size instead to
+call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
+we can safely omit the size argument and let strscpy() infer it using
+sizeof().
+
+Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+index cc47e361089a0..ebdf4efa09d4d 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
+ return -EINVAL;
+ }
+ err_msg = "Invalid engine group format";
+- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
++ strscpy(tmp_buf, ctx->val.vstr);
+ start = tmp_buf;
+
+ has_se = has_ie = has_ae = false;
+--
+2.51.0
+
--- /dev/null
+From 30216dd0c690f0a837200ef09c9a7e62eb5ebe69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 23:22:38 +0300
+Subject: dm vdo: return error on corrupted metadata in start_restoring_volume
+ functions
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]
+
+The return values of VDO_ASSERT calls that validate metadata are not acted
+upon.
+
+Return UDS_CORRUPT_DATA in case of an error.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Reviewed-by: Matthew Sakai <msakai@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
+index 12f954a0c5325..afb062e1f1fb4 100644
+--- a/drivers/md/dm-vdo/indexer/volume-index.c
++++ b/drivers/md/dm-vdo/indexer/volume-index.c
+@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+--
+2.51.0
+
--- /dev/null
+From 48a2afd08c53a727913eb18a8b6b004d094f7fd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 11:07:38 -0500
+Subject: dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation
+
+From: Nathan Lynch <nathan.lynch@amd.com>
+
+[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ]
+
+Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc
+warnings") inserted new documentation for @desc_free in the middle of
+@tx_submit's description.
+
+Put @tx_submit's description back together, matching the indentation
+style of the rest of the documentation for dma_async_tx_descriptor.
+
+Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings")
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
+Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dmaengine.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index bb146c5ac3e4c..51e1e357892a0 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops {
+ * @phys: physical address of the descriptor
+ * @chan: target channel for this operation
+ * @tx_submit: accept the descriptor, assign ordered cookie and mark the
++ * descriptor pending. To be pushed on .issue_pending() call
+ * @desc_free: driver's callback function to free a resusable descriptor
+ * after completion
+- * descriptor pending. To be pushed on .issue_pending() call
+ * @callback: routine to call after this operation is complete
+ * @callback_result: error result from a DMA transaction
+ * @callback_param: general parameter to pass to the callback routine
+--
+2.51.0
+
--- /dev/null
+From a7c29bbbde01bab45b827b6cf5dde74136b73369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 16:44:23 +0200
+Subject: docs: iio: ad3552r: Fix malformed code-block directive
+
+From: Jorge Marques <jorge.marques@analog.com>
+
+[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ]
+
+Missing required double dot and line break.
+
+Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver")
+Signed-off-by: Jorge Marques <jorge.marques@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/iio/ad3552r.rst | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst
+index f5d59e4e86c7e..4274e35f503d9 100644
+--- a/Documentation/iio/ad3552r.rst
++++ b/Documentation/iio/ad3552r.rst
+@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``.
+ Usage examples
+ --------------
+
+-. code-block:: bash
++.. code-block:: bash
++
+ root:/sys/bus/iio/devices/iio:device0# cat data_source
+ normal
+ root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source
+--
+2.51.0
+
--- /dev/null
+From 25222334ab4dd34266235a80c81aee8a3d663e45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 5765eb3e9efa7..a30f4bed11b4e 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From 8dca7cd8cf20f46eefacd2c95ece62025f497d00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 340525155e993..715ae053dc8a1 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -892,7 +892,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 56bac4571fbabd311519e712a9de7a0f5baae56e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index c19094481630d..340525155e993 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -890,6 +890,11 @@ int __register_one_node(int nid)
+ node_devices[nid] = node;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From cad1ff1c1b318cc181099adcac371e513b1f9cce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:14:01 +0530
+Subject: drm/amd/display: Add NULL pointer checks in dc_stream cursor
+ attribute functions
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ]
+
+The function dc_stream_set_cursor_attributes() currently dereferences
+the `stream` pointer and nested members `stream->ctx->dc->current_state`
+without checking for NULL.
+
+All callers of these functions, such as in
+`dcn30_apply_idle_power_optimizations()` and
+`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
+before calling these functions.
+
+Fixes below:
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
+error: we previously assumed 'stream' could be null (see line 334)
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
+ 327 bool dc_stream_program_cursor_attributes(
+ 328 struct dc_stream_state *stream,
+ 329 const struct dc_cursor_attributes *attributes)
+ 330 {
+ 331 struct dc *dc;
+ 332 bool reset_idle_optimizations = false;
+ 333
+ 334 dc = stream ? stream->ctx->dc : NULL;
+ ^^^^^^
+The old code assumed stream could be NULL.
+
+ 335
+--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {
+ ^^^^^^
+The refactor added an unchecked dereference.
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
+ 313 bool dc_stream_set_cursor_attributes(
+ 314 struct dc_stream_state *stream,
+ 315 const struct dc_cursor_attributes *attributes)
+ 316 {
+ 317 bool result = false;
+ 318
+ 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
+This function used to check for if stream as NULL and return false at
+the start. Probably we should add that back.
+
+Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Alvin Lee <alvin.lee2@amd.com>
+Cc: Ray Wu <ray.wu@amd.com>
+Cc: Dillon Varone <dillon.varone@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: ChiaHsuan Chung <chiahsuan.chung@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Daniel Wheeler <daniel.wheeler@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Wenjing Liu <wenjing.liu@amd.com>
+Cc: Jun Lei <Jun.Lei@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Dillon Varone <Dillon.varone@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+index b883fb24fa127..2a68d470d093a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes(
+ {
+ bool result = false;
+
++ if (!stream)
++ return false;
++
+ if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
+ stream->cursor_attributes = *attributes;
+ result = true;
+@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes(
+ struct dc *dc;
+ bool reset_idle_optimizations = false;
+
+- dc = stream ? stream->ctx->dc : NULL;
++ if (!stream)
++ return false;
++
++ dc = stream->ctx->dc;
+
+ if (dc_stream_set_cursor_attributes(stream, attributes)) {
+ dc_z10_restore(dc);
+--
+2.51.0
+
--- /dev/null
+From 110db373f83a4974b141fc49e439b04453006bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:50:14 +0800
+Subject: drm/amd/display: Remove redundant semicolons
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
+
+Remove unnecessary semicolons.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 9ba6cb67655f4..6c75aa82327ac 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ if (dual_plane) {
+ unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
+ num_pipes, pipe_idx);
+- ;
+ if (src->sw_mode == dm_sw_linear)
+ ASSERT(p1_pte_row_height_linear >= 8);
+
+--
+2.51.0
+
--- /dev/null
+From 1967bfbc817e3f91e0a88cff887ee88c595a3da7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:07 +0200
+Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
+
+Based on some comments in dm_pp_display_configuration
+above the crtc_index and line_time fields, these values
+are programmed to the SMC to work around an SMC hang
+when it switches MCLK.
+
+According to Alex, the Windows driver programs them to:
+mclk_change_block_cp_min = 200 / line_time
+mclk_change_block_cp_max = 100 / line_time
+Let's use the same for the sake of consistency.
+
+Previously we used the watermark values, but it seemed buggy
+as the code was mixing up low/high and A/B watermarks, and
+was not saving a low watermark value on DCE 6, so
+mclk_change_block_cp_max would be always zero previously.
+
+Split this change off from the previous si_upload_smc_data
+to make it easier to bisect, in case it causes any issues.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index a0cdf6e2d788e..223f59bbf49de 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ crtc_index = amdgpu_crtc->crtc_id;
+
+ if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5bf981e500519d78a5598495268a493d522c7729 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:09 +0200
+Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
+
+According to pp_pm_compute_clocks the non-DC display code
+has "issues with mclk switching with refresh rates over 120 hz".
+The workaround is to disable MCLK switching in this case.
+
+Do the same for legacy DPM.
+
+Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 42efe838fa85c..2d2d2d5e67634 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ (amdgpu_crtc->v_border * 2));
+
+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* we have issues with mclk switching with
++ * refresh rates over 120 hz on the non-DC code.
++ */
++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
++ vblank_time_us = 0;
++
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 506b9151ac71caf81b1d00e241792beedd07fa84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:10 +0200
+Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
+ (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
+
+Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
+switching on Oland when two 4K 60Hz monitors are connected")
+
+This is an ad-hoc DPM fix, necessary because we don't have
+proper bandwidth calculation for DCE 6.
+
+We define "high pixelclock" for SI as higher than necessary
+for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
+this category.
+
+When two high pixel clock displays are connected to Oland,
+additionally disable shader clock switching, which results in
+a higher voltage, thereby addressing some visible flickering.
+
+v2:
+Add more comments.
+v3:
+Split into two commits for easier review.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index d70104bdaa998..80d79a7f8edf1 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ {
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
++ struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+ u16 vddc, vddci, min_vce_voltage = 0;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+ u32 max_sclk = 0, max_mclk = 0;
++ u32 high_pixelclock_count = 0;
+ int i;
+
+ if (adev->asic_type == CHIP_HAINAN) {
+@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ }
+ }
+
++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
++ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
++ * Find number of such displays connected.
++ */
++ for (i = 0; i < adev->mode_info.num_crtc; i++) {
++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
++ !adev->mode_info.crtcs[i]->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
++
++ if (conn->pixelclock_for_modeset > 297000)
++ high_pixelclock_count++;
++ }
++
++ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
++ * They are necessary because we don't have something like dce_calcs
++ * for these GPUs to calculate bandwidth requirements.
++ */
++ if (high_pixelclock_count) {
++ /* On Oland, we observe some flickering when two 4K 60Hz
++ * displays are connected, possibly because voltage is too low.
++ * Raise the voltage by requiring a higher SCLK.
++ * (Voltage cannot be adjusted independently without also SCLK.)
++ */
++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
++ disable_sclk_switching = true;
++ }
++
+ if (rps->vce_active) {
+ rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
+ rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
+--
+2.51.0
+
--- /dev/null
+From 933186d17d426895d9177d78936b0b391ccc3ac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:04 +0200
+Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
+
+Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
+is unsupported, to make sure it is properly turned off.
+
+v3:
+Simplify si_disable_ulv further.
+Always check the return value of amdgpu_si_send_msg_to_smc.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 4c0e976004ba4..50da1eed8ddf0 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
+
+ static int si_disable_ulv(struct amdgpu_device *adev)
+ {
+- struct si_power_info *si_pi = si_get_pi(adev);
+- struct si_ulv_param *ulv = &si_pi->ulv;
++ PPSMC_Result r;
+
+- if (ulv->supported)
+- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
+- 0 : -EINVAL;
+-
+- return 0;
++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
+ }
+
+ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+--
+2.51.0
+
--- /dev/null
+From d647b1605a6cfcfdf0a250fea64040517ca53578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:06 +0200
+Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
+
+The si_upload_smc_data function uses si_write_smc_soft_register
+to set some register values in the SMC, and expects the result
+to be PPSMC_Result_OK which is 1.
+
+The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
+checking the result of a command sent to the SMC.
+However, the si_write_smc_soft_register actually doesn't send
+any commands to the SMC and returns zero on success,
+so this check was incorrect.
+
+Fix that by not checking the return value, just like other
+calls to si_write_smc_soft_register.
+
+v3:
+Additionally, when no display is plugged in, there is no need
+to restrict MCLK switching, so program the registers to zero.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 50da1eed8ddf0..a0cdf6e2d788e 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+ struct amdgpu_crtc *amdgpu_crtc = NULL;
+ int i;
+-
+- if (adev->pm.dpm.new_active_crtc_count == 0)
+- return 0;
++ u32 crtc_index = 0;
++ u32 mclk_change_block_cp_min = 0;
++ u32 mclk_change_block_cp_max = 0;
+
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ }
+ }
+
+- if (amdgpu_crtc == NULL)
+- return 0;
++ /* When a display is plugged in, program these so that the SMC
++ * performs MCLK switching when it doesn't cause flickering.
++ * When no display is plugged in, there is no need to restrict
++ * MCLK switching, so program them to zero.
++ */
++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
++ crtc_index = amdgpu_crtc->crtc_id;
+
+- if (amdgpu_crtc->line_time <= 0)
+- return 0;
++ if (amdgpu_crtc->line_time) {
++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ }
++ }
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_crtc_index,
+- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_crtc_index,
++ crtc_index);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
++ mclk_change_block_cp_min);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
++ mclk_change_block_cp_max);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 50121b0e4d99ea1c9aee11ba5af9833602536827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:08 +0200
+Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
+
+Some parts of the code base expect that MCLK switching is turned
+off when the vblank time is set to zero.
+
+According to pp_pm_compute_clocks the non-DC code has issues
+with MCLK switching with refresh rates over 120 Hz.
+
+v3:
+Add code comment to explain this better.
+Add an if statement instead of changing the switch_limit.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 223f59bbf49de..d70104bdaa998 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle)
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+- if (vblank_time < switch_limit)
++ /* Consider zero vblank time too short and disable MCLK switching.
++ * Note that the vblank time is set to maximum when no displays are attached,
++ * so we'll still enable MCLK switching in that case.
++ */
++ if (vblank_time == 0)
++ return true;
++ else if (vblank_time < switch_limit)
+ return true;
+ else
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 90467f5e9879dde46570c7ff49599aa08fe6fe6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:49:35 +0200
+Subject: drm/amdgpu: Fix allocating extra dwords for rings (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ]
+
+Rename extra_dw to extra_bytes and document what it's for.
+
+The value is already used as if it were bytes in vcn_v4_0.c
+and in amdgpu_ring_init. Just adjust the dword count in
+jpeg_v1_0.c so that it becomes a byte count.
+
+v2:
+Rename extra_dw to extra_bytes as discussed during review.
+
+Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring")
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++-
+ drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 2 +-
+ 4 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+index a0b7ac7486dc5..5693830c0c364 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -335,7 +335,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
+
+ /* Allocate ring buffer */
+ if (ring->ring_obj == NULL) {
+- r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE,
++ r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes,
++ PAGE_SIZE,
+ AMDGPU_GEM_DOMAIN_GTT,
+ &ring->ring_obj,
+ &ring->gpu_addr,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+index e1f25218943a4..0fc4a2ed88e26 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+@@ -202,7 +202,18 @@ struct amdgpu_ring_funcs {
+ bool support_64bit_ptrs;
+ bool no_user_fence;
+ bool secure_submission_supported;
+- unsigned extra_dw;
++
++ /**
++ * @extra_bytes:
++ *
++ * Optional extra space in bytes that is added to the ring size
++ * when allocating the BO that holds the contents of the ring.
++ * This space isn't used for command submission to the ring,
++ * but is just there to satisfy some hardware requirements or
++ * implement workarounds. It's up to the implementation of each
++ * specific ring to initialize this space.
++ */
++ unsigned extra_bytes;
+
+ /* ring read/write ptr handling */
+ u64 (*get_rptr)(struct amdgpu_ring *ring);
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+index 9e428e669ada6..b5bb7f4d607c1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = {
+ .nop = PACKET0(0x81ff, 0),
+ .support_64bit_ptrs = false,
+ .no_user_fence = true,
+- .extra_dw = 64,
++ .extra_bytes = 256,
+ .get_rptr = jpeg_v1_0_decode_ring_get_rptr,
+ .get_wptr = jpeg_v1_0_decode_ring_get_wptr,
+ .set_wptr = jpeg_v1_0_decode_ring_set_wptr,
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+index e77f2df1beb77..c4e15ea1e66ed 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = {
+ .type = AMDGPU_RING_TYPE_VCN_ENC,
+ .align_mask = 0x3f,
+ .nop = VCN_ENC_CMD_NO_OP,
+- .extra_dw = sizeof(struct amdgpu_vcn_rb_metadata),
++ .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata),
+ .get_rptr = vcn_v4_0_unified_ring_get_rptr,
+ .get_wptr = vcn_v4_0_unified_ring_get_wptr,
+ .set_wptr = vcn_v4_0_unified_ring_set_wptr,
+--
+2.51.0
+
--- /dev/null
+From 3779309fbe9017b6af7c6d191a315705c660bf40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:28:26 +0800
+Subject: drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini.
+
+[25209.467154] Call Trace:
+[25209.467156] <TASK>
+[25209.467158] ? srso_alias_return_thunk+0x5/0x7f
+[25209.467162] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.467166] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
+[25209.467300] ? show_regs.part.0+0x23/0x29
+[25209.467303] ? show_regs.cold+0x8/0xd
+[25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467403] ? __warn+0x8c/0x100
+[25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467503] ? report_bug+0xa4/0xd0
+[25209.467508] ? handle_bug+0x39/0x90
+[25209.467511] ? exc_invalid_op+0x19/0x70
+[25209.467513] ? asm_exc_invalid_op+0x1b/0x20
+[25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu]
+[25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
+[25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
+[25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
+
+Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq")
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+index 90d773dbe337c..21a35c83982e6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+@@ -446,7 +446,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
+ ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE);
+ }
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG))
++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev))
+ amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 4bd9c9b36ef11bad7193a0bd0123f69ff5553cde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:54:50 +0800
+Subject: drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini.
+
+[25209.468816] Call Trace:
+[25209.468817] <TASK>
+[25209.468818] ? srso_alias_return_thunk+0x5/0x7f
+[25209.468820] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.468822] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
+[25209.468936] ? show_regs.part.0+0x23/0x29
+[25209.468939] ? show_regs.cold+0x8/0xd
+[25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469038] ? __warn+0x8c/0x100
+[25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469135] ? report_bug+0xa4/0xd0
+[25209.469138] ? handle_bug+0x39/0x90
+[25209.469140] ? exc_invalid_op+0x19/0x70
+[25209.469142] ? asm_exc_invalid_op+0x1b/0x20
+[25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
+[25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
+[25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
+
+Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq")
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+index faba11166efb6..802520d82a438 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
+ vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+ }
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
+ amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From d7c0ed210a9cd930ac10e31a2295abdb78621167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 5dbaebb592b30..2e79a3afc7748 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @ip_block: Pointer to the amdgpu_ip_block for this hw instance.
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ {
+@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From a32ea2590f26b192121338a590d73551b281ed6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index a0f22ea6d15af..3d8b20828c068 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 03f158ba5f36cae43af37fb674de6eddc1b32101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:07 +0300
+Subject: drm/bridge: cdns-dsi: Fix the _atomic_check()
+
+From: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+
+[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ]
+
+Use the "adjusted_mode" for the dsi configuration check, as that is the
+more appropriate display_mode for validation, and later bridge enable.
+
+Also, fix the mode_valid_check parameter from false to true, as the dsi
+configuration check is taking place during the check-phase, and the
+crtc_* mode values are not expected to be populated yet.
+
+Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()")
+Signed-off-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index b022dd6e6b6e9..1c3fefce5fd28 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -989,10 +989,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge,
+ struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge);
+ struct cdns_dsi *dsi = input_to_dsi(input);
+ struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state);
+- const struct drm_display_mode *mode = &crtc_state->mode;
++ const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
+ struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg;
+
+- return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false);
++ return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true);
+ }
+
+ static struct drm_bridge_state *
+--
+2.51.0
+
--- /dev/null
+From 9da4b65a09d72475c416589e34f952cfc7cd1eae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:58:25 -0700
+Subject: drm/bridge: it6505: select REGMAP_I2C
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
+
+Fix
+
+ aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
+ ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
+index b9e0ca85226a6..a6d6e62071a0e 100644
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -122,6 +122,7 @@ config DRM_ITE_IT6505
+ select EXTCON
+ select CRYPTO
+ select CRYPTO_HASH
++ select REGMAP_I2C
+ help
+ ITE IT6505 DisplayPort bridge chip driver.
+
+--
+2.51.0
+
--- /dev/null
+From 778f97f903a8ee142d7d809edc72ddc8bbb4de03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:30:55 +0800
+Subject: drm/msm: Do not validate SSPP when it is not ready
+
+From: Jun Nie <jun.nie@linaro.org>
+
+[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ]
+
+Current code will validate current plane and previous plane to
+confirm they can share a SSPP with multi-rect mode. The SSPP
+is already allocated for previous plane, while current plane
+is not associated with any SSPP yet. Null pointer is referenced
+when validating the SSPP of current plane. Skip SSPP validation
+for current plane.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+Mem abort info:
+ ESR = 0x0000000096000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x04: level 0 translation fault
+Data abort info:
+ ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
+[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
+Internal error: Oops: 0000000096000004 [#1] SMP
+Modules linked in:
+CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
+Tainted: [S]=CPU_OUT_OF_SPEC
+Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
+pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
+pc : dpu_plane_is_multirect_capable+0x68/0x90
+lr : dpu_assign_plane_resources+0x288/0x410
+sp : ffff800093dcb770
+x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
+x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
+x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
+x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
+x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
+x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
+x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
+x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
+x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
+x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
+Call trace:
+ dpu_plane_is_multirect_capable+0x68/0x90 (P)
+ dpu_crtc_atomic_check+0x5bc/0x650
+ drm_atomic_helper_check_planes+0x13c/0x220
+ drm_atomic_helper_check+0x58/0xb8
+ msm_atomic_check+0xd8/0xf0
+ drm_atomic_check_only+0x4a8/0x968
+ drm_atomic_commit+0x50/0xd8
+ drm_atomic_helper_update_plane+0x140/0x188
+ __setplane_atomic+0xfc/0x148
+ drm_mode_setplane+0x164/0x378
+ drm_ioctl_kernel+0xc0/0x140
+ drm_ioctl+0x20c/0x500
+ __arm64_sys_ioctl+0xbc/0xf8
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0x48/0xf8
+ do_el0_svc+0x28/0x40
+ el0_svc+0x30/0xd0
+ el0t_64_sync_handler+0x144/0x168
+ el0t_64_sync+0x198/0x1a0
+Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
+---[ end trace 0000000000000000 ]---
+
+Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
+Signed-off-by: Jun Nie <jun.nie@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/669224/
+Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index d059ed1e4b707..eba8adb660568 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -929,6 +929,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
+ if (MSM_FORMAT_IS_YUV(fmt))
+ return false;
+
++ if (!sspp)
++ return true;
++
+ if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
+ !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
+ return false;
+@@ -1035,6 +1038,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate,
+ prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
+ return false;
+
++ /* Do not validate SSPP of current plane when it is not ready */
+ if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
+ !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt))
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 85425bcf101ba593e2b24ea0a02d2578ece4de65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:20:45 +0800
+Subject: drm/msm/dpu: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
+
+Change 'ret' from unsigned long to int, as storing negative error codes
+in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
+errors.
+
+Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/671100/
+Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+index 849fea580a4ca..5ea7745f9c78e 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+@@ -448,7 +448,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+ static int dpu_encoder_phys_wb_wait_for_commit_done(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- unsigned long ret;
++ int ret;
+ struct dpu_encoder_wait_info wait_info;
+ struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+--
+2.51.0
+
--- /dev/null
+From 8bd2233663aeaf91b0cd09d9ef5c0183f0dc7282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 14:16:27 +0800
+Subject: drm/panel-edp: Add disable to 100ms for MNB601LS1-4
+
+From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+
+[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ]
+
+For the MNB601LS1-4 panel, the T9+T10 timing does not meet the
+requirements of the specification, so disable is set to 100ms.
+
+Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4")
+Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 90e8c154a9788..bfb09352a4acb 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = {
+ .powered_on_to_enable = 335,
+ };
+
++static const struct panel_delay delay_200_500_e50_d100 = {
++ .hpd_absent = 200,
++ .unprepare = 500,
++ .enable = 50,
++ .disable = 100,
++};
++
+ #define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \
+ { \
+ .ident = { \
+@@ -1979,7 +1986,7 @@ static const struct edp_panel_entry edp_panels[] = {
+
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
+- EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"),
++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"),
+
+--
+2.51.0
+
--- /dev/null
+From 90d4044b87619663945cdf4fc5acac4a00c098c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 21:23:41 -0600
+Subject: drm/panel: novatek-nt35560: Fix invalid return value
+
+From: Brigham Campbell <me@brighamcampbell.com>
+
+[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
+
+Fix bug in nt35560_set_brightness() which causes the function to
+erroneously report an error. mipi_dsi_dcs_write() returns either a
+negative value when an error occurred or a positive number of bytes
+written when no error occurred. The buggy code reports an error under
+either condition.
+
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+index 5bbea734123bc..ee04c55175bb8 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
+ par = 0x00;
+ ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
+ &par, 1);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From f8952adbd5442449721fb7b5bbec3d81928ac095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index ac77d1246b945..811265648a582 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From af2c1ae73dfa758c3e1b955aabee90a3b3a0e210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:28:49 +0200
+Subject: drm: re-allow no-op changes on non-primary planes in async flips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xaver Hugl <xaver.hugl@kde.org>
+
+[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ]
+
+Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to
+async flip") unintentionally disallowed no-op changes on non-primary
+planes that the driver doesn't allow async flips on. This broke async
+flips for compositors that disable the cursor plane in every async
+atomic commit. To fix that, change drm_atomic_set_property to again
+only run atomic_async_check if the plane would actually be changed by
+the atomic commit.
+
+Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263
+Signed-off-by: Xaver Hugl <xaver.hugl@kde.org>
+Reviewed-by: André Almeida <andrealmeid@igalia.com>
+Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org
+[andrealmeid: fix checkpatch warning]
+Signed-off-by: André Almeida <andrealmeid@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
+index c2726af6698e7..317303cf5b8c2 100644
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -1077,19 +1077,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
+ }
+
+ if (async_flip) {
+- /* check if the prop does a nop change */
+- if ((prop != config->prop_fb_id &&
+- prop != config->prop_in_fence_fd &&
+- prop != config->prop_fb_damage_clips)) {
+- ret = drm_atomic_plane_get_property(plane, plane_state,
+- prop, &old_val);
+- ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
+- }
++ /* no-op changes are always allowed */
++ ret = drm_atomic_plane_get_property(plane, plane_state,
++ prop, &old_val);
++ ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
+
+- /* ask the driver if this non-primary plane is supported */
+- if (plane->type != DRM_PLANE_TYPE_PRIMARY) {
+- ret = -EINVAL;
++ /* fail everything that isn't no-op or a pure flip */
++ if (ret && prop != config->prop_fb_id &&
++ prop != config->prop_in_fence_fd &&
++ prop != config->prop_fb_damage_clips) {
++ break;
++ }
+
++ if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) {
++ /* ask the driver if this non-primary plane is supported */
+ if (plane_funcs && plane_funcs->atomic_async_check)
+ ret = plane_funcs->atomic_async_check(plane, state, true);
+
+--
+2.51.0
+
--- /dev/null
+From dccdcf62edc6e5f33829730b9ee20668a843bcb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:21:33 -0500
+Subject: dt-bindings: vendor-prefixes: Add undocumented vendor prefixes
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ]
+
+Add various vendor prefixes which are in use in compatible strings
+already. These were found by modifying vendor-prefixes.yaml into a
+schema to check compatible strings.
+
+The added prefixes doesn't include various duplicate prefixes in use
+such as "lge".
+
+Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/vendor-prefixes.yaml | 50 +++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+index 5d2a7a8d3ac6c..75ccab226182c 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -85,6 +85,8 @@ patternProperties:
+ description: Allegro DVT
+ "^allegromicro,.*":
+ description: Allegro MicroSystems, Inc.
++ "^alliedtelesis,.*":
++ description: Allied Telesis, Inc.
+ "^alliedvision,.*":
+ description: Allied Vision Technologies GmbH
+ "^allo,.*":
+@@ -224,6 +226,8 @@ patternProperties:
+ description: Bitmain Technologies
+ "^blaize,.*":
+ description: Blaize, Inc.
++ "^bluegiga,.*":
++ description: Bluegiga Technologies Ltd.
+ "^blutek,.*":
+ description: BluTek Power
+ "^boe,.*":
+@@ -242,6 +246,8 @@ patternProperties:
+ description: Bticino International
+ "^buffalo,.*":
+ description: Buffalo, Inc.
++ "^buglabs,.*":
++ description: Bug Labs, Inc.
+ "^bur,.*":
+ description: B&R Industrial Automation GmbH
+ "^bytedance,.*":
+@@ -318,6 +324,8 @@ patternProperties:
+ description: Conexant Systems, Inc.
+ "^colorfly,.*":
+ description: Colorful GRP, Shenzhen Xueyushi Technology Ltd.
++ "^compal,.*":
++ description: Compal Electronics, Inc.
+ "^compulab,.*":
+ description: CompuLab Ltd.
+ "^comvetia,.*":
+@@ -346,6 +354,8 @@ patternProperties:
+ description: Guangzhou China Star Optoelectronics Technology Co., Ltd
+ "^csq,.*":
+ description: Shenzen Chuangsiqi Technology Co.,Ltd.
++ "^csr,.*":
++ description: Cambridge Silicon Radio
+ "^ctera,.*":
+ description: CTERA Networks Intl.
+ "^ctu,.*":
+@@ -446,6 +456,8 @@ patternProperties:
+ description: Emtop Embedded Solutions
+ "^eeti,.*":
+ description: eGalax_eMPIA Technology Inc
++ "^egnite,.*":
++ description: egnite GmbH
+ "^einfochips,.*":
+ description: Einfochips
+ "^eink,.*":
+@@ -476,8 +488,12 @@ patternProperties:
+ description: Empire Electronix
+ "^emtrion,.*":
+ description: emtrion GmbH
++ "^enbw,.*":
++ description: Energie Baden-Württemberg AG
+ "^enclustra,.*":
+ description: Enclustra GmbH
++ "^endian,.*":
++ description: Endian SRL
+ "^endless,.*":
+ description: Endless Mobile, Inc.
+ "^ene,.*":
+@@ -543,6 +559,8 @@ patternProperties:
+ description: FocalTech Systems Co.,Ltd
+ "^forlinx,.*":
+ description: Baoding Forlinx Embedded Technology Co., Ltd.
++ "^foxlink,.*":
++ description: Foxlink Group
+ "^freebox,.*":
+ description: Freebox SAS
+ "^freecom,.*":
+@@ -631,6 +649,10 @@ patternProperties:
+ description: Haoyu Microelectronic Co. Ltd.
+ "^hardkernel,.*":
+ description: Hardkernel Co., Ltd
++ "^hce,.*":
++ description: HCE Engineering SRL
++ "^headacoustics,.*":
++ description: HEAD acoustics
+ "^hechuang,.*":
+ description: Shenzhen Hechuang Intelligent Co.
+ "^hideep,.*":
+@@ -712,6 +734,8 @@ patternProperties:
+ description: Shenzhen INANBO Electronic Technology Co., Ltd.
+ "^incircuit,.*":
+ description: In-Circuit GmbH
++ "^incostartec,.*":
++ description: INCOstartec GmbH
+ "^indiedroid,.*":
+ description: Indiedroid
+ "^inet-tek,.*":
+@@ -916,6 +940,8 @@ patternProperties:
+ description: Maxim Integrated Products
+ "^maxlinear,.*":
+ description: MaxLinear Inc.
++ "^maxtor,.*":
++ description: Maxtor Corporation
+ "^mbvl,.*":
+ description: Mobiveil Inc.
+ "^mcube,.*":
+@@ -1077,6 +1103,8 @@ patternProperties:
+ description: Nordic Semiconductor
+ "^nothing,.*":
+ description: Nothing Technology Limited
++ "^novatech,.*":
++ description: NovaTech Automation
+ "^novatek,.*":
+ description: Novatek
+ "^novtech,.*":
+@@ -1172,6 +1200,8 @@ patternProperties:
+ description: Pervasive Displays, Inc.
+ "^phicomm,.*":
+ description: PHICOMM Co., Ltd.
++ "^phontech,.*":
++ description: Phontech
+ "^phytec,.*":
+ description: PHYTEC Messtechnik GmbH
+ "^picochip,.*":
+@@ -1256,6 +1286,8 @@ patternProperties:
+ description: Ramtron International
+ "^raspberrypi,.*":
+ description: Raspberry Pi Foundation
++ "^raumfeld,.*":
++ description: Raumfeld GmbH
+ "^raydium,.*":
+ description: Raydium Semiconductor Corp.
+ "^rda,.*":
+@@ -1294,6 +1326,8 @@ patternProperties:
+ description: ROHM Semiconductor Co., Ltd
+ "^ronbo,.*":
+ description: Ronbo Electronics
++ "^ronetix,.*":
++ description: Ronetix GmbH
+ "^roofull,.*":
+ description: Shenzhen Roofull Technology Co, Ltd
+ "^roseapplepi,.*":
+@@ -1318,8 +1352,12 @@ patternProperties:
+ description: Schindler
+ "^schneider,.*":
+ description: Schneider Electric
++ "^schulercontrol,.*":
++ description: Schuler Group
+ "^sciosense,.*":
+ description: ScioSense B.V.
++ "^sdmc,.*":
++ description: SDMC Technology Co., Ltd
+ "^seagate,.*":
+ description: Seagate Technology PLC
+ "^seeed,.*":
+@@ -1358,6 +1396,8 @@ patternProperties:
+ description: Si-En Technology Ltd.
+ "^si-linux,.*":
+ description: Silicon Linux Corporation
++ "^sielaff,.*":
++ description: Sielaff GmbH & Co.
+ "^siemens,.*":
+ description: Siemens AG
+ "^sifive,.*":
+@@ -1426,6 +1466,8 @@ patternProperties:
+ description: SolidRun
+ "^solomon,.*":
+ description: Solomon Systech Limited
++ "^somfy,.*":
++ description: Somfy Systems Inc.
+ "^sony,.*":
+ description: Sony Corporation
+ "^sophgo,.*":
+@@ -1496,6 +1538,8 @@ patternProperties:
+ "^synopsys,.*":
+ description: Synopsys, Inc. (deprecated, use snps)
+ deprecated: true
++ "^taos,.*":
++ description: Texas Advanced Optoelectronic Solutions Inc.
+ "^tbs,.*":
+ description: TBS Technologies
+ "^tbs-biometrics,.*":
+@@ -1526,6 +1570,8 @@ patternProperties:
+ description: Teltonika Networks
+ "^tempo,.*":
+ description: Tempo Semiconductor
++ "^tenda,.*":
++ description: Shenzhen Tenda Technology Co., Ltd.
+ "^terasic,.*":
+ description: Terasic Inc.
+ "^tesla,.*":
+@@ -1629,6 +1675,8 @@ patternProperties:
+ description: V3 Semiconductor
+ "^vaisala,.*":
+ description: Vaisala
++ "^valve,.*":
++ description: Valve Corporation
+ "^vamrs,.*":
+ description: Vamrs Ltd.
+ "^variscite,.*":
+@@ -1729,6 +1777,8 @@ patternProperties:
+ description: Extreme Engineering Solutions (X-ES)
+ "^xiaomi,.*":
+ description: Xiaomi Technology Co., Ltd.
++ "^xicor,.*":
++ description: Xicor Inc.
+ "^xillybus,.*":
+ description: Xillybus Ltd.
+ "^xingbangda,.*":
+--
+2.51.0
+
--- /dev/null
+From 6559927821dc1cb64b8ce513fabf7675da621d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 17:29:54 +0800
+Subject: dts: arm: amlogic: fix pwm node for c3
+
+From: Xianwei Zhao <xianwei.zhao@amlogic.com>
+
+[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ]
+
+Fix reg address for c3 pwm node.
+
+Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM")
+Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+index cb9ea3ca6ee0f..71b2b3b547f7c 100644
+--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
++++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+@@ -792,7 +792,7 @@ spicc1: spi@52000 {
+ pwm_mn: pwm@54000 {
+ compatible = "amlogic,c3-pwm",
+ "amlogic,meson-s4-pwm";
+- reg = <0x0 54000 0x0 0x24>;
++ reg = <0x0 0x54000 0x0 0x24>;
+ clocks = <&clkc_periphs CLKID_PWM_M>,
+ <&clkc_periphs CLKID_PWM_N>;
+ #pwm-cells = <3>;
+--
+2.51.0
+
--- /dev/null
+From bbcf563699d6f39f8c2070d2e13f5c2d6cbca16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:57:07 +0800
+Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
+
+When loading the i10nm_edac driver on some Intel Granite Rapids servers,
+a call trace may appear as follows:
+
+ UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
+ shift exponent -66 is negative
+ ...
+ __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
+ skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
+ i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
+ skx_register_mci+0x159/0x220 [skx_edac_common]
+ i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
+ ...
+
+This occurs because some BIOS may disable a memory controller if there
+aren't any memory DIMMs populated on this memory controller. The DIMMMTR
+register of this disabled memory controller contains the invalid value
+~0, resulting in the call trace above.
+
+Fix this call trace by skipping DIMM enumeration on a disabled memory
+controller.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
+Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index a3fca2567752e..ac9afcf461d71 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -1047,6 +1047,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
+ return !!GET_BITFIELD(mcmtr, 2, 2);
+ }
+
++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
++{
++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
++
++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
++
++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
++}
++
+ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ struct res_config *cfg)
+ {
+@@ -1060,6 +1069,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ if (!imc->mbase)
+ continue;
+
++ if (i10nm_channel_disabled(imc, i)) {
++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
++ continue;
++ }
++
+ ndimms = 0;
+
+ if (res_cfg->type != GNR)
+--
+2.51.0
+
--- /dev/null
+From ba314a3864382b600d8e3ee0a16025d35d653b30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:03:38 +0800
+Subject: f2fs: fix condition in __allow_reserved_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
+
+If reserve_root mount option is not assigned, __allow_reserved_blocks()
+will return false, it's not correct, fix it.
+
+Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index e084b96f11090..ec9a1d334ddaf 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2358,8 +2358,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+ {
+ if (!inode)
+ return true;
+- if (!test_opt(sbi, RESERVE_ROOT))
+- return false;
+ if (IS_NOQUOTA(inode))
+ return true;
+ if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
+@@ -2380,7 +2378,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+ avail_user_block_count = sbi->user_block_count -
+ sbi->current_reserved_blocks;
+
+- if (!__allow_reserved_blocks(sbi, inode, cap))
++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
+ avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+--
+2.51.0
+
--- /dev/null
+From 89acc9b33a6df06ccafce93da2b1374d3ddc216e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 14:29:10 +0800
+Subject: f2fs: fix to avoid overflow while left shift operation
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ]
+
+Should cast type of folio->index from pgoff_t to loff_t to avoid overflow
+while left shift operation.
+
+Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 8cbb8038bc72f..e6ec77d6903be 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
+
+ for (i = cluster_size - 1; i >= 0; i--) {
+ struct folio *folio = page_folio(rpages[i]);
+- loff_t start = folio->index << PAGE_SHIFT;
++ loff_t start = (loff_t)folio->index << PAGE_SHIFT;
+
+ if (from <= start) {
+ folio_zero_segment(folio, 0, folio_size(folio));
+--
+2.51.0
+
--- /dev/null
+From b68ad98844ad0c05ea48f16d7d4b3ac4491c5ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 10:47:09 +0800
+Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
+
+f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
+and page lookup, change as below to mitigate its overhead:
+- check new_size before grabbing invalidate_lock
+- lookup and invalidate pages only in range of [old_size, new_size]
+
+Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 0b4868b2370d0..e203ec4d06ae2 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -35,15 +35,23 @@
+ #include <trace/events/f2fs.h>
+ #include <uapi/linux/f2fs.h>
+
+-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
++static void f2fs_zero_post_eof_page(struct inode *inode,
++ loff_t new_size, bool lock)
+ {
+ loff_t old_size = i_size_read(inode);
+
+ if (old_size >= new_size)
+ return;
+
++ if (mapping_empty(inode->i_mapping))
++ return;
++
++ if (lock)
++ filemap_invalidate_lock(inode->i_mapping);
+ /* zero or drop pages only in range of [old_size, new_size] */
+- truncate_pagecache(inode, old_size);
++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
++ if (lock)
++ filemap_invalidate_unlock(inode->i_mapping);
+ }
+
+ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+
+ f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
+
+ file_update_time(vmf->vma->vm_file);
+ filemap_invalidate_lock_shared(inode->i_mapping);
+@@ -1134,7 +1140,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ filemap_invalidate_lock(inode->i_mapping);
+
+ if (attr->ia_size > old_size)
+- f2fs_zero_post_eof_page(inode, attr->ia_size);
++ f2fs_zero_post_eof_page(inode, attr->ia_size, false);
+ truncate_setsize(inode, attr->ia_size);
+
+ if (attr->ia_size <= old_size)
+@@ -1253,9 +1259,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1540,7 +1544,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(inode->i_mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+
+ f2fs_lock_op(sbi);
+ f2fs_drop_extent_tree(inode);
+@@ -1663,9 +1667,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1799,7 +1801,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+ truncate_pagecache(inode, offset);
+
+ while (!ret && idx > pg_start) {
+@@ -1857,9 +1859,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ f2fs_balance_fs(sbi, true);
+
+@@ -4903,9 +4903,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode,
++ iocb->ki_pos + iov_iter_count(from), true);
+ return count;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 570efeea38efa76180a0cd9c30e86b9af68ef45c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:40:24 +0800
+Subject: f2fs: fix to truncate first page in error path of f2fs_truncate()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
+
+syzbot reports a bug as below:
+
+loop0: detected capacity change from 0 to 40427
+F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
+F2FS-fs (loop0): invalid crc value
+F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
+------------[ cut here ]------------
+kernel BUG at fs/inode.c:753!
+RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
+Call Trace:
+ <TASK>
+ evict+0x504/0x9c0 fs/inode.c:810
+ f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
+ get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
+ vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
+ do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
+ do_mount fs/namespace.c:4136 [inline]
+ __do_sys_mount fs/namespace.c:4347 [inline]
+ __se_sys_mount+0x317/0x410 fs/namespace.c:4324
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
+all page cache before destorying inode, that is because in below path, we
+will create page #0 in cache, but missed to drop it in error path, let's fix
+it.
+
+- evict
+ - f2fs_evict_inode
+ - f2fs_truncate
+ - f2fs_convert_inline_inode
+ - f2fs_grab_cache_folio
+ : create page #0 in cache
+ - f2fs_convert_inline_folio
+ : sanity check failed, return -EFSCORRUPTED
+ - clear_inode detects that inode->i_data.nrpages is not zero
+
+Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
+Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index bb3fd6a8416fd..0b4868b2370d0 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -900,8 +900,16 @@ int f2fs_truncate(struct inode *inode)
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+- if (err)
++ if (err) {
++ /*
++ * Always truncate page #0 to avoid page cache
++ * leak in evict() path.
++ */
++ truncate_inode_pages_range(inode->i_mapping,
++ F2FS_BLK_TO_BYTES(0),
++ F2FS_BLK_END_BYTES(0));
+ return err;
++ }
+ }
+
+ err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
+--
+2.51.0
+
--- /dev/null
+From f336a37e1999cc5516e82e5e9d0ac82ccd0b3ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:12:50 +0800
+Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
+
+Script to reproduce:
+mkfs.f2fs -O extra_attr,compression /dev/vdb -f
+mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
+cd /mnt/f2fs
+f2fs_io write 1 0 1024 rand dsync testfile
+xfs_io testfile -c "fsync"
+f2fs_io write 1 0 512 rand dsync testfile
+xfs_io testfile -c "fsync"
+cd /
+umount /mnt/f2fs
+mount /dev/vdb /mnt/f2fs
+f2fs_io precache_extents /mnt/f2fs/testfile
+umount /mnt/f2fs
+
+Tracepoint output:
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
+
+During precache_extents, there is off-by-one issue, we should update
+map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
+valid and not contiguous to previous extent.
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 53b64f4ff2d74..6ff650f425113 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1785,7 +1785,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+- *map->m_next_extent = pgofs + 1;
++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+ }
+ f2fs_put_dnode(&dn);
+ unlock_out:
+--
+2.51.0
+
--- /dev/null
+From 5b1b28ac280a6a29610c6561bffa9b94b3a3680f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:11:06 +0800
+Subject: f2fs: fix to zero data after EOF for compressed file correctly
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ]
+
+generic/091 may fail, then it bisects to the bad commit ba8dac350faf
+("f2fs: fix to zero post-eof page").
+
+What will cause generic/091 to fail is something like below Testcase #1:
+1. write 16k as compressed blocks
+2. truncate to 12k
+3. truncate to 20k
+4. verify data in range of [12k, 16k], however data is not zero as
+expected
+
+Script of Testcase #1
+mkfs.f2fs -f -O extra_attr,compression /dev/vdb
+mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
+dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
+dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
+sync
+truncate -s $((12*1024)) /mnt/f2fs/file
+truncate -s $((20*1024)) /mnt/f2fs/file
+dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
+od /mnt/f2fs/data
+umount /mnt/f2fs
+
+Analisys:
+in step 2), we will redirty all data pages from #0 to #3 in compressed
+cluster, and zero page #3,
+in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop
+all page cache post eof, includeing dirtied page #3,
+in step 4) when we read data from page #3, it will decompressed cluster
+and extra random data to page #3, finally, we hit the non-zeroed data
+post eof.
+
+However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just
+let the issue be reproduced easily, w/o the commit, it can reproduce this
+bug w/ below Testcase #2:
+1. write 16k as compressed blocks
+2. truncate to 8k
+3. truncate to 12k
+4. truncate to 20k
+5. verify data in range of [12k, 16k], however data is not zero as
+expected
+
+Script of Testcase #2
+mkfs.f2fs -f -O extra_attr,compression /dev/vdb
+mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
+dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
+dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
+sync
+truncate -s $((8*1024)) /mnt/f2fs/file
+truncate -s $((12*1024)) /mnt/f2fs/file
+truncate -s $((20*1024)) /mnt/f2fs/file
+echo 3 > /proc/sys/vm/drop_caches
+dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
+od /mnt/f2fs/data
+umount /mnt/f2fs
+
+Anlysis:
+in step 2), we will redirty all data pages from #0 to #3 in compressed
+cluster, and zero page #2 and #3,
+in step 3), we will truncate page #3 in page cache,
+in step 4), expand file size,
+in step 5), hit random data post eof w/ the same reason in Testcase #1.
+
+Root Cause:
+In f2fs_truncate_partial_cluster(), after we truncate partial data block
+on compressed cluster, all pages in cluster including the one post eof
+will be dirtied, after another tuncation, dirty page post eof will be
+dropped, however on-disk compressed cluster is still valid, it may
+include non-zero data post eof, result in exposing previous non-zero data
+post eof while reading.
+
+Fix:
+In f2fs_truncate_partial_cluster(), let change as below to fix:
+- call filemap_write_and_wait_range() to flush dirty page
+- call truncate_pagecache() to drop pages or zero partial page post eof
+- call f2fs_do_truncate_blocks() to truncate non-compress cluster to
+ last valid block
+
+Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
+Reported-by: Jan Prusakowski <jprusakowski@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index e6ec77d6903be..67cac17cc7dc7 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
+ for (i = cluster_size - 1; i >= 0; i--) {
+ struct folio *folio = page_folio(rpages[i]);
+ loff_t start = (loff_t)folio->index << PAGE_SHIFT;
++ loff_t offset = from > start ? from - start : 0;
+
+- if (from <= start) {
+- folio_zero_segment(folio, 0, folio_size(folio));
+- } else {
+- folio_zero_segment(folio, from - start,
+- folio_size(folio));
++ folio_zero_segment(folio, offset, folio_size(folio));
++
++ if (from >= start)
+ break;
+- }
+ }
+
+ f2fs_compress_write_end(inode, fsdata, start_idx, true);
++
++ err = filemap_write_and_wait_range(inode->i_mapping,
++ round_down(from, cluster_size << PAGE_SHIFT),
++ LLONG_MAX);
++ if (err)
++ return err;
++
++ truncate_pagecache(inode, from);
++
++ err = f2fs_do_truncate_blocks(inode,
++ round_up(from, PAGE_SIZE), lock);
+ }
+- return 0;
++ return err;
+ }
+
+ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+--
+2.51.0
+
--- /dev/null
+From 84f80526261c2b87aba8f431018320bed9a60933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:21 +0800
+Subject: f2fs: fix zero-sized extent for precache extents
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
+
+Script to reproduce:
+f2fs_io write 1 0 1881 rand dsync testfile
+f2fs_io fallocate 0 7708672 4096 testfile
+f2fs_io write 1 1881 1 rand buffered testfile
+fsync testfile
+umount
+mount
+f2fs_io precache_extents testfile
+
+When the data layout is something like this:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+...
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+During precache_extents, we map the last block(valid blkaddr) in dnode1:
+map->m_flags |= F2FS_MAP_MAPPED;
+map->m_pblk = blkaddr(valid blkaddr);
+map->m_len = 1;
+then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
+map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
+
+map->m_len = 1
+ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
+ei.fofs = start_pgofs = 1882
+ei.len = map->m_len - ofs = 1 - 1 = 0
+
+Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
+A,B,C is valid blkaddr
+case1:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case2:
+dnode1: dnode2:
+[0] A [0] C (C!=B+1)
+[1] A+1 [1] C+1
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case3:
+dnode1: dnode2:
+[0] A [0] C (C!=B+2)
+[1] A+1 [1] C+1
+... ....
+[1015] A+1015
+[1016] B (B!=A+1016)
+[1017] B+1 [1017] 0x0
+
+[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 6ff650f425113..9c35a0fb79e73 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1780,9 +1780,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ if (map->m_flags & F2FS_MAP_MAPPED) {
+ unsigned int ofs = start_pgofs - map->m_lblk;
+
+- f2fs_update_read_extent_cache_range(&dn,
+- start_pgofs, map->m_pblk + ofs,
+- map->m_len - ofs);
++ if (map->m_len > ofs)
++ f2fs_update_read_extent_cache_range(&dn,
++ start_pgofs, map->m_pblk + ofs,
++ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+--
+2.51.0
+
--- /dev/null
+From 3418198bdcbee8bb983958e480194a35e62b2cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 16:09:13 +0200
+Subject: fanotify: Validate the return value of mnt_ns_from_dentry() before
+ dereferencing
+
+From: Anderson Nascimento <anderson@allelesecurity.com>
+
+[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ]
+
+The function do_fanotify_mark() does not validate if
+mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.
+This causes a NULL pointer dereference in do_fanotify_mark() if the
+path is not a mount namespace object.
+
+Fix this by checking mnt_ns_from_dentry()'s return value before
+dereferencing it.
+
+Before the patch
+
+$ gcc fanotify_nullptr.c -o fanotify_nullptr
+$ mkdir A
+$ ./fanotify_nullptr
+Fanotify fd: 3
+fanotify_mark: Operation not permitted
+$ unshare -Urm
+Fanotify fd: 3
+Killed
+
+int main(void){
+ int ffd;
+ ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);
+ if(ffd < 0){
+ perror("fanotify_init");
+ exit(EXIT_FAILURE);
+ }
+
+ printf("Fanotify fd: %d\n",ffd);
+
+ if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,
+FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){
+ perror("fanotify_mark");
+ exit(EXIT_FAILURE);
+ }
+
+return 0;
+}
+
+After the patch
+
+$ gcc fanotify_nullptr.c -o fanotify_nullptr
+$ mkdir A
+$ ./fanotify_nullptr
+Fanotify fd: 3
+fanotify_mark: Operation not permitted
+$ unshare -Urm
+Fanotify fd: 3
+fanotify_mark: Invalid argument
+
+[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038
+[ 25.695006] #PF: supervisor read access in kernel mode
+[ 25.695012] #PF: error_code(0x0000) - not-present page
+[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0
+[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI
+[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not
+tainted 6.17.0-rc4 #1 PREEMPT(lazy)
+[ 25.695040] Hardware name: VMware, Inc. VMware Virtual
+Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
+[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950
+[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54
+24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b
+5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28
+85 c9
+[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203
+[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220
+[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180
+[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000
+[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7
+[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0
+[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)
+knlGS:0000000000000000
+[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0
+[ 25.695201] Call Trace:
+[ 25.695209] <TASK>
+[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30
+[ 25.695222] do_syscall_64+0x82/0x2c0
+...
+
+Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns")
+Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com
+Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index b192ee068a7ac..561339b4cf752 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
+ user_ns = path.mnt->mnt_sb->s_user_ns;
+ obj = path.mnt->mnt_sb;
+ } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) {
++ ret = -EINVAL;
+ mntns = mnt_ns_from_dentry(path.dentry);
++ if (!mntns)
++ goto path_put_and_out;
+ user_ns = mntns->user_ns;
+ obj = mntns;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3a3191e60fec286dc8cba60908adb968e3f67bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index b8d1e00a7982c..2dfeb158e848a 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From 64598ab1445d9666c76a8441c49e0ef463ea7183 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:53:43 +0800
+Subject: firmware: arm_scmi: Mark VirtIO ready before registering
+ scmi_virtio_driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Junnan Wu <junnan01.wu@samsung.com>
+
+[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]
+
+After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
+standalone driver”), the VirtIO transport probes independently. During
+scmi_virtio_probe, scmi_probe() is called, which intune invokes
+scmi_protocol_acquire() that sends a message over the virtqueue and
+waits for a reply.
+
+Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
+virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
+Initialization):
+ | The driver MUST NOT send any buffer available notifications to the
+ | device before setting DRIVER_OK.
+
+Some type-1 hypervisors block available-buffer notifications until the
+driver is marked OK. In such cases, scmi_vio_probe stalls in
+scmi_wait_for_reply(), and the probe never completes.
+
+Resolve this by setting DRIVER_OK immediately after the device-specific
+setup, so scmi_probe() can safely send notifications.
+
+Note after splitting the transports into modules, the probe sequence
+changed a bit. We can no longer rely on virtio_device_ready() being
+called by the core in virtio_dev_probe(), because scmi_vio_probe()
+doesn’t complete until the core SCMI stack runs scmi_probe(), which
+immediately issues the initial BASE protocol exchanges.
+
+Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
+Signed-off-by: Junnan Wu <junnan01.wu@samsung.com>
+Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
+index cb934db9b2b4a..326c4a93e44b9 100644
+--- a/drivers/firmware/arm_scmi/transports/virtio.c
++++ b/drivers/firmware/arm_scmi/transports/virtio.c
+@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
+ /* Ensure initialized scmi_vdev is visible */
+ smp_store_mb(scmi_vdev, vdev);
+
++ /* Set device ready */
++ virtio_device_ready(vdev);
++
+ ret = platform_driver_register(&scmi_virtio_driver);
+ if (ret) {
+ vdev->priv = NULL;
+--
+2.51.0
+
--- /dev/null
+From e20a7cc336cba44d9db1ff738ea2f7e87eb08ac2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From d787afb975964a61469676b00948ad6e6416af83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 6e86d66197ef2..88550085f7457 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else {
+ /* The size of 'dlcn' can't be > 8. */
+ return -EINVAL;
+ }
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From dde216c045efb536e31eca4e4e478163b14c3eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 10:40:16 -0700
+Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks
+ exist
+
+From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+
+[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
+
+Index allocation requires at least one bit in the $BITMAP attribute to
+track usage of index entries. If the bitmap is empty while index blocks
+are already present, this reflects on-disk corruption.
+
+syzbot triggered this condition using a malformed NTFS image. During a
+rename() operation involving a long filename (which spans multiple
+index entries), the empty bitmap allowed the name to be added without
+valid tracking. Subsequent deletion of the original entry failed with
+-ENOENT, due to unexpected index state.
+
+Reject such cases by verifying that the bitmap is not empty when index
+blocks exist.
+
+Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
+Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
+Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 1bf2a6593dec6..6d1bf890929d9 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
+ bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
+ }
+
++ /*
++ * Index blocks exist, but $BITMAP has zero valid bits.
++ * This implies an on-disk corruption and must be rejected.
++ */
++ if (in->name == I30_NAME &&
++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
++ err = -EINVAL;
++ goto out1;
++ }
++
+ bit = bmp_size << 3;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f1df31eec09bd93f6d2cabf0188d98a8066b80fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 11:49:54 +0530
+Subject: fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ]
+
+Use kvfree() to free memory allocated by kvzalloc() instead of kfree().
+Avoid potential memory management issue considering kvzalloc() can
+internally choose to use either kmalloc() or vmalloc() based on memory
+request and current system memory state. Hence, use more appropriate
+kvfree() which automatically determines correct free method to avoid
+potential hard to debug memory issues. Fix this issue discovered by
+running spatch static analysis tool using coccinelle script -
+scripts/coccinelle/api/kfree_mismatch.cocci
+
+Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw")
+Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fwctl/mlx5/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c
+index f93aa0cecdb97..4b379f695eb73 100644
+--- a/drivers/fwctl/mlx5/main.c
++++ b/drivers/fwctl/mlx5/main.c
+@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope,
+ */
+ if (ret && ret != -EREMOTEIO) {
+ if (rpc_out != rpc_in)
+- kfree(rpc_out);
++ kvfree(rpc_out);
+ return ERR_PTR(ret);
+ }
+ return rpc_out;
+--
+2.51.0
+
--- /dev/null
+From 947e194027abac7ed01c82a5f44301721032db21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 23:57:24 +0200
+Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
+
+Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
+flag a second time after it has already been cleared. Fix that.
+
+Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index ea96113edbe31..5f44486479d69 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -807,8 +807,6 @@ __acquires(&gl->gl_lockref.lock)
+ clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
+ return;
+- } else {
+- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 82ff4e2791518d34de1a79975daa41dbcf74efc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 18:58:51 +0200
+Subject: HID: hidraw: tighten ioctl command parsing
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]
+
+The handling for variable-length ioctl commands in hidraw_ioctl() is
+rather complex and the check for the data direction is incomplete.
+
+Simplify this code by factoring out the various ioctls grouped by dir
+and size, and using a switch() statement with the size masked out, to
+ensure the rest of the command is correctly matched.
+
+Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hidraw.c | 224 ++++++++++++++++++++----------------
+ include/uapi/linux/hidraw.h | 2 +
+ 2 files changed, 124 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index c887f48756f4b..bbd6f23bce789 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
+ return 0;
+ }
+
+-static long hidraw_ioctl(struct file *file, unsigned int cmd,
+- unsigned long arg)
++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *arg)
+ {
+- struct inode *inode = file_inode(file);
+- unsigned int minor = iminor(inode);
+- long ret = 0;
+- struct hidraw *dev;
+- struct hidraw_list *list = file->private_data;
+- void __user *user_arg = (void __user*) arg;
+-
+- down_read(&minors_rwsem);
+- dev = hidraw_table[minor];
+- if (!dev || !dev->exist || hidraw_is_revoked(list)) {
+- ret = -ENODEV;
+- goto out;
+- }
++ struct hid_device *hid = dev->hid;
+
+ switch (cmd) {
+ case HIDIOCGRDESCSIZE:
+- if (put_user(dev->hid->rsize, (int __user *)arg))
+- ret = -EFAULT;
++ if (put_user(hid->rsize, (int __user *)arg))
++ return -EFAULT;
+ break;
+
+ case HIDIOCGRDESC:
+@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+ __u32 len;
+
+ if (get_user(len, (int __user *)arg))
+- ret = -EFAULT;
+- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+- ret = -EINVAL;
+- else if (copy_to_user(user_arg + offsetof(
+- struct hidraw_report_descriptor,
+- value[0]),
+- dev->hid->rdesc,
+- min(dev->hid->rsize, len)))
+- ret = -EFAULT;
++ return -EFAULT;
++
++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
++ return -EINVAL;
++
++ if (copy_to_user(arg + offsetof(
++ struct hidraw_report_descriptor,
++ value[0]),
++ hid->rdesc,
++ min(hid->rsize, len)))
++ return -EFAULT;
++
+ break;
+ }
+ case HIDIOCGRAWINFO:
+ {
+ struct hidraw_devinfo dinfo;
+
+- dinfo.bustype = dev->hid->bus;
+- dinfo.vendor = dev->hid->vendor;
+- dinfo.product = dev->hid->product;
+- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
+- ret = -EFAULT;
++ dinfo.bustype = hid->bus;
++ dinfo.vendor = hid->vendor;
++ dinfo.product = hid->product;
++ if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
++ return -EFAULT;
+ break;
+ }
+ case HIDIOCREVOKE:
+ {
+- if (user_arg)
+- ret = -EINVAL;
+- else
+- ret = hidraw_revoke(list);
+- break;
++ struct hidraw_list *list = file->private_data;
++
++ if (arg)
++ return -EINVAL;
++
++ return hidraw_revoke(list);
+ }
+ default:
+- {
+- struct hid_device *hid = dev->hid;
+- if (_IOC_TYPE(cmd) != 'H') {
+- ret = -EINVAL;
+- break;
+- }
++ /*
++ * None of the above ioctls can return -EAGAIN, so
++ * use it as a marker that we need to check variable
++ * length ioctls.
++ */
++ return -EAGAIN;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
++ return 0;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ int len = _IOC_SIZE(cmd);
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCSFEATURE(0):
++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCGFEATURE(0):
++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCSINPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCGINPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCSOUTPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ case HIDIOCGOUTPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
++ return -EINVAL;
++}
+
+- /* Begin Read-only ioctls. */
+- if (_IOC_DIR(cmd) != _IOC_READ) {
+- ret = -EINVAL;
+- break;
+- }
++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ struct hid_device *hid = dev->hid;
++ int len = _IOC_SIZE(cmd);
++ int field_len;
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCGRAWNAME(0):
++ field_len = strlen(hid->name) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len;
++ case HIDIOCGRAWPHYS(0):
++ field_len = strlen(hid->phys) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len;
++ case HIDIOCGRAWUNIQ(0):
++ field_len = strlen(hid->uniq) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
+- int len = strlen(hid->name) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->name, len) ?
+- -EFAULT : len;
+- break;
+- }
++ return -EINVAL;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
+- int len = strlen(hid->phys) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->phys, len) ?
+- -EFAULT : len;
+- break;
+- }
++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ struct inode *inode = file_inode(file);
++ unsigned int minor = iminor(inode);
++ struct hidraw *dev;
++ struct hidraw_list *list = file->private_data;
++ void __user *user_arg = (void __user *)arg;
++ int ret;
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
+- int len = strlen(hid->uniq) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->uniq, len) ?
+- -EFAULT : len;
+- break;
+- }
+- }
++ down_read(&minors_rwsem);
++ dev = hidraw_table[minor];
++ if (!dev || !dev->exist || hidraw_is_revoked(list)) {
++ ret = -ENODEV;
++ goto out;
++ }
++
++ if (_IOC_TYPE(cmd) != 'H') {
++ ret = -EINVAL;
++ goto out;
++ }
+
++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
+ ret = -ENOTTY;
++ goto out;
+ }
++
++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
++ if (ret != -EAGAIN)
++ goto out;
++
++ switch (_IOC_DIR(cmd)) {
++ case (_IOC_READ | _IOC_WRITE):
++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ case _IOC_READ:
++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ default:
++ /* Any other IOC_DIR is wrong */
++ ret = -EINVAL;
++ }
++
+ out:
+ up_read(&minors_rwsem);
+ return ret;
+diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
+index d5ee269864e07..ebd701b3c18d9 100644
+--- a/include/uapi/linux/hidraw.h
++++ b/include/uapi/linux/hidraw.h
+@@ -48,6 +48,8 @@ struct hidraw_devinfo {
+ #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
+ #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */
+
++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE)
++
+ #define HIDRAW_FIRST_MINOR 0
+ #define HIDRAW_MAX_DEVICES 64
+ /* number of reports to buffer */
+--
+2.51.0
+
--- /dev/null
+From 6fa21740fb65709ab70f5825dca70f1acdd56a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:27:35 +0200
+Subject: HID: steelseries: Fix STEELSERIES_SRWS1 handling in
+ steelseries_remove()
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ]
+
+srws1_remove label can be only reached only if LEDS subsystem is enabled. To
+avoid putting horryfing ifdef second time around the label, just perform
+the cleanup and exit immediately directly.
+
+Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-steelseries.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
+index 8af98d67959e0..f98435631aa18 100644
+--- a/drivers/hid/hid-steelseries.c
++++ b/drivers/hid/hid-steelseries.c
+@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev)
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+- goto srws1_remove;
++ hid_hw_stop(hdev);
+ #endif
+ return;
+ }
+@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev)
+ cancel_delayed_work_sync(&sd->battery_work);
+
+ hid_hw_close(hdev);
+-srws1_remove:
+ hid_hw_stop(hdev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 64bbc2de738bea00929848c08339da34531af790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 20:26:43 +0900
+Subject: HID: steelseries: refactor probe() and remove()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ]
+
+steelseries_srws1_probe() still does not use devm_kzalloc() and
+devm_led_classdev_register(), so there is a lot of code to safely manage
+heap, which reduces readability and may cause memory leaks due to minor
+patch mistakes in the future.
+
+Therefore, it should be changed to use devm_kzalloc() and
+devm_led_classdev_register() to easily and safely manage heap.
+
+Also, the current steelseries driver mainly checks sd->quriks to determine
+which product a specific HID device is, which is not the correct way.
+
+remove(), unlike probe(), does not receive struct hid_device_id as an
+argument, so it must check hdev unconditionally to know which product
+it is.
+
+However, since struct steelseries_device and struct steelseries_srws1_data
+have different structures, if SRWS1 is removed in remove(), converts
+hdev->dev, which is initialized to struct steelseries_srws1_data,
+to struct steelseries_device and uses it. This causes various
+memory-related bugs as completely unexpected values exist in member
+variables of the structure.
+
+Therefore, in order to modify probe() and remove() to work properly,
+Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be
+modified to check hdev->product when determining HID device product.
+
+Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox")
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 +
+ drivers/hid/hid-quirks.c | 2 +
+ drivers/hid/hid-steelseries.c | 109 ++++++++++++----------------------
+ 3 files changed, 43 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index a752c667fbcaa..dde20386def17 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1293,6 +1293,8 @@
+
+ #define USB_VENDOR_ID_STEELSERIES 0x1038
+ #define USB_DEVICE_ID_STEELSERIES_SRWS1 0x1410
++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1 0x12b6
++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9 0x12c2
+
+ #define USB_VENDOR_ID_SUN 0x0430
+ #define USB_DEVICE_ID_RARITAN_KVM_DONGLE 0xcdab
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 416160cfde77b..ccffd08cd8840 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -694,6 +694,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #endif
+ #if IS_ENABLED(CONFIG_HID_STEELSERIES)
+ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_SUNPLUS)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
+diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
+index d4bd7848b8c66..8af98d67959e0 100644
+--- a/drivers/hid/hid-steelseries.c
++++ b/drivers/hid/hid-steelseries.c
+@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ {
+ int ret, i;
+ struct led_classdev *led;
++ struct steelseries_srws1_data *drv_data;
+ size_t name_sz;
+ char *name;
+
+- struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL);
+-
++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
+ if (drv_data == NULL) {
+ hid_err(hdev, "can't alloc SRW-S1 memory\n");
+ return -ENOMEM;
+@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+- goto err_free;
++ goto err;
+ }
+
+ if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
+ ret = -ENODEV;
+- goto err_free;
++ goto err;
+ }
+
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+ if (ret) {
+ hid_err(hdev, "hw start failed\n");
+- goto err_free;
++ goto err;
+ }
+
+ /* register led subsystem */
+@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ name_sz = strlen(hdev->uniq) + 16;
+
+ /* 'ALL', for setting all LEDs simultaneously */
+- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ if (!led) {
+ hid_err(hdev, "can't allocate memory for LED ALL\n");
+- goto err_led;
++ goto out;
+ }
+
+ name = (void *)(&led[1]);
+@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ led->brightness_set = steelseries_srws1_led_all_set_brightness;
+
+ drv_data->led[SRWS1_NUMBER_LEDS] = led;
+- ret = led_classdev_register(&hdev->dev, led);
+- if (ret)
+- goto err_led;
++ ret = devm_led_classdev_register(&hdev->dev, led);
++ if (ret) {
++ hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS);
++ goto out; /* let the driver continue without LEDs */
++ }
+
+ /* Each individual LED */
+ for (i = 0; i < SRWS1_NUMBER_LEDS; i++) {
+- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ if (!led) {
+ hid_err(hdev, "can't allocate memory for LED %d\n", i);
+- goto err_led;
++ break;
+ }
+
+ name = (void *)(&led[1]);
+@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ led->brightness_set = steelseries_srws1_led_set_brightness;
+
+ drv_data->led[i] = led;
+- ret = led_classdev_register(&hdev->dev, led);
++ ret = devm_led_classdev_register(&hdev->dev, led);
+
+ if (ret) {
+ hid_err(hdev, "failed to register LED %d. Aborting.\n", i);
+-err_led:
+- /* Deregister all LEDs (if any) */
+- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
+- led = drv_data->led[i];
+- drv_data->led[i] = NULL;
+- if (!led)
+- continue;
+- led_classdev_unregister(led);
+- kfree(led);
+- }
+- goto out; /* but let the driver continue without LEDs */
++ break; /* but let the driver continue without LEDs */
+ }
+ }
+ out:
+ return 0;
+-err_free:
+- kfree(drv_data);
++err:
+ return ret;
+ }
+-
+-static void steelseries_srws1_remove(struct hid_device *hdev)
+-{
+- int i;
+- struct led_classdev *led;
+-
+- struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev);
+-
+- if (drv_data) {
+- /* Deregister LEDs (if any) */
+- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
+- led = drv_data->led[i];
+- drv_data->led[i] = NULL;
+- if (!led)
+- continue;
+- led_classdev_unregister(led);
+- kfree(led);
+- }
+-
+- }
+-
+- hid_hw_stop(hdev);
+- kfree(drv_data);
+-}
+ #endif
+
+ #define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS 3000
+@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev,
+
+ static void steelseries_headset_fetch_battery(struct hid_device *hdev)
+ {
+- struct steelseries_device *sd = hid_get_drvdata(hdev);
+ int ret = 0;
+
+- if (sd->quirks & STEELSERIES_ARCTIS_1)
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1)
+ ret = steelseries_headset_request_battery(hdev,
+ arctis_1_battery_request, sizeof(arctis_1_battery_request));
+- else if (sd->quirks & STEELSERIES_ARCTIS_9)
++ else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9)
+ ret = steelseries_headset_request_battery(hdev,
+ arctis_9_battery_request, sizeof(arctis_9_battery_request));
+
+@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+ struct steelseries_device *sd;
+ int ret;
+
+- sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
+- if (!sd)
+- return -ENOMEM;
+- hid_set_drvdata(hdev, sd);
+- sd->hdev = hdev;
+- sd->quirks = id->driver_data;
+-
+- if (sd->quirks & STEELSERIES_SRWS1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+ return steelseries_srws1_probe(hdev, id);
+@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+ #endif
+ }
+
++ sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
++ if (!sd)
++ return -ENOMEM;
++ hid_set_drvdata(hdev, sd);
++ sd->hdev = hdev;
++ sd->quirks = id->driver_data;
++
+ ret = hid_parse(hdev);
+ if (ret)
+ return ret;
+@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+
+ static void steelseries_remove(struct hid_device *hdev)
+ {
+- struct steelseries_device *sd = hid_get_drvdata(hdev);
++ struct steelseries_device *sd;
+ unsigned long flags;
+
+- if (sd->quirks & STEELSERIES_SRWS1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+- steelseries_srws1_remove(hdev);
++ goto srws1_remove;
+ #endif
+ return;
+ }
+
++ sd = hid_get_drvdata(hdev);
++
+ spin_lock_irqsave(&sd->lock, flags);
+ sd->removed = true;
+ spin_unlock_irqrestore(&sd->lock, flags);
+@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev)
+ cancel_delayed_work_sync(&sd->battery_work);
+
+ hid_hw_close(hdev);
++srws1_remove:
+ hid_hw_stop(hdev);
+ }
+
+@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
+ unsigned long flags;
+
+ /* Not a headset */
+- if (sd->quirks & STEELSERIES_SRWS1)
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1)
+ return 0;
+
+- if (sd->quirks & STEELSERIES_ARCTIS_1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) {
+ hid_dbg(sd->hdev,
+ "Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf);
+ if (size < ARCTIS_1_BATTERY_RESPONSE_LEN ||
+@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
+ }
+ }
+
+- if (sd->quirks & STEELSERIES_ARCTIS_9) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) {
+ hid_dbg(sd->hdev,
+ "Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf);
+ if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) {
+@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = {
+ .driver_data = STEELSERIES_SRWS1 },
+
+ { /* SteelSeries Arctis 1 Wireless for XBox */
+- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6),
+- .driver_data = STEELSERIES_ARCTIS_1 },
++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1),
++ .driver_data = STEELSERIES_ARCTIS_1 },
+
+ { /* SteelSeries Arctis 9 Wireless for XBox */
+- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2),
++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9),
+ .driver_data = STEELSERIES_ARCTIS_9 },
+
+ { }
+--
+2.51.0
+
--- /dev/null
+From 978c5aafad2b54f34a9626b261e8f2d09f68e43d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:02:54 +0530
+Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ]
+
+hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate
+operations. As per the original design in commit 40549ba8f8e0 ("hugetlb:
+use new vma_lock for pmd sharing synchronization"), if the trylock fails
+or the VMA has no lock, it should skip that VMA. Any remaining mapped
+pages are handled by remove_inode_hugepages() which is called after
+hugetlb_vmdelete_list() and uses proper lock ordering to guarantee
+unmapping success.
+
+Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs
+without shareable locks, the code proceeds to call unmap_hugepage_range().
+This causes assertion failures in huge_pmd_unshare() →
+hugetlb_vma_assert_locked() because no lock is actually held:
+
+ WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted
+ Call Trace:
+ hugetlb_vma_assert_locked+0x1dd/0x250
+ huge_pmd_unshare+0x2c8/0x540
+ __unmap_hugepage_range+0x6e3/0x1aa0
+ unmap_hugepage_range+0x32e/0x410
+ hugetlb_vmdelete_list+0x189/0x1f0
+
+Fix by using goto to ensure locks acquired by trylock are always released,
+even when skipping VMAs without shareable locks.
+
+Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com
+Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization")
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Oscar Salvador <osalvador@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hugetlbfs/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 6040e54082777..f56155a2969ee 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -493,6 +493,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ if (!hugetlb_vma_trylock_write(vma))
+ continue;
+
++ /*
++ * Skip VMAs without shareable locks. Per the design in commit
++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages()
++ * called after this function with proper locking.
++ */
++ if (!__vma_shareable_lock(vma))
++ goto skip;
++
+ v_start = vma_offset_start(vma, start);
+ v_end = vma_offset_end(vma, end);
+
+@@ -503,6 +511,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ * vmas. Therefore, lock is not held when calling
+ * unmap_hugepage_range for private vmas.
+ */
++skip:
+ hugetlb_vma_unlock_write(vma);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From e2861afcbbfd5af8679e5b4b2441810eb5e08192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:48:58 +0200
+Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
+ different subsystems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
+
+Distinct between fan speed setting request coming for hwmon and
+thermal subsystems.
+
+There are fields 'last_hwmon_state' and 'last_thermal_state' in the
+structure 'mlxreg_fan_pwm', which respectively store the cooling state
+set by the 'hwmon' and 'thermal' subsystem.
+The purpose is to make arbitration of fan speed setting. For example, if
+fan speed required to be not lower than some limit, such setting is to
+be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
+not set fan below this limit.
+
+Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
+cooling state to never be set to a lower value.
+
+Eliminate update of 'last_thermal_state', when request is coming from
+'hwmon' subsystem.
+
+Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index c25a54d5b39ad..0ba9195c9d713 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -113,8 +113,8 @@ struct mlxreg_fan {
+ int divider;
+ };
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state);
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal);
+
+ static int
+ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ * last thermal state.
+ */
+ if (pwm->last_hwmon_state >= pwm->last_thermal_state)
+- return mlxreg_fan_set_cur_state(pwm->cdev,
+- pwm->last_hwmon_state);
++ return _mlxreg_fan_set_cur_state(pwm->cdev,
++ pwm->last_hwmon_state,
++ false);
+ return 0;
+ }
+ return regmap_write(fan->regmap, pwm->reg, val);
+@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state)
+-
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal)
+ {
+ struct mlxreg_fan_pwm *pwm = cdev->devdata;
+ struct mlxreg_fan *fan = pwm->fan;
+@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return -EINVAL;
+
+ /* Save thermal state. */
+- pwm->last_thermal_state = state;
++ if (thermal)
++ pwm->last_thermal_state = state;
+
+ state = max_t(unsigned long, state, pwm->last_hwmon_state);
+ err = regmap_write(fan->regmap, pwm->reg,
+@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state)
++
++{
++ return _mlxreg_fan_set_cur_state(cdev, state, true);
++}
++
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+ .get_max_state = mlxreg_fan_get_max_state,
+ .get_cur_state = mlxreg_fan_get_cur_state,
+--
+2.51.0
+
--- /dev/null
+From 7f67106eeee0b7e6bdef1d75498548ba91b2ca33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index d8fd8a3544828..9e408144a10c1 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ if (IS_ERR(ks_sa_rng->regmap_cfg))
+ return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n");
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 164ec5d0472e3efd858fe3dea0599d5aa1176a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 17:28:00 +0200
+Subject: hwrng: nomadik - add ARM_AMBA dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
+
+Compile-testing this driver is only possible when the AMBA bus driver is
+available in the kernel:
+
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
+nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
+nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
+x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
+
+The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
+specified for the COMPILE_TEST case.
+
+Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index c858278434475..7826fd7c4603f 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG
+ config HW_RANDOM_NOMADIK
+ tristate "ST-Ericsson Nomadik Random Number Generator support"
+ depends on ARCH_NOMADIK || COMPILE_TEST
++ depends on ARM_AMBA
+ default HW_RANDOM
+ help
+ This driver provides kernel-side support for the Random Number
+--
+2.51.0
+
--- /dev/null
+From 88d3fbdfb59e0800ed8af87ee5741752f5adcef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 128b8cd7924e0..006c312cf7c82 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 693a57b0d4c8d101304732bb3760f9c8e44f5e23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:10 +0900
+Subject: i2c: designware: Fix clock issue when PM is disabled
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
+
+When the driver is removed, the clocks are first enabled by
+calling pm_runtime_get_sync(), and then disabled with
+pm_runtime_put_sync().
+
+If CONFIG_PM=y, clocks for this controller are disabled when it's in
+the idle state. So the clocks are properly disabled when the driver
+exits.
+
+Othewise, the clocks are always enabled and the PM functions have
+no effect. Therefore, the driver exits without disabling the clocks.
+
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 18
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+
+To ensure that the clocks can be disabled correctly even without
+CONFIG_PM=y, should add the following fixes:
+
+- Replace with pm_runtime_put_noidle(), which only decrements the runtime
+ PM usage count.
+- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index c1262df02cdb2..128b8cd7924e0 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
+ i2c_dw_disable(dev);
+
+ pm_runtime_dont_use_autosuspend(device);
+- pm_runtime_put_sync(device);
++ pm_runtime_put_noidle(device);
+ dw_i2c_plat_pm_cleanup(dev);
+
++ i2c_dw_prepare_clk(dev, false);
++
+ i2c_dw_remove_lock_support(dev);
+
+ reset_control_assert(dev->rst);
+--
+2.51.0
+
--- /dev/null
+From 3f32f73b19ff00212c2625b2fe4d9a2d0de1bc1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index ab456c3717db1..dee40704825cb 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 241cdb6ca57e9cdd5d4f171d96f16c6082455bcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:28 +0800
+Subject: i2c: spacemit: check SDA instead of SCL after bus reset
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ]
+
+After calling spacemit_i2c_conditionally_reset_bus(),
+the controller should ensure that the SDA line is release
+before proceeding.
+
+Previously, the driver checked the SCL line instead,
+which does not guarantee that the bus is truly idle.
+
+This patch changes the check to verify SDA. This ensures
+proper bus recovery and avoids potential communication errors
+after a conditional reset.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 9bf9f01aa68bd..848dfaf634f63 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ spacemit_i2c_reset(i2c);
+ usleep_range(10, 20);
+
+- /* check scl status again */
++ /* check sda again here */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+- if (!(status & SPACEMIT_BMR_SCL))
++ if (!(status & SPACEMIT_BMR_SDA))
+ dev_warn_ratelimited(i2c->dev, "unit reset failed\n");
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6434cd9a09d8122d00e969815d7bdb779bb11435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:27 +0800
+Subject: i2c: spacemit: disable SDA glitch fix to avoid restart delay
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ]
+
+The K1 I2C controller has an SDA glitch fix that introduces a small
+delay on restart signals. While this feature can suppress glitches
+on SDA when SCL = 0, it also delays the restart signal, which may
+cause unexpected behavior in some transfers.
+
+The glitch itself does not affect normal I2C operation, because
+the I2C specification allows SDA to change while SCL is low.
+
+To ensure correct transmission for every message, we disable the
+SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during
+initialization.
+
+This guarantees that restarts are issued promptly without
+unintended delays.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 84f132d0504dc..9bf9f01aa68bd 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -14,6 +14,7 @@
+ #define SPACEMIT_ICR 0x0 /* Control register */
+ #define SPACEMIT_ISR 0x4 /* Status register */
+ #define SPACEMIT_IDBR 0xc /* Data buffer register */
++#define SPACEMIT_IRCR 0x18 /* Reset cycle counter */
+ #define SPACEMIT_IBMR 0x1c /* Bus monitor register */
+
+ /* SPACEMIT_ICR register fields */
+@@ -76,6 +77,8 @@
+ SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \
+ SPACEMIT_SR_ALD)
+
++#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
++
+ /* SPACEMIT_IBMR register fields */
+ #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
+ #define SPACEMIT_BMR_SCL BIT(1) /* SCL line level */
+@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
+ val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE;
+
+ writel(val, i2c->base + SPACEMIT_ICR);
++
++ /*
++ * The glitch fix in the K1 I2C controller introduces a delay
++ * on restart signals, so we disable the fix here.
++ */
++ val = readl(i2c->base + SPACEMIT_IRCR);
++ val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
++ writel(val, i2c->base + SPACEMIT_IRCR);
+ }
+
+ static inline void
+--
+2.51.0
+
--- /dev/null
+From a9504ddff65b28092759f2ceef747fb1aa8a8124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:25 +0800
+Subject: i2c: spacemit: ensure bus release check runs when wait_bus_idle()
+ fails
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ]
+
+spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative
+error code on failure.
+
+Since 'ret' can never be positive, the final 'else' branch was
+unreachable, and spacemit_i2c_check_bus_release() was never called.
+
+This commit guarantees we attempt to release the bus whenever waiting for
+an idle bus fails.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index b68a21fff0b56..ee08811f4087c 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in
+ spacemit_i2c_enable(i2c);
+
+ ret = spacemit_i2c_wait_bus_idle(i2c);
+- if (!ret)
++ if (!ret) {
+ ret = spacemit_i2c_xfer_msg(i2c);
+- else if (ret < 0)
+- dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
+- else
++ if (ret < 0)
++ dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
++ } else {
+ spacemit_i2c_check_bus_release(i2c);
++ }
+
+ spacemit_i2c_disable(i2c);
+
+--
+2.51.0
+
--- /dev/null
+From 8019d189f37ebe3667b9f9850603a007c6f07c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:29 +0800
+Subject: i2c: spacemit: ensure SDA is released after bus reset
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ]
+
+After performing a conditional bus reset, the controller must ensure
+that the SDA line is actually released.
+
+Previously, the reset routine only performed a single check,
+which could leave the bus in a locked state in some situations.
+
+This patch introduces a loop that toggles the reset cycle and issues
+a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking
+SDA after each attempt. If SDA is released before the maximum count,
+the function returns early. Otherwise, a warning is emitted.
+
+This change improves bus recovery reliability.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 848dfaf634f63..6b918770e612e 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2024-2025 Troy Mitchell <troymitchell988@gmail.com>
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/i2c.h>
+ #include <linux/iopoll.h>
+@@ -26,7 +27,8 @@
+ #define SPACEMIT_CR_MODE_FAST BIT(8) /* bus mode (master operation) */
+ /* Bit 9 is reserved */
+ #define SPACEMIT_CR_UR BIT(10) /* unit reset */
+-/* Bits 11-12 are reserved */
++#define SPACEMIT_CR_RSTREQ BIT(11) /* i2c bus reset request */
++/* Bit 12 is reserved */
+ #define SPACEMIT_CR_SCLE BIT(13) /* master clock enable */
+ #define SPACEMIT_CR_IUE BIT(14) /* unit enable */
+ /* Bits 15-17 are reserved */
+@@ -78,6 +80,8 @@
+ SPACEMIT_SR_ALD)
+
+ #define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
++/* the cycles of SCL during bus reset */
++#define SPACEMIT_RCR_FIELD_RST_CYC GENMASK(3, 0)
+
+ /* SPACEMIT_IBMR register fields */
+ #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
+@@ -91,6 +95,8 @@
+
+ #define SPACEMIT_SR_ERR (SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD)
+
++#define SPACEMIT_BUS_RESET_CLK_CNT_MAX 9
++
+ enum spacemit_i2c_state {
+ SPACEMIT_STATE_IDLE,
+ SPACEMIT_STATE_START,
+@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c)
+ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ {
+ u32 status;
++ u8 clk_cnt;
+
+ /* if bus is locked, reset unit. 0: locked */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ spacemit_i2c_reset(i2c);
+ usleep_range(10, 20);
+
++ for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) {
++ status = readl(i2c->base + SPACEMIT_IBMR);
++ if (status & SPACEMIT_BMR_SDA)
++ return;
++
++ /* There's nothing left to save here, we are about to exit */
++ writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1),
++ i2c->base + SPACEMIT_IRCR);
++ writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR);
++ usleep_range(20, 30);
++ }
++
+ /* check sda again here */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+ if (!(status & SPACEMIT_BMR_SDA))
+--
+2.51.0
+
--- /dev/null
+From 87a63dc5dd845d27ff9c8ae26bfc475ed787b433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:26 +0800
+Subject: i2c: spacemit: remove stop function to avoid bus error
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ]
+
+Previously, STOP handling was split into two separate steps:
+ 1) clear TB/STOP/START/ACK bits
+ 2) issue STOP by calling spacemit_i2c_stop()
+
+This left a small window where the control register was updated
+twice, which can confuse the controller. While this race has not
+been observed with interrupt-driven transfers, it reliably causes
+bus errors in PIO mode.
+
+Inline the STOP sequence into the IRQ handler and ensure that
+control register bits are updated atomically in a single writel().
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 26 +++++++-------------------
+ 1 file changed, 7 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index ee08811f4087c..84f132d0504dc 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c)
+ writel(val, i2c->base + SPACEMIT_ICR);
+ }
+
+-static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c)
+-{
+- u32 val;
+-
+- val = readl(i2c->base + SPACEMIT_ICR);
+- val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
+-
+- if (i2c->read)
+- val |= SPACEMIT_CR_ACKNAK;
+-
+- writel(val, i2c->base + SPACEMIT_ICR);
+-}
+-
+ static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c)
+ {
+ unsigned long time_left;
+@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
+
+ val = readl(i2c->base + SPACEMIT_ICR);
+ val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START);
+- writel(val, i2c->base + SPACEMIT_ICR);
+
+ switch (i2c->state) {
+ case SPACEMIT_STATE_START:
+@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
+ }
+
+ if (i2c->state != SPACEMIT_STATE_IDLE) {
++ val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE;
++
+ if (spacemit_i2c_is_last_msg(i2c)) {
+ /* trigger next byte with stop */
+- spacemit_i2c_stop(i2c);
+- } else {
+- /* trigger next byte */
+- val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
+- writel(val, i2c->base + SPACEMIT_ICR);
++ val |= SPACEMIT_CR_STOP;
++
++ if (i2c->read)
++ val |= SPACEMIT_CR_ACKNAK;
+ }
++ writel(val, i2c->base + SPACEMIT_ICR);
+ }
+
+ err_out:
+--
+2.51.0
+
--- /dev/null
+From be9f96bf6241871e935e5b34c0bfaa7e000a09ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index fc2829c22c647..93632194ffcca 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b1390fdad74d203413ce6dd3d74b464b163a241c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:08 +0800
+Subject: i3c: master: svc: Use manual response for IBI events
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
+
+Driver wants to nack the IBI request when the target is not in the
+known address list. In below code, svc_i3c_master_nack_ibi() will
+cause undefined behavior when using AUTOIBI with auto response rule,
+because hw always auto ack the IBI request.
+
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ svc_i3c_master_nack_ibi(master);
+ ...
+ break;
+
+AutoIBI has another issue that the controller doesn't quit AutoIBI state
+after IBIWON polling timeout when there is a SDA glitch(high->low->high).
+1. SDA high->low: raising an interrupt to execute IBI ISR
+2. SDA low->high
+3. Driver writes an AutoIBI request
+4. AutoIBI process does not start because SDA is not low
+5. IBIWON polling times out
+6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
+
+Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index ece5633538958..fc2829c22c647 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ */
+ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
+- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
+- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
+- SVC_I3C_MCTRL_IBIRESP_AUTO,
++ /*
++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
++ * instend of using AUTO_IBI.
++ *
++ * Using AutoIBI request may cause controller to remain in AutoIBI state when
++ * there is a glitch on SDA line (high->low->high).
++ * 1. SDA high->low, raising an interrupt to execute IBI isr.
++ * 2. SDA low->high.
++ * 3. IBI isr writes an AutoIBI request.
++ * 4. The controller will not start AutoIBI process because SDA is not low.
++ * 5. IBIWON polling times out.
++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
++ */
++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
++ SVC_I3C_MCTRL_TYPE_I3C |
++ SVC_I3C_MCTRL_IBIRESP_MANUAL |
++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
+ master->regs + SVC_I3C_MCTRL);
+
+ /* Wait for IBIWON, should take approximately 100us */
+@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
+ svc_i3c_master_nack_ibi(master);
+- else
++ } else {
++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
++ svc_i3c_master_ack_ibi(master, true);
++ else
++ svc_i3c_master_ack_ibi(master, false);
+ svc_i3c_master_handle_ibi(master, dev);
++ }
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
+ if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
+--
+2.51.0
+
--- /dev/null
+From bc5e60e82100d53012c436e22305a2d7e893357c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 53571e6b3162c..66df5bed6a562 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 415421efc94989ec55ffb0c61535fdbf6c9b8e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 11:02:10 -0700
+Subject: idpf: fix mismatched free function for dma_alloc_coherent
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]
+
+The mailbox receive path allocates coherent DMA memory with
+dma_alloc_coherent(), but frees it with dmam_free_coherent().
+This is incorrect since dmam_free_coherent() is only valid for
+buffers allocated with dmam_alloc_coherent().
+
+Fix the mismatch by using dma_free_coherent() instead of
+dmam_free_coherent
+
+Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index cb9a27307670e..edec127fb52f4 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -701,9 +701,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
+ /* If post failed clear the only buffer we supplied */
+ if (post_err) {
+ if (dma_mem)
+- dmam_free_coherent(&adapter->pdev->dev,
+- dma_mem->size, dma_mem->va,
+- dma_mem->pa);
++ dma_free_coherent(&adapter->pdev->dev,
++ dma_mem->size, dma_mem->va,
++ dma_mem->pa);
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 14eff6662965235168a680efb95e1eab2e678ac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:54:56 +0200
+Subject: idpf: fix Rx descriptor ready check barrier in splitq
+
+From: Alexander Lobakin <aleksander.lobakin@intel.com>
+
+[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]
+
+No idea what the current barrier position was meant for. At that point,
+nothing is read from the descriptor, only the pointer to the actual one
+is fetched.
+The correct barrier usage here is after the generation check, so that
+only the first qword is read if the descriptor is not yet ready and we
+need to stop polling. Debatable on coherent DMA as the Rx descriptor
+size is <= cacheline size, but anyway, the current barrier position
+only makes the codegen worse.
+
+Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Tested-by: Ramu R <ramu.r@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index cd83243e7c765..6438e371f8bd8 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -3434,18 +3434,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
+ /* get the Rx desc from Rx queue based on 'next_to_clean' */
+ rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
+
+- /* This memory barrier is needed to keep us from reading
+- * any other fields out of the rx_desc
+- */
+- dma_rmb();
+-
+ /* if the descriptor isn't done, no work yet to do */
+ gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
+ VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
+-
+ if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
+ break;
+
++ dma_rmb();
++
+ rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
+ rx_desc->rxdid_ucast);
+ if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
+--
+2.51.0
+
--- /dev/null
+From 2bab812d73adaadacbddc8b75879a068114a2a16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:20 +0200
+Subject: iio: consumers: Fix handling of negative channel scale in
+ iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
+
+There is an issue with the handling of negative channel scales
+in iio_convert_raw_to_processed_unlocked() when the channel-scale
+is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
+
+Things work for channel-scale values > -1.0 and < 0.0 because of
+the use of signed values in:
+
+ *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
+
+Things will break however for scale values < -1.0. Lets for example say
+that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
+
+The result should then be 2 * 10 * -1.5 = -30.
+
+channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
+now lets see what gets stored in processed:
+
+1. *processed = raw64 * scale_val * scale;
+2. *processed += raw64 * scale_val2 * scale / 1000000LL;
+
+1. Sets processed to 2 * -1 * 10 = -20
+2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
+
+And the end result is processed = -20 + 10 = -10, which is not correct.
+
+Fix this by always using the abs value of both scale_val and scale_val2
+and if either is negative multiply the end-result by -1.
+
+Note there seems to be an unwritten rule about negative
+IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
+
+i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx
+ii. values <= -1.0 are written as val=-xxx val2=xxx
+
+But iio_format_value() will also correctly display a third option:
+
+iii. values <= -1.0 written as val=-xxx val2=-xxx
+
+Since iio_format_value() uses abs(val) when val2 < 0.
+
+This fix also makes iio_convert_raw_to_processed() properly handle
+channel-scales using this third option.
+
+Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
+Cc: Matteo Martelli <matteomartelli3@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index c174ebb7d5e6d..d36a80a7b8a93 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -11,6 +11,7 @@
+ #include <linux/mutex.h>
+ #include <linux/property.h>
+ #include <linux/slab.h>
++#include <linux/units.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/iio-opaque.h>
+@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ {
+ int scale_type, scale_val, scale_val2;
+ int offset_type, offset_val, offset_val2;
+- s64 raw64 = raw;
++ s64 denominator, raw64 = raw;
+
+ offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
+ IIO_CHAN_INFO_OFFSET);
+@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ *processed = raw64 * scale_val * scale;
+ break;
+ case IIO_VAL_INT_PLUS_MICRO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000LL);
+- break;
+ case IIO_VAL_INT_PLUS_NANO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000000LL);
++ switch (scale_type) {
++ case IIO_VAL_INT_PLUS_MICRO:
++ denominator = MICRO;
++ break;
++ case IIO_VAL_INT_PLUS_NANO:
++ denominator = NANO;
++ break;
++ }
++ *processed = raw64 * scale * abs(scale_val);
++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
++ if (scale_val < 0 || scale_val2 < 0)
++ *processed *= -1;
+ break;
+ case IIO_VAL_FRACTIONAL:
+ *processed = div_s64(raw64 * (s64)scale_val * scale,
+--
+2.51.0
+
--- /dev/null
+From 985f54b97470e8a00b90250b5e04d207eaf3f59b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index d36a80a7b8a93..642beb4b3360d 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6b3d207981bdb2b171b55456951e8bd13ab93b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:30:51 +0000
+Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
+
+We need to check socket netns before considering them in ping_get_port().
+Otherwise, one malicious netns could 'consume' all ports.
+
+Add corresponding check in ping_lookup().
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 031df4c19fcc5..d2c3480df8f77 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
+
+ int ping_get_port(struct sock *sk, unsigned short ident)
+ {
++ struct net *net = sock_net(sk);
+ struct inet_sock *isk, *isk2;
+ struct hlist_head *hlist;
+ struct sock *sk2 = NULL;
+@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ for (i = 0; i < (1L << 16); i++, result++) {
+ if (!result)
+ result++; /* avoid zero */
+- hlist = ping_hashslot(&ping_table, sock_net(sk),
+- result);
++ hlist = ping_hashslot(&ping_table, net, result);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ if (isk2->inet_num == result)
+@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ if (i >= (1L << 16))
+ goto fail;
+ } else {
+- hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
++ hlist = ping_hashslot(&ping_table, net, ident);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ /* BUG? Why is this reuse and not reuseaddr? ping.c
+@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ pr_debug("was not hashed\n");
+ sk_add_node_rcu(sk, hlist);
+ sock_set_flag(sk, SOCK_RCU_FREE);
+- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++ sock_prot_inuse_add(net, sk->sk_prot, 1);
+ }
+ spin_unlock(&ping_table.lock);
+ return 0;
+@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ }
+
+ sk_for_each_rcu(sk, hslot) {
++ if (!net_eq(sock_net(sk), net))
++ continue;
+ isk = inet_sk(sk);
+
+ pr_debug("iterate\n");
+--
+2.51.0
+
--- /dev/null
+From 081a8b3ee79499a03c18b964be938268a33b9fcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:11:05 +0200
+Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
+
+INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
+init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
+prevent asking the user about this feature when configuring a kernel
+without initramfs support.
+
+Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 2e15b4a8478e8..32be83de9c699 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1472,6 +1472,7 @@ config BOOT_CONFIG_EMBED_FILE
+
+ config INITRAMFS_PRESERVE_MTIME
+ bool "Preserve cpio archive mtimes in initramfs"
++ depends on BLK_DEV_INITRD
+ default y
+ help
+ Each entry in an initramfs cpio archive carries an mtime value. When
+--
+2.51.0
+
--- /dev/null
+From d102fdda90f7be0a6f20317d96455f84793234fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:16:28 +0200
+Subject: iommu/selftest: prevent use of uninitialized variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alessandro Zanni <alessandro.zanni87@gmail.com>
+
+[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ]
+
+Fix to avoid the usage of the `res` variable uninitialized in the
+following macro expansions.
+
+It solves the following warning:
+In function ‘iommufd_viommu_vdevice_alloc’,
+ inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1:
+../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized]
+ 760 | if (!(__exp _t __seen)) { \
+ | ^
+../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’
+ 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1)
+ | ^~~~~~~~
+iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’
+ 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents))
+ | ^~~~~~~~~
+iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’
+ 2924 | test_cmd_trigger_vevents(dev_id, 3);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+
+The issue can be reproduced, building the tests, with the command: make -C
+tools/testing/selftests TARGETS=iommu
+
+Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com
+Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage")
+Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/iommu/iommufd_utils.h | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
+index 6e967b58acfd3..1d4936747db45 100644
+--- a/tools/testing/selftests/iommu/iommufd_utils.h
++++ b/tools/testing/selftests/iommu/iommufd_utils.h
+@@ -995,15 +995,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)
+ .dev_id = dev_id,
+ },
+ };
+- int ret;
+
+ while (nvevents--) {
+- ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
+- &trigger_vevent_cmd);
+- if (ret < 0)
++ if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
++ &trigger_vevent_cmd))
+ return -1;
+ }
+- return ret;
++ return 0;
+ }
+
+ #define test_cmd_trigger_vevents(dev_id, nvevents) \
+--
+2.51.0
+
--- /dev/null
+From 570ef33688d26464eeda6d86e3c3b202d4020b12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:59 +0800
+Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic
+
+From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+
+[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ]
+
+In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR
+maybe uninitialized or zero in that case and may cause oops like:
+
+ Oops: general protection fault, probably for non-canonical address
+ 0xf00087d3f000f000: 0000 [#1] SMP NOPTI
+ CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
+ RIP: 0010:pgtable_walk_level+0x98/0x150
+ RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206
+ RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e
+ RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000
+ RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002
+ R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000
+ R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98
+ FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ pgtable_walk_level+0x88/0x150
+ domain_translation_struct_show.isra.0+0x2d9/0x300
+ dev_domain_translation_struct_show+0x20/0x40
+ seq_read_iter+0x12d/0x490
+...
+
+Avoid walking the page table if TT is not 00b or 01b.
+
+Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table")
+Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index affbf4a1558de..5aa7f46a420b5 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m,
+ }
+ pgd &= VTD_PAGE_MASK;
+ } else { /* legacy mode */
+- pgd = context->lo & VTD_PAGE_MASK;
+- agaw = context->hi & 7;
++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2;
++
++ /*
++ * According to Translation Type(TT),
++ * get the page table pointer(SSPTPTR).
++ */
++ switch (tt) {
++ case CONTEXT_TT_MULTI_LEVEL:
++ case CONTEXT_TT_DEV_IOTLB:
++ pgd = context->lo & VTD_PAGE_MASK;
++ agaw = context->hi & 7;
++ break;
++ default:
++ goto iommu_unlock;
++ }
+ }
+
+ seq_printf(m, "Device %04x:%02x:%02x.%x ",
+--
+2.51.0
+
--- /dev/null
+From 3190fbee1714c897596adeeddcc7303ef976d9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 10:41:30 +0800
+Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ]
+
+Dirty page tracking relies on the IOMMU atomically updating the dirty bit
+in the paging-structure entry. For this operation to succeed, the paging-
+structure memory must be coherent between the IOMMU and the CPU. In
+another word, if the iommu page walk is incoherent, dirty page tracking
+doesn't work.
+
+The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:
+
+"Remapping hardware encountering the need to atomically update A/EA/D bits
+ in a paging-structure entry that is not snooped will result in a non-
+ recoverable fault."
+
+To prevent an IOMMU from being incorrectly configured for dirty page
+tracking when it is operating in an incoherent mode, mark SSADS as
+supported only when both ecap_slads and ecap_smpwc are supported.
+
+Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index c699ed8810f23..ca39044978fb7 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -541,7 +541,8 @@ enum {
+ #define pasid_supported(iommu) (sm_supported(iommu) && \
+ ecap_pasid((iommu)->ecap))
+ #define ssads_supported(iommu) (sm_supported(iommu) && \
+- ecap_slads((iommu)->ecap))
++ ecap_slads((iommu)->ecap) && \
++ ecap_smpwc(iommu->ecap))
+ #define nested_supported(iommu) (sm_supported(iommu) && \
+ ecap_nest((iommu)->ecap))
+
+--
+2.51.0
+
--- /dev/null
+From 5ad0ad9ff782fa48839eb0e6a6699a362e448506 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:47:30 +0800
+Subject: iommufd: Register iommufd mock devices with fwspec
+
+From: Guixin Liu <kanie@linux.alibaba.com>
+
+[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ]
+
+Since the bus ops were retired the iommu subsystem changed to using fwspec
+to match the iommu driver to the iommu device. If a device has a NULL
+fwspec then it is matched to the first iommu driver with a NULL fwspec,
+effectively disabling support for systems with more than one non-fwspec
+iommu driver.
+
+Thus, if the iommufd selfest are run in an x86 system that registers a
+non-fwspec iommu driver they fail to bind their mock devices to the mock
+iommu driver.
+
+Fix this by allocating a software fwnode for mock iommu driver's
+iommu_device, and set it to the device which mock iommu driver created.
+
+This is done by adding a new helper iommu_mock_device_add() which abuses
+the internals of the fwspec system to establish a fwspec before the device
+is added and is careful not to leak it. A matching dummy fwspec is
+automatically added to the mock iommu driver.
+
+Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests":
+PASSED: 229 / 229 tests passed.
+
+In addition, this issue is also can be found on amd platform, and
+also tested on a amd machine.
+
+Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com
+Fixes: 17de3f5fdd35 ("iommu: Retire bus ops")
+Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu-priv.h | 2 ++
+ drivers/iommu/iommu.c | 26 ++++++++++++++++++++++++++
+ drivers/iommu/iommufd/selftest.c | 2 +-
+ 3 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h
+index e236b932e7668..c95394cd03a77 100644
+--- a/drivers/iommu/iommu-priv.h
++++ b/drivers/iommu/iommu-priv.h
+@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
+ const struct bus_type *bus,
+ struct notifier_block *nb);
+
++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu);
++
+ struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group,
+ ioasid_t pasid,
+ unsigned int type);
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index a4b606c591da6..c9a8d19e2ab77 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
+ struct notifier_block *nb)
+ {
+ bus_unregister_notifier(bus, nb);
++ fwnode_remove_software_node(iommu->fwnode);
+ iommu_device_unregister(iommu);
+ }
+ EXPORT_SYMBOL_GPL(iommu_device_unregister_bus);
+@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu,
+ if (err)
+ return err;
+
++ iommu->fwnode = fwnode_create_software_node(NULL, NULL);
++ if (IS_ERR(iommu->fwnode)) {
++ bus_unregister_notifier(bus, nb);
++ return PTR_ERR(iommu->fwnode);
++ }
++
+ spin_lock(&iommu_device_lock);
+ list_add_tail(&iommu->list, &iommu_device_list);
+ spin_unlock(&iommu_device_lock);
+@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu,
+ iommu_device_unregister_bus(iommu, bus, nb);
+ return err;
+ }
++ WRITE_ONCE(iommu->ready, true);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(iommu_device_register_bus);
++
++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu)
++{
++ int rc;
++
++ mutex_lock(&iommu_probe_device_lock);
++ rc = iommu_fwspec_init(dev, iommu->fwnode);
++ mutex_unlock(&iommu_probe_device_lock);
++
++ if (rc)
++ return rc;
++
++ rc = device_add(dev);
++ if (rc)
++ iommu_fwspec_free(dev);
++ return rc;
++}
++EXPORT_SYMBOL_GPL(iommu_mock_device_add);
+ #endif
+
+ static struct dev_iommu *dev_iommu_get(struct device *dev)
+diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
+index c52bf037a2f01..4a558c4e6f882 100644
+--- a/drivers/iommu/iommufd/selftest.c
++++ b/drivers/iommu/iommufd/selftest.c
+@@ -981,7 +981,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags)
+ goto err_put;
+ }
+
+- rc = device_add(&mdev->dev);
++ rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev);
+ if (rc)
+ goto err_put;
+ return mdev;
+--
+2.51.0
+
--- /dev/null
+From d03fbfb0c928e2a0f068729804c5bdcb87250585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index d8a284999544b..206c6700e2006 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From d3ddab2680956d9d5eef0c17ade08d4edcee2d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 21:46:54 +0800
+Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
+
+From: Zhang Tengfei <zhtfdev@gmail.com>
+
+[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
+
+KCSAN reported a data-race on the `ipvs->enable` flag, which is
+written in the control path and read concurrently from many other
+contexts.
+
+Following a suggestion by Julian, this patch fixes the race by
+converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
+This lightweight approach ensures atomic access and acts as a
+compiler barrier, preventing unsafe optimizations where the flag
+is checked in loops (e.g., in ip_vs_est.c).
+
+Additionally, the `enable` checks in the fast-path hooks
+(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
+removed. These are unnecessary since commit 857ca89711de
+("ipvs: register hooks only with services"). The `enable=0`
+condition they check for can only occur in two rare and non-fatal
+scenarios: 1) after hooks are registered but before the flag is set,
+and 2) after hooks are unregistered on cleanup_net. In the worst
+case, a single packet might be mishandled (e.g., dropped), which
+does not lead to a system crash or data corruption. Adding a check
+in the performance-critical fast-path to handle this harmless
+condition is not a worthwhile trade-off.
+
+Fixes: 857ca89711de ("ipvs: register hooks only with services")
+Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
+Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
+ net/netfilter/ipvs/ip_vs_ctl.c | 6 +++---
+ net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++--------
+ 4 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 44b2ad695c153..35d1260dbff0d 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
+ * conntrack cleanup for the net.
+ */
+ smp_rmb();
+- if (ipvs->enable)
++ if (READ_ONCE(ipvs->enable))
+ ip_vs_conn_drop_conntrack(cp);
+ }
+
+@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
+ cond_resched_rcu();
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ break;
+ }
+ rcu_read_unlock();
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index c7a8a08b73089..5ea7ab8bf4dcc 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
+ if (unlikely(!skb_dst(skb)))
+ return NF_ACCEPT;
+
+- if (!ipvs->enable)
+- return NF_ACCEPT;
+-
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (af == AF_INET6) {
+@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
+ return NF_ACCEPT;
+ }
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
+ int r;
+
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ if (state->pf == NFPROTO_IPV4) {
+@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
+ return -ENOMEM;
+
+ /* Hold the beast until a service is registered */
+- ipvs->enable = 0;
++ WRITE_ONCE(ipvs->enable, 0);
+ ipvs->net = net;
+ /* Counters used for creating unique names */
+ ipvs->gen = atomic_read(&ipvs_netns_cnt);
+@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
+ ipvs = net_ipvs(net);
+ ip_vs_unregister_hooks(ipvs, AF_INET);
+ ip_vs_unregister_hooks(ipvs, AF_INET6);
+- ipvs->enable = 0; /* Disable packet reception */
++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */
+ smp_wmb();
+ ip_vs_sync_net_cleanup(ipvs);
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 6a6fc44785337..4c8fa22be88ad 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
+ struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock;
+ if (!kd)
+ continue;
+@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+
+ *svc_p = svc;
+
+- if (!ipvs->enable) {
++ if (!READ_ONCE(ipvs->enable)) {
+ /* Now there is a service - full throttle */
+- ipvs->enable = 1;
++ WRITE_ONCE(ipvs->enable, 1);
+
+ /* Start estimation for first time */
+ ip_vs_est_reload_start(ipvs);
+diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
+index 15049b8267327..93a925f1ed9b8 100644
+--- a/net/netfilter/ipvs/ip_vs_est.c
++++ b/net/netfilter/ipvs/ip_vs_est.c
+@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
+ void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
+ {
+ /* Ignore reloads before first service is added */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ return;
+ ip_vs_est_stopped_recalc(ipvs);
+ /* Bump the kthread configuration genid */
+@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ int i;
+
+ if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
+- ipvs->enable && ipvs->est_max_threads)
++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
+ return -EINVAL;
+
+ mutex_lock(&ipvs->est_mutex);
+@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ }
+
+ /* Start kthread tasks only when services are present */
+- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
+ ret = ip_vs_est_kthread_start(ipvs, kd);
+ if (ret < 0)
+ goto out;
+@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
+ struct ip_vs_estimator *est = &stats->est;
+ int ret;
+
+- if (!ipvs->est_max_threads && ipvs->enable)
++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
+ ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
+
+ est->ktid = -1;
+@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ /* Wait for cpufreq frequency transition */
+ wait_event_idle_timeout(wq, kthread_should_stop(),
+ HZ / 50);
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ }
+
+@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ rcu_read_unlock();
+ local_bh_enable();
+
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ cond_resched();
+
+@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ mutex_lock(&ipvs->est_mutex);
+ for (id = 1; id < ipvs->est_kt_count; id++) {
+ /* netns clean up started, abort */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock2;
+ kd = ipvs->est_kt_arr[id];
+ if (!kd)
+@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ id = ipvs->est_kt_count;
+
+ next_kt:
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto unlock;
+ id--;
+ if (id < 0)
+--
+2.51.0
+
--- /dev/null
+From d9466dd587fb08ffdc0a703486fc63ff3a6c12e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 15:26:39 -0500
+Subject: kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
+
+From: Kienan Stewart <kstewart@efficios.com>
+
+[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ]
+
+In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b
+("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
+artifacts required for building out-of-tree kernel modules had
+$(objtree) prepended to them to prepare for building in other
+directories.
+
+When building external modules for powerpc,
+arch/powerpc/lib/crtsavres.o is required for certain
+configurations. This artifact is missing the prepended $(objtree).
+
+Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=")
+Acked-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nicolas Schier <n.schier@avm.de>
+Tested-by: Nicolas Schier <n.schier@avm.de>
+Signed-off-by: Kienan Stewart <kstewart@efficios.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index f3804103c56cc..9933b98df69d7 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
+ # There is a corresponding test in arch/powerpc/lib/Makefile
+ KBUILD_LDFLAGS_MODULE += --save-restore-funcs
+ else
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
++KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o
+ endif
+
+ ifdef CONFIG_CPU_LITTLE_ENDIAN
+--
+2.51.0
+
--- /dev/null
+From 7919890fdfd8a83307a7ee1e33d6fc5d80563850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 21:15:50 +0000
+Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing
+
+From: Fan Wu <wufan@kernel.org>
+
+[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
+
+Fix the X.509 Basic Constraints CA flag parsing to correctly handle
+the ASN.1 DER encoded structure. The parser was incorrectly treating
+the length field as the boolean value.
+
+Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
+According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
+
+Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
+
+The basicConstraints extension with CA:TRUE is encoded as:
+
+ SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
+ ^-- v[2] ^-- v[3] ^-- v[4]
+
+The parser was checking v[3] (the length field, always 0x01) instead
+of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
+
+Also handle the case where the extension is an empty SEQUENCE (30 00),
+which is valid for CA:FALSE when the default value is omitted as
+required by DER encoding rules (X.690 section 11.5).
+
+Per ITU-T X.690-0207:
+- Section 11.5: Default values must be omitted in DER
+- Section 11.1: DER requires TRUE to be encoded as 0xFF
+
+Link: https://datatracker.ietf.org/doc/html/rfc5280
+Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
+Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
+Signed-off-by: Fan Wu <wufan@kernel.org>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index 2ffe4ae90bea0..8df3fa60a44f8 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen,
+ /*
+ * Get hold of the basicConstraints
+ * v[1] is the encoding size
+- * (Expect 0x2 or greater, making it 1 or more bytes)
++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or
++ * 0x03 or greater for non-empty SEQUENCE)
+ * v[2] is the encoding type
+ * (Expect an ASN1_BOOL for the CA)
+- * v[3] is the contents of the ASN1_BOOL
+- * (Expect 1 if the CA is TRUE)
++ * v[3] is the length of the ASN1_BOOL
++ * (Expect 1 for a single byte boolean)
++ * v[4] is the contents of the ASN1_BOOL
++ * (Expect 0xFF if the CA is TRUE)
+ * vlen should match the entire extension size
+ */
+ if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen,
+ return -EBADMSG;
+ if (v[1] != vlen - 2)
+ return -EBADMSG;
+- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
++ if (v[1] == 0)
++ return 0;
++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
+ ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
++ else
++ return -EBADMSG;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b6a655b4310b5789d755f3aad55b35984a570d90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:13:02 +0200
+Subject: kselftest/arm64/gcs: Correctly check return value when disabling GCS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ]
+
+The return value was not assigned to 'ret', so the check afterwards
+does not do anything.
+
+Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c
+index 3fb9742342a34..a4462a00111e7 100644
+--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c
++++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c
+@@ -347,7 +347,7 @@ int main(void)
+ }
+
+ /* One last test: disable GCS, we can do this one time */
+- my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
++ ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
+ if (ret != 0)
+ ksft_print_msg("Failed to disable GCS: %d\n", ret);
+
+--
+2.51.0
+
--- /dev/null
+From ffdcf17c323eb43fe8de0b2008ed98dfb273502b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:51:22 +0800
+Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
+
+There is a register to clamp the flash current per LED channel when
+safety timer is disabled. It needs to be updated according to the
+maximum torch LED current setting to ensure the torch current won't
+be clamped unexpectedly.
+
+Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
+index 89cf5120f5d55..db7c2c743adc7 100644
+--- a/drivers/leds/flash/leds-qcom-flash.c
++++ b/drivers/leds/flash/leds-qcom-flash.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #include <linux/bitfield.h>
+@@ -114,36 +114,39 @@ enum {
+ REG_THERM_THRSH1,
+ REG_THERM_THRSH2,
+ REG_THERM_THRSH3,
++ REG_TORCH_CLAMP,
+ REG_MAX_COUNT,
+ };
+
+ static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x08, 0, 7), /* status1 */
+- REG_FIELD(0x09, 0, 7), /* status2 */
+- REG_FIELD(0x0a, 0, 7), /* status3 */
+- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */
+- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x47, 0, 5), /* iresolution */
+- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */
+- REG_FIELD(0x4c, 0, 2), /* chan_en */
+- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */
+- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7),
++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2),
++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2),
++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6),
+ };
+
+ static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x06, 0, 7), /* status1 */
+- REG_FIELD(0x07, 0, 6), /* status2 */
+- REG_FIELD(0x09, 0, 7), /* status3 */
+- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */
+- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x49, 0, 3), /* iresolution */
+- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */
+- REG_FIELD(0x4e, 0, 3), /* chan_en */
+- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */
++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6),
++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3),
++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6),
+ };
+
+ struct qcom_flash_data {
+@@ -156,6 +159,7 @@ struct qcom_flash_data {
+ u8 max_channels;
+ u8 chan_en_bits;
+ u8 revision;
++ u8 torch_clamp;
+ };
+
+ struct qcom_flash_led {
+@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
+ u32 current_ua, timeout_us;
+ u32 channels[4];
+ int i, rc, count;
++ u8 torch_clamp;
+
+ count = fwnode_property_count_u32(node, "led-sources");
+ if (count <= 0) {
+@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
+ current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
+ led->max_torch_current_ma = current_ua / UA_PER_MA;
+
++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
++ if (torch_clamp != 0)
++ torch_clamp--;
++
++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
++
+ if (fwnode_property_present(node, "flash-max-microamp")) {
+ flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
+
+@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
+ flash_data->leds_count++;
+ }
+
+- return 0;
+-
++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
+ release:
+ while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
+ v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]);
+--
+2.51.0
+
--- /dev/null
+From 9937712e653525e00cb903c685846b81e9fe4d82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:47:12 +0200
+Subject: leds: leds-lp55xx: Use correct address for memory programming
+
+From: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+
+[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]
+
+Memory programming doesn't work for devices without page support.
+For example, LP5562 has 3 engines but doesn't support pages,
+the start address is changed depending on engine number.
+According to datasheet [1], the PROG MEM register addresses for each
+engine are as follows:
+
+ Engine 1: 0x10
+ Engine 2: 0x30
+ Engine 3: 0x50
+
+However, the current implementation incorrectly calculates the address
+of PROG MEM register using the engine index starting from 1:
+
+ prog_mem_base = 0x10
+ LP55xx_BYTES_PER_PAGE = 0x20
+
+ Engine 1: 0x10 + 0x20 * 1 = 0x30
+ Engine 2: 0x10 + 0x20 * 2 = 0x50
+ Engine 3: 0x10 + 0x20 * 3 = 0x70
+
+This results in writing to the wrong engine memory, causing pattern
+programming to fail.
+
+To correct it, the engine index should be decreased:
+ Engine 1: 0x10 + 0x20 * 0 = 0x10
+ Engine 2: 0x10 + 0x20 * 1 = 0x30
+ Engine 3: 0x10 + 0x20 * 2 = 0x50
+
+1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf
+
+Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
+Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp55xx-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
+index e71456a56ab8d..fd447eb7eb15e 100644
+--- a/drivers/leds/leds-lp55xx-common.c
++++ b/drivers/leds/leds-lp55xx-common.c
+@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
+ * For LED chip that support page, PAGE is already set in load_engine.
+ */
+ if (!cfg->pages_per_engine)
+- start_addr += LP55xx_BYTES_PER_PAGE * idx;
++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
+
+ for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
+ /* Write to the next page each 32 bytes (if supported) */
+--
+2.51.0
+
--- /dev/null
+From 716600ace6f68ca1ae087153ae8e82afebe69f10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 07:56:45 +0000
+Subject: leds: max77705: Function return instead of variable assignment
+
+From: Len Bao <len.bao@gmx.us>
+
+[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ]
+
+Coverity noticed that assigning value -EINVAL to 'ret' in the if
+statement is useless because 'ret' is overwritten a few lines later.
+However, after inspect the code, this warning reveals that we need to
+return -EINVAL instead of the variable assignment. So, fix it.
+
+Coverity-id: 1646104
+Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
+Signed-off-by: Len Bao <len.bao@gmx.us>
+Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-max77705.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
+index 933cb4f19be9b..b7403b3fcf5e7 100644
+--- a/drivers/leds/leds-max77705.c
++++ b/drivers/leds/leds-max77705.c
+@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
+
+ ret = fwnode_property_read_u32(np, "reg", ®);
+ if (ret || reg >= MAX77705_LED_NUM_LEDS)
+- ret = -EINVAL;
++ return -EINVAL;
+
+ info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL);
+ if (!info)
+--
+2.51.0
+
--- /dev/null
+From 5698e58cf942405c4f63e661244ce06064a395a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 22:51:19 +0100
+Subject: libbpf: Export bpf_object__prepare symbol
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ]
+
+Add missing LIBBPF_API macro for bpf_object__prepare function to enable
+its export. libbpf.map had bpf_object__prepare already listed.
+
+Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load")
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
+index 1137e7d2e1b5a..739ee60a780cd 100644
+--- a/tools/lib/bpf/libbpf.h
++++ b/tools/lib/bpf/libbpf.h
+@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
+ * @return 0, on success; negative error code, otherwise, error code is
+ * stored in errno
+ */
+-int bpf_object__prepare(struct bpf_object *obj);
++LIBBPF_API int bpf_object__prepare(struct bpf_object *obj);
+
+ /**
+ * @brief **bpf_object__load()** loads BPF object into kernel.
+--
+2.51.0
+
--- /dev/null
+From e3943caf5115fecd755b19c4f6eb9e9b61e698e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 15:17:51 +0800
+Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]
+
+When a module registers a struct_ops, the struct_ops type and its
+corresponding map_value type ("bpf_struct_ops_") may reside in different
+btf objects, here are four possible case:
+
++--------+---------------+-------------+---------------------------------+
+| |bpf_struct_ops_| xxx_ops | |
++--------+---------------+-------------+---------------------------------+
+| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux |
++--------+---------------+-------------+---------------------------------+
+| case 1 | btf_vmlinux | mod_btf | INVALID |
++--------+---------------+-------------+---------------------------------+
+| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in |
+| | | | vmlinux and mod. |
++--------+---------------+-------------+---------------------------------+
+| case 3 | mod_btf | mod_btf | be used and reg only in mod |
++--------+---------------+-------------+---------------------------------+
+
+Currently we figure out the mod_btf by searching with the struct_ops type,
+which makes it impossible to figure out the mod_btf when the struct_ops
+type is in btf_vmlinux while it's corresponding map_value type is in
+mod_btf (case 2).
+
+The fix is to use the corresponding map_value type ("bpf_struct_ops_")
+as the lookup anchor instead of the struct_ops type to figure out the
+`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
+the kern_type_id via btf__find_by_name_kind() with the `btf` we just
+obtained from find_ksym_btf_id().
+
+With this change the lookup obtains the correct btf and mod_btf for case 2,
+preserves correct behavior for other valid cases, and still fails as
+expected for the invalid scenario (case 1).
+
+Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 41c95b1220192..4abb9f4d245eb 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ const struct btf_member *kern_data_member;
+ struct btf *btf = NULL;
+ __s32 kern_vtype_id, kern_type_id;
+- char tname[256];
++ char tname[192], stname[256];
+ __u32 i;
+
+ snprintf(tname, sizeof(tname), "%.*s",
+ (int)bpf_core_essential_name_len(tname_raw), tname_raw);
+
+- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
+- &btf, mod_btf);
+- if (kern_type_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
+- tname);
+- return kern_type_id;
+- }
+- kern_type = btf__type_by_id(btf, kern_type_id);
++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
+
+- /* Find the corresponding "map_value" type that will be used
+- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example,
+- * find "struct bpf_struct_ops_tcp_congestion_ops" from the
+- * btf_vmlinux.
++ /* Look for the corresponding "map_value" type that will be used
++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
++ * and the mod_btf.
++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
+ */
+- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
+- tname, BTF_KIND_STRUCT);
++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
+ if (kern_vtype_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
+- STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
+ return kern_vtype_id;
+ }
+ kern_vtype = btf__type_by_id(btf, kern_vtype_id);
+
++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
++ if (kern_type_id < 0) {
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
++ return kern_type_id;
++ }
++ kern_type = btf__type_by_id(btf, kern_type_id);
++
+ /* Find "struct tcp_congestion_ops" from
+ * struct bpf_struct_ops_tcp_congestion_ops {
+ * [ ... ]
+@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ break;
+ }
+ if (i == btf_vlen(kern_vtype)) {
+- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
+- tname, STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
++ tname, stname);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From eeb320d715472019bb5498f9d0b00abb6c750e1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 8fe427960eee4..41c95b1220192 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From 429703d04a12c11d95d87ee4886212b12b9014b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 15:28:00 -0700
+Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]
+
+When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
+not need to be visible and settable since builtin_lsm_order is defined in
+security.o, which is only built when CONFIG_SECURITY=y.
+
+So make CONFIG_LSM depend on CONFIG_SECURITY.
+
+Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[PM: subj tweak]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 4816fc74f81eb..285f284dfcac4 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -269,6 +269,7 @@ endchoice
+
+ config LSM
+ string "Ordered list of enabled LSMs"
++ depends on SECURITY
+ default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
+ default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
+ default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
+--
+2.51.0
+
--- /dev/null
+From 355a58d16140256e1842fe40dcc0403453ff5123 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 15:50:58 +0200
+Subject: media: i2c: vd55g1: Fix duster register address
+
+From: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
+
+[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ]
+
+The duster register needs to be disabled on test patterns. While the
+code is correctly doing so, the register address contained a typo, thus
+not disabling the duster correctly. Fix the typo.
+
+Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor")
+
+Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/vd55g1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c
+index dec6e3e231d54..37b83125bcc81 100644
+--- a/drivers/media/i2c/vd55g1.c
++++ b/drivers/media/i2c/vd55g1.c
+@@ -66,7 +66,7 @@
+ #define VD55G1_REG_READOUT_CTRL CCI_REG8(0x052e)
+ #define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL 0
+ #define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2 1
+-#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ea)
++#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ae)
+ #define VD55G1_DUSTER_ENABLE BIT(0)
+ #define VD55G1_DUSTER_DISABLE 0
+ #define VD55G1_DUSTER_DYN_ENABLE BIT(1)
+--
+2.51.0
+
--- /dev/null
+From 6b2e6197b49dad7c9a548381b72bc96b74f499f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index b7ca39f63dba8..6dfc912168510 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From e7ddd940385ee9bfa1aafb1f5dff2793127c1d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 11:31:56 +0200
+Subject: media: st-delta: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
+
+Building with a reduced stack warning limit shows that delta_mjpeg_decode()
+copies a giant structure to the stack each time but only uses three of
+its members:
+
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Open-code the passing of the structure members that are actually used here.
+
+Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+index 0533d4a083d24..a078f1107300e 100644
+--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
+ return 0;
+ }
+
+-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
+ {
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+
+ memset(params, 0, sizeof(*params));
+
+- params->picture_start_addr_p = (u32)(au->paddr);
+- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
++ params->picture_start_addr_p = pstart;
++ params->picture_end_addr_p = pend;
+
+ /*
+ * !WARNING!
+@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+ int ret;
+- struct delta_au au = *pau;
++ void *au_vaddr = pau->vaddr;
++ dma_addr_t au_dma = pau->paddr;
++ size_t au_size = pau->size;
+ unsigned int data_offset = 0;
+ struct mjpeg_header *header = &ctx->header_struct;
+
+ if (!ctx->header) {
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ goto err;
+ }
+
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ ctx->header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+ goto err;
+ }
+
+- au.paddr += data_offset;
+- au.vaddr += data_offset;
++ au_dma += data_offset;
++ au_vaddr += data_offset;
+
+- ret = delta_mjpeg_ipc_decode(pctx, &au);
++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
+ if (ret)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From 21ca0b741168ad855e653f5036e0355e503ca702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:30:15 +0300
+Subject: media: zoran: Remove zoran_fh structure
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
+
+The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
+mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
+but the structure stayed by mistake. It is now used in a single
+location, assigned from a void pointer and then recast to a void
+pointer, without being every accessed. Drop it.
+
+Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/zoran/zoran.h | 6 ------
+ drivers/media/pci/zoran/zoran_driver.c | 3 +--
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
+index 1cd990468d3de..d05e222b39215 100644
+--- a/drivers/media/pci/zoran/zoran.h
++++ b/drivers/media/pci/zoran/zoran.h
+@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
+
+ struct zoran;
+
+-/* zoran_fh contains per-open() settings */
+-struct zoran_fh {
+- struct v4l2_fh fh;
+- struct zoran *zr;
+-};
+-
+ struct card_info {
+ enum card_type type;
+ char name[32];
+diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
+index f42f596d3e629..ec7fc1da4cc02 100644
+--- a/drivers/media/pci/zoran/zoran_driver.c
++++ b/drivers/media/pci/zoran/zoran_driver.c
+@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
+ struct v4l2_format *fmt)
+ {
+ struct zoran *zr = video_drvdata(file);
+- struct zoran_fh *fh = __fh;
+ int i;
+ int res = 0;
+
+ if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
+- return zoran_s_fmt_vid_out(file, fh, fmt);
++ return zoran_s_fmt_vid_out(file, __fh, fmt);
+
+ for (i = 0; i < NUM_FORMATS; i++)
+ if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
+--
+2.51.0
+
--- /dev/null
+From 1107700191920d0f114098da354fae6e79bece36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 20:06:46 +0300
+Subject: mfd: max77705: max77705_charger: move active discharge setting to mfd
+ parent
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ]
+
+Active discharge setting is a part of MFD top level i2c device, hence
+cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1
+register from charger driver is a mistake.
+
+Move active discharge setting to MFD parent driver.
+
+Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Acked-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/max77705.c | 3 +++
+ drivers/power/supply/max77705_charger.c | 3 ---
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
+index 6b263bacb8c28..ff07d0e0d5f8e 100644
+--- a/drivers/mfd/max77705.c
++++ b/drivers/mfd/max77705.c
+@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
+ if (pmic_rev != MAX77705_PASS3)
+ return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev);
+
++ /* Active Discharge Enable */
++ regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
++
+ ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
+ i2c->irq,
+ IRQF_ONESHOT | IRQF_SHARED, 0,
+diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
+index 329b430d0e506..3b75c82b9b9ea 100644
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+ regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
+ MAX77705_WDTEN_MASK, 0);
+
+- /* Active Discharge Enable */
+- regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
+-
+ /* VBYPSET=5.0V */
+ regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
+
+--
+2.51.0
+
--- /dev/null
+From acd3712440cbc1f5446e74f4963d9f0895d609bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 21:23:07 +0300
+Subject: mfd: max77705: Setup the core driver as an interrupt controller
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ]
+
+Current implementation describes only MFD's own topsys interrupts.
+However, max77705 has a register which indicates interrupt source, i.e.
+it acts as an interrupt controller. There's 4 interrupt sources in
+max77705: topsys, charger, fuelgauge, usb type-c manager.
+
+Setup max77705 MFD parent as an interrupt controller. Delete topsys
+interrupts because currently unused.
+
+Remove shared interrupt flag, because we're are an interrupt controller
+now, and subdevices should request interrupts from us.
+
+Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
+
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/max77705.c | 35 ++++++++++++++---------------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
+index ff07d0e0d5f8e..e1a9bfd658560 100644
+--- a/drivers/mfd/max77705.c
++++ b/drivers/mfd/max77705.c
+@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = {
+ .max_register = MAX77705_PMIC_REG_USBC_RESET,
+ };
+
+-static const struct regmap_irq max77705_topsys_irqs[] = {
+- { .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_TM_INT, },
++static const struct regmap_irq max77705_irqs[] = {
++ { .mask = MAX77705_SRC_IRQ_CHG, },
++ { .mask = MAX77705_SRC_IRQ_TOP, },
++ { .mask = MAX77705_SRC_IRQ_FG, },
++ { .mask = MAX77705_SRC_IRQ_USBC, },
+ };
+
+-static const struct regmap_irq_chip max77705_topsys_irq_chip = {
+- .name = "max77705-topsys",
+- .status_base = MAX77705_PMIC_REG_SYSTEM_INT,
+- .mask_base = MAX77705_PMIC_REG_SYSTEM_INT_MASK,
++static const struct regmap_irq_chip max77705_irq_chip = {
++ .name = "max77705",
++ .status_base = MAX77705_PMIC_REG_INTSRC,
++ .ack_base = MAX77705_PMIC_REG_INTSRC,
++ .mask_base = MAX77705_PMIC_REG_INTSRC_MASK,
+ .num_regs = 1,
+- .irqs = max77705_topsys_irqs,
+- .num_irqs = ARRAY_SIZE(max77705_topsys_irqs),
++ .irqs = max77705_irqs,
++ .num_irqs = ARRAY_SIZE(max77705_irqs),
+ };
+
+ static int max77705_i2c_probe(struct i2c_client *i2c)
+@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
+
+ ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
+ i2c->irq,
+- IRQF_ONESHOT | IRQF_SHARED, 0,
+- &max77705_topsys_irq_chip,
++ IRQF_ONESHOT, 0,
++ &max77705_irq_chip,
+ &irq_data);
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
+
+- /* Unmask interrupts from all blocks in interrupt source register */
+- ret = regmap_update_bits(max77705->regmap,
+- MAX77705_PMIC_REG_INTSRC_MASK,
+- MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL);
+- if (ret < 0)
+- return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n");
+-
+ domain = regmap_irq_get_domain(irq_data);
+
+ ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
+--
+2.51.0
+
--- /dev/null
+From afc32d8a473d55bc59462083e3120dd85613ea65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From a3abc0ffc4d5bd9ea896bb2950f90b265c899049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 14:23:14 +0800
+Subject: mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ]
+
+The comparison function cmp_loc_by_count() used for sorting stack trace
+locations in debugfs currently returns -1 if a->count > b->count and 1
+otherwise. This breaks the antisymmetry property required by sort(),
+because when two counts are equal, both cmp(a, b) and cmp(b, a) return
+1.
+
+This can lead to undefined or incorrect ordering results. Fix it by
+updating the comparison logic to explicitly handle the case when counts
+are equal, and use cmp_int() to ensure the comparison function adheres
+to the required mathematical properties of antisymmetry.
+
+Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces")
+Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/slub.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 09b6404ac5752..a63053505a1ac 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -7738,10 +7738,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data)
+ struct location *loc1 = (struct location *)a;
+ struct location *loc2 = (struct location *)b;
+
+- if (loc1->count > loc2->count)
+- return -1;
+- else
+- return 1;
++ return cmp_int(loc2->count, loc1->count);
+ }
+
+ static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos)
+--
+2.51.0
+
--- /dev/null
+From 19e9d8361570ae84122aa9109d8698e18ab39a9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:06:05 +0200
+Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
+
+From: Bean Huo <beanhuo@micron.com>
+
+[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]
+
+Rename the inner 'frm' variable to 'resp_frm' in the write path of
+mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.
+
+The function declares 'frm' at function scope pointing to the request
+frame, but then redeclares another 'frm' variable inside the write
+block pointing to the response frame. This shadowing makes the code
+confusing and error-prone.
+
+Using 'resp_frm' for the response frame makes the distinction clear
+and improves code readability.
+
+Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 9cc47bf94804b..dd6cffc0df729 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
+ return -ENOMEM;
+
+ if (write) {
+- struct rpmb_frame *frm = (struct rpmb_frame *)resp;
++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
+
+ /* Send write request frame(s) */
+ set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
+ 1 | MMC_CMD23_ARG_REL_WR, req, req_len);
+
+ /* Send result request frame */
+- memset(frm, 0, sizeof(*frm));
+- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
++ memset(resp_frm, 0, sizeof(*resp_frm));
++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
+ set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
+ resp_len);
+
+--
+2.51.0
+
--- /dev/null
+From 7e82c67f4de28a3890505a22170294dd85cc78fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:07:27 +0300
+Subject: mtd: rawnand: atmel: Fix error handling path in
+ atmel_nand_controller_add_nands
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
+
+In case of a jump to the err label due to atmel_nand_create() or
+atmel_nand_controller_add_nand() failure, the reference to nand_np
+need to be released
+
+Use for_each_child_of_node_scoped() to fix the issue.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index db94d14a3807f..49e00458eebeb 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
+
+ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+ {
+- struct device_node *np, *nand_np;
++ struct device_node *np;
+ struct device *dev = nc->dev;
+ int ret, reg_cells;
+ u32 val;
+@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ reg_cells += val;
+
+- for_each_child_of_node(np, nand_np) {
++ for_each_child_of_node_scoped(np, nand_np) {
+ struct atmel_nand *nand;
+
+ nand = atmel_nand_create(nc, nand_np, reg_cells);
+--
+2.51.0
+
--- /dev/null
+From a9f3e0578a96b8723a7b578cfb47044760e926d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:22:43 +0000
+Subject: nbd: restrict sockets to TCP and UDP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
+
+Recently, syzbot started to abuse NBD with all kinds of sockets.
+
+Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
+made sure the socket supported a shutdown() method.
+
+Explicitely accept TCP and UNIX stream sockets.
+
+Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
+Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Richard W.M. Jones <rjones@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Yu Kuai <yukuai1@huaweicloud.com>
+Cc: linux-block@vger.kernel.org
+Cc: nbd@other.debian.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 6463d0e8d0cef..87b0b78249da3 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (!sock)
+ return NULL;
+
++ if (!sk_is_tcp(sock->sk) &&
++ !sk_is_stream_unix(sock->sk)) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
++ *err = -EINVAL;
++ sockfd_put(sock);
++ return NULL;
++ }
++
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From ba22f040951694b8d604feec1ea01e99af033148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index f828f38cd7682..7e22f1dc4a49f 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From fd307c2e5c1c0a6a9e9710d05ac67a1f3ff12153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index a3c934c3de71d..3620a4deb0187 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From 94a7201d0fe2b97490d45764f37fceb25c082c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:27:55 +0800
+Subject: net: enetc: Fix probing error message typo for the ENETCv4 PF driver
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ]
+
+Blamed commit wrongly indicates VF error in case of PF probing error.
+
+Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+index b3dc1afeefd1d..a5c1f1cef3b0c 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev,
+ err = enetc_get_driver_data(si);
+ if (err)
+ return dev_err_probe(dev, err,
+- "Could not get VF driver data\n");
++ "Could not get PF driver data\n");
+
+ err = enetc4_pf_struct_init(si);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 81924896f7cd7bcf041b60b6a4d7a9840945b765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:39:53 +0800
+Subject: net: enetc: initialize SW PIR and CIR based HW PIR and CIR values
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ]
+
+Software can only initialize the PIR and CIR of the command BD ring after
+a FLR, and these two registers can only be set to 0. But the reset values
+of these two registers are 0, so software does not need to update them.
+If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or
+other values by software will cause the command BD ring to work
+abnormally. This is because of an internal context in the ring prefetch
+logic that will retain the state from the first incarnation of the ring
+and continue prefetching from the stale location when the ring is
+reinitialized. The internal context can only be reset by the FLR.
+
+In addition, there is a logic error in the implementation, next_to_clean
+indicates the software CIR and next_to_use indicates the software PIR.
+But the current driver uses next_to_clean to set PIR and use next_to_use
+to set CIR. This does not cause a problem in actual use, because the
+current command BD ring is only initialized after FLR, and the initial
+values of next_to_use and next_to_clean are both 0.
+
+Therefore, this patch removes the initialization of PIR and CIR. Instead,
+next_to_use and next_to_clean are initialized by reading the values of
+PIR and CIR.
+
+Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c
+index ba32c1bbd9e18..0c1d343253bfb 100644
+--- a/drivers/net/ethernet/freescale/enetc/ntmp.c
++++ b/drivers/net/ethernet/freescale/enetc/ntmp.c
+@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
+ cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base,
+ NTMP_BASE_ADDR_ALIGN);
+
+- cbdr->next_to_clean = 0;
+- cbdr->next_to_use = 0;
+ spin_lock_init(&cbdr->ring_lock);
+
++ cbdr->next_to_use = netc_read(cbdr->regs.pir);
++ cbdr->next_to_clean = netc_read(cbdr->regs.cir);
++
+ /* Step 1: Configure the base address of the Control BD Ring */
+ netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align));
+ netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align));
+
+- /* Step 2: Configure the producer index register */
+- netc_write(cbdr->regs.pir, cbdr->next_to_clean);
+-
+- /* Step 3: Configure the consumer index register */
+- netc_write(cbdr->regs.cir, cbdr->next_to_use);
+-
+- /* Step4: Configure the number of BDs of the Control BD Ring */
++ /* Step 2: Configure the number of BDs of the Control BD Ring */
+ netc_write(cbdr->regs.lenr, cbdr->bd_num);
+
+- /* Step 5: Enable the Control BD Ring */
++ /* Step 3: Enable the Control BD Ring */
+ netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 6e72c9ce5fe15802cb2c9cef57e3565d88f44ab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:19:24 -0700
+Subject: net: ethtool: tsconfig: set command must provide a reply
+
+From: Vadim Fedorenko <vadfed@meta.com>
+
+[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ]
+
+Timestamping configuration through ethtool has inconsistent behavior of
+skipping the reply for set command if configuration was not changed. Fix
+it be providing reply in any case.
+
+Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config")
+Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/tsconfig.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c
+index 2be356bdfe873..169b413b31fc5 100644
+--- a/net/ethtool/tsconfig.c
++++ b/net/ethtool/tsconfig.c
+@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base,
+ return ret;
+ }
+
+- if (hwprov_mod || config_mod) {
+- ret = tsconfig_send_reply(dev, info);
+- if (ret && ret != -EOPNOTSUPP) {
+- NL_SET_ERR_MSG(info->extack,
+- "error while reading the new configuration set");
+- return ret;
+- }
++ ret = tsconfig_send_reply(dev, info);
++ if (ret && ret != -EOPNOTSUPP) {
++ NL_SET_ERR_MSG(info->extack,
++ "error while reading the new configuration set");
++ return ret;
+ }
+
+ /* tsconfig has no notification */
+--
+2.51.0
+
--- /dev/null
+From e81e0d172153c9e2a83894c6dc0feb8356a57352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:09 +0300
+Subject: net/mlx5: fw reset, add reset timeout work
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
+
+Add sync reset timeout to stop poll_sync_reset in case there was no
+reset done or abort event within timeout. Otherwise poll sync reset will
+just continue and in case of fw fatal error no health reporting will be
+done.
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 22995131824a0..89e399606877b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
+ struct work_struct reset_reload_work;
+ struct work_struct reset_now_work;
+ struct work_struct reset_abort_work;
++ struct delayed_work reset_timeout_work;
+ unsigned long reset_flags;
+ u8 reset_method;
+ struct timer_list timer;
+@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
+ return -EALREADY;
+ }
+
++ if (current_work() != &fw_reset->reset_timeout_work.work)
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ mlx5_stop_sync_reset_poll(dev);
+ if (poll_health)
+ mlx5_start_health_poll(dev);
+@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+ }
+ mlx5_stop_health_poll(dev, true);
+ mlx5_start_sync_reset_poll(dev);
++
++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
++ &fw_reset->reset_flags))
++ schedule_delayed_work(&fw_reset->reset_timeout_work,
++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
+ return 0;
+ }
+
+@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
+ }
+ }
+
++static void mlx5_sync_reset_timeout_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_fw_reset *fw_reset =
++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
++ struct mlx5_core_dev *dev = fw_reset->dev;
++
++ if (mlx5_sync_reset_clear_reset_requested(dev, true))
++ return;
++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
++}
++
+ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
+ cancel_work_sync(&fw_reset->reset_reload_work);
+ cancel_work_sync(&fw_reset->reset_now_work);
+ cancel_work_sync(&fw_reset->reset_abort_work);
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ }
+
+ static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
+@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
+ INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
+ INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
++ mlx5_sync_reset_timeout_work);
+
+ init_completion(&fw_reset->done);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From e3c0e17db3a4054ee9765b414af53dbffbb2dda0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:08 +0300
+Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
+ teardown
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
+
+The reclaim_pages_cmd() function sends a command to the firmware to
+reclaim pages if the command interface is active.
+
+A race condition can occur if the command interface goes down (e.g., due
+to a PCI error) while the mlx5_cmd_do() call is in flight. In this
+case, mlx5_cmd_do() will return an error. The original code would
+propagate this error immediately, bypassing the software-based page
+reclamation logic that is supposed to run when the command interface is
+down.
+
+Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
+that command interface is down. If this is the case, fall through to
+the software reclamation path. If the command failed for any another
+reason, or finished successfully, return as before.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 9bc9bd83c2324..cd68c4b2c0bf9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
++ int err;
+
+- if (!mlx5_cmd_is_down(dev))
+- return mlx5_cmd_do(dev, in, in_size, out, out_size);
++ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
++ if (err != -ENXIO)
++ return err;
+
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+--
+2.51.0
+
--- /dev/null
+From c2d19aee8efe09777c98f61e6d5cec539e6882ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:07 +0300
+Subject: net/mlx5: Stop polling for command response if interface goes down
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
+
+Stop polling on firmware response to command in polling mode if the
+command interface got down. This situation can occur, for example, if a
+firmware fatal error is detected during polling.
+
+This change halts the polling process when the command interface goes
+down, preventing unnecessary waits.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index e395ef5f356eb..722282cebce9a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+ return;
+ }
+ cond_resched();
++ if (mlx5_cmd_is_down(dev)) {
++ ent->ret = -ENXIO;
++ return;
++ }
+ } while (time_before(jiffies, poll_end));
+
+ ent->ret = -ETIMEDOUT;
+@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a3f26c0d306cbb8107c8be6e52a69f1f60c4950d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index ddff6f19ff98e..92add3daadbb1 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 2bc556139fe247ffe817f8eca2699ee5079b6ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 5251524b96afa..5e4453e9ef8e7 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -63,7 +63,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From a20a1ac139f5502f12f0b5323e8ebe3f2bfa6026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 07:27:09 +0000
+Subject: netfilter: nf_conntrack: do not skip entries in
+ /proc/net/nf_conntrack
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ]
+
+ct_seq_show() has an opportunistic garbage collector :
+
+if (nf_ct_should_gc(ct)) {
+ nf_ct_kill(ct);
+ goto release;
+}
+
+So if one nf_conn is killed there, next time ct_get_next() runs,
+we skip the following item in the bucket, even if it should have
+been displayed if gc did not take place.
+
+We can decrement st->skip_elems to tell ct_get_next() one of the items
+was removed from the chain.
+
+Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_standalone.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 6c4cff10357df..e271dd648a681 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -322,6 +322,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
+ smp_acquire__after_ctrl_dep();
+
+ if (nf_ct_should_gc(ct)) {
++ struct ct_iter_state *st = s->private;
++
++ st->skip_elems--;
+ nf_ct_kill(ct);
+ goto release;
+ }
+--
+2.51.0
+
--- /dev/null
+From 7014e6bc134b0b67575660f7a2511313f2ad657d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:40:43 +0200
+Subject: netfilter: nfnetlink: reset nlh pointer during batch replay
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ]
+
+During a batch replay, the nlh pointer is not reset until the parsing of
+the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle
+ACK flags for batch messages") that is problematic as the condition to
+add an ACK for batch begin will evaluate to true even if NLM_F_ACK
+wasn't used for batch begin message.
+
+If there is an error during the command processing, netlink is sending
+an ACK despite that. This misleads userspace tools which think that the
+return code was 0. Reset the nlh pointer to the original one when a
+replay is triggered.
+
+Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nfnetlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index e598a2a252b0a..811d02b4c4f7c 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ const struct nfnetlink_subsystem *ss;
+ const struct nfnl_callback *nc;
+ struct netlink_ext_ack extack;
++ struct nlmsghdr *onlh = nlh;
+ LIST_HEAD(err_list);
+ u32 status;
+ int err;
+@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ status = 0;
+ replay_abort:
+ skb = netlink_skb_clone(oskb, GFP_KERNEL);
++ nlh = onlh;
+ if (!skb)
+ return netlink_ack(oskb, nlh, -ENOMEM, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From 68cb2e1e884b771e49c0d4450737b0c15feceafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index fbca8d0efd858..37a46596268a0 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From 82222c2816dee2f673762b97d9f9d079defb1a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 8d492e3b21631..0366322de20f3 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9438,7 +9438,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 87dd5f95877afd3c9145d0a37b595fe3b1eb19ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:07:32 +0800
+Subject: null_blk: Fix the description of the cache_size module argument
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
+
+When executing modinfo null_blk, there is an error in the description
+of module parameter mbps, and the output information of cache_size is
+incomplete.The output of modinfo before and after applying this patch
+is as follows:
+
+Before:
+[...]
+parm: cache_size:ulong
+[...]
+parm: mbps:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (uint)
+[...]
+
+After:
+[...]
+parm: cache_size:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (ulong)
+[...]
+parm: mbps:Limit maximum bandwidth (in MiB/s).
+ Default: 0 (no limit) (uint)
+[...]
+
+Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index aa163ae9b2aa5..8b58986d538fa 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
+
+ static unsigned long g_cache_size;
+ module_param_named(cache_size, g_cache_size, ulong, 0444);
+-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+
+ static bool g_fua = true;
+ module_param_named(fua, g_fua, bool, 0444);
+--
+2.51.0
+
--- /dev/null
+From 7f435c0ac926a6b550e276a3ef794984ef42c4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:21 +0530
+Subject: nvme-auth: update bi_directional flag
+
+From: Martin George <martinus.gpy@gmail.com>
+
+[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ]
+
+While setting chap->s2 to zero as part of secure channel
+concatenation, the host missed out to disable the bi_directional
+flag to indicate that controller authentication is not requested.
+Fix the same.
+
+Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
+Signed-off-by: Martin George <marting@netapp.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index f6ddbe5532890..1386e5f8682ef 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl,
+ } else {
+ memset(chap->c2, 0, chap->hash_len);
+ }
+- if (ctrl->opts->concat)
++ if (ctrl->opts->concat) {
+ chap->s2 = 0;
+- else
++ chap->bi_directional = false;
++ } else
+ chap->s2 = nvme_auth_get_seqnum();
+ data->seqnum = cpu_to_le32(chap->s2);
+ if (chap->host_key_len) {
+--
+2.51.0
+
--- /dev/null
+From 491a598605c08da6336def33aa12e5f460c66f18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:05:09 +0530
+Subject: nvme-tcp: send only permitted commands for secure concat
+
+From: Martin George <martinus.gpy@gmail.com>
+
+[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ]
+
+In addition to sending permitted commands such as connect/auth
+over the initial unencrypted admin connection as part of secure
+channel concatenation, the host also sends commands such as
+Property Get and Identify on the same. This is a spec violation
+leading to secure concat failures. Fix this by ensuring these
+additional commands are avoided on this connection.
+
+Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation")
+Signed-off-by: Martin George <marting@netapp.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 9233f088fac88..7ecd9866453fb 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
+ if (error)
+ goto out_cleanup_tagset;
+
++ if (ctrl->opts->concat && !ctrl->tls_pskid)
++ return 0;
++
+ error = nvme_enable_ctrl(ctrl);
+ if (error)
+ goto out_stop_queue;
+--
+2.51.0
+
--- /dev/null
+From 4ec17f98cc0ff435093f3a5c3c41fd1b72ca2e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 25598a46bf0d6..fb2cd1118eb83 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From f898a02aec6b8c550db6e7992e5954f63bf471f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:02 +0200
+Subject: nvmet-fcloop: call done callback even when remote port is gone
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ]
+
+When the target port is gone, it's not possible to access any of the
+request resources. The function should just silently drop the response.
+The comment is misleading in this regard.
+
+Though it's still necessary to call the driver via the ->done callback
+so the driver is able to release all resources.
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/
+Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 257b497d515a8..5dffcc5becae8 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport,
+ if (!targetport) {
+ /*
+ * The target port is gone. The target doesn't expect any
+- * response anymore and the ->done call is not valid
+- * because the resources have been freed by
+- * nvmet_fc_free_pending_reqs.
++ * response anymore and thus lsreq can't be accessed anymore.
+ *
+ * We end up here from delete association exchange:
+ * nvmet_fc_xmt_disconnect_assoc sends an async request.
++ *
++ * Return success because this is what LLDDs do; silently
++ * drop the response.
+ */
++ lsrsp->done(lsrsp);
+ kmem_cache_free(lsreq_cache, tls_req);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 774b9cc89b3062d44669270e29600d490a95a3b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 77edcd70f72c2..c5236b3ed168f 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 5da60b047e39008ebf0ce039a8cf853723443377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 14:12:36 +0800
+Subject: octeontx2-pf: fix bitmap leak
+
+From: Bo Sun <bo@mboxify.com>
+
+[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ]
+
+The bitmap allocated with bitmap_zalloc() in otx2_probe() was not
+released in otx2_remove(). Unbinding and rebinding the driver therefore
+triggers a kmemleak warning:
+
+ unreferenced object (size 8):
+ backtrace:
+ bitmap_zalloc
+ otx2_probe
+
+Call bitmap_free() in the remove path to fix the leak.
+
+Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
+Signed-off-by: Bo Sun <bo@mboxify.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index c6d2f2249cc35..12fe71dc20a79 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -3468,6 +3468,7 @@ static void otx2_remove(struct pci_dev *pdev)
+ otx2_disable_mbox_intr(pf);
+ otx2_pfaf_mbox_destroy(pf);
+ pci_free_irq_vectors(pf->pdev);
++ bitmap_free(pf->af_xdp_zc_qidx);
+ pci_set_drvdata(pdev, NULL);
+ free_netdev(netdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From d183342228bf64af767b3c150057d4c7a482c21b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 14:12:35 +0800
+Subject: octeontx2-vf: fix bitmap leak
+
+From: Bo Sun <bo@mboxify.com>
+
+[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ]
+
+The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not
+released in otx2vf_remove(). Unbinding and rebinding the driver therefore
+triggers a kmemleak warning:
+
+ unreferenced object (size 8):
+ backtrace:
+ bitmap_zalloc
+ otx2vf_probe
+
+Call bitmap_free() in the remove path to fix the leak.
+
+Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
+Signed-off-by: Bo Sun <bo@mboxify.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+index 76dd2e965cf03..e9018775ffadd 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+@@ -822,6 +822,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
+ qmem_free(vf->dev, vf->dync_lmt);
+ otx2vf_vfaf_mbox_destroy(vf);
+ pci_free_irq_vectors(vf->pdev);
++ bitmap_free(vf->af_xdp_zc_qidx);
+ pci_set_drvdata(pdev, NULL);
+ free_netdev(netdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From 9204e93c5cc63562381033f419192d96883f4722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 19:29:10 +0800
+Subject: once: fix race by moving DO_ONCE to separate section
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
+
+The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
+DO_ONCE's ___done variable to .data.once section, which conflicts with
+DO_ONCE_LITE() that also uses the same section.
+
+This creates a race condition when clear_warn_once is used:
+
+Thread 1 (DO_ONCE) Thread 2 (DO_ONCE)
+__do_once_start
+ read ___done (false)
+ acquire once_lock
+execute func
+__do_once_done
+ write ___done (true) __do_once_start
+ release once_lock // Thread 3 clear_warn_once reset ___done
+ read ___done (false)
+ acquire once_lock
+ execute func
+schedule once_work __do_once_done
+once_deferred: OK write ___done (true)
+static_branch_disable release once_lock
+ schedule once_work
+ once_deferred:
+ BUG_ON(!static_key_enabled)
+
+DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
+macros. Keep its ___done flag in the .data..once section and allow resetting
+by clear_warn_once, as originally intended.
+
+In contrast, DO_ONCE() is used for functions like get_random_once() and
+relies on its ___done flag for internal synchronization. We should not reset
+DO_ONCE() by clear_warn_once.
+
+Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
+shielding it from clear_warn_once.
+
+Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 1 +
+ include/linux/once.h | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index fa5f19b8d53a0..083d091bd7263 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
+ __start_once = .; \
+ *(.data..once) \
+ __end_once = .; \
++ *(.data..do_once) \
+ STRUCT_ALIGN(); \
+ *(__tracepoints) \
+ /* implement dynamic printk debug */ \
+diff --git a/include/linux/once.h b/include/linux/once.h
+index 30346fcdc7995..449a0e34ad5ad 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ unsigned long ___flags; \
+@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE_SLEEPABLE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ ___ret = __do_once_sleepable_start(&___done); \
+--
+2.51.0
+
--- /dev/null
+From bafdfcd3d5e9c812044913d961e34bebca872951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 14:46:42 -0700
+Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]
+
+pci_acpi_preserve_config() leaks memory by returning early without freeing
+the ACPI object on success. Fix that by always freeing the obj, which is
+not needed by the caller.
+
+Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-acpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 99c58ee09fbb0..0cd8a75e22580 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
+
+ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ {
++ bool ret = false;
++
+ if (ACPI_HANDLE(&host_bridge->dev)) {
+ union acpi_object *obj;
+
+@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ 1, DSM_PCI_PRESERVE_BOOT_CONFIG,
+ NULL, ACPI_TYPE_INTEGER);
+ if (obj && obj->integer.value == 0)
+- return true;
++ ret = true;
+ ACPI_FREE(obj);
+ }
+
+- return false;
++ return ret;
+ }
+
+ /* _HPX PCI Setting Record (Type 0); same as _HPP */
+--
+2.51.0
+
--- /dev/null
+From 66954a40719ea005e8ff62a5ada6bc1b0e74da83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 14:14:34 -0700
+Subject: PCI: j721e: Fix incorrect error message in probe()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]
+
+The probe() function prints "pm_runtime_get_sync failed" when
+j721e_pcie_ctrl_init() returns an error. This is misleading since
+the failure is not from pm_runtime, but from the controller init
+routine. Update the error message to correctly reflect the source.
+
+No functional changes.
+
+Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 6c93f39d02888..5e445a7bda332 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+
+ ret = j721e_pcie_ctrl_init(pcie);
+ if (ret < 0) {
+- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
+ goto err_get_sync;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5840b068521700885f229d8af75d563e2a318508 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 17:56:25 +0200
+Subject: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ]
+
+When devm_add_action_or_reset() fails, it calls the passed cleanup
+function. Hence the caller must not repeat that cleanup.
+
+Replace the "goto err_regulator_free" by the actual freeing, as there
+will never be a need again for a second user of this label.
+
+Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # V4H Sparrow Hawk
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pwrctrl/slot.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c
+index 18becc144913e..26b21746da50b 100644
+--- a/drivers/pci/pwrctrl/slot.c
++++ b/drivers/pci/pwrctrl/slot.c
+@@ -47,13 +47,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
+ ret = regulator_bulk_enable(slot->num_supplies, slot->supplies);
+ if (ret < 0) {
+ dev_err_probe(dev, ret, "Failed to enable slot regulators\n");
+- goto err_regulator_free;
++ regulator_bulk_free(slot->num_supplies, slot->supplies);
++ return ret;
+ }
+
+ ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off,
+ slot);
+ if (ret)
+- goto err_regulator_disable;
++ return ret;
+
+ pci_pwrctrl_init(&slot->ctx, dev);
+
+@@ -62,13 +63,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
+ return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n");
+
+ return 0;
+-
+-err_regulator_disable:
+- regulator_bulk_disable(slot->num_supplies, slot->supplies);
+-err_regulator_free:
+- regulator_bulk_free(slot->num_supplies, slot->supplies);
+-
+- return ret;
+ }
+
+ static const struct of_device_id pci_pwrctrl_slot_of_match[] = {
+--
+2.51.0
+
--- /dev/null
+From 9513a4c36480ef71b13470906639717eb4f7b73f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 14:52:23 +0800
+Subject: PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s
+
+From: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
+
+[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ]
+
+Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link
+stability and avoid AER Correctable Errors reported on some platforms
+(eg. SA8775P).
+
+8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting.
+This setting is programmed into a group of shadow registers, which can be
+switched to configure equalization for different speeds by writing 00b,
+01b and 10b to `RATE_SHADOW_SEL`.
+
+Hence, program equalization registers in a loop using link speed as index,
+so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s
+and 32.0 GT/s.
+
+Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes")
+Co-developed-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
+Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
+Signed-off-by: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
+[mani: wrapped the warning to fit 100 columns, used post-increment for loop]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.h | 1 -
+ drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++--------
+ drivers/pci/controller/dwc/pcie-qcom-common.h | 2 +-
+ drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +-
+ drivers/pci/controller/dwc/pcie-qcom.c | 6 +-
+ 5 files changed, 41 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
+index ce9e18554e426..388306991467a 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.h
++++ b/drivers/pci/controller/dwc/pcie-designware.h
+@@ -127,7 +127,6 @@
+ #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE BIT(16)
+ #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT 24
+ #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK GENMASK(25, 24)
+-#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT 0x1
+
+ #define GEN3_EQ_CONTROL_OFF 0x8A8
+ #define GEN3_EQ_CONTROL_OFF_FB_MODE GENMASK(3, 0)
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c
+index 3aad19b56da8f..0c6f4514f922f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-common.c
++++ b/drivers/pci/controller/dwc/pcie-qcom-common.c
+@@ -8,9 +8,11 @@
+ #include "pcie-designware.h"
+ #include "pcie-qcom-common.h"
+
+-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
++void qcom_pcie_common_set_equalization(struct dw_pcie *pci)
+ {
++ struct device *dev = pci->dev;
+ u32 reg;
++ u16 speed;
+
+ /*
+ * GEN3_RELATED_OFF register is repurposed to apply equalization
+@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
+ * determines the data rate for which these equalization settings are
+ * applied.
+ */
+- reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
+- reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
+- reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
+- reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
+- GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT);
+- dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
+
+- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
+- reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
+- GEN3_EQ_FMDC_N_EVALS |
+- GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
+- GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
+- reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
+- FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
+- FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
+- FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
+- dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
++ for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) {
++ if (speed > PCIE_SPEED_32_0GT) {
++ dev_warn(dev, "Skipped equalization settings for unsupported data rate\n");
++ break;
++ }
+
+- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
+- reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
+- GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
+- GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
+- GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
+- dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
++ reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
++ reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
++ reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
++ reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
++ speed - PCIE_SPEED_8_0GT);
++ dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
++
++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
++ reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
++ GEN3_EQ_FMDC_N_EVALS |
++ GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
++ GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
++ reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
++ FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
++ FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
++ FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
++ dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
++
++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
++ reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
++ GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
++ GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
++ GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
++ dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
++ }
+ }
+-EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization);
++EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization);
+
+ void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci)
+ {
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h
+index 7d88d29e47661..7f5ca2fd9a72f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-common.h
++++ b/drivers/pci/controller/dwc/pcie-qcom-common.h
+@@ -8,7 +8,7 @@
+
+ struct dw_pcie;
+
+-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci);
++void qcom_pcie_common_set_equalization(struct dw_pcie *pci);
+ void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci);
+
+ #endif
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
+index bf7c6ac0f3e39..aaf060bf39d40 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
+@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci)
+ goto err_disable_resources;
+ }
+
+- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+- qcom_pcie_common_set_16gt_equalization(pci);
++ qcom_pcie_common_set_equalization(pci);
++
++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
+ qcom_pcie_common_set_16gt_lane_margining(pci);
+- }
+
+ /*
+ * The physical address of the MMIO region which is exposed as the BAR
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 9b12f2f020422..e5e686705e485 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -298,10 +298,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci)
+ {
+ struct qcom_pcie *pcie = to_qcom_pcie(pci);
+
+- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+- qcom_pcie_common_set_16gt_equalization(pci);
++ qcom_pcie_common_set_equalization(pci);
++
++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
+ qcom_pcie_common_set_16gt_lane_margining(pci);
+- }
+
+ /* Enable Link Training state machine */
+ if (pcie->cfg->ops->ltssm_enable)
+--
+2.51.0
+
--- /dev/null
+From ba636f596a61b2a62f9bdb252d1e2f5a94e2ce3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:45:58 +0200
+Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
+Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
+domain, after reset has been asserted by writing a matching reset bit into
+register SRCR, it is mandatory to wait 1ms.
+
+Because it is the controller driver which can determine whether or not the
+controller is in HSC domain based on its compatible string, add the missing
+delay in the controller driver.
+
+This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
+whether S4 is affected as well. This patch does apply the extra delay on
+R-Car S4 as well.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+[mani: added the missing r-b tag from Krzysztof]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 18055807a4f5f..d9a42fa51520a 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ return ret;
+ }
+
+- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
+ reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ /*
++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
++ * indicates that for peripherals in HSC domain, after
++ * reset has been asserted by writing a matching reset bit
++ * into register SRCR, it is mandatory to wait 1ms.
++ */
++ fsleep(1000);
++ }
+
+ val = readl(rcar->base + PCIEMSR0);
+ if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
+--
+2.51.0
+
--- /dev/null
+From f4a4e26cf3ce57afbc3fed97355e6b9ad0947d25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 02:55:45 +0200
+Subject: PCI: rcar-gen4: Assure reset occurs before DBI access
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]
+
+Assure the reset is latched and the core is ready for DBI access. On R-Car
+V4H, the PCIe reset is asynchronous and does not take effect immediately,
+but needs a short time to complete. In case DBI access happens in that
+short time, that access generates an SError. Make sure that condition can
+never happen, read back the state of the reset, which should turn the
+asynchronous reset into a synchronous one, and wait a little over 1ms to
+add additional safety margin.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index d9a42fa51520a..9ac3f0f11adad 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ if (ret)
+ goto err_unprepare;
+
++ /*
++ * Assure the reset is latched and the core is ready for DBI access.
++ * On R-Car V4H, the PCIe reset is asynchronous and does not take
++ * effect immediately, but needs a short time to complete. In case
++ * DBI access happens in that short time, that access generates an
++ * SError. To make sure that condition can never happen, read back the
++ * state of the reset, which should turn the asynchronous reset into
++ * synchronous one, and wait a little over 1ms to add additional
++ * safety margin.
++ */
++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ fsleep(1000);
++
+ if (rcar->drvdata->additional_common_init)
+ rcar->drvdata->additional_common_init(rcar);
+
+--
+2.51.0
+
--- /dev/null
+From e8bf04acc9dda3e15ee2605f6572987e20370228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 01:58:40 +0200
+Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
+Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
+figure indicates that register 0xf8 should be polled until bit 18 becomes
+set to 1.
+
+Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
+set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
+break condition is inverted and returns when register 0xf8, bit 18 is set
+to 0, which in most cases means immediately. In case
+CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
+readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
+afterward never read register 0xf8, bit 18 as 0, which leads to timeout
+and failure to start the PCIe controller.
+
+Fix this by inverting the poll condition to match the reference manual
+initialization sequence.
+
+Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 9ac3f0f11adad..c16c4c2be4993 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
+ val &= ~APP_HOLD_PHY_RST;
+ writel(val, rcar->base + PCIERSTCTRL1);
+
+- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
+ if (ret < 0)
+ return ret;
+
+--
+2.51.0
+
--- /dev/null
+From 1a749bda74d696311944b61e569fa0451d8a956f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 467ddc701adce..bb88767a37979 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From c5160d5c782d7979a7388ca0541fc67e0f1d1f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 11:30:22 +0200
+Subject: PCI: tegra194: Fix duplicate PLL disable in
+ pex_ep_event_pex_rst_assert()
+
+From: Nagarjuna Kristam <nkristam@nvidia.com>
+
+[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
+
+During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
+called twice.
+
+pex_ep_event_pex_rst_assert() should do the opposite of
+pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
+tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
+tegra_pcie_bpmp_set_pll_state() call should instead be a call to
+tegra_pcie_bpmp_set_ctrl_state().
+
+With this, the uninitialization sequence also matches that of
+tegra_pcie_unconfig_controller().
+
+Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
+Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
+[cassel: improve commit log]
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 4f26086f25daf..0c0734aa14b68 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
+ ret);
+ }
+
+- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
+ if (ret)
+- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
+
+ pcie->ep_state = EP_STATE_DISABLED;
+ dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
+--
+2.51.0
+
--- /dev/null
+From 5b1423b1bc20ea91b0cee4564332d2759bcf2505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 3efed8839a4ec..ef9b3955ac662 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -97,7 +97,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From 918ec43e00dcdc9a84ad1533d900bea0bc65b22c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:30:27 +0800
+Subject: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
+
+From: Dapeng Mi <dapeng1.mi@linux.intel.com>
+
+[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ]
+
+When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
+ access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.
+
+[ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
+[ 55.611280] Call Trace:
+[ 55.611282] <TASK>
+[ 55.611284] ? intel_pmu_config_acr+0x87/0x160
+[ 55.611289] intel_pmu_enable_acr+0x6d/0x80
+[ 55.611291] intel_pmu_enable_event+0xce/0x460
+[ 55.611293] x86_pmu_start+0x78/0xb0
+[ 55.611297] x86_pmu_enable+0x218/0x3a0
+[ 55.611300] ? x86_pmu_enable+0x121/0x3a0
+[ 55.611302] perf_pmu_enable+0x40/0x50
+[ 55.611307] ctx_resched+0x19d/0x220
+[ 55.611309] __perf_install_in_context+0x284/0x2f0
+[ 55.611311] ? __pfx_remote_function+0x10/0x10
+[ 55.611314] remote_function+0x52/0x70
+[ 55.611317] ? __pfx_remote_function+0x10/0x10
+[ 55.611319] generic_exec_single+0x84/0x150
+[ 55.611323] smp_call_function_single+0xc5/0x1a0
+[ 55.611326] ? __pfx_remote_function+0x10/0x10
+[ 55.611329] perf_install_in_context+0xd1/0x1e0
+[ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10
+[ 55.611333] __do_sys_perf_event_open+0xa76/0x1040
+[ 55.611336] __x64_sys_perf_event_open+0x26/0x30
+[ 55.611337] x64_sys_call+0x1d8e/0x20c0
+[ 55.611339] do_syscall_64+0x4f/0x120
+[ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
+thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
+which requires to enable auto counter reload on GP counter 0.
+
+The root cause of causing this issue is the check for auto counter
+reload (ACR) counter mask from user space is incorrect in
+intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
+mask from user space could be set into hw.config1 and then written into
+CFG_B MSRs and trigger the MSR access warning.
+
+e.g., User may create a perf event with ACR counter mask (config2=0xcb),
+and there is only 1 event created, so "cpuc->n_events" is 1.
+
+The correct check condition should be "i + idx >= cpuc->n_events"
+instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
+the counter mask would traverse twice and an invalid "cpuc->assign[1]"
+bit (bit 0) is set into hw.config1 and cause MSR accessing error.
+
+Besides, also check if the ACR counter mask corresponding events are
+ACR events. If not, filter out these counter mask. If a event is not a
+ACR event, it could be scheduled to an HW counter which doesn't support
+ACR. It's invalid to add their counter index in ACR counter mask.
+
+Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
+user could set any invalid ACR counter mask and the warning message
+could mislead users.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index c2fb729c270ec..15da60cf69f20 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc)
+ if (event->group_leader != leader->group_leader)
+ break;
+ for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) {
+- if (WARN_ON_ONCE(i + idx > cpuc->n_events))
++ if (i + idx >= cpuc->n_events ||
++ !is_acr_event_group(cpuc->event_list[i + idx]))
+ return;
+ __set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1);
+ }
+--
+2.51.0
+
--- /dev/null
+From d2187771c7ef3eaa6df4427f371d8cad4dec57a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:30:26 +0800
+Subject: perf/x86/intel: Use early_initcall() to hook bts_init()
+
+From: Dapeng Mi <dapeng1.mi@linux.intel.com>
+
+[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ]
+
+After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS
+ initialization from PEBS initialization")' is introduced, x86_pmu.bts
+would initialized in bts_init() which is hooked by arch_initcall().
+
+Whereas init_hw_perf_events() is hooked by early_initcall(). Once the
+core PMU is initialized, nmi watchdog initialization is called
+immediately before bts_init() is called. It leads to the BTS buffer is
+not really initialized since bts_init() is not called and x86_pmu.bts is
+still false at that time. Worse, BTS buffer would never be initialized
+then unless all core PMU events are freed and reserve_ds_buffers()
+is called again.
+
+Thus aligning with init_hw_perf_events(), use early_initcall() to hook
+bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog
+initialization.
+
+Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")
+Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/bts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
+index 61da6b8a3d519..cbac54cb3a9ec 100644
+--- a/arch/x86/events/intel/bts.c
++++ b/arch/x86/events/intel/bts.c
+@@ -643,4 +643,4 @@ static __init int bts_init(void)
+
+ return perf_pmu_register(&bts_pmu, "intel_bts", -1);
+ }
+-arch_initcall(bts_init);
++early_initcall(bts_init);
+--
+2.51.0
+
--- /dev/null
+From ff3fbe786ddd9325e829e0cf29bfef9adeb5200e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 07:23:22 +0000
+Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
+
+The boot firmware may disable the U3 port early during boot and leave it
+up to the controller or PHY driver to re-enable U3 when needed.
+
+The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
+something the Rockchip Naneng Combo PHY driver never does for RK3568.
+This may result in USB 3.0 ports being limited to only using USB 2.0 or
+in special cases not working at all on RK3568.
+
+Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
+when a PHY with PHY_TYPE_USB3 mode is used.
+
+Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+index ce91fb1d51671..17c6310f4b54b 100644
+--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg {
+ struct combphy_reg pipe_xpcs_phy_ready;
+ struct combphy_reg pipe_pcie1l0_sel;
+ struct combphy_reg pipe_pcie1l1_sel;
++ struct combphy_reg u3otg0_port_en;
++ struct combphy_reg u3otg1_port_en;
+ };
+
+ struct rockchip_combphy_cfg {
+@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
++ switch (priv->id) {
++ case 0:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
++ break;
++ case 1:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
++ break;
++ }
+ break;
+
+ case PHY_TYPE_SATA:
+@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
+ /* pipe-grf */
+ .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 },
+ .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 },
++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 },
++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 },
+ };
+
+ static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
+--
+2.51.0
+
--- /dev/null
+From acab3b4a0c47761b8bc246a2c38268e0d856cbc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 21:26:05 +0200
+Subject: pid: use ns_capable_noaudit() when determining net sysctl permissions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Göttsche <cgzones@googlemail.com>
+
+[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ]
+
+The capability check should not be audited since it is only being used
+to determine the inode permissions. A failed check does not indicate a
+violation of security policy but, when an LSM is enabled, a denial audit
+message was being generated.
+
+The denial audit message can either lead to the capability being
+unnecessarily allowed in a security policy, or being silenced potentially
+masking a legitimate capability check at a later point in time.
+
+Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when
+determining net sysctl permissions")
+
+Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace")
+CC: Christian Brauner <brauner@kernel.org>
+CC: linux-security-module@vger.kernel.org
+CC: selinux@vger.kernel.org
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Acked-by: Serge Hallyn <serge@hallyn.com>
+Reviewed-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/pid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 8317bcbc7cf7d..24f839d9c3031 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head,
+ container_of(head->set, struct pid_namespace, set);
+ int mode = table->mode;
+
+- if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) ||
++ if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) ||
+ uid_eq(current_euid(), make_kuid(pidns->user_ns, 0)))
+ mode = (mode & S_IRWXU) >> 6;
+ else if (in_egroup_p(make_kgid(pidns->user_ns, 0)))
+--
+2.51.0
+
--- /dev/null
+From 4f469996b4e4a41f36206e533ba187d5a3e073a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 9171de657f978..a75762e4d2641 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From 3924b273c44e295f6d9ac0523a78a3e163b891cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 17:08:13 +0100
+Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in
+ rzg3s_oen_read()
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]
+
+rzg3s_oen_read() returns a u32 value, but previously propagated a negative
+error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
+positive value due to unsigned conversion. This caused incorrect
+output-enable reporting for certain pins.
+
+Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
+as "output enabled" in the pinconf-pins debugfs file. With this fix, only
+P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
+hardware manual.
+
+Fix this by returning 0 when the OEN bit lookup fails, treating the pin
+as output-disabled by default.
+
+Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 78fa08ff0faa8..47b983ca44712 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1119,7 +1119,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
+
+ bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
+ if (bit < 0)
+- return bit;
++ return 0;
+
+ return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
+ }
+--
+2.51.0
+
--- /dev/null
+From ede27b0f3c361673324af90fe0a8bcd283d802bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index 29d16c9c1bd19..3a742f74ecd1d 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From 27b0ea1bc5b2c6a322d21a7b2e993096c21846bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:58:23 +0300
+Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
+ probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
+
+The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
+would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
+that the pointer is valid.
+
+Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
+index 22fe9e631f8aa..5730076846e1b 100644
+--- a/drivers/devfreq/mtk-cci-devfreq.c
++++ b/drivers/devfreq/mtk-cci-devfreq.c
+@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
+ out_free_resources:
+ if (regulator_is_enabled(drv->proc_reg))
+ regulator_disable(drv->proc_reg);
+- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
++ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
++ regulator_is_enabled(drv->sram_reg))
+ regulator_disable(drv->sram_reg);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From c1d8afde7a597e39b8dbe87bbc69ded64995226a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 15:38:08 +0200
+Subject: PM / devfreq: rockchip-dfi: double count on RK3588
+
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+
+[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]
+
+On RK3588 with LPDDR4X memory, the cycle count as returned by
+
+ perf stat -a -e rockchip_ddr/cycles/ sleep 1
+
+consistently reads half as much as what the actual DDR frequency is at.
+For a LPDDR4X module running at 2112MHz, I get more like 1056059916
+cycles per second, which is almost bang-on half what it should be. No,
+I'm not mixing up megatransfers and megahertz.
+
+Consulting the downstream driver, this appears to be because the RK3588
+hardware specifically (and RK3528 as well, for future reference) needs a
+multiplier of 2 to get to the correct frequency with everything but
+LPDDR5.
+
+The RK3588's actual memory bandwidth measurements in MB/s are correct
+however, as confirmed with stress-ng --stream. This makes me think the
+access counters are not affected in the same way. This tracks with the
+vendor kernel not multiplying the access counts either.
+
+Solve this by adding a new member to the dfi struct, which each SoC can
+set to whatever they want, but defaults to 1 if left unset by the SoC
+init functions. The event_get_count op can then use this multiplier if
+the cycle count is requested.
+
+The cycle multiplier is not used in rockchip_dfi_get_event because the
+vendor driver doesn't use it there either, and we don't do other actual
+bandwidth unit conversion stuff in there anyway.
+
+Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
+index 0470d7c175f4f..54effb6351965 100644
+--- a/drivers/devfreq/event/rockchip-dfi.c
++++ b/drivers/devfreq/event/rockchip-dfi.c
+@@ -116,6 +116,7 @@ struct rockchip_dfi {
+ int buswidth[DMC_MAX_CHANNELS];
+ int ddrmon_stride;
+ bool ddrmon_ctrl_single;
++ unsigned int count_multiplier; /* number of data clocks per count */
+ };
+
+ static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
+@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
+
+ switch (event->attr.config) {
+ case PERF_EVENT_CYCLES:
+- count = total.c[0].clock_cycles;
++ count = total.c[0].clock_cycles * dfi->count_multiplier;
+ break;
+ case PERF_EVENT_READ_BYTES:
+ for (i = 0; i < dfi->max_channels; i++)
+@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
+ break;
+ }
+
++ if (!dfi->count_multiplier)
++ dfi->count_multiplier = 1;
++
+ ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
+ if (ret)
+ return ret;
+@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
+ dfi->max_channels = 4;
+
+ dfi->ddrmon_stride = 0x4000;
++ dfi->count_multiplier = 2;
+
+ return 0;
+ };
+--
+2.51.0
+
--- /dev/null
+From c62f16114008861fa125c57e35990d42714b2d8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 7a50af416cac8..9f25ae5b2dc62 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -690,8 +690,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From 54dc97eef66a0c1bdcd11b662bff68513319d641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 20:32:59 +0800
+Subject: power: supply: cw2015: Fix a alignment coding style issue
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
+
+Fix the checkpatch warning:
+CHECK: Alignment should match open parenthesis
+
+Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index f63c3c4104515..382dff8805c62 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
+ if (!cw_bat->battery_workqueue)
+ return -ENOMEM;
+
+- devm_delayed_work_autocancel(&client->dev,
+- &cw_bat->battery_delay_work, cw_bat_work);
++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ queue_delayed_work(cw_bat->battery_workqueue,
+ &cw_bat->battery_delay_work, msecs_to_jiffies(10));
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 47ef6e2bc554cfcb026d468b600dcdeeb5f80bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 08:30:18 +0200
+Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]
+
+Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
+PGDIRs and preallocate execmem page tables") was supposed to extend
+to powerpc 603 the copy of kernel PGD entries into all PGDIRs
+implemented in a previous patch on the 8xx. But 603 is book3s/32 and
+uses a duplicate of pgd_alloc() defined in another header.
+
+So really do the copy at the correct place for the 603.
+
+Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
+ arch/powerpc/include/asm/nohash/pgalloc.h | 2 +-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+index dd4eb30631758..f4390704d5ba2 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+@@ -7,8 +7,14 @@
+
+ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+- pgtable_gfp_flags(mm, GFP_KERNEL));
++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
++ pgtable_gfp_flags(mm, GFP_KERNEL));
++
++#ifdef CONFIG_PPC_BOOK3S_603
++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
++#endif
++ return pgd;
+ }
+
+ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
+index bb5f3e8ea912d..4ef780b291bc3 100644
+--- a/arch/powerpc/include/asm/nohash/pgalloc.h
++++ b/arch/powerpc/include/asm/nohash/pgalloc.h
+@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
+
+-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
++#ifdef CONFIG_PPC_8xx
+ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
+ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 52dc3e52139882c0f2430f5b3e6569ecf24bbe43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 18:33:26 +0200
+Subject: powerpc/8xx: Remove left-over instruction and comments in
+ DataStoreTLBMiss handler
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]
+
+Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
+DTLB misses") removed the test that needed the valeur in SPRN_EPN but
+failed to remove the read.
+
+Remove it.
+
+And remove related comments, including the very same comment
+in InstructionTLBMiss that should have been removed by
+commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
+ITLB misses").
+
+Also update the comment about absence of a second level table which
+has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
+remove tests on PGDIR entry validity").
+
+Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 56c5ebe21b99a..613606400ee99 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -162,7 +162,7 @@ instruction_counter:
+ * For the MPC8xx, this is a software tablewalk to load the instruction
+ * TLB. The task switch loads the M_TWB register with the pointer to the first
+ * level table.
+- * If we discover there is no second level table (value is zero) or if there
++ * If there is no second level table (value is zero) or if there
+ * is an invalid pte, we load that into the TLB, which causes another fault
+ * into the TLB Error interrupt where we can handle such problems.
+ * We have to use the MD_xxx registers for the tablewalk because the
+@@ -183,9 +183,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+ mfspr r10, SPRN_SRR0 /* Get effective address of fault */
+ INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
+ mtspr SPRN_MD_EPN, r10
+@@ -228,10 +225,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+- mfspr r10, SPRN_MD_EPN
+ mfspr r10, SPRN_M_TWB /* Get level 1 table */
+ lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */
+
+--
+2.51.0
+
--- /dev/null
+From 82090854441c653641c40c031790f7da6c7fb598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:27:38 -0400
+Subject: powerpc/ftrace: ensure ftrace record ops are always set for NOPs
+
+From: Joe Lawrence <joe.lawrence@redhat.com>
+
+[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ]
+
+When an ftrace call site is converted to a NOP, its corresponding
+dyn_ftrace record should have its ftrace_ops pointer set to
+ftrace_nop_ops.
+
+Correct the powerpc implementation to ensure the
+ftrace_rec_set_nop_ops() helper is called on all successful NOP
+initialization paths. This ensures all ftrace records are consistent
+before being handled by the ftrace core.
+
+Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
+Suggested-by: Naveen N Rao <naveen@kernel.org>
+Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
+Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
+index 6dca92d5a6e82..841d077e28251 100644
+--- a/arch/powerpc/kernel/trace/ftrace.c
++++ b/arch/powerpc/kernel/trace/ftrace.c
+@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
+ return ret;
+
+ /* Set up out-of-line stub */
+- if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE))
+- return ftrace_init_ool_stub(mod, rec);
++ if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) {
++ ret = ftrace_init_ool_stub(mod, rec);
++ goto out;
++ }
+
+ /* Nop-out the ftrace location */
+ new = ppc_inst(PPC_RAW_NOP());
+@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
+ return -EINVAL;
+ }
+
++out:
++ if (!ret)
++ ret = ftrace_rec_set_nop_ops(rec);
++
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 84ac9169b524c175717af72705912ec4f0a6b770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:27:39 -0400
+Subject: powerpc64/modules: correctly iterate over stubs in
+ setup_ftrace_ool_stubs
+
+From: Joe Lawrence <joe.lawrence@redhat.com>
+
+[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ]
+
+CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to
+extend the ppc64le module .stubs section with an array of
+ftrace_ool_stub structures for each patchable function.
+
+Fix its ppc64_stub_entry stub reservation loop to properly write across
+all of the num_stubs used and not just the first entry.
+
+Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
+Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
+Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/module_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 126bf3b06ab7e..0e45cac4de76b 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr,
+
+ /* reserve stubs */
+ for (i = 0; i < num_stubs; i++)
+- if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP()))
++ if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP()))
+ return -1;
+ #endif
+
+--
+2.51.0
+
--- /dev/null
+From ba7b282d8c3d9318721e68a6e4bf3cff0c5a0880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index 9463232af8d2e..c6b8b64782761 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From 2161b8f891ec7bd2a4b32f051c92a8ea2afaa244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:29:08 +0530
+Subject: ptp: Add a upper bound on max_vclocks
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]
+
+syzbot reported WARNING in max_vclocks_store.
+
+This occurs when the argument max is too large for kcalloc to handle.
+
+Extend the guard to guard against values that are too large for
+kcalloc
+
+Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
+Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_private.h | 1 +
+ drivers/ptp/ptp_sysfs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
+index b352df4cd3f97..f329263f33aa1 100644
+--- a/drivers/ptp/ptp_private.h
++++ b/drivers/ptp/ptp_private.h
+@@ -22,6 +22,7 @@
+ #define PTP_MAX_TIMESTAMPS 128
+ #define PTP_BUF_TIMESTAMPS 30
+ #define PTP_DEFAULT_MAX_VCLOCKS 20
++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
+ #define PTP_MAX_CHANNELS 2048
+
+ enum {
+diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
+index 6b1b8f57cd951..200eaf5006968 100644
+--- a/drivers/ptp/ptp_sysfs.c
++++ b/drivers/ptp/ptp_sysfs.c
+@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
+ size_t size;
+ u32 max;
+
+- if (kstrtou32(buf, 0, &max) || max == 0)
++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
+ return -EINVAL;
+
+ if (max == ptp->max_vclocks)
+--
+2.51.0
+
--- /dev/null
+From 069b1b06b52afc035e610ca52140d649c7448455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:00:59 +0200
+Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]
+
+The pwm driver calls pm_runtime_get_sync() when the hardware becomes
+enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
+state is kept when a consumer goes away, so the call to
+pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
+a non-functional device and a reference underlow for the second consumer.
+
+The easiest fix for that issue is to just not drop the runtime PM
+reference in .free(), so do that.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 0125e73b98dfb..5e674a7bbf3be 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- if (pwm_is_enabled(pwm)) {
+- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
+- pm_runtime_put_sync(pwmchip_parent(chip));
+- }
+-
+ /* set period value to zero on free */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From af981354d8c58afad1a5202a3cf34de1c1ab3d87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a23e48b8523db..7a86cb090f76f 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(pwmchip_parent(chip), "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From fc22efba86f3800689b9f09eace61d3285286a49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:01 +0200
+Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
+ calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]
+
+In Up-Count Mode the timer is reset to zero one tick after it reaches
+TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
+the documentation and measurements. So the value written to the TBPRD has
+to be one less than the calculated period_cycles value.
+
+A complication here is that for a 100% relative duty-cycle the value
+written to the CMPx register has to be TBPRD + 1 which might overflow if
+TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
+has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
+be skipped.
+
+Additionally the AQCTL_PRD register field has to be 0 because that defines
+the hardware's action when the maximal counter value is reached, which is
+(as above) one clock tick before the period's end. The period start edge
+has to happen when the counter is reset and so is defined in the AQCTL_ZRO
+field.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
+ 1 file changed, 58 insertions(+), 85 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a94b1e387b924..a23e48b8523db 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -36,7 +36,7 @@
+
+ #define CLKDIV_MAX 7
+ #define HSPCLKDIV_MAX 7
+-#define PERIOD_MAX 0xFFFF
++#define PERIOD_MAX 0x10000
+
+ /* compare module registers */
+ #define CMPA 0x12
+@@ -65,14 +65,10 @@
+ #define AQCTL_ZRO_FRCHIGH BIT(1)
+ #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0))
+
+-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
+-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
+
+ #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6))
+ #define AQSFRC_RLDCSF_ZRO 0
+@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
+ unsigned long clk_rate;
+ void __iomem *mmio_base;
+ unsigned long period_cycles[NUM_PWM_CHANNEL];
+- enum pwm_polarity polarity[NUM_PWM_CHANNEL];
+ struct clk *tbclk;
+ struct ehrpwm_context ctx;
+ };
+@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+ return 1;
+ }
+
+-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
+-{
+- u16 aqctl_val, aqctl_mask;
+- unsigned int aqctl_reg;
+-
+- /*
+- * Configure PWM output to HIGH/LOW level on counter
+- * reaches compare register value and LOW/HIGH level
+- * on counter value reaches period register value and
+- * zero value on counter
+- */
+- if (chan == 1) {
+- aqctl_reg = AQCTLB;
+- aqctl_mask = AQCTL_CBU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANB_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANB_POLNORMAL;
+- } else {
+- aqctl_reg = AQCTLA;
+- aqctl_mask = AQCTL_CAU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANA_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANA_POLNORMAL;
+- }
+-
+- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
+- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
+-}
+-
+ /*
+ * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
+ * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
+ */
+ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+- u64 duty_ns, u64 period_ns)
++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+ u32 period_cycles, duty_cycles;
+ u16 ps_divval, tb_divval;
+ unsigned int i, cmp_reg;
+ unsigned long long c;
++ u16 aqctl_val, aqctl_mask;
++ unsigned int aqctl_reg;
+
+ if (period_ns > NSEC_PER_SEC)
+ return -ERANGE;
+@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ do_div(c, NSEC_PER_SEC);
+ period_cycles = (unsigned long)c;
+
+- if (period_cycles < 1) {
+- period_cycles = 1;
+- duty_cycles = 1;
+- } else {
+- c = pc->clk_rate;
+- c = c * duty_ns;
+- do_div(c, NSEC_PER_SEC);
+- duty_cycles = (unsigned long)c;
+- }
++ c = pc->clk_rate;
++ c = c * duty_ns;
++ do_div(c, NSEC_PER_SEC);
++ duty_cycles = (unsigned long)c;
+
+ /*
+ * Period values should be same for multiple PWM channels as IP uses
+@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ return -EINVAL;
+ }
+
+- pm_runtime_get_sync(pwmchip_parent(chip));
+-
+- /* Update clock prescaler values */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+-
+ /* Update period & duty cycle with presacler division */
+ period_cycles = period_cycles / ps_divval;
+ duty_cycles = duty_cycles / ps_divval;
+
+- /* Configure shadow loading on Period register */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++ if (period_cycles < 1)
++ period_cycles = 1;
+
+- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
++ pm_runtime_get_sync(pwmchip_parent(chip));
+
+- /* Configure ehrpwm counter for up-count mode */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
+- TBCTL_CTRMODE_UP);
++ /* Update clock prescaler values */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+
+- if (pwm->hwpwm == 1)
++ if (pwm->hwpwm == 1) {
+ /* Channel 1 configured with compare B register */
+ cmp_reg = CMPB;
+- else
++
++ aqctl_reg = AQCTLB;
++ aqctl_mask = AQCTL_CBU_MASK;
++
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANB_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANB_POLNORMAL;
++
++ /* if duty_cycle is big, don't toggle on CBU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CBU_MASK;
++
++ } else {
+ /* Channel 0 configured with compare A register */
+ cmp_reg = CMPA;
+
+- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
++ aqctl_reg = AQCTLA;
++ aqctl_mask = AQCTL_CAU_MASK;
+
+- pm_runtime_put_sync(pwmchip_parent(chip));
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANA_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANA_POLNORMAL;
+
+- return 0;
+-}
++ /* if duty_cycle is big, don't toggle on CAU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CAU_MASK;
++ }
+
+-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
+- struct pwm_device *pwm,
+- enum pwm_polarity polarity)
+-{
+- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
++
++ /* Configure shadow loading on Period register */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++
++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
++
++ /* Configure ehrpwm counter for up-count mode */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
++ TBCTL_CTRMODE_UP);
++
++ if (!(duty_cycles > period_cycles))
++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
+
+- /* Configuration of polarity in hardware delayed, do at enable */
+- pc->polarity[pwm->hwpwm] = polarity;
++ pm_runtime_put_sync(pwmchip_parent(chip));
+
+ return 0;
+ }
+@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+
+- /* Channels polarity can be configured from action qualifier module */
+- configure_polarity(pc, pwm->hwpwm);
+-
+ /* Enable TBCLK */
+ ret = clk_enable(pc->tbclk);
+ if (ret) {
+@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ ehrpwm_pwm_disable(chip, pwm);
+ enabled = false;
+ }
+-
+- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
+- if (err)
+- return err;
+ }
+
+ if (!state->enabled) {
+@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ return 0;
+ }
+
+- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
+ if (err)
+ return err;
+
+--
+2.51.0
+
--- /dev/null
+From 81392e5367d2a4298e998730c7d3dd75b9d7be38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:00 +0200
+Subject: pwm: tiehrpwm: Make code comment in .free() more useful
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]
+
+Instead of explaining trivia to everyone who can read C describe the
+higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.
+
+Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 5e674a7bbf3be..a94b1e387b924 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- /* set period value to zero on free */
++ /* Don't let a pwm without consumer block requests to the other channel */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 615ab6b2ae8a2b8340a93f5df6abbb7344be83e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 15:27:07 +0800
+Subject: raid6: riscv: Clean up unused header file inclusion
+
+From: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+
+[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ]
+
+These two C files don't reference things defined in simd.h or types.h
+so remove these redundant #inclusions.
+
+Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations")
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
+Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/recov_rvv.c | 2 --
+ lib/raid6/rvv.c | 3 ---
+ 2 files changed, 5 deletions(-)
+
+diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c
+index f29303795ccfe..500da521a8063 100644
+--- a/lib/raid6/recov_rvv.c
++++ b/lib/raid6/recov_rvv.c
+@@ -4,9 +4,7 @@
+ * Author: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+ */
+
+-#include <asm/simd.h>
+ #include <asm/vector.h>
+-#include <crypto/internal/simd.h>
+ #include <linux/raid/pq.h>
+
+ static int rvv_has_vector(void)
+diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c
+index 7d82efa5b14f9..b193ea176d5d3 100644
+--- a/lib/raid6/rvv.c
++++ b/lib/raid6/rvv.c
+@@ -9,11 +9,8 @@
+ * Copyright 2002-2004 H. Peter Anvin
+ */
+
+-#include <asm/simd.h>
+ #include <asm/vector.h>
+-#include <crypto/internal/simd.h>
+ #include <linux/raid/pq.h>
+-#include <linux/types.h>
+ #include "rvv.h"
+
+ #define NSIZE (riscv_v_vsize / 32) /* NSIZE = vlenb */
+--
+2.51.0
+
--- /dev/null
+From 22414da3ca108d561fe54f14d611b5f8907872bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 8670e58675c6d..75b2911462628 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1034,8 +1034,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From 58d684f9dc1caeb7bfc9d9877d5af2fa2d1c46f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index be0743dac3fff..929e89841c12a 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5afe228318475b91eddbd6ba8ae8b86018c48a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:39:56 +0300
+Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Or Har-Toov <ohartoov@nvidia.com>
+
+[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]
+
+The mlx5 driver currently derives max_qp_wr directly from the
+log_max_qp_sz HCA capability:
+
+ props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+
+However, this value represents the number of WQEs in units of Basic
+Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size
+of a WQE can vary depending on transport type and features (e.g., atomic
+operations, UMR, LSO), the actual number of WQEs can be significantly
+smaller than the WQEBB count suggests.
+
+This patch introduces a conservative estimation of the worst-case WQE size
+— considering largest segments possible with 1 SGE and no inline data or
+special features. It uses this to derive a more accurate max_qp_wr value.
+
+Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
+Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org
+Reported-by: Chuck Lever <cel@kernel.org>
+Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/
+Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index df6557ddbdfc5..fdc4306878615 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -13,6 +13,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ #include <linux/bitmap.h>
++#include <linux/log2.h>
+ #include <linux/sched.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/task.h>
+@@ -882,6 +883,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
+ resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
+ }
+
++/*
++ * Calculate maximum SQ overhead across all QP types.
++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
++ * have smaller overhead than the types calculated below,
++ * so they are implicitly included.
++ */
++static u32 mlx5_ib_calc_max_sq_overhead(void)
++{
++ u32 max_overhead_xrc, overhead_ud_lso, a, b;
++
++ /* XRC_INI */
++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
++ a = sizeof(struct mlx5_wqe_atomic_seg) +
++ sizeof(struct mlx5_wqe_raddr_seg);
++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
++ sizeof(struct mlx5_mkey_seg) +
++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
++ max_overhead_xrc += max(a, b);
++
++ /* UD with LSO */
++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
++
++ return max(max_overhead_xrc, overhead_ud_lso);
++}
++
++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
++{
++ struct mlx5_core_dev *mdev = dev->mdev;
++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ u32 max_wqe_size;
++ /* max QP overhead + 1 SGE, no inline, no special features */
++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
++ sizeof(struct mlx5_wqe_data_seg);
++
++ max_wqe_size = roundup_pow_of_two(max_wqe_size);
++
++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
++
++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
++}
++
+ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ struct ib_device_attr *props,
+ struct ib_udata *uhw)
+@@ -1040,7 +1086,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ props->max_mr_size = ~0ull;
+ props->page_size_cap = ~(min_page_size - 1);
+ props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
+- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
+ max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
+ sizeof(struct mlx5_wqe_data_seg);
+ max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
+--
+2.51.0
+
--- /dev/null
+From e4b6da443b44a29101ce59bd090e061cd8bca96e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:41:19 +0300
+Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
+
+Previously loopback for MPV was supposed to be permanently enabled,
+however other driver flows were able to over-ride that configuration and
+disable it.
+
+Add force_lb parameter that indicates that loopback should always be
+enabled which prevents all other driver flows from disabling it.
+
+Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
+Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++----
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index fdc4306878615..268ebf6609708 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1838,7 +1838,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
+ }
+
+ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ int err;
+
+@@ -1850,6 +1851,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ if (err)
+ goto out;
+
++ lb_state->force_enable = true;
+ return 0;
+
+ out:
+@@ -1858,16 +1860,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ }
+
+ static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ mlx5_nic_vport_update_local_lb(slave, false);
+ mlx5_nic_vport_update_local_lb(master, false);
++
++ lb_state->force_enable = false;
+ }
+
+ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
+ int err = 0;
+
++ if (dev->lb.force_enable)
++ return 0;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td++;
+@@ -1889,6 +1897,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+
+ void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
++ if (dev->lb.force_enable)
++ return;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td--;
+@@ -3568,7 +3579,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
+
+ lockdep_assert_held(&mlx5_ib_multiport_mutex);
+
+- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+
+ mlx5_core_mp_event_replay(ibdev->mdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
+@@ -3665,7 +3676,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_DONE,
+ &key);
+
+- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+ if (err)
+ goto unbind;
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index fde859d207aea..030b7c2b109b1 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1113,6 +1113,7 @@ struct mlx5_ib_lb_state {
+ u32 user_td;
+ int qps;
+ bool enabled;
++ bool force_enable;
+ };
+
+ struct mlx5_ib_pf_eq {
+--
+2.51.0
+
--- /dev/null
+From 937d7c49a673c238bcd9c95cdca3d8e78036ec26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 02:52:12 +0000
+Subject: RDMA/rxe: Fix race in do_task() when draining
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
+
+When do_task() exhausts its iteration budget (!ret), it sets the state
+to TASK_STATE_IDLE to reschedule, without a secondary check on the
+current task->state. This can overwrite the TASK_STATE_DRAINING state
+set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
+
+While state changes are protected by a spinlock, both rxe_cleanup_task()
+and rxe_disable_task() release the lock while waiting for the task to
+finish draining in the while(!is_done(task)) loop. The race occurs if
+do_task() hits its iteration limit and acquires the lock in this window.
+The cleanup logic may then proceed while the task incorrectly
+reschedules itself, leading to a potential use-after-free.
+
+This bug was introduced during the migration from tasklets to workqueues,
+where the special handling for the draining case was lost.
+
+Fix this by restoring the original pre-migration behavior. If the state is
+TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
+force a new loop iteration. This allows the task to finish its work, so
+that a subsequent iteration can reach the switch statement and correctly
+transition the state to TASK_STATE_DRAINED, stopping the task as intended.
+
+Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 6f8f353e95838..f522820b950c7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
+ * yield the cpu and reschedule the task
+ */
+ if (!ret) {
+- task->state = TASK_STATE_IDLE;
+- resched = 1;
++ if (task->state != TASK_STATE_DRAINING) {
++ task->state = TASK_STATE_IDLE;
++ resched = 1;
++ } else {
++ cont = 1;
++ }
+ goto exit;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1bac02a368a9b5ea9cb92e3b72485675058a4b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 2b2a7b8e93b01..3acb23d13729d 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From e3fa6a892ccb28155c4ec83f7b6501e4e7965612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 1f3f782a04ba2..6883e1a43fe5d 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+ if (config->reg_update_bits)
+ map->reg_update_bits = config->reg_update_bits;
+--
+2.51.0
+
--- /dev/null
+From 16b3a245820cb1b3b7d826c4bfd26c33d97d5981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index 9df726f10ad12..6d609c42e4793 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 77ad1b9b943dd43cb662c6da1195382d680323f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:35 +0200
+Subject: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ]
+
+The ADSP firmware on X1E has separate firmware binaries for the main
+firmware and the DTB. The same applies for the "lite" firmware loaded by
+the boot firmware.
+
+When preparing to load the new ADSP firmware we shutdown the lite_pas_id
+for the main firmware, but we don't shutdown the corresponding lite pas_id
+for the DTB. The fact that we're leaving it "running" forever becomes
+obvious if you try to reuse (or just access) the memory region used by the
+"lite" firmware: The &adsp_boot_mem is accessible, but accessing the
+&adsp_boot_dtb_mem results in a crash.
+
+We don't support reusing the memory regions currently, but nevertheless we
+should not keep part of the lite firmware running. Fix this by adding the
+lite_dtb_pas_id and shutting it down as well.
+
+We don't have a way to detect if the lite firmware is actually running yet,
+so ignore the return status of qcom_scm_pas_shutdown() for now. This was
+already the case before, the assignment to "ret" is not used anywhere.
+
+Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 02e29171cbbee..f3ec5b06261e8 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -42,6 +42,7 @@ struct qcom_pas_data {
+ int pas_id;
+ int dtb_pas_id;
+ int lite_pas_id;
++ int lite_dtb_pas_id;
+ unsigned int minidump_id;
+ bool auto_boot;
+ bool decrypt_shutdown;
+@@ -80,6 +81,7 @@ struct qcom_pas {
+ int pas_id;
+ int dtb_pas_id;
+ int lite_pas_id;
++ int lite_dtb_pas_id;
+ unsigned int minidump_id;
+ int crash_reason_smem;
+ unsigned int smem_host_id;
+@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw)
+
+ if (pas->lite_pas_id)
+ ret = qcom_scm_pas_shutdown(pas->lite_pas_id);
++ if (pas->lite_dtb_pas_id)
++ qcom_scm_pas_shutdown(pas->lite_dtb_pas_id);
+
+ if (pas->dtb_pas_id) {
+ ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
+@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev)
+ pas->minidump_id = desc->minidump_id;
+ pas->pas_id = desc->pas_id;
+ pas->lite_pas_id = desc->lite_pas_id;
++ pas->lite_dtb_pas_id = desc->lite_dtb_pas_id;
+ pas->info_name = desc->sysmon_name;
+ pas->smem_host_id = desc->smem_host_id;
+ pas->decrypt_shutdown = desc->decrypt_shutdown;
+@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = {
+ .pas_id = 1,
+ .dtb_pas_id = 0x24,
+ .lite_pas_id = 0x1f,
++ .lite_dtb_pas_id = 0x29,
+ .minidump_id = 5,
+ .auto_boot = true,
+ .proxy_pd_names = (char*[]){
+--
+2.51.0
+
--- /dev/null
+From 6b5470d23ef54a8c34f43fc94dde8bc530860cf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 4ee5e67a9f03f..769c6d6d6a731 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From e1f7ff8eea47e78b25fac616e76f7826cb2efcf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 17:47:08 +0300
+Subject: remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ]
+
+On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw
+MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was
+specified as the firmware image.
+
+Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Tested-by: Luca Weiss <luca@lucaweiss.eu> # msm8974pro-fairphone-fp2
+Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com
+[bjorn: Unwrapped the long memcpy line, to taste]
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 0c0199fb0e68d..3087d895b87f4 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region)
+ release_firmware(dp_fw);
+ }
+
++#define MSM8974_B00_OFFSET 0x1000
++
+ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
+ {
+ struct q6v5 *qproc = rproc->priv;
+@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
+ return -EBUSY;
+ }
+
+- memcpy(mba_region, fw->data, fw->size);
++ if ((qproc->version == MSS_MSM8974 ||
++ qproc->version == MSS_MSM8226 ||
++ qproc->version == MSS_MSM8926) &&
++ fw->size > MSM8974_B00_OFFSET &&
++ !memcmp(fw->data, ELFMAG, SELFMAG))
++ memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET);
++ else
++ memcpy(mba_region, fw->data, fw->size);
+ q6v5_debug_policy_load(qproc, mba_region);
+ memunmap(mba_region);
+
+--
+2.51.0
+
--- /dev/null
+From 74383ba9b795a732a2d6ba7477437f8130877006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index 66d276a1be836..f4a19ffbb641c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index f0142d32b648f..16d818943487b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -48,7 +48,6 @@
+ #include "en.h"
+ #include "en/dim.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2986,11 +2985,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -3000,18 +2997,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 0d94bfa3dca317a6120b62abf8f017a7877489ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 4f8f5aab109d0..6309200e93dc3 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command) {
+--
+2.51.0
+
--- /dev/null
+From 4b788aa7069a33835b239020db74d6472c372fee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 01:24:48 +0000
+Subject: riscv, bpf: Sign extend struct ops return values properly
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]
+
+The ns_bpf_qdisc selftest triggers a kernel panic:
+
+ Unable to handle kernel paging request at virtual address ffffffffa38dbf58
+ Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
+ [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
+ Oops [#1]
+ Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
+ CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE
+ Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+ Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
+ epc : __qdisc_run+0x82/0x6f0
+ ra : __qdisc_run+0x6e/0x6f0
+ epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
+ gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
+ t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
+ s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
+ a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
+ a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
+ s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
+ s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
+ s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
+ s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
+ t5 : 0000000000000000 t6 : ff60000093a6a8b6
+ status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
+ [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
+ [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
+ [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
+ [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
+ [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
+ [<ffffffff80d31446>] ip6_output+0x5e/0x178
+ [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
+ [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
+ [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
+ [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
+ [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
+ [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
+ [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
+ [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
+ [<ffffffff80b42bee>] __sys_connect+0x96/0xc8
+ [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
+ [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
+ [<ffffffff80e69af2>] handle_exception+0x14a/0x156
+ Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
+ ---[ end trace 0000000000000000 ]---
+
+The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
+is treated as a 32bit value and sign extend to 64bit in epilogue. This
+behavior is right for most bpf prog types but wrong for struct ops which
+requires RISC-V ABI.
+
+So let's sign extend struct ops return values according to the function
+model and RISC-V ABI([0]).
+
+ [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
+
+Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Pu Lehui <pulehui@huawei.com>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 9883a55d61b5b..f1efa4d6b27f3 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn,
+ return 0;
+ }
+
++/*
++ * Sign-extend the register if necessary
++ */
++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
++{
++ if (!sign && (sz == 1 || sz == 2)) {
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ return 0;
++ }
++
++ switch (sz) {
++ case 1:
++ emit_sextb(rd, rs, ctx);
++ break;
++ case 2:
++ emit_sexth(rd, rs, ctx);
++ break;
++ case 4:
++ emit_sextw(rd, rs, ctx);
++ break;
++ case 8:
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ break;
++ default:
++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0)
+ #define BPF_FIXUP_REG_MASK GENMASK(31, 27)
+ #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */
+@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
+
+ if (save_ret) {
+- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
+ emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
++ if (is_struct_ops) {
++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
++ if (ret)
++ goto out;
++ } else {
++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
++ }
+ }
+
+ emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
+--
+2.51.0
+
--- /dev/null
+From 35ce44a31d6a8c8f3cdd34ee5e815f9893f23bd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 22:02:58 +0200
+Subject: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ]
+
+mbox_request_channel() returning value was changed in case of error.
+It uses returning value of of_parse_phandle_with_args().
+It is returning with -ENOENT instead of -ENODEV when no mboxes property
+exists.
+
+Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Tested-by: Stephan Gerhold <stephan.gerhold@linaro.org> # msm8939
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_smd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index 87c944d4b4f31..1cbe457b4e96f 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev,
+ edge->mbox_client.knows_txdone = true;
+ edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
+ if (IS_ERR(edge->mbox_chan)) {
+- if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
++ if (PTR_ERR(edge->mbox_chan) != -ENOENT) {
+ ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan),
+ "failed to acquire IPC mailbox\n");
+ goto put_node;
+--
+2.51.0
+
--- /dev/null
+From 5abb1511a4a79f8fa2b32e6cda8eb0926eabf264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:42:11 +0200
+Subject: rust: cpumask: Mark CpumaskVar as transparent
+
+From: Baptiste Lepers <baptiste.lepers@gmail.com>
+
+[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ]
+
+Unsafe code in CpumaskVar's methods assumes that the type has the same
+layout as `bindings::cpumask_var_t`. This is not guaranteed by
+the default struct representation in Rust, but requires specifying the
+`transparent` representation.
+
+Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions")
+Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/cpumask.rs | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs
+index 19c607709b5fd..8bc8325b200dc 100644
+--- a/rust/kernel/cpumask.rs
++++ b/rust/kernel/cpumask.rs
+@@ -215,6 +215,7 @@ impl Cpumask {
+ /// }
+ /// assert_eq!(mask2.weight(), count);
+ /// ```
++#[repr(transparent)]
+ pub struct CpumaskVar {
+ #[cfg(CONFIG_CPUMASK_OFFSTACK)]
+ ptr: NonNull<Cpumask>,
+--
+2.51.0
+
--- /dev/null
+From 0138fe973bbc3899540a7b7f3200b9d960622195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:29 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
+
+The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
+as follows:
+
+ entry()
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+
+entry() copies its tail call counter to the subprog_tail()'s frame,
+which then increments it. However, the incremented result is discarded,
+leading to an astronomically large number of tail calls.
+
+Fix by writing the incremented counter back to the entry()'s frame.
+
+Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 0c9a35782c833..794f99675cef4 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1778,13 +1778,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ jit->seen |= SEEN_FUNC;
+ /*
+ * Copy the tail call counter to where the callee expects it.
+- *
+- * Note 1: The callee can increment the tail call counter, but
+- * we do not load it back, since the x86 JIT does not do this
+- * either.
+- *
+- * Note 2: We assume that the verifier does not let us call the
+- * main program, which clears the tail call counter on entry.
+ */
+ /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
+ _EMIT6(0xd203f000 | STK_OFF_TCCNT,
+@@ -1810,6 +1803,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ call_r1(jit);
+ /* lgr %b0,%r2: load return value into %b0 */
+ EMIT4(0xb9040000, BPF_REG_0, REG_2);
++
++ /*
++ * Copy the potentially updated tail call counter back.
++ */
++
++ if (insn->src_reg == BPF_PSEUDO_CALL)
++ /*
++ * mvc frame_off+tail_call_cnt(%r15),
++ * tail_call_cnt(4,%r15)
++ */
++ _EMIT6(0xd203f000 | (jit->frame_off +
++ offsetof(struct prog_frame,
++ tail_call_cnt)),
++ 0xf000 | offsetof(struct prog_frame,
++ tail_call_cnt));
++
+ break;
+ }
+ case BPF_JMP | BPF_TAIL_CALL: {
+--
+2.51.0
+
--- /dev/null
+From 26a6ee9b28e1aaa8fad7a3b7e2a9e92ac4e2430b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:30 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
+
+The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
+graph is as follows:
+
+ entry()
+ subprog_tail()
+ trampoline()
+ fentry()
+ the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG
+ return to entry()
+
+The problem is that the rest of subprog_tail() increments the tail call
+counter, but the trampoline discards the incremented value. This
+results in an astronomically large number of tail calls.
+
+Fix by making the trampoline write the incremented tail call counter
+back.
+
+Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 794f99675cef4..47046e3080355 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -2811,6 +2811,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ /* stg %r2,retval_off(%r15) */
+ EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
+ tjit->retval_off);
++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
++ _EMIT6(0xd203f000 | tjit->tccnt_off,
++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt));
+
+ im->ip_after_call = jit->prg_buf + jit->prg;
+
+--
+2.51.0
+
--- /dev/null
+From c29dc45d58e9ecbcc0dfe8285407792a5ab0f73e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index dc74ebc6405ac..66fd301f03b0d 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From 51c0819725af9b72f6f62f8b7f255c38ae9eb1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 95af3bb03834c..a58abd796603b 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From 4a3389c2af7d30e951d89195ea60d1040b1983b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 753c09363cbbc..3e1dac4b820fe 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From 9ab4d406299701ae4e0dbe3a3595b7134a48e318 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:16 +0200
+Subject: scsi: pm80xx: Restore support for expanders
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ]
+
+Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke
+support for expanders. After the commit, devices behind an expander are
+no longer detected.
+
+Simply reverting the commit restores support for devices behind an
+expander.
+
+Instead of reverting the commit (and reintroducing a helper to get the
+port), get the port directly from the lldd_port pointer in struct
+asd_sas_port.
+
+Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID")
+Suggested-by: Igor Pylypiv <ipylypiv@google.com>
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index f7067878b34f3..753c09363cbbc 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
+ bool internal_abort = sas_is_internal_abort(task);
+ struct pm8001_hba_info *pm8001_ha;
+- struct pm8001_port *port = NULL;
++ struct pm8001_port *port;
+ struct pm8001_ccb_info *ccb;
+ unsigned long flags;
+ u32 n_elem = 0;
+@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
+
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+
+- pm8001_dev = dev->lldd_dev;
+- port = pm8001_ha->phy[pm8001_dev->attached_phy].port;
++ port = dev->port->lldd_port;
+
+ if (!internal_abort &&
+ (DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) {
+--
+2.51.0
+
--- /dev/null
+From 5e43b3b22579579c5775904ec5928d3603929c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index 91bbd3b75bff9..ccd4485087a10 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 1ac65f86203e886d7c837ad6d3ad91ac77ec6a6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:45 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ qla_nvme_xmt_ls_rsp()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
+
+Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
+align with qla2x00_start_sp() returning negative error codes or
+QLA_SUCCESS, preventing logical errors.
+
+Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 8ee2e337c9e1b..316594aa40cc5 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(PURLS_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < PURLS_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 45b62c45695e905d3ee10d88c6cabc8b9aced7dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 514934dd6f80e..caba003abfd69 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 5333326ef0baa485207a1fc903ac054fc54183fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 17:41:43 +0800
+Subject: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
+
+From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+
+[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ]
+
+The cpu_latency_qos_add/remove/update_request interfaces lack internal
+synchronization by design, requiring the caller to ensure thread safety.
+The current implementation relies on the 'pm_qos_enabled' flag, which is
+insufficient to prevent concurrent access and cannot serve as a proper
+synchronization mechanism. This has led to data races and list
+corruption issues.
+
+A typical race condition call trace is:
+
+[Thread A]
+ufshcd_pm_qos_exit()
+ --> cpu_latency_qos_remove_request()
+ --> cpu_latency_qos_apply();
+ --> pm_qos_update_target()
+ --> plist_del <--(1) delete plist node
+ --> memset(req, 0, sizeof(*req));
+ --> hba->pm_qos_enabled = false;
+
+[Thread B]
+ufshcd_devfreq_target
+ --> ufshcd_devfreq_scale
+ --> ufshcd_scale_clks
+ --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true
+ --> cpu_latency_qos_update_request
+ --> pm_qos_update_target
+ --> plist_del <--(3) plist node use-after-free
+
+Introduces a dedicated mutex to serialize PM QoS operations, preventing
+data races and ensuring safe access to PM QoS resources, including sysfs
+interface reads.
+
+Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver")
+Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Huan Tang <tanghuan@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs-sysfs.c | 2 ++
+ drivers/ufs/core/ufshcd.c | 9 +++++++++
+ include/ufs/ufshcd.h | 3 +++
+ 3 files changed, 14 insertions(+)
+
+diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c
+index fcb4b14a710ff..62c7a3ecfb7eb 100644
+--- a/drivers/ufs/core/ufs-sysfs.c
++++ b/drivers/ufs/core/ufs-sysfs.c
+@@ -494,6 +494,8 @@ static ssize_t pm_qos_enable_show(struct device *dev,
+ {
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled);
+ }
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 5224a21454021..b698e2fdc15fb 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -1017,6 +1017,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active);
+ */
+ void ufshcd_pm_qos_init(struct ufs_hba *hba)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
+
+ if (hba->pm_qos_enabled)
+ return;
+@@ -1033,6 +1034,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba)
+ */
+ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ if (!hba->pm_qos_enabled)
+ return;
+
+@@ -1047,6 +1050,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
+ */
+ static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ if (!hba->pm_qos_enabled)
+ return;
+
+@@ -10711,6 +10716,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ mutex_init(&hba->ee_ctrl_mutex);
+
+ mutex_init(&hba->wb_mutex);
++
++ /* Initialize mutex for PM QoS request synchronization */
++ mutex_init(&hba->pm_qos_mutex);
++
+ init_rwsem(&hba->clk_scaling_lock);
+
+ ufshcd_init_clk_gating(hba);
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 9b3515cee7117..b94afda2233d6 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr {
+ * @ufs_rtc_update_work: A work for UFS RTC periodic update
+ * @pm_qos_req: PM QoS request handle
+ * @pm_qos_enabled: flag to check if pm qos is enabled
++ * @pm_qos_mutex: synchronizes PM QoS request and status updates
+ * @critical_health_count: count of critical health exceptions
+ * @dev_lvl_exception_count: count of device level exceptions since last reset
+ * @dev_lvl_exception_id: vendor specific information about the
+@@ -1136,6 +1137,8 @@ struct ufs_hba {
+ struct delayed_work ufs_rtc_update_work;
+ struct pm_qos_request pm_qos_req;
+ bool pm_qos_enabled;
++ /* synchronizes PM QoS request and status updates */
++ struct mutex pm_qos_mutex;
+
+ int critical_health_count;
+ atomic_t dev_lvl_exception_count;
+--
+2.51.0
+
--- /dev/null
+From 98fe73eaee81920a717d4c178c17cc478dda0729 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 18:31:18 +0200
+Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
+ fast
+
+From: Johannes Nixdorf <johannes@nixdorf.dev>
+
+[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
+
+Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
+event to the tracer, and starts to wait interruptibly. With
+SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
+message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
+and is subsequently interrupted, the tracee begins to wait again
+uninterruptibly (but killable).
+
+This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
+is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
+condition to begin waiting again. In this case the tracee is interrupted
+even though the tracer already acted on its behalf. This breaks the
+assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
+namely that the tracer can be sure the syscall is not interrupted or
+restarted on the tracee after it is received on the tracer. Fix this
+by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
+switch to uninterruptible waiting.
+
+With the condition changed the loop in seccomp_do_user_notification()
+would exit immediately after deciding that noninterruptible waiting
+is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
+skipping the code that processes pending addfd commands first. Prevent
+this by executing the remaining loop body one last time in this case.
+
+Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
+Reported-by: Ali Polatel <alip@chesswob.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
+Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
+Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 41aa761c7738c..3bbfba30a777a 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
+ static bool should_sleep_killable(struct seccomp_filter *match,
+ struct seccomp_knotif *n)
+ {
+- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
+ }
+
+ static int seccomp_do_user_notification(int this_syscall,
+@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall,
+
+ if (err != 0) {
+ /*
+- * Check to see if the notifcation got picked up and
+- * whether we should switch to wait killable.
++ * Check to see whether we should switch to wait
++ * killable. Only return the interrupted error if not.
+ */
+- if (!wait_killable && should_sleep_killable(match, &n))
+- continue;
+-
+- goto interrupted;
++ if (!(!wait_killable && should_sleep_killable(match, &n)))
++ goto interrupted;
+ }
+
+ addfd = list_first_entry_or_null(&n.addfd,
+--
+2.51.0
+
--- /dev/null
+From 57836f0ae04ac873f872cf8180696a9b9233c6cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:56:36 +0200
+Subject: selftests: always install UAPI headers to the correct directory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ]
+
+Currently the UAPI headers are always installed into the source directory.
+When building out-of-tree this doesn't work, as the include path will be
+wrong and it dirties the source tree, leading to complains by kbuild.
+
+Make sure the 'headers' target installs the UAPI headers in the correctly.
+
+The real target directory can come from multiple places. To handle them all
+extract the target directory from KHDR_INCLUDES.
+
+Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de
+Reported-by: Jason Gunthorpe <jgg@nvidia.com>
+Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/
+Fixes: 1a59f5d31569 ("selftests: Add headers target")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lib.mk | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 5303900339292..a448fae57831d 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S
+ $(LINK.S) $^ $(LDLIBS) -o $@
+ endif
+
++# Extract the expected header directory
++khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES)))
++
+ headers:
+- $(Q)$(MAKE) -C $(top_srcdir) headers
++ $(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers
+
+ .PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers
+--
+2.51.0
+
--- /dev/null
+From e4177c850ddbcd87af072c3248256d12b88ebdc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From c515097583306509e25831331d6a2e2c3ef4448f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 10:50:39 -0700
+Subject: selftests/bpf: Copy test_kmods when installing selftest
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ]
+
+Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into
+common directory") consolidated the Makefile of test_kmods. However,
+since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel
+modules required by bpf selftests are now missing from kselftest_install
+when "make install". Fix it by adding test_kmod to TEST_GEN_FILES.
+
+Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory")
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 910d8d6402ef1..159b7cb3dcb9b 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -136,7 +136,7 @@ TEST_GEN_PROGS_EXTENDED = \
+ xdping \
+ xskxceiver
+
+-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
++TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi
+
+ ifneq ($(V),1)
+ submake_extras := feature_display=0
+--
+2.51.0
+
--- /dev/null
+From d3342dd7181f347947149450a21df24de9bd37b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:33:49 -0300
+Subject: selftests/bpf: Fix count write in testapp_xdp_metadata_copy()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ]
+
+Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support
+check") added a new global to xsk_xdp_progs.c, but left out the access in
+the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will
+write to the whole bss section, it gets truncated. Fix by writing to
+skel_rx->bss->count directly.
+
+Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check")
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index 0ced4026ee443..50b03b89f2ee2 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -2240,25 +2240,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test)
+ {
+ struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs;
+ struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs;
+- struct bpf_map *data_map;
+- int count = 0;
+- int key = 0;
+
+ test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata,
+ skel_tx->progs.xsk_xdp_populate_metadata,
+ skel_rx->maps.xsk, skel_tx->maps.xsk);
+ test->ifobj_rx->use_metadata = true;
+
+- data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss");
+- if (!data_map || !bpf_map__is_internal(data_map)) {
+- ksft_print_msg("Error: could not find bss section of XDP program\n");
+- return TEST_FAILURE;
+- }
+-
+- if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) {
+- ksft_print_msg("Error: could not update count element\n");
+- return TEST_FAILURE;
+- }
++ skel_rx->bss->count = 0;
+
+ return testapp_validate_traffic(test);
+ }
+--
+2.51.0
+
--- /dev/null
+From d730cf70b01c3dae5ae6e23db215e60fcfcef94c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:53:00 +0200
+Subject: selftests: cgroup: Make test_pids backwards compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Koutný <mkoutny@suse.com>
+
+[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ]
+
+The predicates in test expect event counting from 73e75e6fc352b
+("cgroup/pids: Separate semantics of pids.events related to pids.max")
+and the test would fail on older kernels. We want to have one version of
+tests for all, so detect the feature and skip the test on old kernels.
+(The test could even switch to check v1 semantics based on the flag but
+keep it simple for now.)
+
+Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller")
+Signed-off-by: Michal Koutný <mkoutny@suse.com>
+Tested-by: Sebastian Chlad <sebastian.chlad@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/lib/cgroup_util.c | 12 ++++++++++++
+ .../selftests/cgroup/lib/include/cgroup_util.h | 1 +
+ tools/testing/selftests/cgroup/test_pids.c | 3 +++
+ 3 files changed, 16 insertions(+)
+
+diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c
+index 8832f3d1cb614..84c2b5a021a77 100644
+--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c
+@@ -520,6 +520,18 @@ int proc_mount_contains(const char *option)
+ return strstr(buf, option) != NULL;
+ }
+
++int cgroup_feature(const char *feature)
++{
++ char buf[PAGE_SIZE];
++ ssize_t read;
++
++ read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf));
++ if (read < 0)
++ return read;
++
++ return strstr(buf, feature) != NULL;
++}
++
+ ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size)
+ {
+ char path[PATH_MAX];
+diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+index adb2bc1931839..e726c959d6538 100644
+--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
++++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+@@ -56,6 +56,7 @@ extern int cg_run_nowait(const char *cgroup,
+ extern int cg_wait_for_proc_count(const char *cgroup, int count);
+ extern int cg_killall(const char *cgroup);
+ int proc_mount_contains(const char *option);
++int cgroup_feature(const char *feature);
+ extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size);
+ extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle);
+ extern pid_t clone_into_cgroup(int cgroup_fd);
+diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c
+index 9ecb83c6cc5cb..d8a1d1cd50072 100644
+--- a/tools/testing/selftests/cgroup/test_pids.c
++++ b/tools/testing/selftests/cgroup/test_pids.c
+@@ -77,6 +77,9 @@ static int test_pids_events(const char *root)
+ char *cg_parent = NULL, *cg_child = NULL;
+ int pid;
+
++ if (cgroup_feature("pids_localevents") <= 0)
++ return KSFT_SKIP;
++
+ cg_parent = cg_name(root, "pids_parent");
+ cg_child = cg_name(cg_parent, "pids_child");
+ if (!cg_parent || !cg_child)
+--
+2.51.0
+
--- /dev/null
+From 95ac739a3596224d48a3a30aee09272a9686d337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:00:08 +0200
+Subject: selftests/futex: Fix some futex_numa_mpol subtests
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ]
+
+The "Memory out of range" subtest of futex_numa_mpol assumes that memory
+access outside of the mmap'ed area is invalid. That may not be the case
+depending on the actual memory layout of the test application. When that
+subtest was run on an x86-64 system with latest upstream kernel, the test
+passed as an error was returned from futex_wake(). On another PowerPC system,
+the same subtest failed because futex_wake() returned 0.
+
+ Bail out! futex2_wake(64, 0x86) should fail, but didn't
+
+Looking further into the passed subtest on x86-64, it was found that an
+-EINVAL was returned instead of -EFAULT. The -EINVAL error was returned
+because the node value test with FLAGS_NUMA set failed with a node value
+of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed
+because the supposed node number wasn't valid. If that memory location
+happens to have a very small value (e.g. 0), the test will pass and no
+error will be returned.
+
+Since this subtest is non-deterministic, drop it unless a guard page beyond
+the mmap region is explicitly set.
+
+The other problematic test is the "Memory too small" test. The futex_wake()
+function returns the -EINVAL error code because the given futex address isn't
+8-byte aligned, not because only 4 of the 8 bytes are valid and the other
+4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to
+reflect the reality.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+index a9ecfb2d3932a..802c15c821906 100644
+--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+@@ -182,12 +182,10 @@ int main(int argc, char *argv[])
+ if (futex_numa->numa == FUTEX_NO_NODE)
+ ksft_exit_fail_msg("NUMA node is left uninitialized\n");
+
+- ksft_print_msg("Memory too small\n");
++ /* FUTEX2_NUMA futex must be 8-byte aligned */
++ ksft_print_msg("Mis-aligned futex\n");
+ test_futex(futex_ptr + mem_size - 4, 1);
+
+- ksft_print_msg("Memory out of range\n");
+- test_futex(futex_ptr + mem_size, 1);
+-
+ futex_numa->numa = FUTEX_NO_NODE;
+ mprotect(futex_ptr, mem_size, PROT_READ);
+ ksft_print_msg("Memory, RO\n");
+--
+2.51.0
+
--- /dev/null
+From 448aca94b3a3298d6ba4bf6f2b476b53cf4ac94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:26:19 +0800
+Subject: selftests/kselftest_harness: Add harness-selftest.expected to
+ TEST_FILES
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yi Lai <yi1.lai@intel.com>
+
+[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ]
+
+The harness-selftest.expected is not installed in INSTALL_PATH.
+Attempting to execute harness-selftest.sh shows warning:
+
+diff: ./kselftest_harness/harness-selftest.expected: No such file or
+directory
+
+Add harness-selftest.expected to TEST_FILES.
+
+Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com
+Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest")
+Signed-off-by: Yi Lai <yi1.lai@intel.com>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_harness/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile
+index 0617535a6ce42..d2369c01701a0 100644
+--- a/tools/testing/selftests/kselftest_harness/Makefile
++++ b/tools/testing/selftests/kselftest_harness/Makefile
+@@ -2,6 +2,7 @@
+
+ TEST_GEN_PROGS_EXTENDED := harness-selftest
+ TEST_PROGS := harness-selftest.sh
++TEST_FILES := harness-selftest.expected
+ EXTRA_CLEAN := harness-selftest.seen
+
+ include ../lib.mk
+--
+2.51.0
+
--- /dev/null
+From 5fe56e0a2b3dd5a0fe27a6c240633d26c71909e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:37:11 +0800
+Subject: selftests/mm: fix va_high_addr_switch.sh failure on x86_64
+
+From: Chunyu Hu <chuhu@redhat.com>
+
+[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ]
+
+The test will fail as below on x86_64 with cpu la57 support (will skip if
+no la57 support). Note, the test requries nr_hugepages to be set first.
+
+ # running bash ./va_high_addr_switch.sh
+ # -------------------------------------
+ # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
+ # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK
+ # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
+ # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
+ # mmap(NULL): 0x7f55b60f9000 - OK
+ # mmap(low_addr): 0x40000000 - OK
+ # mmap(high_addr): 0x1000000000000 - OK
+ # mmap(high_addr) again: 0xffff55b6136000 - OK
+ # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK
+ # mmap(-1): 0xffff55b6134000 - OK
+ # mmap(-1) again: 0xffff55b6132000 - OK
+ # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
+ # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK
+ # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK
+ # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
+ # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
+ # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK
+ # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK
+ # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK
+ # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK
+ # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK
+ # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK
+ # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK
+ # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED
+ # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK
+ # [FAIL]
+
+addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for
+x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit.
+
+Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
+functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch
+code arch/x86/mm/hugetlbpage.c and addr is checked with
+map_address_hint_valid() after align with 'addr &= huge_page_mask(h)'
+which is a round down way, and it will fail the check because the addr is
+within the DEFAULT_MAP_WINDOW but (addr + len) is above the
+DFEFAULT_MAP_WINDOW. So it wil go through the
+hugetlb_get_unmmaped_area_top_down() to find an area within the
+DFEFAULT_MAP_WINDOW.
+
+After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
+functions"). The addr hint for hugetlb_get_unmmaped_area() will be
+rounded up and aligned to hugepage size with ALIGN() for all arches. And
+after the align, the addr will be above the default MAP_DEFAULT_WINDOW,
+and the map_addresshint_valid() check will pass because both aligned addr
+(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned
+hint address (0x800000000000) is returned as an suitable gap is found
+there, in arch_get_unmapped_area_topdown().
+
+To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and
+addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last
+hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr,
+and the addr + len (2 hugepages) will be one hugepage above the
+DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page
+round up or round down from kernel, so it's determistic.
+
+Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com
+Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions")
+Signed-off-by: Chunyu Hu <chuhu@redhat.com>
+Suggested-by: David Hildenbrand <david@redhat.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c
+index 896b3f73fc53b..306eba8251077 100644
+--- a/tools/testing/selftests/mm/va_high_addr_switch.c
++++ b/tools/testing/selftests/mm/va_high_addr_switch.c
+@@ -230,10 +230,10 @@ void testcases_init(void)
+ .msg = "mmap(-1, MAP_HUGETLB) again",
+ },
+ {
+- .addr = (void *)(addr_switch_hint - pagesize),
++ .addr = (void *)(addr_switch_hint - hugepagesize),
+ .size = 2 * hugepagesize,
+ .flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS,
+- .msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)",
++ .msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)",
+ .low_addr_required = 1,
+ .keep_mapped = 1,
+ },
+--
+2.51.0
+
--- /dev/null
+From dc9543f633b53b297a85e8513a7812e792c845a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 22:12:22 +0200
+Subject: selftests/nolibc: fix EXPECT_NZ macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
+
+The expect non-zero macro was incorrect and never used. Fix its
+definition.
+
+Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
+index b5c04c1372495..c2f0c40c1856f 100644
+--- a/tools/testing/selftests/nolibc/nolibc-test.c
++++ b/tools/testing/selftests/nolibc/nolibc-test.c
+@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
+ }
+
+
+-#define EXPECT_NZ(cond, expr, val) \
+- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
++#define EXPECT_NZ(cond, expr) \
++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
+
+ static __attribute__((unused))
+ int expect_nz(int expr, int llen)
+--
+2.51.0
+
--- /dev/null
+From 60af0c353f0cd4a1778d4cb3f16567d186b6fdbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:02 +0200
+Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]
+
+The _rval register variable is meant to be an output operand of the asm
+statement but is instead used as input operand.
+clang 20.1 notices this and triggers -Wuninitialized warnings:
+
+tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
+ 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
+ 59 | : "r" (_rval) \
+ | ^~~~~
+tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
+tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
+ 47 | register long _rval asm ("r3"); \
+ | ^
+
+It seems the list of input and output operands have been switched around.
+However as the argument registers are not always initialized they can not
+be marked as pure inputs as that would trigger -Wuninitialized warnings.
+Adding _rval as another input and output operand does also not work as it
+would collide with the existing _r3 variable.
+
+Instead reuse _r3 for both the argument and the return value.
+
+Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de
+Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
+index bb237d771051b..e7205584cbdca 100644
+--- a/tools/testing/selftests/vDSO/vdso_call.h
++++ b/tools/testing/selftests/vDSO/vdso_call.h
+@@ -44,7 +44,6 @@
+ register long _r6 asm ("r6"); \
+ register long _r7 asm ("r7"); \
+ register long _r8 asm ("r8"); \
+- register long _rval asm ("r3"); \
+ \
+ LOADARGS_##nr(fn, args); \
+ \
+@@ -54,13 +53,13 @@
+ " bns+ 1f\n" \
+ " neg 3, 3\n" \
+ "1:" \
+- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \
++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \
+ "+r" (_r6), "+r" (_r7), "+r" (_r8) \
+- : "r" (_rval) \
++ : \
+ : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \
+ "cr6", "cr7", "xer", "lr", "ctr", "memory" \
+ ); \
+- _rval; \
++ _r3; \
+ })
+
+ #else
+--
+2.51.0
+
--- /dev/null
+From 537af440da373ab81d548095064e9249784c3163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:03 +0200
+Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with
+ missing vDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]
+
+If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
+Currently this results in the following output:
+
+ TAP version 13
+ 1..16
+ # AT_SYSINFO_EHDR is not present!
+
+This output is incorrect, as "1..16" still requires the subtest lines to
+be printed, which isn't done however.
+
+Switch to the correct skipping functions, so the output now correctly
+indicates that no subtests are being run:
+
+ TAP version 13
+ 1..0 # SKIP AT_SYSINFO_EHDR is not present!
+
+Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
+index a54424e2336f4..67cbfc56e4e1b 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
+@@ -182,12 +182,11 @@ int main(int argc, char **argv)
+ unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
+
+ ksft_print_header();
+- ksft_set_plan(VDSO_TEST_PLAN);
+
+- if (!sysinfo_ehdr) {
+- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
+- return KSFT_SKIP;
+- }
++ if (!sysinfo_ehdr)
++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
++
++ ksft_set_plan(VDSO_TEST_PLAN);
+
+ version = versions[VDSO_VERSION];
+ name = (const char **)&names[VDSO_NAMES];
+--
+2.51.0
+
--- /dev/null
+From 7d70db8f301c6b93f0ccee62ce66707c5a08ebb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index a1f506ba55786..4f09c5db0c7f3 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From f5f9a093d2381a944ab58013fb0d77b6b20ed6e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 541c790c01090..2b42a4c21a9b8 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regcfg_i2c.name = max310x_regmap_name(i);
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+--
+2.51.0
+
--- /dev/null
+arch-copy_thread-pass-clone_flags-as-u64.patch
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
+seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+kselftest-arm64-gcs-correctly-check-return-value-whe.patch
+gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
+powerpc-8xx-remove-left-over-instruction-and-comment.patch
+powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
+powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
+powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
+uprobes-uprobe_warn-should-use-passed-task.patch
+raid6-riscv-clean-up-unused-header-file-inclusion.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+smb-server-fix-ird-ord-negotiation-with-the-client.patch
+edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
+perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
+perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+selftests-cgroup-make-test_pids-backwards-compatible.patch
+lsm-config_lsm-can-depend-on-config_security.patch
+cpuset-fix-failure-to-enable-isolated-partition-when.patch
+btrfs-return-any-hit-error-from-extent_writepage_io.patch
+pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
+arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+bpf-tidy-verifier-bug-message.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+selftests-bpf-copy-test_kmods-when-installing-selfte.patch
+rust-cpumask-mark-cpumaskvar-as-transparent.patch
+bpf-selftests-fix-test_tcpnotify_user.patch
+bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+libbpf-fix-reuse-of-devmap.patch
+arm-dts-renesas-porter-fix-can-pin-group.patch
+leds-max77705-function-return-instead-of-variable-as.patch
+leds-flash-leds-qcom-flash-update-torch-current-clam.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
+arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
+libbpf-export-bpf_object__prepare-symbol.patch
+firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
+arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
+arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
+arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+selftests-futex-fix-some-futex_numa_mpol-subtests.patch
+selftests-nolibc-fix-expect_nz-macro.patch
+leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
+dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
+selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
+vdso-datastore-gate-time-data-behind-config_generic_.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+vdso-add-struct-__kernel_old_timeval-forward-declara.patch
+arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
+arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
+arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
+pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+null_blk-fix-the-description-of-the-cache_size-modul.patch
+blk-throttle-fix-access-race-during-throttle-policy-.patch
+selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
+selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
+tick-do-not-set-device-to-detached-state-in-tick_shu.patch
+arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
+nbd-restrict-sockets-to-tcp-and-udp.patch
+pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+dts-arm-amlogic-fix-pwm-node-for-c3.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
+cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
+arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
+arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
+arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
+arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
+mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
+arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
+arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
+pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
+pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
+pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+acpica-apply-acpi_nonstring.patch
+acpica-fix-largest-possible-resource-descriptor-inde.patch
+riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
+nvme-auth-update-bi_directional-flag.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+nvmet-fcloop-call-done-callback-even-when-remote-por.patch
+nvme-tcp-send-only-permitted-commands-for-secure-con.patch
+i3c-master-svc-use-manual-response-for-ibi-events.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+selftests-kselftest_harness-add-harness-selftest.exp.patch
+blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
+selftests-always-install-uapi-headers-to-the-correct.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+mfd-max77705-max77705_charger-move-active-discharge-.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+spi-fix-return-code-when-spi-device-has-too-many-chi.patch
+clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
+clocksource-drivers-tegra186-avoid-64-bit-division.patch
+bpf-mark-kfuncs-as-__noclone.patch
+once-fix-race-by-moving-do_once-to-separate-section.patch
+hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
+i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
+i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
+i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
+i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
+i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
+bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
+drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
+drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
+drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+f2fs-fix-condition-in-__allow_reserved_blocks.patch
+f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
+f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
+drm-bridge-it6505-select-regmap_i2c.patch
+wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
+hid-steelseries-refactor-probe-and-remove.patch
+media-zoran-remove-zoran_fh-structure.patch
+phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
+drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
+pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
+serial-max310x-add-error-checking-in-probe.patch
+drm-amd-display-remove-redundant-semicolons.patch
+drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
+crypto-keembay-add-missing-check-after-sg_nents_for_.patch
+hwrng-nomadik-add-arm_amba-dependency.patch
+docs-iio-ad3552r-fix-malformed-code-block-directive.patch
+fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
+scsi-pm80xx-restore-support-for-expanders.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
+drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+media-i2c-vd55g1-fix-duster-register-address.patch
+rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
+rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
+wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
+pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+media-st-delta-avoid-excessive-stack-usage.patch
+accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
+crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+crypto-hisilicon-check-the-sva-module-status-while-e.patch
+crypto-hisilicon-qm-check-whether-the-input-function.patch
+crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
+inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
+dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
+coresight-trbe-add-isb-after-trblimitr-write.patch
+coresight-fix-missing-include-for-field_get.patch
+coresight-only-register-perf-symlink-for-sinks-with-.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+drm-amd-pm-fix-si_upload_smc_data-v3.patch
+drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+wifi-iwlwifi-remove-redundant-header-files.patch
+idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+drm-msm-dpu-fix-incorrect-type-for-ret.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
+iio-consumers-fix-handling-of-negative-channel-scale.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
+tools-ynl-fix-undefined-variable-name.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+ipvs-use-read_once-write_once-for-ipvs-enable.patch
+hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
+watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
+wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
+wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
+wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
+wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
+wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
+wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
+asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
+srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
+drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
+f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
+f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
+f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
+alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
+hid-hidraw-tighten-ioctl-command-parsing.patch
+f2fs-fix-zero-sized-extent-for-precache-extents.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
+wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
+wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
+wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
+wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
+wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-20082
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12084
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-8584
+vfio-pds-replace-bitmap_free-with-vfree.patch
+crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
+rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
+remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
+rdma-rxe-fix-race-in-do_task-when-draining.patch
+selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
+wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
+wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
+wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
+dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
+coresight-fix-indentation-error-in-cscfg_remove_owne.patch
+coresight-etm4x-conditionally-access-register-trcext.patch
+coresight-tmc-support-atclk.patch
+coresight-catu-support-atclk.patch
+coresight-etm4x-support-atclk.patch
+coresight-appropriately-disable-programming-clocks.patch
+coresight-appropriately-disable-trace-bus-clocks.patch
+coresight-avoid-enable-programming-clock-duplicately.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
+coresight-fix-incorrect-handling-for-return-value-of.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
+netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
+scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
+pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
+pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
+iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
+iommu-selftest-prevent-use-of-uninitialized-variable.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-enetc-fix-probing-error-message-typo-for-the-ene.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+ptp-add-a-upper-bound-on-max_vclocks.patch
+vhost-vringh-fix-copy_to_iter-return-value-check.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+bluetooth-iso-free-rx_skb-if-not-consumed.patch
+bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
+mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+pci-j721e-fix-incorrect-error-message-in-probe.patch
+idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+net-mlx5-stop-polling-for-command-response-if-interf.patch
+net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+net-mlx5-fw-reset-add-reset-timeout-work.patch
+smb-client-fix-crypto-buffers-in-non-linear-memory.patch
+bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
+net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
+iommufd-register-iommufd-mock-devices-with-fwspec.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+octeontx2-vf-fix-bitmap-leak.patch
+octeontx2-pf-fix-bitmap-leak.patch
+vhost-vringh-modify-the-return-value-check.patch
+bpf-reject-negative-offsets-for-alu-ops.patch
--- /dev/null
+From 410968e585100d9c0642272ba9d2b068c80482a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 12:10:33 -0300
+Subject: smb: client: fix crypto buffers in non-linear memory
+
+From: Enzo Matsumiya <ematsumiya@suse.de>
+
+[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
+
+The crypto API, through the scatterlist API, expects input buffers to be
+in linear memory. We handle this with the cifs_sg_set_buf() helper
+that converts vmalloc'd memory to their corresponding pages.
+
+However, when we allocate our aead_request buffer (@creq in
+smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
+puts aead_request->__ctx in vmalloc area.
+
+AEAD algorithm then uses ->__ctx for its private/internal data and
+operations, and uses sg_set_buf() for such data on a few places.
+
+This works fine as long as @creq falls into kmalloc zone (small
+requests) or vmalloc'd memory is still within linear range.
+
+Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
+many tasks will increment the base stacks' addresses to a point where
+virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
+happens.
+
+In practice: too many parallel reads and writes on an encrypted mount
+will trigger this bug.
+
+To fix this, always alloc @creq with kmalloc() instead.
+Also drop the @sensitive_size variable/arguments since
+kfree_sensitive() doesn't need it.
+
+Backtrace:
+
+[ 945.272081] ------------[ cut here ]------------
+[ 945.272774] kernel BUG at include/linux/scatterlist.h:209!
+[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
+[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
+[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
+[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
+[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
+[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
+[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
+[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
+[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
+[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
+[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
+[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
+[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
+[ 945.286683] Call Trace:
+[ 945.286952] <TASK>
+[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs]
+[ 945.287719] crypto_gcm_encrypt+0x36/0xe0
+[ 945.288152] crypt_message+0x54a/0xad0 [cifs]
+[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs]
+[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs]
+[ 945.289944] cifs_call_async+0x178/0x340 [cifs]
+[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
+[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs]
+[ 945.291759] ? find_held_lock+0x32/0x90
+[ 945.292212] ? netfs_advance_write+0xf2/0x310
+[ 945.292723] netfs_advance_write+0xf2/0x310
+[ 945.293210] netfs_write_folio+0x346/0xcc0
+[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10
+[ 945.294250] netfs_writepages+0x117/0x460
+[ 945.294724] do_writepages+0xbe/0x170
+[ 945.295152] ? find_held_lock+0x32/0x90
+[ 945.295600] ? kvm_sched_clock_read+0x11/0x20
+[ 945.296103] __writeback_single_inode+0x56/0x4b0
+[ 945.296643] writeback_sb_inodes+0x229/0x550
+[ 945.297140] __writeback_inodes_wb+0x4c/0xe0
+[ 945.297642] wb_writeback+0x2f1/0x3f0
+[ 945.298069] wb_workfn+0x300/0x490
+[ 945.298472] process_one_work+0x1fe/0x590
+[ 945.298949] worker_thread+0x1ce/0x3c0
+[ 945.299397] ? __pfx_worker_thread+0x10/0x10
+[ 945.299900] kthread+0x119/0x210
+[ 945.300285] ? __pfx_kthread+0x10/0x10
+[ 945.300729] ret_from_fork+0x119/0x1b0
+[ 945.301163] ? __pfx_kthread+0x10/0x10
+[ 945.301601] ret_from_fork_asm+0x1a/0x30
+[ 945.302055] </TASK>
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index cd051bb1a9d60..62d6a465dfa10 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+ struct aead_request **req, struct sg_table *sgt,
+- unsigned int *num_sgs, size_t *sensitive_size)
++ unsigned int *num_sgs)
+ {
+ unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
+ unsigned int iv_size = crypto_aead_ivsize(tfm);
+@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+ len += req_size;
+ len = ALIGN(len, __alignof__(struct scatterlist));
+ len += array_size(*num_sgs, sizeof(struct scatterlist));
+- *sensitive_size = len;
+
+- p = kvzalloc(len, GFP_NOFS);
++ p = kzalloc(len, GFP_NOFS);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+
+ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+- struct aead_request **req, struct scatterlist **sgl,
+- size_t *sensitive_size)
++ struct aead_request **req, struct scatterlist **sgl)
+ {
+ struct sg_table sgtable = {};
+ unsigned int skip, num_sgs, i, j;
+ ssize_t rc;
+ void *p;
+
+- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
+- &num_sgs, sensitive_size);
++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
+ if (IS_ERR(p))
+ return ERR_CAST(p);
+
+@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ DECLARE_CRYPTO_WAIT(wait);
+ unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+ void *creq;
+- size_t sensitive_size;
+
+ rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
+ if (rc) {
+@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ return rc;
+ }
+
+- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
+- &sensitive_size);
++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
+ if (IS_ERR(creq))
+ return PTR_ERR(creq);
+
+@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ if (!rc && enc)
+ memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
+
+- kvfree_sensitive(creq, sensitive_size);
++ kfree_sensitive(creq);
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 92876ffc0a3fbb9b5f61a05cb5bdfc012f0db042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:34:58 +0200
+Subject: smb: server: fix IRD/ORD negotiation with the client
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
+
+Already do real negotiation in smb_direct_handle_connect_request()
+where we see the requested initiator_depth and responder_resources
+from the client.
+
+We should detect legacy iwarp clients using MPA v1
+with the custom IRD/ORD negotiation.
+
+We need to send the custom IRD/ORD in big endian,
+but we need to try to let clients with broken requests
+using little endian (older cifs.ko) to work.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
+ 1 file changed, 85 insertions(+), 14 deletions(-)
+
+diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
+index 74dfb6496095d..e1f659d3b4cf5 100644
+--- a/fs/smb/server/transport_rdma.c
++++ b/fs/smb/server/transport_rdma.c
+@@ -153,6 +153,10 @@ struct smb_direct_transport {
+ struct work_struct disconnect_work;
+
+ bool negotiation_requested;
++
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ };
+
+ #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
+@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
+ t->cm_id = cm_id;
+ cm_id->context = t;
+
++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
++ t->responder_resources = 1;
++
+ t->status = SMB_DIRECT_CS_NEW;
+ init_waitqueue_head(&t->wait_status);
+
+@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
+ static int smb_direct_accept_client(struct smb_direct_transport *t)
+ {
+ struct rdma_conn_param conn_param;
+- struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+ int ret;
+
++ /*
++ * smb_direct_handle_connect_request()
++ * already negotiated t->initiator_depth
++ * and t->responder_resources
++ */
+ memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
+- SMB_DIRECT_CM_INITIATOR_DEPTH);
+- conn_param.responder_resources = 0;
+-
+- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
+- t->cm_id->port_num,
+- &port_immutable);
+- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = conn_param.responder_resources;
+- ird_ord_hdr[1] = 1;
++ conn_param.initiator_depth = t->initiator_depth;
++ conn_param.responder_resources = t->responder_resources;
++
++ if (t->legacy_iwarp) {
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
+ return true;
+ }
+
+-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
++ struct rdma_cm_event *event)
+ {
+ struct smb_direct_transport *t;
+ struct task_struct *handler;
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+ int ret;
+
+ if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
+@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+ if (!t)
+ return -ENOMEM;
+
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ t->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * First set what the we as server are able to support
++ */
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ new_cm_id->device->attrs.max_qp_rd_atom);
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ t->responder_resources = min_t(u8, t->responder_resources,
++ peer_responder_resources);
++
+ ret = smb_direct_connect(t);
+ if (ret)
+ goto out_err;
+@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
+ {
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST: {
+- int ret = smb_direct_handle_connect_request(cm_id);
++ int ret = smb_direct_handle_connect_request(cm_id, event);
+
+ if (ret) {
+ pr_err("Can't create transport: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From 1ae3a2d8f97f193cae52bdc438142f56daa59846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 974f3a3962e8d..35af7e58b075f 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -892,16 +892,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From b4c275df9e4ef430bcc48f89c8b08e5817cb74bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:50 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index 7c349a94b45c0..48804e1e5a6c8 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
+ return dev;
+ }
+
++static void svs_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ dev = svs_add_device_link(svsp, "thermal-sensor");
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get thermal device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From ed3d4c1ba0edce1a72d745e243e75e2f53538bd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:51 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index 48804e1e5a6c8..f45537546553e 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst");
+ if (IS_ERR(svsp->rst))
+@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get lvts device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 9eba8eb3205e6523be168eefe837352abfa9104c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index fdab2b1067dbb..c6f7d5c9c493d 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
+--
+2.51.0
+
--- /dev/null
+From 33201b3c93695aa4309694221a6c80a90f8a495e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index 635398ec7540e..154fbd35400ca 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From 00d90918d1633bb081c039a9a6c0ca06f18db432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index ee51c12306894..bbd3ea0a64822 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -79,8 +79,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From 211c7e7ce88c6cec9683dc4991eb8d55f71706b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From d737d1e83bc6099846b3c1e323e74488ea365f23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From 27c3a9f853ca71452906e0e8ae994b0f8baab2ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From 9bb998ca4ba880c9ab805cebd7003dea83ca1d6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 20:37:19 +0200
+Subject: spi: fix return code when spi device has too many chipselects
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]
+
+Don't return a positive value when there are too many chipselects.
+
+Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 0ffa3f9f28707..68222a9898a4b 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2450,7 +2450,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
+ if (rc > ctlr->num_chipselect) {
+ dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
+ nc, rc);
+- return rc;
++ return -EINVAL;
+ }
+ if ((of_property_present(nc, "parallel-memories")) &&
+ (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
+--
+2.51.0
+
--- /dev/null
+From 25c5735cc2b1bc93a063024d3db934224e3bbafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 20:51:55 +0800
+Subject: srcu/tiny: Remove preempt_disable/enable() in
+ srcu_gp_start_if_needed()
+
+From: Zqiang <qiang.zhang@linux.dev>
+
+[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ]
+
+Currently, the srcu_gp_start_if_needed() is always be invoked in
+preempt disable's critical section, this commit therefore remove
+redundant preempt_disable/enable() in srcu_gp_start_if_needed()
+and adds a call to lockdep_assert_preemption_disabled() in order
+to enable lockdep to diagnose mistaken invocations of this function
+from preempts-enabled code.
+
+Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption")
+Signed-off-by: Zqiang <qiang.zhang@linux.dev>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/srcutiny.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
+index 6e9fe2ce1075d..e3b64a5e0ec7e 100644
+--- a/kernel/rcu/srcutiny.c
++++ b/kernel/rcu/srcutiny.c
+@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
+ {
+ unsigned long cookie;
+
+- preempt_disable(); // Needed for PREEMPT_LAZY
++ lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY
+ cookie = get_state_synchronize_srcu(ssp);
+ if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) {
+- preempt_enable();
+ return;
+ }
+ WRITE_ONCE(ssp->srcu_idx_max, cookie);
+@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
+ else if (list_empty(&ssp->srcu_work.entry))
+ list_add(&ssp->srcu_work.entry, &srcu_boot_list);
+ }
+- preempt_enable();
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 7d1d82fd1749bb83ca9be73b5baab5d8f1e074b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 98da33e0c308b..c818a8b32daeb 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3102,8 +3102,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -3122,11 +3122,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e96e9466538b93d5f9b2f3c6f7624fd13b8cf548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index 991d1573983d9..dff3dc062d736 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From 7b5c8fd0a70bf302bf375beb1d6e56716ca5715d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index 2c7f3f9a26ebb..a6bb01082ec69 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From 8f4fa97e635945af0cbdb17e0fe32e5a4cc36b6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 14:49:51 +0800
+Subject: tick: Do not set device to detached state in tick_shutdown()
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ]
+
+tick_shutdown() sets the state of the clockevent device to detached
+first and the invokes clockevents_exchange_device(), which in turn
+invokes clockevents_switch_state().
+
+But clockevents_switch_state() returns without invoking the device shutdown
+callback as the device is already in detached state. As a consequence the
+timer device is not shutdown when a CPU goes offline.
+
+tick_shutdown() does this because it was originally invoked on a online CPU
+and not on the outgoing CPU. It therefore could not access the clockevent
+device of the already offlined CPU and just set the state.
+
+Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so
+the hardware device can be accessed.
+
+Remove the state set before calling clockevents_exchange_device(), so that
+the subsequent clockevents_switch_state() handles the state transition and
+invokes the shutdown callback of the clockevent device.
+
+[ tglx: Massaged change log ]
+
+Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING")
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/clockevents.c | 2 +-
+ kernel/time/tick-common.c | 16 +++++-----------
+ kernel/time/tick-internal.h | 2 +-
+ 3 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index f3e831f62906f..a59bc75ab7c5b 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu)
+ raw_spin_lock(&clockevents_lock);
+
+ tick_broadcast_offline(cpu);
+- tick_shutdown(cpu);
++ tick_shutdown();
+
+ /*
+ * Unregister the clock event devices which were
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 9a3859443c042..7e33d3f2e889b 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu)
+ }
+
+ /*
+- * Shutdown an event device on a given cpu:
++ * Shutdown an event device on the outgoing CPU:
+ *
+- * This is called on a life CPU, when a CPU is dead. So we cannot
+- * access the hardware device itself.
+- * We just set the mode and remove it from the lists.
++ * Called by the dying CPU during teardown, with clockevents_lock held
++ * and interrupts disabled.
+ */
+-void tick_shutdown(unsigned int cpu)
++void tick_shutdown(void)
+ {
+- struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
++ struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
+ struct clock_event_device *dev = td->evtdev;
+
+ td->mode = TICKDEV_MODE_PERIODIC;
+ if (dev) {
+- /*
+- * Prevent that the clock events layer tries to call
+- * the set mode function!
+- */
+- clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
+ clockevents_exchange_device(dev, NULL);
+ dev->event_handler = clockevents_handle_noop;
+ td->evtdev = NULL;
+diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
+index faac36de35b9e..4e4f7bbe2a64b 100644
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
+ extern void tick_handle_periodic(struct clock_event_device *dev);
+ extern void tick_check_new_device(struct clock_event_device *dev);
+ extern void tick_offline_cpu(unsigned int cpu);
+-extern void tick_shutdown(unsigned int cpu);
++extern void tick_shutdown(void);
+ extern void tick_suspend(void);
+ extern void tick_resume(void);
+ extern bool tick_check_replacement(struct clock_event_device *curdev,
+--
+2.51.0
+
--- /dev/null
+From d35607ef99c26b9d8ef77bcbf37b7d8de669ba93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index ba950f0e73384..2c1ad23b9b5c1 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -29,6 +29,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From e048876e6207334177f3f23516d80cf096a9f199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 23:07:47 +0200
+Subject: tools: ynl: fix undefined variable name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ]
+
+This variable used in the error path was not defined according to Ruff.
+msg_format.attr_set is used instead, presumably the one that was
+supposed to be used originally.
+
+This is linked to Ruff error F821 [1]:
+
+ An undefined name is likely to raise NameError at runtime.
+
+Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl")
+Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/pyynl/lib/ynl.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py
+index 61deb59230671..7f49573896fd0 100644
+--- a/tools/net/ynl/pyynl/lib/ynl.py
++++ b/tools/net/ynl/pyynl/lib/ynl.py
+@@ -731,7 +731,7 @@ class YnlFamily(SpecFamily):
+ subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set)
+ decoded.update(subdict)
+ else:
+- raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'")
++ raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'")
+ return decoded
+
+ def _decode(self, attrs, space, outer_attrs = None):
+--
+2.51.0
+
--- /dev/null
+From 8e8cbeb90552f9eac6379c7a55609e7f05d9dd63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:26:56 +0300
+Subject: tty: n_gsm: Don't block input queue by waiting MSC
+
+From: Seppo Takalo <seppo.takalo@nordicsemi.no>
+
+[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
+
+Currently gsm_queue() processes incoming frames and when opening
+a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
+If basic mode is used it calls gsm_modem_upd_via_msc() and it
+cannot block the input queue by waiting the response to come
+into the same input queue.
+
+Instead allow sending Modem Status Command without waiting for remote
+end to respond. Define a new function gsm_modem_send_initial_msc()
+for this purpose. As MSC is only valid for basic encoding, it does
+not do anything for advanced or when convergence layer type 2 is used.
+
+Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
+Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
+Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 7fc535452c0b3..553d8c70352b1 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
+ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
+ static void gsmld_write_trigger(struct gsm_mux *gsm);
+ static void gsmld_write_task(struct work_struct *work);
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
+
+ /**
+ * gsm_fcs_add - update FCS
+@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
+ pr_debug("DLCI %d goes open.\n", dlci->addr);
+ /* Send current modem state */
+ if (dlci->addr) {
+- gsm_modem_update(dlci, 0);
++ gsm_modem_send_initial_msc(dlci);
+ } else {
+ /* Start keep-alive control */
+ gsm->ka_num = 0;
+@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
+ return gsm_control_wait(dlci->gsm, ctrl);
+ }
+
++/**
++ * gsm_modem_send_initial_msc - Send initial modem status message
++ *
++ * @dlci channel
++ *
++ * Send an initial MSC message after DLCI open to set the initial
++ * modem status lines. This is only done for basic mode.
++ * Does not wait for a response as we cannot block the input queue
++ * processing.
++ */
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
++{
++ u8 modembits[2];
++
++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
++ return 0;
++
++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
++}
++
+ /**
+ * gsm_modem_update - send modem status line state
+ * @dlci: channel
+--
+2.51.0
+
--- /dev/null
+From 7d41eb3ce5c7de94f2ad829fffa2c6c21b78fa75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 22:34:21 -0500
+Subject: uprobes: uprobe_warn should use passed task
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ]
+
+uprobe_warn() is passed a task structure, yet its using current. For
+the most part this shouldn't matter, but since a task structure is
+provided, lets use it.
+
+Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances")
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 84ee7b590861a..d0a17f0e5b419 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -121,7 +121,7 @@ struct xol_area {
+
+ static void uprobe_warn(struct task_struct *t, const char *msg)
+ {
+- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg);
++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 568aa438a34c1d38b83dc16f3c46a360e1e7bc0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index f94ea196ce547..6bcac85c55501 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From d82c9ebea854b3cd22ec08045592e409a88767a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index dcf31a592f5d1..4b5f03f683f77 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From 4c3b438d7c30290dba41af9d2a2d8db2a8bf18d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:31:32 +0530
+Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
+
+From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+
+[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
+
+EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
+as read-only for operating system running at EL1, enforcing access
+restrictions that prohibit direct memory-mapped writes via writel().
+
+Attempts to write to this region from HLOS can result in silent failures
+or memory access violations, particularly when toggling EUD (Embedded
+USB Debugger) state. To ensure secure register access, modify the driver
+to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
+Secure Channel Monitor (SCM). SCM has the necessary permissions to access
+protected memory regions, enabling reliable control over EUD state.
+
+SC7280, the only user of EUD is also affected, indicating that this could
+never have worked on a properly fused device.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/Kconfig | 1 +
+ drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
+ 2 files changed, 25 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
+index 6497c4e81e951..9bf8fc6247bac 100644
+--- a/drivers/usb/misc/Kconfig
++++ b/drivers/usb/misc/Kconfig
+@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
+ config USB_QCOM_EUD
+ tristate "QCOM Embedded USB Debugger(EUD) Driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ select USB_ROLE_SWITCH
+ help
+ This module enables support for Qualcomm Technologies, Inc.
+diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
+index 83079c414b4f2..05c8bdc943a88 100644
+--- a/drivers/usb/misc/qcom_eud.c
++++ b/drivers/usb/misc/qcom_eud.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/sysfs.h>
+ #include <linux/usb/role.h>
++#include <linux/firmware/qcom/qcom_scm.h>
+
+ #define EUD_REG_INT1_EN_MASK 0x0024
+ #define EUD_REG_INT_STATUS_1 0x0044
+@@ -34,7 +35,7 @@ struct eud_chip {
+ struct device *dev;
+ struct usb_role_switch *role_sw;
+ void __iomem *base;
+- void __iomem *mode_mgr;
++ phys_addr_t mode_mgr;
+ unsigned int int_status;
+ int irq;
+ bool enabled;
+@@ -43,18 +44,29 @@ struct eud_chip {
+
+ static int enable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
++ if (ret)
++ return ret;
++
+ writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
+ writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
+ priv->base + EUD_REG_INT1_EN_MASK);
+- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+
+ return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
+ }
+
+-static void disable_eud(struct eud_chip *priv)
++static int disable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
++ if (ret)
++ return ret;
++
+ writel(0, priv->base + EUD_REG_CSR_EUD_EN);
+- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
++ return 0;
+ }
+
+ static ssize_t enable_show(struct device *dev,
+@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
+ chip->enabled = enable;
+ else
+ disable_eud(chip);
++
+ } else {
+- disable_eud(chip);
++ ret = disable_eud(chip);
+ }
+
+- return count;
++ return ret < 0 ? ret : count;
+ }
+
+ static DEVICE_ATTR_RW(enable);
+@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
+ static int eud_probe(struct platform_device *pdev)
+ {
+ struct eud_chip *chip;
++ struct resource *res;
+ int ret;
+
+ chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
+ if (IS_ERR(chip->base))
+ return PTR_ERR(chip->base);
+
+- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
+- if (IS_ERR(chip->mode_mgr))
+- return PTR_ERR(chip->mode_mgr);
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res)
++ return -ENODEV;
++ chip->mode_mgr = res->start;
+
+ chip->irq = platform_get_irq(pdev, 0);
+ if (chip->irq < 0)
+--
+2.51.0
+
--- /dev/null
+From aa1ee3cfde970a78d7ef13a22b199612493ee918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 49d79c1257f3a..8c09db750bfd6 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From 4550c8ce503d72368ce63bbcf993bb0c0c51ee10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index e70fba9f55d6a..0d6c10a8490c0 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From baa4101c732878b92e8d4d79d4bcc304381531be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:41:10 +0200
+Subject: vdso: Add struct __kernel_old_timeval forward declaration to
+ gettime.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]
+
+The prototype of __vdso_gettimeofday() uses this struct. However
+gettime.h's own includes do not provide a definition for it.
+
+Add a forward declaration, similar to other used structs.
+
+Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/vdso/gettime.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
+index c50d152e7b3e0..9ac161866653a 100644
+--- a/include/vdso/gettime.h
++++ b/include/vdso/gettime.h
+@@ -5,6 +5,7 @@
+ #include <linux/types.h>
+
+ struct __kernel_timespec;
++struct __kernel_old_timeval;
+ struct timezone;
+
+ #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
+--
+2.51.0
+
--- /dev/null
+From a16ebfb7d2a6e9ad2a383e06ce78ed645617bab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 08:17:04 +0200
+Subject: vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ]
+
+When the generic vDSO does not provide time functions, as for example on
+riscv32, then the time data store is not necessary.
+
+Avoid allocating these time data pages when not used.
+
+Fixes: df7fcbefa710 ("vdso: Add generic time data storage")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/vdso/datastore.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c
+index 3693c6caf2c4d..a565c30c71a04 100644
+--- a/lib/vdso/datastore.c
++++ b/lib/vdso/datastore.c
+@@ -11,14 +11,14 @@
+ /*
+ * The vDSO data page.
+ */
+-#ifdef CONFIG_HAVE_GENERIC_VDSO
++#ifdef CONFIG_GENERIC_GETTIMEOFDAY
+ static union {
+ struct vdso_time_data data;
+ u8 page[PAGE_SIZE];
+ } vdso_time_data_store __page_aligned_data;
+ struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data;
+ static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE);
+-#endif /* CONFIG_HAVE_GENERIC_VDSO */
++#endif /* CONFIG_GENERIC_GETTIMEOFDAY */
+
+ #ifdef CONFIG_VDSO_GETRANDOM
+ static union {
+@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
+
+ switch (vmf->pgoff) {
+ case VDSO_TIME_PAGE_OFFSET:
+- if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO))
++ if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY))
+ return VM_FAULT_SIGBUS;
+ pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data));
+ if (timens_page) {
+--
+2.51.0
+
--- /dev/null
+From 243e2837359056017a342c754ad6eaafae370b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:31:54 +0000
+Subject: vfio/pds: replace bitmap_free with vfree
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
+
+host_seq_bmp is allocated with vzalloc but is currently freed with
+bitmap_free, which uses kfree internally. This mismach prevents the
+resource from being released properly and may result in memory leaks
+or other issues.
+
+Fix this by freeing host_seq_bmp with vfree to match the vzalloc
+allocation.
+
+Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/pds/dirty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
+index c51f5e4c3dd6d..481992142f790 100644
+--- a/drivers/vfio/pci/pds/dirty.c
++++ b/drivers/vfio/pci/pds/dirty.c
+@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
+
+ host_ack_bmp = vzalloc(bytes);
+ if (!host_ack_bmp) {
+- bitmap_free(host_seq_bmp);
++ vfree(host_seq_bmp);
+ return -ENOMEM;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From dcfbda4e9e02b9f0bbcb355f60fbfe53ef2f36be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:04:08 -0400
+Subject: vhost: vringh: Fix copy_to_iter return value check
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
+
+The return value of copy_to_iter can't be negative, check whether the
+copied length is equal to the requested length instead of checking for
+negative values.
+
+Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index bbce654527013..e547bdc21940b 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1236,6 +1236,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
+ len - total_translated, &translated,
+@@ -1253,9 +1254,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_to_iter(src, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_to_iter(src, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From 8477c47a7bacd7db420d93f6db22d3711aa9d609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:17:38 +0800
+Subject: vhost: vringh: Modify the return value check
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
+
+The return value of copy_from_iter and copy_to_iter can't be negative,
+check whether the copied lengths are equal.
+
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Cc: "Stefano Garzarella" <sgarzare@redhat.com>
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index e547bdc21940b..1e7c5e25860b7 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1190,6 +1190,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
+ len - total_translated, &translated,
+@@ -1207,9 +1208,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_from_iter(dst, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_from_iter(dst, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From e5c2e55b680380f9a80cc1c42f2ef97741807a02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Aug 2025 07:48:17 -0700
+Subject: watchdog: intel_oc_wdt: Do not try to write into const memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ]
+
+The code tries to update the intel_oc_wdt_info data structure if the
+watchdog is locked. That data structure is marked as const and can not
+be written into. Copy it into struct intel_oc_wdt and modify it there
+to fix the problem.
+
+Reported-by: Petar Kulić <cooleech@gmail.com>
+Cc: Diogo Ivo <diogo.ivo@siemens.com>
+Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Diogo Ivo <diogo.ivo@siemens.com>
+Tested-by: Diogo Ivo <diogo.ivo@siemens.com>
+Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/intel_oc_wdt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c
+index 7c0551106981b..a39892c10770e 100644
+--- a/drivers/watchdog/intel_oc_wdt.c
++++ b/drivers/watchdog/intel_oc_wdt.c
+@@ -41,6 +41,7 @@
+ struct intel_oc_wdt {
+ struct watchdog_device wdd;
+ struct resource *ctrl_res;
++ struct watchdog_info info;
+ bool locked;
+ };
+
+@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = {
+
+ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ {
+- struct watchdog_info *info;
+ unsigned long val;
+
+ val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt));
+@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status);
+
+ if (oc_wdt->locked) {
+- info = (struct watchdog_info *)&intel_oc_wdt_info;
+ /*
+ * Set nowayout unconditionally as we cannot stop
+ * the watchdog.
+@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ * and inform the core we can't change it.
+ */
+ oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1;
+- info->options &= ~WDIOF_SETTIMEOUT;
++ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT;
+
+ dev_info(oc_wdt->wdd.parent,
+ "Register access locked, heartbeat fixed at: %u s\n",
+@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev)
+ wdd->min_timeout = INTEL_OC_WDT_MIN_TOV;
+ wdd->max_timeout = INTEL_OC_WDT_MAX_TOV;
+ wdd->timeout = INTEL_OC_WDT_DEF_TOV;
+- wdd->info = &intel_oc_wdt_info;
++ oc_wdt->info = intel_oc_wdt_info;
++ wdd->info = &oc_wdt->info;
+ wdd->ops = &intel_oc_wdt_ops;
+ wdd->parent = dev;
+
+--
+2.51.0
+
--- /dev/null
+From 709fc8103c0fafe1b25076ebf63b1fe447dfd060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 867f9f3113797..a4b497ecfa205 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 05f1efa98556cbf018127cc0f08147dfacca9c93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index cb8ae751eb312..e595b0979a56d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From 4d25d86128a4a5f84a33aadcb27d0242287df7f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 00:36:51 +0530
+Subject: wifi: ath12k: Add fallback for invalid channel number in PHY metadata
+
+From: Sriram R <quic_srirrama@quicinc.com>
+
+[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ]
+
+Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency
+based on the channel number and center frequency from the RX descriptor's
+PHY metadata. However, in rare cases, it is observed that frequency
+retrieved from the metadata may be invalid or unexpected especially for
+6 GHz frames.
+This can result in a NULL sband, which prevents proper frequency assignment
+in rx_status and potentially leading to incorrect RX packet classification.
+
+To fix this potential issue, add a fallback mechanism that uses
+ar->rx_channel to populate the band and frequency when the derived
+sband is invalid or missing.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Vinith Kumar R <quic_vinithku@quicinc.com>
+Signed-off-by: Vinith Kumar R <quic_vinithku@quicinc.com>
+Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
+index e9137ffeb5ab4..5a57290927f19 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
+@@ -2504,6 +2504,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
+ channel_num = meta_data;
+ center_freq = meta_data >> 16;
+
++ rx_status->band = NUM_NL80211_BANDS;
++
+ if (center_freq >= ATH12K_MIN_6GHZ_FREQ &&
+ center_freq <= ATH12K_MAX_6GHZ_FREQ) {
+ rx_status->band = NL80211_BAND_6GHZ;
+@@ -2512,21 +2514,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
+ rx_status->band = NL80211_BAND_2GHZ;
+ } else if (channel_num >= 36 && channel_num <= 173) {
+ rx_status->band = NL80211_BAND_5GHZ;
+- } else {
++ }
++
++ if (unlikely(rx_status->band == NUM_NL80211_BANDS ||
++ !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) {
++ ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n",
++ rx_status->band, channel_num, center_freq, ar->pdev_idx);
++
+ spin_lock_bh(&ar->data_lock);
+ channel = ar->rx_channel;
+ if (channel) {
+ rx_status->band = channel->band;
+ channel_num =
+ ieee80211_frequency_to_channel(channel->center_freq);
++ rx_status->freq = ieee80211_channel_to_frequency(channel_num,
++ rx_status->band);
++ } else {
++ ath12k_err(ar->ab, "unable to determine channel, band for rx packet");
+ }
+ spin_unlock_bh(&ar->data_lock);
++ goto h_rate;
+ }
+
+ if (rx_status->band != NL80211_BAND_6GHZ)
+ rx_status->freq = ieee80211_channel_to_frequency(channel_num,
+ rx_status->band);
+
++h_rate:
+ ath12k_dp_rx_h_rate(ar, rx_info);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4d55c533f1e7e85be8e40f1e80dc85d585edaa6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 17:59:33 +0800
+Subject: wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ]
+
+Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with
+struct hal_phyrx_common_user_info.
+
+Obviously, they do not match. The original intention here was to parse
+HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing
+HAL_PHYRX_COMMON_USER_INFO instead.
+
+Also add LTF parsing and report to radiotap along with GI.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support")
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++----
+ drivers/net/wireless/ath/ath12k/hal_rx.h | 3 +-
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index 6a0915a0c7aae..559cbb1ae20f2 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap)
+ *errmap |= HAL_RX_MPDU_ERR_MPDU_LEN;
+ }
+
++static void
++ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info,
++ struct hal_rx_mon_ppdu_info *ppdu_info)
++{
++ struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht;
++ u32 known, data, cp_setting, ltf_size;
++
++ known = __le32_to_cpu(eht->known);
++ known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI |
++ IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF;
++ eht->known = cpu_to_le32(known);
++
++ cp_setting = le32_get_bits(cmn_usr_info->info0,
++ HAL_RX_CMN_USR_INFO0_CP_SETTING);
++ ltf_size = le32_get_bits(cmn_usr_info->info0,
++ HAL_RX_CMN_USR_INFO0_LTF_SIZE);
++
++ data = __le32_to_cpu(eht->data[0]);
++ data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI);
++ data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF);
++ eht->data[0] = cpu_to_le32(data);
++
++ if (!ppdu_info->ltf_size)
++ ppdu_info->ltf_size = ltf_size;
++ if (!ppdu_info->gi)
++ ppdu_info->gi = cp_setting;
++}
++
+ static void
+ ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon,
+ const struct hal_rx_msdu_end *msdu_end)
+@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
+ HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
+ break;
+ }
+- case HAL_PHYRX_OTHER_RECEIVE_INFO: {
+- const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data;
+-
+- ppdu_info->gi = le32_get_bits(cmn_usr_info->info0,
+- HAL_RX_PHY_CMN_USER_INFO0_GI);
++ case HAL_PHYRX_COMMON_USER_INFO: {
++ ath12k_parse_cmn_usr_info(tlv_data, ppdu_info);
+ break;
+ }
+ case HAL_RX_PPDU_START_USER_INFO:
+diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
+index a3ab588aae19d..801a5f6d3458b 100644
+--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
+@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info {
+ #define HAL_RX_MPDU_ERR_MPDU_LEN BIT(6)
+ #define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME BIT(7)
+
+-#define HAL_RX_PHY_CMN_USER_INFO0_GI GENMASK(17, 16)
++#define HAL_RX_CMN_USR_INFO0_CP_SETTING GENMASK(17, 16)
++#define HAL_RX_CMN_USR_INFO0_LTF_SIZE GENMASK(19, 18)
+
+ struct hal_phyrx_common_user_info {
+ __le32 rsvd[2];
+--
+2.51.0
+
--- /dev/null
+From d10032d9db337715ca7d12e65e66a340b5a58302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 11:03:11 +0800
+Subject: wifi: ath12k: fix overflow warning on num_pwr_levels
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ]
+
+In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is
+limited by ATH12K_NUM_PWR_LEVELS which is 16:
+
+ if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+ tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
+
+Then it is used to iterate entries in local_non_psd->power[] and
+reg_non_psd->power[]:
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_non_psd->power[i],
+ reg_non_psd->power[i]) / 2;
+
+Since the two array are of size 5, Smatch warns:
+
+drivers/net/wireless/ath/ath12k/mac.c:9812
+ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15
+drivers/net/wireless/ath/ath12k/mac.c:9812
+ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15
+
+This is a false positive as there is already implicit limitation:
+
+ tpc_info->num_pwr_levels = max(local_non_psd->count,
+ reg_non_psd->count);
+
+meaning it won't exceed 5.
+
+However, to make robot happy, add explicit limit there.
+
+Also add the same to the PSD case, although no warning due to
+ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
+
+Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 708dc3dd4347a..4f66f79091e37 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -10609,8 +10609,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
+
+ tpc_info->num_pwr_levels = max(local_psd->count,
+ reg_psd->count);
+- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
++ tpc_info->num_pwr_levels =
++ min3(tpc_info->num_pwr_levels,
++ IEEE80211_TPE_PSD_ENTRIES_320MHZ,
++ ATH12K_NUM_PWR_LEVELS);
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_psd->power[i],
+@@ -10625,8 +10627,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
+
+ tpc_info->num_pwr_levels = max(local_non_psd->count,
+ reg_non_psd->count);
+- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
++ tpc_info->num_pwr_levels =
++ min3(tpc_info->num_pwr_levels,
++ IEEE80211_TPE_EIRP_ENTRIES_320MHZ,
++ ATH12K_NUM_PWR_LEVELS);
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_non_psd->power[i],
+--
+2.51.0
+
--- /dev/null
+From 059be386de6ad215d84ed0dcac69bb3c48d15fc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 09:35:52 +0530
+Subject: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
+
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+
+[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ]
+
+In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because
+rxcb->peer_id is not updated with a valid value. This is expected
+in monitor mode, where RX frames bypass the regular RX
+descriptor path that typically sets rxcb->peer_id.
+As a result, the peer is NULL, and link_id and link_valid fields
+in the RX status are not populated. This leads to a WARN_ON in
+mac80211 when it receives data frame from an associated station
+with invalid link_id.
+
+Fix this potential issue by using ppduinfo->peer_id, which holds
+the correct peer id for the received frame. This ensures that the
+peer is correctly found and the associated link metadata is updated
+accordingly.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info")
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index 3be6bcd2a3d92..212a30fb9824a 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -2264,6 +2264,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
+
+ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi,
+ struct sk_buff *msdu,
++ const struct hal_rx_mon_ppdu_info *ppduinfo,
+ struct ieee80211_rx_status *status,
+ u8 decap)
+ {
+@@ -2277,7 +2278,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
+ struct ieee80211_sta *pubsta = NULL;
+ struct ath12k_peer *peer;
+ struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu);
+- struct ath12k_dp_rx_info rx_info;
+ bool is_mcbc = rxcb->is_mcbc;
+ bool is_eapol_tkip = rxcb->is_eapol;
+
+@@ -2291,8 +2291,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
+ }
+
+ spin_lock_bh(&ar->ab->base_lock);
+- rx_info.addr2_present = false;
+- peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info);
++ peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id);
+ if (peer && peer->sta) {
+ pubsta = peer->sta;
+ if (pubsta->valid_links) {
+@@ -2385,7 +2384,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar,
+ decap = mon_mpdu->decap_format;
+
+ ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs);
+- ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap);
++ ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap);
+ mon_skb = skb_next;
+ } while (mon_skb);
+ rxs->flag = 0;
+--
+2.51.0
+
--- /dev/null
+From aca18bde882da33dc9bcc249e5608434b4dfffce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 17:59:34 +0800
+Subject: wifi: ath12k: fix the fetching of combined rssi
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ]
+
+Currently, host fetches combined rssi from rssi_comb in struct
+hal_rx_phyrx_rssi_legacy_info.
+
+rssi_comb is 8th to 15th bits of the second to last variable.
+rssi_comb_ppdu is the 0th to 7th of the last variable.
+
+When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth >
+20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power
+of primary 20 MHz while rssi_comb_ppdu includes power of active
+RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu.
+
+Also related macro definitions are too long, rename them.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++----
+ drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++----
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index 559cbb1ae20f2..3be6bcd2a3d92 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
+ const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data;
+
+ info[0] = __le32_to_cpu(rssi->info0);
+- info[1] = __le32_to_cpu(rssi->info1);
++ info[2] = __le32_to_cpu(rssi->info2);
+
+ /* TODO: Please note that the combined rssi will not be accurate
+ * in MU case. Rssi in MU needs to be retrieved from
+ * PHYRX_OTHER_RECEIVE_INFO TLV.
+ */
+ ppdu_info->rssi_comb =
+- u32_get_bits(info[1],
+- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB);
++ u32_get_bits(info[2],
++ HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU);
+
+ ppdu_info->bw = u32_get_bits(info[0],
+- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
++ HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW);
+ break;
+ }
+ case HAL_PHYRX_COMMON_USER_INFO: {
+diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
+index 801a5f6d3458b..d1ad7747b82c4 100644
+--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
+@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type {
+ HAL_RECEPTION_TYPE_FRAMELESS
+ };
+
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU GENMASK(7, 0)
+
+ struct hal_rx_phyrx_rssi_legacy_info {
+ __le32 info0;
+ __le32 rsvd0[39];
+ __le32 info1;
+- __le32 rsvd1;
++ __le32 info2;
+ } __packed;
+
+ #define HAL_RX_MPDU_START_INFO0_PPDU_ID GENMASK(31, 16)
+--
+2.51.0
+
--- /dev/null
+From f098bf4770187cb653a9193899b447aa6adb7b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:44:57 +0800
+Subject: wifi: ath12k: fix wrong logging ID used for CE
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ]
+
+ATH12K_DBG_AHB is used for CE logging which is not proper. Add
+ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it.
+
+Compile tested only.
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/ce.c | 2 +-
+ drivers/net/wireless/ath/ath12k/debug.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
+index f7c15b547504d..139365cbf89de 100644
+--- a/drivers/net/wireless/ath/ath12k/ce.c
++++ b/drivers/net/wireless/ath/ath12k/ce.c
+@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe)
+ }
+
+ while ((skb = __skb_dequeue(&list))) {
+- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n",
++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n",
+ pipe->pipe_num, skb->len);
+ pipe->recv_cb(ab, skb);
+ }
+diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h
+index 48916e4e1f601..bf254e43a68d0 100644
+--- a/drivers/net/wireless/ath/ath12k/debug.h
++++ b/drivers/net/wireless/ath/ath12k/debug.h
+@@ -26,6 +26,7 @@ enum ath12k_debug_mask {
+ ATH12K_DBG_DP_TX = 0x00002000,
+ ATH12K_DBG_DP_RX = 0x00004000,
+ ATH12K_DBG_WOW = 0x00008000,
++ ATH12K_DBG_CE = 0x00010000,
+ ATH12K_DBG_ANY = 0xffffffff,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 580faf44cb1c538467bd0fa8d23936ef289a878b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 22:19:08 +0000
+Subject: wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ]
+
+The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz.
+However, the expected unit is KHz.
+
+Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 1ad5a6bdfd755..c1c4d32a8efcf 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -2956,7 +2956,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
+ u32 freq, width;
+
+ freq = ieee80211_chandef_to_khz(chandef);
+- width = cfg80211_chandef_get_width(chandef);
++ width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef));
+ if (!ieee80211_radio_freq_range_valid(radio, freq, width))
+ return false;
+
+--
+2.51.0
+
--- /dev/null
+From 5f79a6878a4e04bac01d4c6accea8f02d359fc4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:11:51 +0800
+Subject: wifi: iwlwifi: Remove redundant header files
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]
+
+The header file "fw/img.h" is already included on line 9. Remove the
+redundant include.
+
+Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+index 9bed3d573b1ef..c676e0d14f310 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+@@ -12,7 +12,6 @@
+ #include "fw/api/phy.h"
+ #include "fw/api/config.h"
+ #include "fw/api/nvm-reg.h"
+-#include "fw/img.h"
+ #include "iwl-trans.h"
+
+ #define BIOS_SAR_MAX_PROFILE_NUM 4
+--
+2.51.0
+
--- /dev/null
+From 918d624e19d0ff62f8fff8cdee50574cea50f1f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 12:42:03 +0530
+Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
+ available
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
+
+In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
+information, an attempt is made to find the station using the address 2
+(source address) field in the header. Since pubsta is missing, link
+information such as link_valid and link_id is also unavailable. Now if such
+a situation comes, and if a matching ML station entry is found based on
+the source address, currently the packet is dropped due to missing link ID
+in the status field which is not correct.
+
+Hence, to fix this issue, if link_valid is not set and the station is an
+ML station, make an attempt to find a link station entry using the source
+address. If a valid link station is found, derive the link ID and proceed
+with packet processing. Otherwise, drop the packet as per the existing
+flow.
+
+Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
+Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 7b801dd3f569a..ad6776069ded0 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5210,12 +5210,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ continue;
++
++ link_id = link_sta->link_id;
++ }
++
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
+- continue;
+-
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+
+ prev_sta = sta;
+@@ -5223,10 +5231,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+- goto out;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
++ link_id = link_sta->link_id;
++ }
++
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+--
+2.51.0
+
--- /dev/null
+From 872efdd9e868ab90b2d5bf8ee4ed7563ec13a90d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index 08590aa68356f..1dd3723720480 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 678a5c64698638e1b40a60eac9439eca73baa741 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 14:48:24 +0800
+Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration
+
+From: Zhi-Jun You <hujy652@gmail.com>
+
+[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]
+
+In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
+although the chip doesn't support it.
+
+mt76 doesn't take this into account which results in reading from the
+incorrect offset.
+
+For devices with precal, this would lead to lower bitrate.
+
+Fix this by aligning groupcal size with vendor driver and switch to
+freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.
+
+Below are iwinfo of the test device with two clients connected
+(iPhone 16, Intel AX210).
+Before :
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 612.4 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+After:
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 900.6 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+Tested-on: mt7981 20240823
+
+Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
+Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
+Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++--
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++--------------
+ 2 files changed, 10 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+index 31aec0f40232a..73611c9d26e15 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT)
+ #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT)
+-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */
+
+ #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_RX_PATH GENMASK(5, 3)
+@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
+ return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
+ MT_EE_CAL_GROUP_SIZE_7916;
++ } else if (is_mt7981(&dev->mt76)) {
++ return MT_EE_CAL_GROUP_SIZE_7981;
+ } else if (mt7915_check_adie(dev, false)) {
+ return MT_EE_CAL_GROUP_SIZE_7976;
+ } else {
+@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
+ {
+ if (is_mt7915(&dev->mt76))
+ return MT_EE_CAL_DPD_SIZE_V1;
+- else if (is_mt7981(&dev->mt76))
+- return MT_EE_CAL_DPD_SIZE_V2_7981;
+ else
+ return MT_EE_CAL_DPD_SIZE_V2;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index c1cfdbc2fe848..9689a49020a4b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -3050,30 +3050,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ /* 5G BW160 */
+ 5250, 5570, 5815
+ };
+- static const u16 freq_list_v2_7981[] = {
+- /* 5G BW20 */
+- 5180, 5200, 5220, 5240,
+- 5260, 5280, 5300, 5320,
+- 5500, 5520, 5540, 5560,
+- 5580, 5600, 5620, 5640,
+- 5660, 5680, 5700, 5720,
+- 5745, 5765, 5785, 5805,
+- 5825, 5845, 5865, 5885,
+- /* 5G BW160 */
+- 5250, 5570, 5815
+- };
+- const u16 *freq_list = freq_list_v1;
+- int n_freqs = ARRAY_SIZE(freq_list_v1);
+- int idx;
++ const u16 *freq_list;
++ int idx, n_freqs;
+
+ if (!is_mt7915(&dev->mt76)) {
+- if (is_mt7981(&dev->mt76)) {
+- freq_list = freq_list_v2_7981;
+- n_freqs = ARRAY_SIZE(freq_list_v2_7981);
+- } else {
+- freq_list = freq_list_v2;
+- n_freqs = ARRAY_SIZE(freq_list_v2);
+- }
++ freq_list = freq_list_v2;
++ n_freqs = ARRAY_SIZE(freq_list_v2);
++ } else {
++ freq_list = freq_list_v1;
++ n_freqs = ARRAY_SIZE(freq_list_v1);
+ }
+
+ if (freq < 4000) {
+--
+2.51.0
+
--- /dev/null
+From 5218384a4fcd4d61dbd461795def49dce093a12f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:19 +0200
+Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]
+
+Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
+break endianness
+
+Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++---
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index be729db5b75c1..84015ab24af62 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
+ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
+ struct mt7996_wed_rro_addr *addr;
+@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+
+ addr = dev->wed_rro.addr_elem[i].ptr;
+ for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ dev->wed_rro.session.ptr = ptr;
+ addr = dev->wed_rro.session.ptr;
+ for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+ static void mt7996_wed_rro_work(struct work_struct *work)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mt7996_dev *dev;
+ LIST_HEAD(list);
+
+@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
+ MT7996_RRO_WINDOW_MAX_LEN;
+ reset:
+ elem = ptr + elem_id * sizeof(*elem);
+- elem->signature = 0xff;
++ elem->data |= cpu_to_le32(val);
+ }
+ mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
+ out:
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index b98cfe6e5be8c..048d9a9898c6e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -277,13 +277,12 @@ struct mt7996_hif {
+ int irq;
+ };
+
++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24)
++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4)
++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0)
+ struct mt7996_wed_rro_addr {
+- u32 head_low;
+- u32 head_high : 4;
+- u32 count: 11;
+- u32 oor: 1;
+- u32 rsv : 8;
+- u32 signature : 8;
++ __le32 head_low;
++ __le32 data;
+ };
+
+ struct mt7996_wed_rro_session_id {
+--
+2.51.0
+
--- /dev/null
+From 26e84f3f887edd048259df1a4cef8185410b87bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 10:26:19 +0200
+Subject: wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ]
+
+Update mt7996_mcu_bss_mld_tlv routine to properly support MLO
+configuring the BSS.
+
+Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/main.c | 46 ++++++++++++++++++-
+ .../net/wireless/mediatek/mt76/mt7996/mcu.c | 26 ++++++++---
+ .../net/wireless/mediatek/mt76/mt7996/mcu.h | 3 +-
+ .../wireless/mediatek/mt76/mt7996/mt7996.h | 8 ++++
+ 4 files changed, 75 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index cb522153113ce..1394155a68ce7 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
+ return -1;
+ }
+
++static int get_own_mld_idx(u64 mask, bool group_mld)
++{
++ u8 start = group_mld ? 0 : 16;
++ u8 end = group_mld ? 15 : 63;
++ int idx;
++
++ idx = get_free_idx(mask, start, end);
++ if (idx)
++ return idx - 1;
++
++ /* If the 16-63 range is not available, perform another lookup in the
++ * range 0-15
++ */
++ if (!group_mld) {
++ idx = get_free_idx(mask, 0, 15);
++ if (idx)
++ return idx - 1;
++ }
++
++ return -EINVAL;
++}
++
+ static void
+ mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink)
+ {
+@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ struct mt7996_dev *dev = phy->dev;
+ u8 band_idx = phy->mt76->band_idx;
+ struct mt76_txq *mtxq;
+- int idx, ret;
++ int mld_idx, idx, ret;
+
+ mlink->idx = __ffs64(~dev->mt76.vif_mask);
+ if (mlink->idx >= mt7996_max_interface_num(dev))
+@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ if (idx < 0)
+ return -ENOSPC;
+
++ if (!dev->mld_idx_mask) { /* first link in the group */
++ mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true);
++ mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask,
++ 0, 15);
++ }
++
++ mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
++ if (mld_idx < 0)
++ return -ENOSPC;
++
++ link->mld_idx = mld_idx;
+ link->phy = phy;
+ mlink->omac_idx = idx;
+ mlink->band_idx = band_idx;
+@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ return ret;
+
+ dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
++ if (!dev->mld_idx_mask) {
++ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
++ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
++ }
++ dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
+ phy->omac_mask |= BIT_ULL(mlink->omac_idx);
+
+ idx = MT7996_WTBL_RESERVED - mlink->idx;
+@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ }
+
+ dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
++ dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
+ phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
++ if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) {
++ /* last link */
++ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
++ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
++ }
+
+ spin_lock_bh(&dev->mt76.sta_poll_lock);
+ if (!list_empty(&msta_link->wcid.poll_list))
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index d422b65737966..14373b2285438 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
+ }
+
+ static void
+-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
++mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
++ struct ieee80211_bss_conf *link_conf,
++ struct mt7996_vif_link *link)
+ {
++ struct ieee80211_vif *vif = link_conf->vif;
++ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ struct bss_mld_tlv *mld;
+ struct tlv *tlv;
+
+ tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
+-
+ mld = (struct bss_mld_tlv *)tlv;
+- mld->group_mld_id = 0xff;
+- mld->own_mld_id = mlink->idx;
+- mld->remap_idx = 0xff;
++ mld->own_mld_id = link->mld_idx;
++ mld->link_id = link_conf->link_id;
++
++ if (ieee80211_vif_is_mld(vif)) {
++ mld->group_mld_id = mvif->mld_group_idx;
++ mld->remap_idx = mvif->mld_remap_idx;
++ memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
++ } else {
++ mld->group_mld_id = 0xff;
++ mld->remap_idx = 0xff;
++ }
+ }
+
+ static void
+@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ goto out;
+
+ if (enable) {
++ struct mt7996_vif_link *link;
++
+ mt7996_mcu_bss_rfch_tlv(skb, phy);
+ mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
+ mt7996_mcu_bss_ra_tlv(skb, phy);
+@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
+
+ /* this tag is necessary no matter if the vif is MLD */
+- mt7996_mcu_bss_mld_tlv(skb, mlink);
++ link = container_of(mlink, struct mt7996_vif_link, mt76);
++ mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
+ }
+
+ mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+index 130ea95626d5b..7b21d6ae7e435 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+@@ -481,7 +481,8 @@ struct bss_mld_tlv {
+ u8 own_mld_id;
+ u8 mac_addr[ETH_ALEN];
+ u8 remap_idx;
+- u8 __rsv[3];
++ u8 link_id;
++ u8 __rsv[2];
+ } __packed;
+
+ struct sta_rec_ht_uni {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index bbd4679edc9d3..b98cfe6e5be8c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -248,11 +248,16 @@ struct mt7996_vif_link {
+
+ struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
+ struct cfg80211_bitrate_mask bitrate_mask;
++
++ u8 mld_idx;
+ };
+
+ struct mt7996_vif {
+ struct mt7996_vif_link deflink; /* must be first */
+ struct mt76_vif_data mt76;
++
++ u8 mld_group_idx;
++ u8 mld_remap_idx;
+ };
+
+ /* crash-dump */
+@@ -337,6 +342,9 @@ struct mt7996_dev {
+ u32 q_int_mask[MT7996_MAX_QUEUE];
+ u32 q_wfdma_mask;
+
++ u64 mld_idx_mask;
++ u64 mld_remap_idx_mask;
++
+ const struct mt76_bus_ops *bus_ops;
+ struct mt7996_phy phy;
+
+--
+2.51.0
+
--- /dev/null
+From 8c1a3da9cfc578ba8f1a0f29ee4c07f8fc3cbfbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 09:12:05 +0200
+Subject: wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ]
+
+Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly
+support MLO scenario.
+
+Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++--
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 12 +++++++-----
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 ++-
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index f6590ef85c0d0..cb522153113ce 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -1321,11 +1321,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ case IEEE80211_AMPDU_RX_START:
+ mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid,
+ ssn, params->buf_size);
+- ret = mt7996_mcu_add_rx_ba(dev, params, link, true);
++ ret = mt7996_mcu_add_rx_ba(dev, params, link,
++ msta_link, true);
+ break;
+ case IEEE80211_AMPDU_RX_STOP:
+ mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid);
+- ret = mt7996_mcu_add_rx_ba(dev, params, link, false);
++ ret = mt7996_mcu_add_rx_ba(dev, params, link,
++ msta_link, false);
+ break;
+ case IEEE80211_AMPDU_TX_OPERATIONAL:
+ mtxq->aggr = true;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index a808218da394c..d422b65737966 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ static int
+ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
+ struct ieee80211_ampdu_params *params,
+- bool enable, bool tx)
++ struct mt76_wcid *wcid, bool enable, bool tx)
+ {
+- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
+ struct sta_rec_ba_uni *ba;
+ struct sk_buff *skb;
+ struct tlv *tlv;
+@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ if (enable && !params->amsdu)
+ msta_link->wcid.amsdu = false;
+
+- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true);
++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
++ enable, true);
+ }
+
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ struct ieee80211_ampdu_params *params,
+- struct mt7996_vif_link *link, bool enable)
++ struct mt7996_vif_link *link,
++ struct mt7996_sta_link *msta_link, bool enable)
+ {
+- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false);
++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
++ enable, false);
+ }
+
+ static void
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index 8509d508e1e19..bbd4679edc9d3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ struct mt7996_sta_link *msta_link, bool enable);
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ struct ieee80211_ampdu_params *params,
+- struct mt7996_vif_link *link, bool enable);
++ struct mt7996_vif_link *link,
++ struct mt7996_sta_link *msta_link, bool enable);
+ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
+ struct mt76_vif_link *mlink,
+ struct cfg80211_he_bss_color *he_bss_color);
+--
+2.51.0
+
--- /dev/null
+From ff2cc0a148f52e4dad2f746836e44332776873c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:17 +0200
+Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED
+ device
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]
+
+In order to properly set the number of rx packets for primary WED device
+if hif device is available, move hif pointer initialization before
+running mt7996_mmio_wed_init routine.
+
+Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+index 19e99bc1c6c41..f5ce50056ee94 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+ mdev = &dev->mt76;
+ mt7996_wfsys_reset(dev);
+ hif2 = mt7996_pci_init_hif2(pdev);
++ dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
+ if (ret < 0)
+@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+
+ if (hif2) {
+ hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
+- dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 04ea838323eed6cb17e6a5d442d87d692cb2e29f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:16 +0200
+Subject: wifi: mt76: mt7996: Fix tx-queues initialization for second phy on
+ mt7996
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ]
+
+Fix the second phy tx queue initialization if hif device is not
+available for MT7990 chipset.
+
+Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Co-developed-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Co-developed-by: Rex Lu <rex.lu@mediatek.com>
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/init.c | 21 ++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index a9599c286328e..be729db5b75c1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)
+
+ /* init wiphy according to mphy and phy */
+ mt7996_init_wiphy_band(mphy->hw, phy);
+- ret = mt7996_init_tx_queues(mphy->priv,
+- MT_TXQ_ID(band),
+- MT7996_TX_RING_SIZE,
+- MT_TXQ_RING_BASE(band) + hif1_ofs,
+- wed);
+- if (ret)
+- goto error;
++
++ if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) {
++ int i;
++
++ for (i = 0; i <= MT_TXQ_PSD; i++)
++ mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0];
++ } else {
++ ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band),
++ MT7996_TX_RING_SIZE,
++ MT_TXQ_RING_BASE(band) + hif1_ofs,
++ wed);
++ if (ret)
++ goto error;
++ }
+
+ ret = mt76_register_phy(mphy, true, mt76_rates,
+ ARRAY_SIZE(mt76_rates));
+--
+2.51.0
+
--- /dev/null
+From 8f0387f05c3f1afa599db49758065ce18482ceaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:58:56 +0200
+Subject: wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during
+ restart
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ]
+
+There is only one wiphy, so extra calls must be removed.
+For calls that need to remain per-wiphy, use mt7996_for_each_phy
+
+Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
+Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/mac.c | 137 +++++-------------
+ 1 file changed, 35 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index a7a5ac8b7d265..e276cd1dc0cee 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+ static int
+ mt7996_mac_restart(struct mt7996_dev *dev)
+ {
+- struct mt7996_phy *phy2, *phy3;
+ struct mt76_dev *mdev = &dev->mt76;
++ struct mt7996_phy *phy;
+ int i, ret;
+
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
+-
+ if (dev->hif2) {
+ mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
+ mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
+@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
+ }
+
+- set_bit(MT76_RESET, &dev->mphy.state);
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
++ mt7996_for_each_phy(dev, phy)
++ set_bit(MT76_RESET, &phy->mt76->state);
+ wake_up(&dev->mt76.mcu.wait);
+- if (phy2)
+- set_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- set_bit(MT76_RESET, &phy3->mt76->state);
+
+ /* lock/unlock all queues to ensure that no tx is pending */
+- mt76_txq_schedule_all(&dev->mphy);
+- if (phy2)
+- mt76_txq_schedule_all(phy2->mt76);
+- if (phy3)
+- mt76_txq_schedule_all(phy3->mt76);
++ mt7996_for_each_phy(dev, phy)
++ mt76_txq_schedule_all(phy->mt76);
+
+ /* disable all tx/rx napi */
+ mt76_worker_disable(&dev->mt76.tx_worker);
+@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ goto out;
+
+ mt7996_mac_init(dev);
+- mt7996_init_txpower(&dev->phy);
+- mt7996_init_txpower(phy2);
+- mt7996_init_txpower(phy3);
++ mt7996_for_each_phy(dev, phy)
++ mt7996_init_txpower(phy);
+ ret = mt7996_txbf_init(dev);
++ if (ret)
++ goto out;
+
+- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
+- ret = mt7996_run(&dev->phy);
+- if (ret)
+- goto out;
+- }
+-
+- if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
+- ret = mt7996_run(phy2);
+- if (ret)
+- goto out;
+- }
++ mt7996_for_each_phy(dev, phy) {
++ if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++ continue;
+
+- if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
+- ret = mt7996_run(phy3);
++ ret = mt7996_run(&dev->phy);
+ if (ret)
+ goto out;
+ }
+
+ out:
+ /* reset done */
+- clear_bit(MT76_RESET, &dev->mphy.state);
+- if (phy2)
+- clear_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- clear_bit(MT76_RESET, &phy3->mt76->state);
++ mt7996_for_each_phy(dev, phy)
++ clear_bit(MT76_RESET, &phy->mt76->state);
+
+ napi_enable(&dev->mt76.tx_napi);
+ local_bh_disable();
+@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ static void
+ mt7996_mac_full_reset(struct mt7996_dev *dev)
+ {
+- struct mt7996_phy *phy2, *phy3;
++ struct ieee80211_hw *hw = mt76_hw(dev);
++ struct mt7996_phy *phy;
+ int i;
+
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
+ dev->recovery.hw_full_reset = true;
+
+ wake_up(&dev->mt76.mcu.wait);
+- ieee80211_stop_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_stop_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_stop_queues(phy3->mt76->hw);
++ ieee80211_stop_queues(hw);
+
+ cancel_work_sync(&dev->wed_rro.work);
+- cancel_delayed_work_sync(&dev->mphy.mac_work);
+- if (phy2)
+- cancel_delayed_work_sync(&phy2->mt76->mac_work);
+- if (phy3)
+- cancel_delayed_work_sync(&phy3->mt76->mac_work);
++ mt7996_for_each_phy(dev, phy)
++ cancel_delayed_work_sync(&phy->mt76->mac_work);
+
+ mutex_lock(&dev->mt76.mutex);
+ for (i = 0; i < 10; i++) {
+@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+ dev_err(dev->mt76.dev, "chip full reset failed\n");
+
+ ieee80211_restart_hw(mt76_hw(dev));
+- if (phy2)
+- ieee80211_restart_hw(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_restart_hw(phy3->mt76->hw);
+-
+ ieee80211_wake_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_wake_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_wake_queues(phy3->mt76->hw);
+
+ dev->recovery.hw_full_reset = false;
+- ieee80211_queue_delayed_work(mt76_hw(dev),
+- &dev->mphy.mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy2)
+- ieee80211_queue_delayed_work(phy2->mt76->hw,
+- &phy2->mt76->mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy3)
+- ieee80211_queue_delayed_work(phy3->mt76->hw,
+- &phy3->mt76->mac_work,
++ mt7996_for_each_phy(dev, phy)
++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
+ MT7996_WATCHDOG_TIME);
+ }
+
+ void mt7996_mac_reset_work(struct work_struct *work)
+ {
+- struct mt7996_phy *phy2, *phy3;
++ struct ieee80211_hw *hw;
+ struct mt7996_dev *dev;
++ struct mt7996_phy *phy;
+ int i;
+
+ dev = container_of(work, struct mt7996_dev, reset_work);
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
++ hw = mt76_hw(dev);
+
+ /* chip full reset */
+ if (dev->recovery.restart) {
+@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ return;
+
+ dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
+- wiphy_name(dev->mt76.hw->wiphy));
++ wiphy_name(hw->wiphy));
+
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
+ mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2);
+@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ mtk_wed_device_stop(&dev->mt76.mmio.wed);
+
+ ieee80211_stop_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_stop_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_stop_queues(phy3->mt76->hw);
+
+ set_bit(MT76_RESET, &dev->mphy.state);
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
+ wake_up(&dev->mt76.mcu.wait);
+
+ cancel_work_sync(&dev->wed_rro.work);
+- cancel_delayed_work_sync(&dev->mphy.mac_work);
+- if (phy2) {
+- set_bit(MT76_RESET, &phy2->mt76->state);
+- cancel_delayed_work_sync(&phy2->mt76->mac_work);
+- }
+- if (phy3) {
+- set_bit(MT76_RESET, &phy3->mt76->state);
+- cancel_delayed_work_sync(&phy3->mt76->mac_work);
++ mt7996_for_each_phy(dev, phy) {
++ set_bit(MT76_RESET, &phy->mt76->state);
++ cancel_delayed_work_sync(&phy->mt76->mac_work);
+ }
++
+ mt76_worker_disable(&dev->mt76.tx_worker);
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ }
+
+ clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+- clear_bit(MT76_RESET, &dev->mphy.state);
+- if (phy2)
+- clear_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- clear_bit(MT76_RESET, &phy3->mt76->state);
++ mt7996_for_each_phy(dev, phy)
++ clear_bit(MT76_RESET, &phy->mt76->state);
+
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ napi_schedule(&dev->mt76.tx_napi);
+ local_bh_enable();
+
+- ieee80211_wake_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_wake_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_wake_queues(phy3->mt76->hw);
++ ieee80211_wake_queues(hw);
+
+ mutex_unlock(&dev->mt76.mutex);
+
+ mt7996_update_beacons(dev);
+
+- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy2)
+- ieee80211_queue_delayed_work(phy2->mt76->hw,
+- &phy2->mt76->mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy3)
+- ieee80211_queue_delayed_work(phy3->mt76->hw,
+- &phy3->mt76->mac_work,
++ mt7996_for_each_phy(dev, phy)
++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
+ MT7996_WATCHDOG_TIME);
+ dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ wiphy_name(dev->mt76.hw->wiphy));
+--
+2.51.0
+
--- /dev/null
+From 12935b6800c9c89fe7b62aa78075b4b0b7147a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 00:14:37 +0200
+Subject: wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ]
+
+Do not always use deflink_id in link_sta_rc_update mac80211
+callback but use the proper link_id provided by mac80211.
+
+Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/main.c | 43 ++++++++++++-------
+ 1 file changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 1394155a68ce7..92ddb35ea8747 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -1655,19 +1655,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ }
+ }
+
+-static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
++static void mt7996_link_rate_ctrl_update(void *data,
++ struct mt7996_sta_link *msta_link)
+ {
+- struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta *msta = msta_link->sta;
+ struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
+- struct mt7996_sta_link *msta_link;
+ u32 *changed = data;
+
+- rcu_read_lock();
+-
+- msta_link = rcu_dereference(msta->link[msta->deflink_id]);
+- if (!msta_link)
+- goto out;
+-
+ spin_lock_bh(&dev->mt76.sta_poll_lock);
+
+ msta_link->changed |= *changed;
+@@ -1675,8 +1669,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
+ list_add_tail(&msta_link->rc_list, &dev->sta_rc_list);
+
+ spin_unlock_bh(&dev->mt76.sta_poll_lock);
+-out:
+- rcu_read_unlock();
+ }
+
+ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1684,11 +1676,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_sta,
+ u32 changed)
+ {
+- struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ struct ieee80211_sta *sta = link_sta->sta;
++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta_link *msta_link;
+
+- mt7996_link_rate_ctrl_update(&changed, sta);
+- ieee80211_queue_work(hw, &dev->rc_work);
++ rcu_read_lock();
++
++ msta_link = rcu_dereference(msta->link[link_sta->link_id]);
++ if (msta_link) {
++ struct mt7996_dev *dev = mt7996_hw_dev(hw);
++
++ mt7996_link_rate_ctrl_update(&changed, msta_link);
++ ieee80211_queue_work(hw, &dev->rc_work);
++ }
++
++ rcu_read_unlock();
++}
++
++static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
++{
++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta_link *msta_link;
++ u32 *changed = data;
++
++ msta_link = rcu_dereference(msta->link[msta->deflink_id]);
++ if (msta_link)
++ mt7996_link_rate_ctrl_update(&changed, msta_link);
+ }
+
+ static int
+@@ -1709,7 +1722,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
+ * then multiple MCS setting (MCS 4,5,6) is not supported.
+ */
+- ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update,
++ ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update,
+ &changed);
+ ieee80211_queue_work(hw, &dev->rc_work);
+
+--
+2.51.0
+
--- /dev/null
+From caaba2618a45ceca6f70fbe3f52065aa4661b56f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 8085a1ae4bdbb..a57c72d6533c4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From e1ceaf1d26f0a0cd8da64de849a90fda67613950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 23:08:24 +0300
+Subject: wifi: rtw88: Lock rtwdev->mutex before setting the LED
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ]
+
+Some users report that the LED blinking breaks AP mode somehow. Most
+likely the LED code and the dynamic mechanism are trying to access the
+hardware registers at the same time. Fix it by locking rtwdev->mutex
+before setting the LED and unlocking it after.
+
+Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking")
+Closes: https://github.com/lwfinger/rtw88/issues/305
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
+index 25aa6cbaa7286..7f9ace351a5b7 100644
+--- a/drivers/net/wireless/realtek/rtw88/led.c
++++ b/drivers/net/wireless/realtek/rtw88/led.c
+@@ -6,13 +6,23 @@
+ #include "debug.h"
+ #include "led.h"
+
+-static int rtw_led_set_blocking(struct led_classdev *led,
+- enum led_brightness brightness)
++static void rtw_led_set(struct led_classdev *led,
++ enum led_brightness brightness)
+ {
+ struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
+
++ mutex_lock(&rtwdev->mutex);
++
+ rtwdev->chip->ops->led_set(led, brightness);
+
++ mutex_unlock(&rtwdev->mutex);
++}
++
++static int rtw_led_set_blocking(struct led_classdev *led,
++ enum led_brightness brightness)
++{
++ rtw_led_set(led, brightness);
++
+ return 0;
+ }
+
+@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
+ return;
+
+ if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+- led->brightness_set = rtwdev->chip->ops->led_set;
++ led->brightness_set = rtw_led_set;
+ else
+ led->brightness_set_blocking = rtw_led_set_blocking;
+
+--
+2.51.0
+
--- /dev/null
+From 96a3944040eea2b6d1c858c1b480d8e3b1d4ffd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 21:46:02 +0300
+Subject: wifi: rtw88: Use led->brightness_set_blocking for PCI too
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ]
+
+Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting
+the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by
+using the brightness_set_blocking member of struct led_classdev for
+PCI devices too. This one is allowed to sleep.
+
+bad: scheduling from the idle thread!
+nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary)
+nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE
+nix kernel: Hardware name: [REDACTED]
+nix kernel: Call Trace:
+nix kernel: <IRQ>
+nix kernel: dump_stack_lvl+0x63/0x90
+nix kernel: dequeue_task_idle+0x2d/0x50
+nix kernel: __schedule+0x191/0x1310
+nix kernel: ? xas_load+0x11/0xd0
+nix kernel: schedule+0x2b/0xe0
+nix kernel: schedule_preempt_disabled+0x19/0x30
+nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0
+nix kernel: rtw_led_set+0x27/0x60 [rtw_core]
+nix kernel: led_blink_set_nosleep+0x56/0xb0
+nix kernel: led_trigger_blink+0x49/0x80
+nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
+nix kernel: call_timer_fn+0x2f/0x140
+nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
+nix kernel: __run_timers+0x21a/0x2b0
+nix kernel: run_timer_softirq+0x8e/0x100
+nix kernel: handle_softirqs+0xea/0x2c0
+nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5
+nix kernel: __irq_exit_rcu+0xdc/0x100
+nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90
+nix kernel: </IRQ>
+nix kernel: <TASK>
+nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20
+nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450
+nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0>
+nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246
+nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
+nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000
+nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400
+nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003
+nix kernel: ? cpuidle_enter_state+0xbc/0x450
+nix kernel: cpuidle_enter+0x32/0x50
+nix kernel: do_idle+0x1b1/0x210
+nix kernel: cpu_startup_entry+0x2d/0x30
+nix kernel: start_secondary+0x118/0x140
+nix kernel: common_startup_64+0x13e/0x141
+nix kernel: </TASK>
+
+Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
+index 7f9ace351a5b7..4cc62e49d1679 100644
+--- a/drivers/net/wireless/realtek/rtw88/led.c
++++ b/drivers/net/wireless/realtek/rtw88/led.c
+@@ -6,8 +6,8 @@
+ #include "debug.h"
+ #include "led.h"
+
+-static void rtw_led_set(struct led_classdev *led,
+- enum led_brightness brightness)
++static int rtw_led_set(struct led_classdev *led,
++ enum led_brightness brightness)
+ {
+ struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
+
+@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led,
+ rtwdev->chip->ops->led_set(led, brightness);
+
+ mutex_unlock(&rtwdev->mutex);
+-}
+-
+-static int rtw_led_set_blocking(struct led_classdev *led,
+- enum led_brightness brightness)
+-{
+- rtw_led_set(led, brightness);
+
+ return 0;
+ }
+@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
+ if (!rtwdev->chip->ops->led_set)
+ return;
+
+- if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+- led->brightness_set = rtw_led_set;
+- else
+- led->brightness_set_blocking = rtw_led_set_blocking;
++ led->brightness_set_blocking = rtw_led_set;
+
+ snprintf(rtwdev->led_name, sizeof(rtwdev->led_name),
+ "rtw88-%s", dev_name(rtwdev->dev));
+--
+2.51.0
+
--- /dev/null
+From cbbc56d667df5e484d700b66d89225c4c9bbb9b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:50 +0300
+Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
+
+Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
+scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
+wiphy lock inside. However, this workqueue can be flushed when e.g.
+closing the interface and wiphy lock is already taken in that case.
+
+Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
+the global workqueue.
+
+[1]:
+
+ WARNING: possible circular locking dependency detected
+ 6.17.0-rc2 #17 Not tainted
+ ------------------------------------------------------
+ kworker/u32:1/61 is trying to acquire lock:
+ ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
+
+ but task is already holding lock:
+ ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
+ process_one_work+0x7c6/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
+ touch_wq_lockdep_map+0x8e/0x180
+ __flush_workqueue+0x129/0x10d0
+ ieee80211_stop_device+0xa8/0x110
+ ieee80211_do_stop+0x14ce/0x2880
+ ieee80211_stop+0x13a/0x2c0
+ __dev_close_many+0x18f/0x510
+ __dev_change_flags+0x25f/0x670
+ netif_change_flags+0x7b/0x160
+ do_setlink.isra.0+0x1640/0x35d0
+ rtnl_newlink+0xd8c/0x1d30
+ rtnetlink_rcv_msg+0x700/0xb80
+ netlink_rcv_skb+0x11d/0x350
+ netlink_unicast+0x49a/0x7a0
+ netlink_sendmsg+0x759/0xc20
+ ____sys_sendmsg+0x812/0xa00
+ ___sys_sendmsg+0xf7/0x180
+ __sys_sendmsg+0x11f/0x1b0
+ do_syscall_64+0xbb/0x360
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock((wq_completion)phy0);
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock(&rdev->wiphy.mtx);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u32:1/61:
+ #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
+ #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
+ Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ print_circular_bug.cold+0x178/0x1be
+ check_noncircular+0x14c/0x170
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index 869ab22a79681..803c88d37ec37 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
+
+ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ {
+- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ struct ser_msg *msg = NULL;
+
+ if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
+@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ list_add(&msg->list, &ser->msg_q);
+ spin_unlock_irq(&ser->msg_q_lock);
+
+- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
++ schedule_work(&ser->ser_hdl_work);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a6b298b22af29727562c33bbe32f21b428ef68a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:49 +0300
+Subject: wifi: rtw89: fix leak in rtw89_core_send_nullfunc()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ]
+
+If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated
+skb is leaked. Free it on the error handling path.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index b506afaaa3ec9..725f668308b8e 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -3389,6 +3389,7 @@ static int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev,
+ rtwsta_link = rtwsta->links[rtwvif_link->link_id];
+ if (unlikely(!rtwsta_link)) {
+ ret = -ENOLINK;
++ dev_kfree_skb_any(skb);
+ goto out;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9e09c5e5e76f1bb0480722f36d5a266d2faaf00d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 77d8f49b92bdd..f59ae7186940a 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 3f8d7dcfa81fdc4d7b6d4a21dcf9dbecc92666b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:39:17 +0800
+Subject: accel/amdxdna: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 24de3daf6179bce3710527b8292d7ee6f1b56393 ]
+
+Change the 'ret' variable from u32 to int to store -EINVAL. Storing the
+negative error codes in unsigned type, doesn't cause an issue at runtime
+but it's ugly as pants.
+
+Additionally, assigning -EINVAL to u32 ret (i.e., u32 ret = -EINVAL) may
+trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://lore.kernel.org/r/20250828033917.113364-1-rongqianfeng@vivo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/aie2_ctx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
+index 2cff5419bd2fa..cda964ba33cd7 100644
+--- a/drivers/accel/amdxdna/aie2_ctx.c
++++ b/drivers/accel/amdxdna/aie2_ctx.c
+@@ -192,7 +192,7 @@ aie2_sched_resp_handler(void *handle, void __iomem *data, size_t size)
+ {
+ struct amdxdna_sched_job *job = handle;
+ struct amdxdna_gem_obj *cmd_abo;
+- u32 ret = 0;
++ int ret = 0;
+ u32 status;
+
+ cmd_abo = job->cmd_bo;
+@@ -222,7 +222,7 @@ static int
+ aie2_sched_nocmd_resp_handler(void *handle, void __iomem *data, size_t size)
+ {
+ struct amdxdna_sched_job *job = handle;
+- u32 ret = 0;
++ int ret = 0;
+ u32 status;
+
+ if (unlikely(!data))
+@@ -250,7 +250,7 @@ aie2_sched_cmdlist_resp_handler(void *handle, void __iomem *data, size_t size)
+ u32 fail_cmd_status;
+ u32 fail_cmd_idx;
+ u32 cmd_status;
+- u32 ret = 0;
++ int ret = 0;
+
+ cmd_abo = job->cmd_bo;
+ if (unlikely(!data) || unlikely(size != sizeof(u32) * 3)) {
+--
+2.51.0
+
--- /dev/null
+From 9cde184d33b6f62ba95605202f8893efd1347f36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ae035b93da087..3eb56b77cb6d9 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From fa97bb57b0bd6d42e278502b407a6b3168bb1999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 2c2dc559e0f8d..d0fc045a8d310 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 52541511e1ff4c3f7a6fdf776cbe4d161efa1271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 21:55:35 +0200
+Subject: ACPICA: Apply ACPI_NONSTRING
+
+From: Ahmed Salem <x0rw3ll@gmail.com>
+
+[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ]
+
+Add ACPI_NONSTRING for destination char arrays without a terminating NUL
+character.
+
+This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
+where a few more destination arrays were missed.
+
+Link: https://github.com/acpica/acpica/commit/f359e5ed
+Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
+Signed-off-by: Ahmed Salem <x0rw3ll@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/actbl.h | 2 +-
+ tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
+index 243097a3da636..8a67d4ea6e3fe 100644
+--- a/include/acpi/actbl.h
++++ b/include/acpi/actbl.h
+@@ -73,7 +73,7 @@ struct acpi_table_header {
+ char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM identification */
+ char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING; /* ASCII OEM table identification */
+ u32 oem_revision; /* OEM revision number */
+- char asl_compiler_id[ACPI_NAMESEG_SIZE]; /* ASCII ASL compiler vendor ID */
++ char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING; /* ASCII ASL compiler vendor ID */
+ u32 asl_compiler_revision; /* ASL compiler version */
+ };
+
+diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+index 9741e7503591c..de93067a5da32 100644
+--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
++++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory)
+ {
+ void *table_dir;
+ u32 instance;
+- char temp_name[ACPI_NAMESEG_SIZE];
++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
+ char *filename;
+ acpi_status status = AE_OK;
+
+@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname,
+ {
+ void *table_dir;
+ u32 current_instance = 0;
+- char temp_name[ACPI_NAMESEG_SIZE];
++ char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
+ char table_filename[PATH_MAX];
+ char *filename;
+ acpi_status status;
+--
+2.51.0
+
--- /dev/null
+From cbfd46a690eae599f06b9506c8d7cf518a7f341d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:03:16 +0200
+Subject: ACPICA: Fix largest possible resource descriptor index
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
+
+ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
+used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
+
+Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
+clamped incorrectly and resulting value may issue an out-of-bounds
+access for 'acpi_gbl_resource_types' array. Compile tested only.
+
+Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
+Link: https://github.com/acpica/acpica/commit/cf00116c
+Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/aclocal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
+index 0c41f0097e8d7..f98640086f4ef 100644
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -1141,7 +1141,7 @@ struct acpi_port_info {
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92
+ #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93
+-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94
++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93
+
+ /*****************************************************************************
+ *
+--
+2.51.0
+
--- /dev/null
+From 8004f7c8be38b92445a47cfbb4dba382e6ac0f75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index 9d95ecb299aed..a99acd1125e74 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 87c39a99bc32406e8f6a43d9cf59a9cd288eab1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:28:51 +0200
+Subject: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
+ PREEMPT_RT
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]
+
+snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
+via spin_lock_irq(). This also implicitly disables the handling of
+softirqs such as TIMER_SOFTIRQ.
+On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
+disable them. That means a timer can be invoked during spin_lock_irq()
+on the same CPU. Due to synchronisations reasons local_bh_disable() has
+a per-CPU lock named softirq_ctrl.lock which synchronizes individual
+softirq against each other.
+syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
+acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
+is a possible deadlock.
+
+The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
+would lead to too much synchronisation against individual threads on the
+system. To avoid the possible deadlock, softirqs must be manually
+disabled before the lock is acquired.
+
+Disable softirqs before the lock is acquired on PREEMPT_RT.
+
+Reported-by: syzbot+10b4363fb0f46527f3f3@syzkaller.appspotmail.com
+Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_native.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 1eab940fa2e5a..68bee40c9adaf 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
+ }
+
+ /* define group lock helpers */
+-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
++#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
+ static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
+ { \
+- if (nonatomic) \
++ if (nonatomic) { \
+ mutex_ ## mutex_action(&group->mutex); \
+- else \
+- spin_ ## action(&group->lock); \
+-}
+-
+-DEFINE_PCM_GROUP_LOCK(lock, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock, unlock);
+-DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
+-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
++ } else { \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock) \
++ local_bh_disable(); \
++ spin_ ## action(&group->lock); \
++ if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
++ local_bh_enable(); \
++ } \
++}
++
++DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
++DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
++DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
+
+ /**
+ * snd_pcm_stream_lock - Lock the PCM stream
+--
+2.51.0
+
--- /dev/null
+From 0c861e3c908dbe96d38b80107505ece7ca6c36cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 15:09:52 +0200
+Subject: arch: copy_thread: pass clone_flags as u64
+
+From: Simon Schuster <schuster.simon@siemens-energy.com>
+
+[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ]
+
+With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
+clone3") the effective bit width of clone_flags on all architectures was
+increased from 32-bit to 64-bit, with a new type of u64 for the flags.
+However, for most consumers of clone_flags the interface was not
+changed from the previous type of unsigned long.
+
+While this works fine as long as none of the new 64-bit flag bits
+(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
+undesirable in terms of the principle of least surprise.
+
+Thus, this commit fixes all relevant interfaces of the copy_thread
+function that is called from copy_process to consistently pass
+clone_flags as u64, so that no truncation to 32-bit integers occurs on
+32-bit architectures.
+
+Signed-off-by: Simon Schuster <schuster.simon@siemens-energy.com>
+Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-3-53fcf5577d57@siemens-energy.com
+Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread")
+Acked-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
+Acked-by: Andreas Larsson <andreas@gaisler.com> # sparc
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/kernel/process.c | 2 +-
+ arch/arc/kernel/process.c | 2 +-
+ arch/arm/kernel/process.c | 2 +-
+ arch/arm64/kernel/process.c | 2 +-
+ arch/csky/kernel/process.c | 2 +-
+ arch/hexagon/kernel/process.c | 2 +-
+ arch/loongarch/kernel/process.c | 2 +-
+ arch/m68k/kernel/process.c | 2 +-
+ arch/microblaze/kernel/process.c | 2 +-
+ arch/mips/kernel/process.c | 2 +-
+ arch/nios2/kernel/process.c | 2 +-
+ arch/openrisc/kernel/process.c | 2 +-
+ arch/parisc/kernel/process.c | 2 +-
+ arch/powerpc/kernel/process.c | 2 +-
+ arch/riscv/kernel/process.c | 2 +-
+ arch/s390/kernel/process.c | 2 +-
+ arch/sh/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_64.c | 2 +-
+ arch/um/kernel/process.c | 2 +-
+ arch/x86/include/asm/fpu/sched.h | 2 +-
+ arch/x86/include/asm/shstk.h | 4 ++--
+ arch/x86/kernel/fpu/core.c | 2 +-
+ arch/x86/kernel/process.c | 2 +-
+ arch/x86/kernel/shstk.c | 2 +-
+ arch/xtensa/kernel/process.c | 2 +-
+ 26 files changed, 27 insertions(+), 27 deletions(-)
+
+diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
+index 582d96548385d..06522451f018f 100644
+--- a/arch/alpha/kernel/process.c
++++ b/arch/alpha/kernel/process.c
+@@ -231,7 +231,7 @@ flush_thread(void)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ extern void ret_from_fork(void);
+diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
+index 186ceab661eb0..8166d09087130 100644
+--- a/arch/arc/kernel/process.c
++++ b/arch/arc/kernel/process.c
+@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void);
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *c_regs; /* child's pt_regs */
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index e16ed102960cb..d7aa95225c70b 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long stack_start = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *thread = task_thread_info(p);
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 96482a1412c6a..fba7ca102a8c4 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -409,7 +409,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long stack_start = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
+index 0c6e4b17fe00f..a7a90340042a5 100644
+--- a/arch/csky/kernel/process.c
++++ b/arch/csky/kernel/process.c
+@@ -32,7 +32,7 @@ void flush_thread(void){}
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct switch_stack *childstack;
+diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
+index 2a77bfd756945..15b4992bfa298 100644
+--- a/arch/hexagon/kernel/process.c
++++ b/arch/hexagon/kernel/process.c
+@@ -52,7 +52,7 @@ void arch_cpu_idle(void)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c
+index 3582f591bab28..efd9edf65603c 100644
+--- a/arch/loongarch/kernel/process.c
++++ b/arch/loongarch/kernel/process.c
+@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ unsigned long childksp;
+ unsigned long tls = args->tls;
+ unsigned long usp = args->stack;
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ struct pt_regs *childregs, *regs = current_pt_regs();
+
+ childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
+diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
+index fda7eac23f872..f5a07a70e9385 100644
+--- a/arch/m68k/kernel/process.c
++++ b/arch/m68k/kernel/process.c
+@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct fork_frame {
+diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
+index 56342e11442d2..6cbf642d7b801 100644
+--- a/arch/microblaze/kernel/process.c
++++ b/arch/microblaze/kernel/process.c
+@@ -54,7 +54,7 @@ void flush_thread(void)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 02aa6a04a21da..29191fa1801e2 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
+index f84021303f6a8..151404139085c 100644
+--- a/arch/nios2/kernel/process.c
++++ b/arch/nios2/kernel/process.c
+@@ -101,7 +101,7 @@ void flush_thread(void)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
+index eef99fee2110c..73ffb9fa3118b 100644
+--- a/arch/openrisc/kernel/process.c
++++ b/arch/openrisc/kernel/process.c
+@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void);
+ int
+ copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *userregs;
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index ed93bd8c15453..e64ab5d2a40d6 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init);
+ int
+ copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *cregs = &(p->thread.regs);
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 855e098865032..eb23966ac0a9f 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ f = ret_from_kernel_user_thread;
+ } else {
+ struct pt_regs *regs = current_pt_regs();
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+
+ /* Copy registers */
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index a0a40889d79a5..31a392993cb45 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index f55f09cda6f88..b107dbca4ed7d 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -106,7 +106,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long new_stackp = args->stack;
+ unsigned long tls = args->tls;
+ struct fake_frame
+diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
+index 92b6649d49295..62f753a85b89c 100644
+--- a/arch/sh/kernel/process_32.c
++++ b/arch/sh/kernel/process_32.c
+@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void);
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
+index 9c7c662cb5659..5a28c0e91bf15 100644
+--- a/arch/sparc/kernel/process_32.c
++++ b/arch/sparc/kernel/process_32.c
+@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void);
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *ti = task_thread_info(p);
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index 529adfecd58ca..25781923788a0 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs)
+ */
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct thread_info *t = task_thread_info(p);
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 1be644de9e41e..9c9c66dc45f05 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -143,7 +143,7 @@ static void fork_handler(void)
+
+ int copy_thread(struct task_struct * p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ void (*handler)(void);
+diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
+index c060549c6c940..89004f4ca208d 100644
+--- a/arch/x86/include/asm/fpu/sched.h
++++ b/arch/x86/include/asm/fpu/sched.h
+@@ -11,7 +11,7 @@
+
+ extern void save_fpregs_to_fpstate(struct fpu *fpu);
+ extern void fpu__drop(struct task_struct *tsk);
+-extern int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
++extern int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
+ unsigned long shstk_addr);
+ extern void fpu_flush_thread(void);
+
+diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
+index ba6f2fe438488..0f50e01259430 100644
+--- a/arch/x86/include/asm/shstk.h
++++ b/arch/x86/include/asm/shstk.h
+@@ -16,7 +16,7 @@ struct thread_shstk {
+
+ long shstk_prctl(struct task_struct *task, int option, unsigned long arg2);
+ void reset_thread_features(void);
+-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags,
++unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags,
+ unsigned long stack_size);
+ void shstk_free(struct task_struct *p);
+ int setup_signal_shadow_stack(struct ksignal *ksig);
+@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option,
+ unsigned long arg2) { return -EINVAL; }
+ static inline void reset_thread_features(void) {}
+ static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p,
+- unsigned long clone_flags,
++ u64 clone_flags,
+ unsigned long stack_size) { return 0; }
+ static inline void shstk_free(struct task_struct *p) {}
+ static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index aefd412a23dc2..1f71cc135e9ad 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -631,7 +631,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp)
+ }
+
+ /* Clone current's FPU state on fork */
+-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
++int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
+ unsigned long ssp)
+ {
+ /*
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 1b7960cf6eb0c..e3a3987b0c4fb 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs,
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long sp = args->stack;
+ unsigned long tls = args->tls;
+ struct inactive_task_frame *frame;
+diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
+index 2ddf23387c7ef..5eba6c5a67757 100644
+--- a/arch/x86/kernel/shstk.c
++++ b/arch/x86/kernel/shstk.c
+@@ -191,7 +191,7 @@ void reset_thread_features(void)
+ current->thread.features_locked = 0;
+ }
+
+-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags,
++unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags,
+ unsigned long stack_size)
+ {
+ struct thread_shstk *shstk = &tsk->thread.shstk;
+diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
+index 7bd66677f7b6d..94d43f44be131 100644
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+
+ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
+ {
+- unsigned long clone_flags = args->flags;
++ u64 clone_flags = args->flags;
+ unsigned long usp_thread_fn = args->stack;
+ unsigned long tls = args->tls;
+ struct pt_regs *childregs = task_pt_regs(p);
+--
+2.51.0
+
--- /dev/null
+From 5115b6921c8721095cf3bbce169c985f84b19257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index e23b868340965..7e6c94f8edeef 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -904,7 +904,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCKx settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -980,7 +980,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From e5c1b06a55f546a40be83779303ff557f192db39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 23:59:57 +0200
+Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
+ property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
+
+The dtbs_check validation for am335x-cm-t335.dtb flags an error
+for an unevaluated 'num-serializer' property in the mcasp0 node.
+
+This property is obsolete; it is not defined in the davinci-mcasp-audio
+schema and is not used by the corresponding (or any) driver.
+
+Remove this unused property to fix the schema validation warning.
+
+Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+index 06767ea164b59..ece7f7854f6aa 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+@@ -483,8 +483,6 @@ &mcasp1 {
+
+ op-mode = <0>; /* MCASP_IIS_MODE */
+ tdm-slots = <2>;
+- /* 16 serializers */
+- num-serializer = <16>;
+ serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */
+ 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
+ >;
+--
+2.51.0
+
--- /dev/null
+From 08673aee545f571191aea6f52246016e01a8163f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 15:49:48 +0200
+Subject: ARM: dts: renesas: porter: Fix CAN pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
+
+According to the schematics, the CAN transceiver is connected to pins
+GP7_3 and GP7_4, which correspond to CAN0 data group B.
+
+Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+index f518eadd8b9cd..81b3c5d74e9b3 100644
+--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+@@ -289,7 +289,7 @@ vin0_pins: vin0 {
+ };
+
+ can0_pins: can0 {
+- groups = "can0_data";
++ groups = "can0_data_b";
+ function = "can0";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 46194a23e76b99a641ac74a2cfcbf26732870e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 00:51:15 +0200
+Subject: ARM: dts: stm32: stm32mp151c-plyaqm: Use correct dai-format property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 0b367e60c73c05721cf2156fe8fe077320115ffd ]
+
+The stm32-i2s binding inherits from the standard audio-graph-port
+schema for its 'port' subnode, audio-graph-port requires the use
+of the 'dai-format' property. The stm32mp151c-plyaqm dts file was
+using the non-standard name 'format'.
+
+Correct the property name to 'dai-format' to fix the dtbs_check
+validation error.
+
+Fixes: 9365fa46be358 ("ARM: dts: stm32: Add Plymovent AQM devicetree")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830225115.303663-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
+index 39a3211c61337..55fe916740d7c 100644
+--- a/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
++++ b/arch/arm/boot/dts/st/stm32mp151c-plyaqm.dts
+@@ -239,7 +239,7 @@ &i2s1 {
+
+ i2s1_port: port {
+ i2s1_endpoint: endpoint {
+- format = "i2s";
++ dai-format = "i2s";
+ mclk-fs = <256>;
+ remote-endpoint = <&codec_endpoint>;
+ };
+--
+2.51.0
+
--- /dev/null
+From e189352fe83b86ae4657af8fbf2ca1e4064af3a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:25:30 +0200
+Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in
+ DTS to use correct boolean syntax
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
+
+The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
+schema, was incorrectly assigned a value (<1>) in the DTS file, causing
+a validation error: "size (4) error for type flag". The driver uses
+of_property_read_bool(), expecting a boolean. Remove the value to fix
+the dtbs_check error.
+
+Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
+Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+index ae2e8dffbe049..ea47f9960c356 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+@@ -269,7 +269,7 @@ &tps {
+ vcc7-supply = <&vbat>;
+ vccio-supply = <&vbat>;
+
+- ti,en-ck32k-xtal = <1>;
++ ti,en-ck32k-xtal;
+
+ regulators {
+ vrtc_reg: regulator@0 {
+--
+2.51.0
+
--- /dev/null
+From 59396fc27abfcab6e6d212628c7babcbca8bb432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:50:52 +0200
+Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on
+ property to use correct boolean syntax in DTS
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
+
+The ti,keep-vref-on property, defined as a boolean flag in the Device
+Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
+causing a validation error: "size (4) error for type flag". Remove
+the value to match the schema and ensure compatibility with the driver
+using device_property_read_bool(). This fixes the dtbs_check error.
+
+Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+index a7f99ae0c1fe9..78c657429f641 100644
+--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+@@ -65,7 +65,7 @@ ads7846@0 {
+ ti,debounce-max = /bits/ 16 <10>;
+ ti,debounce-tol = /bits/ 16 <5>;
+ ti,debounce-rep = /bits/ 16 <1>;
+- ti,keep-vref-on = <1>;
++ ti,keep-vref-on;
+ ti,settle-delay-usec = /bits/ 16 <150>;
+
+ wakeup-source;
+--
+2.51.0
+
--- /dev/null
+From 5c33bf816b87f0fd2de44cb37a001a29175c609c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 02:10:55 +0800
+Subject: arm64: dts: allwinner: a527: cubie-a5e: Add ethernet PHY reset
+ setting
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit a15f095b590bcc1968fbf2ced8fe87fbd8d012e0 ]
+
+The external Ethernet PHY has a reset pin that is connected to the SoC.
+It is missing from the original submission.
+
+Add it to complete the description.
+
+Fixes: acca163f3f51 ("arm64: dts: allwinner: a527: add EMAC0 to Radxa A5E board")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250908181059.1785605-7-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+index 553ad774ed13d..43251042d1bd5 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+@@ -75,6 +75,9 @@ &mdio0 {
+ ext_rgmii_phy: ethernet-phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+ reg = <1>;
++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
++ reset-assert-us = <10000>;
++ reset-deassert-us = <150000>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e17267805ed68996a916e0716fa24aebd183565e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 01:59:27 +0800
+Subject: arm64: dts: allwinner: a527: cubie-a5e: Add LEDs
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 4184f0190792aea06553af963741a24cc9b47689 ]
+
+The Radxa Cubie A5E has a 3-color LED. The green and blue LEDs are wired
+to GPIO pins on the SoC, and the green one is lit by default to serve as
+a power indicator. The red LED is wired to the M.2 slot.
+
+Add device nodes for the green and blue LEDs.
+
+A default "heartbeat" trigger is set for the green power LED, though in
+practice it might be better if it were inverted, i.e. lit most of the
+time.
+
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250812175927.2199219-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Stable-dep-of: 9f01e1e14e71 ("arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/allwinner/sun55i-a527-cubie-a5e.dts | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+index 43251042d1bd5..d4cee22221045 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+@@ -6,6 +6,7 @@
+ #include "sun55i-a523.dtsi"
+
+ #include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
+
+ / {
+ model = "Radxa Cubie A5E";
+@@ -27,6 +28,24 @@ ext_osc32k: ext-osc32k-clk {
+ clock-output-names = "ext_osc32k";
+ };
+
++ leds {
++ compatible = "gpio-leds";
++
++ power-led {
++ function = LED_FUNCTION_POWER;
++ color = <LED_COLOR_ID_GREEN>;
++ gpios = <&r_pio 0 4 GPIO_ACTIVE_LOW>; /* PL4 */
++ default-state = "on";
++ linux,default-trigger = "heartbeat";
++ };
++
++ use-led {
++ function = LED_FUNCTION_ACTIVITY;
++ color = <LED_COLOR_ID_BLUE>;
++ gpios = <&r_pio 0 5 GPIO_ACTIVE_LOW>; /* PL5 */
++ };
++ };
++
+ reg_vcc5v: vcc5v {
+ /* board wide 5V supply from the USB-C connector */
+ compatible = "regulator-fixed";
+--
+2.51.0
+
--- /dev/null
+From 26c27e9034e9200ec6a98a59cc35afc42b159659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:24:48 +0800
+Subject: arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz
+ crystal
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 9f01e1e14e71defefcb4d6823b8476a15f3cf04a ]
+
+The Radxa Cubie A5E has empty pads for a 32.768 KHz crystal, but it is
+left unpopulated, as per the schematics and seen on board images. A dead
+give away is the RTC's LOSC auto switch register showing the external
+OSC to be abnormal.
+
+Drop the external crystal from the device tree. It was not referenced
+anyway.
+
+Fixes: c2520cd032ae ("arm64: dts: allwinner: a523: add Radxa A5E support")
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250913102450.3935943-1-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+index d4cee22221045..514c221a7a866 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+@@ -21,13 +21,6 @@ chosen {
+ stdout-path = "serial0:115200n8";
+ };
+
+- ext_osc32k: ext-osc32k-clk {
+- #clock-cells = <0>;
+- compatible = "fixed-clock";
+- clock-frequency = <32768>;
+- clock-output-names = "ext_osc32k";
+- };
+-
+ leds {
+ compatible = "gpio-leds";
+
+--
+2.51.0
+
--- /dev/null
+From 1af0bd3da5c5b19f781190d45a6181e659872e3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 02:10:57 +0800
+Subject: arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset
+ setting
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ]
+
+The external Ethernet PHY has a reset pin that is connected to the SoC.
+It is missing from the original submission.
+
+Add it to complete the description.
+
+Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250908181059.1785605-9-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+index b9eeb6753e9e3..e7713678208d4 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+@@ -85,6 +85,9 @@ &mdio0 {
+ ext_rgmii_phy: ethernet-phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+ reg = <1>;
++ reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
++ reset-assert-us = <10000>;
++ reset-deassert-us = <150000>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 187d60fc889d3f56bbea7de51227c3a4cb8cccb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:24:49 +0800
+Subject: arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ]
+
+When the board was added, its external 32.768 KHz crystal was described
+but not hooked up correctly. This meant the device had to fall back to
+the SoC's internal oscillator or divide a 32 KHz clock from the main
+oscillator, neither of which are accurate for the RTC. As a result the
+RTC clock will drift badly.
+
+Hook the crystal up to the RTC block and request the correct clock rate.
+
+Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250913102450.3935943-2-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+index e7713678208d4..4e71055fbd159 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+@@ -309,6 +309,14 @@ &r_pio {
+ vcc-pm-supply = <®_aldo3>;
+ };
+
++&rtc {
++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
++ clock-names = "bus", "hosc", "ahb", "ext-osc32k";
++ assigned-clocks = <&rtc CLK_OSC32K>;
++ assigned-clock-rates = <32768>;
++};
++
+ &uart0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&uart0_pb_pins>;
+--
+2.51.0
+
--- /dev/null
+From aa2be5f096a19672711a884e0be7972e478ed68b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:24:50 +0800
+Subject: arm64: dts: allwinner: t527: orangepi-4a: hook up external 32k
+ crystal
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit bd1ce7ef6aef4ee7349eb3124166e712693650ce ]
+
+When the board was added, its external 32.768 KHz crystal was described
+but not hooked up correctly. This meant the device had to fall back to
+the SoC's internal oscillator or divide a 32 KHz clock from the main
+oscillator, neither of which are accurate for the RTC. As a result the
+RTC clock will drift badly.
+
+Hook the crystal up to the RTC block and request the correct clock rate.
+
+Fixes: de713ccb9934 ("arm64: dts: allwinner: t527: Add OrangePi 4A board")
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250913102450.3935943-3-wens@kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
+index d07bb9193b438..b5483bd7b8d5d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
++++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
+@@ -346,6 +346,14 @@ &r_pio {
+ vcc-pm-supply = <®_bldo2>;
+ };
+
++&rtc {
++ clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
++ <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
++ clock-names = "bus", "hosc", "ahb", "ext-osc32k";
++ assigned-clocks = <&rtc CLK_OSC32K>;
++ assigned-clock-rates = <32768>;
++};
++
+ &uart0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&uart0_pb_pins>;
+--
+2.51.0
+
--- /dev/null
+From b565ef12d0714e76cfe1226015926dcb674b44b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 21:38:45 +0200
+Subject: arm64: dts: apple: Add ethernet0 alias for J375 template
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 6313115c55f44f7bee3f469c91d3de60d724eabd ]
+
+The alias is used by the boot loader to fill the MAC address.
+
+Fixes: aaa1d42a4ce3 ("arm64: dts: apple: Add J375 devicetrees")
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t600x-j375.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+index ed38acc0dfc36..c0fb93ae72f4d 100644
+--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+@@ -12,6 +12,7 @@
+ / {
+ aliases {
+ bluetooth0 = &bluetooth0;
++ ethernet0 = ðernet0;
+ serial0 = &serial0;
+ wifi0 = &wifi0;
+ };
+--
+2.51.0
+
--- /dev/null
+From 630b3a2a775e62db19525d9e3d84a1573d037540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:46 +0200
+Subject: arm64: dts: apple: t600x: Add bluetooth device nodes
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit c34e2ec6a84ea3f7a01d8fcd3073f858c4f47605 ]
+
+Add bluetooth PCIe device nodes to specify per device brcm,board-type
+and provide the bootloader filled "local-bd-address" and calibration
+data.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-3-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 8 ++++++++
+ arch/arm64/boot/dts/apple/t600x-j375.dtsi | 8 ++++++++
+ 8 files changed, 40 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts
+index ac35870ca129c..1430b91ff1b15 100644
+--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts
++++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts
+@@ -20,3 +20,7 @@ / {
+ &wifi0 {
+ brcm,board-type = "apple,maldives";
+ };
++
++&bluetooth0 {
++ brcm,board-type = "apple,maldives";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts
+index 77d6d8c14d741..da0cbe7d96736 100644
+--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts
++++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts
+@@ -20,3 +20,7 @@ / {
+ &wifi0 {
+ brcm,board-type = "apple,madagascar";
+ };
++
++&bluetooth0 {
++ brcm,board-type = "apple,madagascar";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts
+index 0a5655792a8f1..c37097dcfdb30 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts
+@@ -20,3 +20,7 @@ / {
+ &wifi0 {
+ brcm,board-type = "apple,maldives";
+ };
++
++&bluetooth0 {
++ brcm,board-type = "apple,maldives";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts
+index 9c215531ea543..3bc6e0c3294cf 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts
+@@ -20,3 +20,7 @@ / {
+ &wifi0 {
+ brcm,board-type = "apple,madagascar";
+ };
++
++&bluetooth0 {
++ brcm,board-type = "apple,madagascar";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts
+index 88ca2037556ce..2e7c23714d4d0 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts
+@@ -20,3 +20,7 @@ / {
+ &wifi0 {
+ brcm,board-type = "apple,okinawa";
+ };
++
++&bluetooth0 {
++ brcm,board-type = "apple,okinawa";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts
+index f56d13b37eaff..2b7f80119618a 100644
+--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts
++++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts
+@@ -42,6 +42,10 @@ &wifi0 {
+ brcm,board-type = "apple,okinawa";
+ };
+
++&bluetooth0 {
++ brcm,board-type = "apple,okinawa";
++};
++
+ /* delete unused always-on power-domains on die 1 */
+
+ /delete-node/ &ps_atc2_usb_aon_die1;
+diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+index b699672a5543c..c0aac59a6fae4 100644
+--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
++++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+@@ -13,6 +13,7 @@
+
+ / {
+ aliases {
++ bluetooth0 = &bluetooth0;
+ serial0 = &serial0;
+ wifi0 = &wifi0;
+ };
+@@ -105,6 +106,13 @@ wifi0: wifi@0,0 {
+ local-mac-address = [00 10 18 00 00 10];
+ apple,antenna-sku = "XX";
+ };
++
++ bluetooth0: bluetooth@0,1 {
++ compatible = "pci14e4,5f71";
++ reg = <0x10100 0x0 0x0 0x0 0x0>;
++ /* To be filled by the loader */
++ local-bd-address = [00 00 00 00 00 00];
++ };
+ };
+
+ &port01 {
+diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+index 95560bf3798bf..ed38acc0dfc36 100644
+--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+@@ -11,6 +11,7 @@
+
+ / {
+ aliases {
++ bluetooth0 = &bluetooth0;
+ serial0 = &serial0;
+ wifi0 = &wifi0;
+ };
+@@ -90,6 +91,13 @@ wifi0: wifi@0,0 {
+ local-mac-address = [00 10 18 00 00 10];
+ apple,antenna-sku = "XX";
+ };
++
++ bluetooth0: bluetooth@0,1 {
++ compatible = "pci14e4,5f71";
++ reg = <0x10100 0x0 0x0 0x0 0x0>;
++ /* To be filled by the loader */
++ local-bd-address = [00 00 00 00 00 00];
++ };
+ };
+
+ &port01 {
+--
+2.51.0
+
--- /dev/null
+From 05a4b4206a3d82969a2dccde7fae9f42ea9b4675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:45 +0200
+Subject: arm64: dts: apple: t600x: Add missing WiFi properties
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit 3050713d84f58d2e4ba463c5474092fa6738c527 ]
+
+Add compatible and antenna-sku properties to the shared node and
+brcm,board-type property to individuall board device trees.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-2-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t6000-j314s.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6000-j316s.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j314c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j316c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6001-j375c.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t6002-j375d.dts | 4 ++++
+ arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 2 ++
+ arch/arm64/boot/dts/apple/t600x-j375.dtsi | 2 ++
+ 8 files changed, 28 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts
+index c9e192848fe3f..ac35870ca129c 100644
+--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts
++++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts
+@@ -16,3 +16,7 @@ / {
+ compatible = "apple,j314s", "apple,t6000", "apple,arm-platform";
+ model = "Apple MacBook Pro (14-inch, M1 Pro, 2021)";
+ };
++
++&wifi0 {
++ brcm,board-type = "apple,maldives";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts
+index ff1803ce23001..77d6d8c14d741 100644
+--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts
++++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts
+@@ -16,3 +16,7 @@ / {
+ compatible = "apple,j316s", "apple,t6000", "apple,arm-platform";
+ model = "Apple MacBook Pro (16-inch, M1 Pro, 2021)";
+ };
++
++&wifi0 {
++ brcm,board-type = "apple,madagascar";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts
+index 1761d15b98c12..0a5655792a8f1 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts
+@@ -16,3 +16,7 @@ / {
+ compatible = "apple,j314c", "apple,t6001", "apple,arm-platform";
+ model = "Apple MacBook Pro (14-inch, M1 Max, 2021)";
+ };
++
++&wifi0 {
++ brcm,board-type = "apple,maldives";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts
+index 750e9beeffc0a..9c215531ea543 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts
+@@ -16,3 +16,7 @@ / {
+ compatible = "apple,j316c", "apple,t6001", "apple,arm-platform";
+ model = "Apple MacBook Pro (16-inch, M1 Max, 2021)";
+ };
++
++&wifi0 {
++ brcm,board-type = "apple,madagascar";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts
+index 62ea437b58b25..88ca2037556ce 100644
+--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts
++++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts
+@@ -16,3 +16,7 @@ / {
+ compatible = "apple,j375c", "apple,t6001", "apple,arm-platform";
+ model = "Apple Mac Studio (M1 Max, 2022)";
+ };
++
++&wifi0 {
++ brcm,board-type = "apple,okinawa";
++};
+diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts
+index 3365429bdc8be..f56d13b37eaff 100644
+--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts
++++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts
+@@ -38,6 +38,10 @@ hpm5: usb-pd@3a {
+ };
+ };
+
++&wifi0 {
++ brcm,board-type = "apple,okinawa";
++};
++
+ /* delete unused always-on power-domains on die 1 */
+
+ /delete-node/ &ps_atc2_usb_aon_die1;
+diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+index 22ebc78e120bf..b699672a5543c 100644
+--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
++++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+@@ -99,9 +99,11 @@ &port00 {
+ /* WLAN */
+ bus-range = <1 1>;
+ wifi0: wifi@0,0 {
++ compatible = "pci14e4,4433";
+ reg = <0x10000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 10];
++ apple,antenna-sku = "XX";
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+index d5b985ad56793..95560bf3798bf 100644
+--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
++++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+@@ -84,9 +84,11 @@ &port00 {
+ /* WLAN */
+ bus-range = <1 1>;
+ wifi0: wifi@0,0 {
++ compatible = "pci14e4,4433";
+ reg = <0x10000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 10];
++ apple,antenna-sku = "XX";
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 1e830fe8fbcaa7a1f8c6bb03ff99e875b18a5c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:44 +0200
+Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
+
+PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
+and disabled. Linux' PCI subsystem assigns the ethernet nic from
+`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
+disabled port as iommu. The `pcie0_dart_1` instance is disabled and
+probably fused off (it is on the M2 Pro Mac mini which has a disabled
+PCIe port as well).
+Without iommu the ethernet nic is not expected work.
+Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
+subsystem's bus number.
+
+Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
+index 152f95fd49a21..7089ccf3ce556 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
+@@ -21,6 +21,14 @@ aliases {
+ };
+ };
+
++/*
++ * Adjust pcie0's iommu-map to account for the disabled port01.
++ */
++&pcie0 {
++ iommu-map = <0x100 &pcie0_dart_0 1 1>,
++ <0x200 &pcie0_dart_2 1 1>;
++};
++
+ &bluetooth0 {
+ brcm,board-type = "apple,santorini";
+ };
+@@ -36,10 +44,10 @@ &wifi0 {
+ */
+
+ &port02 {
+- bus-range = <3 3>;
++ bus-range = <2 2>;
+ status = "okay";
+ ethernet0: ethernet@0,0 {
+- reg = <0x30000 0x0 0x0 0x0 0x0>;
++ reg = <0x20000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 00];
+ };
+--
+2.51.0
+
--- /dev/null
+From 70782909d7d2d916ba4012342743ce4828460df4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:45 +0200
+Subject: arm64: dts: imx93-kontron: Fix GPIO for panel regulator
+
+From: Annette Kobou <annette.kobou@kontron.de>
+
+[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]
+
+The regulator uses the wrong GPIO. Fix this.
+
+Signed-off-by: Annette Kobou <annette.kobou@kontron.de>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 89e97c604bd3e..9a9e5d0daf3ba 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -33,7 +33,9 @@ pwm-beeper {
+
+ reg_vcc_panel: regulator-vcc-panel {
+ compatible = "regulator-fixed";
+- gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_reg_vcc_panel>;
++ gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <3300000>;
+@@ -161,3 +163,11 @@ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+ };
++
++&iomuxc {
++ pinctrl_reg_vcc_panel: regvccpanelgrp {
++ fsl,pins = <
++ MX93_PAD_GPIO_IO21__GPIO2_IO21 0x31e /* PWM_2 */
++ >;
++ };
++};
+--
+2.51.0
+
--- /dev/null
+From b6ad19c4b7f6ff337695a77cc1f9914e86c0577e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:05:46 +0200
+Subject: arm64: dts: imx93-kontron: Fix USB port assignment
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]
+
+The assignment of the USB ports is wrong and needs to be swapped.
+The OTG (USB-C) port is on the first port and the host port with
+the onboard hub is on the second port.
+
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx93-kontron-bl-osm-s.dts | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
+--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+@@ -137,6 +137,16 @@ &tpm6 {
+ };
+
+ &usbotg1 {
++ adp-disable;
++ hnp-disable;
++ srp-disable;
++ disable-over-current;
++ dr_mode = "otg";
++ usb-role-switch;
++ status = "okay";
++};
++
++&usbotg2 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ disable-over-current;
+@@ -149,16 +159,6 @@ usb1@1 {
+ };
+ };
+
+-&usbotg2 {
+- adp-disable;
+- hnp-disable;
+- srp-disable;
+- disable-over-current;
+- dr_mode = "otg";
+- usb-role-switch;
+- status = "okay";
+-};
+-
+ &usdhc2 {
+ vmmc-supply = <®_vdd_3v3>;
+ status = "okay";
+--
+2.51.0
+
--- /dev/null
+From 1b39207187f4bf91db1809e4ee64ba723a03e727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:25:31 +0800
+Subject: arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
+
+From: Joy Zou <joy.zou@nxp.com>
+
+[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]
+
+According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
+and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.
+
+Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
+Signed-off-by: Joy Zou <joy.zou@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
+index 8296888bce594..4521da02d1695 100644
+--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
+@@ -913,7 +913,7 @@ lpuart7: serial@42690000 {
+ interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART7>;
+ clock-names = "ipg";
+- dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
++ dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 {
+ interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&scmi_clk IMX95_CLK_LPUART8>;
+ clock-names = "ipg";
+- dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
++ dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
+ dma-names = "rx", "tx";
+ status = "disabled";
+ };
+--
+2.51.0
+
--- /dev/null
+From ec6067343c8e8cf267c68bb7dcfd87f1073a7af8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:52 +0200
+Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node
+ names
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
+
+The node names for "pmic", "regulators", "rtc", and "keys" are
+dictated by the PMIC MFD binding: change those to adhere to it.
+
+Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+index d89858c73ab1b..243afbffa21fd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+@@ -6,12 +6,12 @@
+ #include <dt-bindings/input/input.h>
+
+ &pwrap {
+- pmic: mt6331 {
++ pmic: pmic {
+ compatible = "mediatek,mt6331";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6331regulator: mt6331regulator {
++ mt6331regulator: regulators {
+ compatible = "mediatek,mt6331-regulator";
+
+ mt6331_vdvfs11_reg: buck-vdvfs11 {
+@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
+ };
+
+ mt6331_vdig18_reg: ldo-vdig18 {
+- regulator-name = "dvdd18_dig";
++ regulator-name = "vdig18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-ramp-delay = <0>;
+@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
+ };
+ };
+
+- mt6331rtc: mt6331rtc {
++ mt6331rtc: rtc {
+ compatible = "mediatek,mt6331-rtc";
+ };
+
+- mt6331keys: mt6331keys {
++ mt6331keys: keys {
+ compatible = "mediatek,mt6331-keys";
+ power {
+ linux,keycodes = <KEY_POWER>;
+--
+2.51.0
+
--- /dev/null
+From c9ee08a0eed5de797787a892c5e722ae52d82531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:56 +0200
+Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
+
+Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
+actually used, the final value that gets written to the register
+field for DAT_LATCH_CK_SEL is just 0x4.
+
+This also fixes dtbs_check warnings.
+
+Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+index 91de920c22457..03cc48321a3f4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+@@ -212,7 +212,7 @@ proximity@48 {
+
+ &mmc0 {
+ /* eMMC controller */
+- mediatek,latch-ck = <0x14>; /* hs400 */
++ mediatek,latch-ck = <4>; /* hs400 */
+ mediatek,hs200-cmd-int-delay = <1>;
+ mediatek,hs400-cmd-int-delay = <1>;
+ mediatek,hs400-ds-dly3 = <0x1a>;
+--
+2.51.0
+
--- /dev/null
+From 803f02763e2cbb2b5d28cefcc3a3bbb8af8003ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:59 +0200
+Subject: arm64: dts: mediatek: mt7986a: Fix PCI-Express T-PHY node address
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 6b3fff78c13f1a2ba5a355a101fa1ca0a13054ad ]
+
+The PCIe TPHY is under the soc bus, which provides MMIO, and all
+nodes under that must use the bus, otherwise those would clearly
+be out of place.
+
+Add ranges to the PCIe tphy and assign the address to the main
+node to silence a dtbs_check warning, and fix the children to
+use the MMIO range of t-phy.
+
+Fixes: 963c3b0c47ec ("arm64: dts: mediatek: fix t-phy unit name")
+Fixes: 918aed7abd2d ("arm64: dts: mt7986: add pcie related device nodes")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-24-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+index 559990dcd1d17..3211905b6f86d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -428,16 +428,16 @@ pcie_intc: interrupt-controller {
+ };
+ };
+
+- pcie_phy: t-phy {
++ pcie_phy: t-phy@11c00000 {
+ compatible = "mediatek,mt7986-tphy",
+ "mediatek,generic-tphy-v2";
+- ranges;
+- #address-cells = <2>;
+- #size-cells = <2>;
++ ranges = <0 0 0x11c00000 0x20000>;
++ #address-cells = <1>;
++ #size-cells = <1>;
+ status = "disabled";
+
+- pcie_port: pcie-phy@11c00000 {
+- reg = <0 0x11c00000 0 0x20000>;
++ pcie_port: pcie-phy@0 {
++ reg = <0 0x20000>;
+ clocks = <&clk40m>;
+ clock-names = "ref";
+ #phy-cells = <1>;
+--
+2.51.0
+
--- /dev/null
+From 3c788a7656d147413917b00bae27dfafd1ca4e01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 12:11:52 -0500
+Subject: arm64: dts: mediatek: mt8183: Fix out of range pull values
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 0aeb7ed4bcb244862a35f880053cd64d28c6fb04 ]
+
+A value of 10 is not valid for "mediatek,pull-down-adv" and
+"mediatek,pull-up-adv" properties which have defined values of 0-3. It
+appears the "10" was written as a binary value. The driver only looks at
+the lowest 2 bits, so the value "10" decimal works out the same as if
+"2" was used.
+
+Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
+Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250722171152.58923-2-robh@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 14 +++++++-------
+ arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 14 +++++++-------
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index 400c61d110356..fff93e26eb760 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -580,7 +580,7 @@ pins-cmd-dat {
+ pins-clk {
+ pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins-rst {
+@@ -609,13 +609,13 @@ pins-cmd-dat {
+ pins-clk {
+ pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins-ds {
+ pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins-rst {
+@@ -633,13 +633,13 @@ pins-cmd-dat {
+ <PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
+ <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
+ input-enable;
+- mediatek,pull-up-adv = <10>;
++ mediatek,pull-up-adv = <2>;
+ };
+
+ pins-clk {
+ pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
+ input-enable;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+ };
+
+@@ -652,13 +652,13 @@ pins-cmd-dat {
+ <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
+ drive-strength = <6>;
+ input-enable;
+- mediatek,pull-up-adv = <10>;
++ mediatek,pull-up-adv = <2>;
+ };
+
+ pins-clk {
+ pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
+ drive-strength = <8>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ input-enable;
+ };
+ };
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
+index dbdee604edab4..7c3010889ae73 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
+@@ -324,7 +324,7 @@ pins_cmd_dat {
+ pins_clk {
+ pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins_rst {
+@@ -353,13 +353,13 @@ pins_cmd_dat {
+ pins_clk {
+ pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins_ds {
+ pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
+ drive-strength = <MTK_DRIVE_14mA>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins_rst {
+@@ -377,13 +377,13 @@ pins_cmd_dat {
+ <PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
+ <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
+ input-enable;
+- mediatek,pull-up-adv = <10>;
++ mediatek,pull-up-adv = <2>;
+ };
+
+ pins_clk {
+ pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
+ input-enable;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ };
+
+ pins_pmu {
+@@ -401,13 +401,13 @@ pins_cmd_dat {
+ <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
+ drive-strength = <6>;
+ input-enable;
+- mediatek,pull-up-adv = <10>;
++ mediatek,pull-up-adv = <2>;
+ };
+
+ pins_clk {
+ pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
+ drive-strength = <8>;
+- mediatek,pull-down-adv = <10>;
++ mediatek,pull-down-adv = <2>;
+ input-enable;
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From c8c9b96f4ca87967afbca9a9ced3eee65defa3a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 17:01:34 +0800
+Subject: arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]
+
+The touchscreen controller used with the original Krabby design is the
+Elan eKTH6918, which is in the same family as eKTH6915, but supporting
+a larger screen size with more sense lines.
+
+OTOH, the touchscreen controller that actually shipped on the Tentacruel
+devices is the Elan eKTH6A12NAY. A compatible string was added for it
+specifically because it has different power sequencing timings.
+
+Fix up the touchscreen nodes for both these. This also includes adding
+a previously missing reset line. Also add "no-reset-on-power-off" since
+the power is always on, and putting it in reset would consume more
+power.
+
+Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20250812090135.3310374-1-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi | 8 ++++----
+ .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts | 4 ++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+index 7c971198fa956..72a2a2bff0a93 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+@@ -71,14 +71,14 @@ &i2c1 {
+ i2c-scl-internal-delay-ns = <10000>;
+
+ touchscreen: touchscreen@10 {
+- compatible = "hid-over-i2c";
++ compatible = "elan,ekth6915";
+ reg = <0x10>;
+ interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&touchscreen_pins>;
+- post-power-on-delay-ms = <10>;
+- hid-descr-addr = <0x0001>;
+- vdd-supply = <&pp3300_s3>;
++ reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
++ vcc33-supply = <&pp3300_s3>;
++ no-reset-on-power-off;
+ };
+ };
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+index 26d3451a5e47c..24d9ede63eaa2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
+ CROS_STD_MAIN_KEYMAP
+ >;
+ };
++
++&touchscreen {
++ compatible = "elan,ekth6a12nay";
++};
+--
+2.51.0
+
--- /dev/null
+From e2445c3f2e65439fc4354c3ffa87ccfe96e64f1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 14:34:30 +0800
+Subject: arm64: dts: mediatek: mt8188: Change efuse fallback compatible to
+ mt8186
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit c881d1c37b2c159d908203dba5c4920bc776046f ]
+
+The efuse block in the MT8188 contains the GPU speed bin cell, and like
+the MT8186 one, has the same conversion scheme to work with the GPU OPP
+binding. This was reflected in a corresponding change to the efuse DT
+binding.
+
+Change the fallback compatible of the MT8188's efuse block from the
+generic one to the MT8186 one. This also makes GPU DVFS work properly.
+
+Fixes: d39aacd1021a ("arm64: dts: mediatek: mt8188: add lvts definitions")
+Fixes: 50e7592cb696 ("arm64: dts: mediatek: mt8188: Add GPU speed bin NVMEM cells")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250610063431.2955757-3-wenst@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8188.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8188.dtsi b/arch/arm64/boot/dts/mediatek/mt8188.dtsi
+index 202478407727e..90c388f1890f5 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8188.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8188.dtsi
+@@ -2183,7 +2183,7 @@ imp_iic_wrap_en: clock-controller@11ec2000 {
+ };
+
+ efuse: efuse@11f20000 {
+- compatible = "mediatek,mt8188-efuse", "mediatek,efuse";
++ compatible = "mediatek,mt8188-efuse", "mediatek,mt8186-efuse";
+ reg = <0 0x11f20000 0 0x1000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+--
+2.51.0
+
--- /dev/null
+From dd94f00efb8603288339f17c0917ac1f74685acf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 17:59:59 +0800
+Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from
+ pcie0
+
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+
+[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
+
+When test suspend resume with 6.8 based kernel, system can't resume
+and I got below error which can be also reproduced with 6.16 rc6+
+kernel.
+
+mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
+mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
+mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
+
+After investigation, looks pcie0 has the same problem as pcie1 as
+decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
+Remove suspend-breaking reset from pcie1").
+
+Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
+Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index 8877953ce292b..ab0b2f606eb43 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1588,9 +1588,6 @@ pcie0: pcie@112f0000 {
+
+ power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
+
+- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
+- reset-names = "mac";
+-
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+--
+2.51.0
+
--- /dev/null
+From ee94d8f3d6c4642d88145b441f02869485c18f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:13 +0200
+Subject: arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator
+ nodes
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]
+
+All of the MT6360 regulator nodes were wrong and would not probe
+because the regulator names are supposed to be lower case, but
+they are upper case in this devicetree.
+
+Change all nodes to be lower case to get working regulators.
+
+Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-38-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+index 4985b65925a9e..d16f545cbbb27 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+@@ -352,7 +352,7 @@ regulator {
+ LDO_VIN2-supply = <&vsys>;
+ LDO_VIN3-supply = <&vsys>;
+
+- mt6360_buck1: BUCK1 {
++ mt6360_buck1: buck1 {
+ regulator-name = "emi_vdd2";
+ regulator-min-microvolt = <600000>;
+ regulator-max-microvolt = <1800000>;
+@@ -362,7 +362,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_buck2: BUCK2 {
++ mt6360_buck2: buck2 {
+ regulator-name = "emi_vddq";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1300000>;
+@@ -372,7 +372,7 @@ MT6360_OPMODE_LP
+ regulator-always-on;
+ };
+
+- mt6360_ldo1: LDO1 {
++ mt6360_ldo1: ldo1 {
+ regulator-name = "mt6360_ldo1"; /* Test point */
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -380,7 +380,7 @@ mt6360_ldo1: LDO1 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo2: LDO2 {
++ mt6360_ldo2: ldo2 {
+ regulator-name = "panel1_p1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -388,7 +388,7 @@ mt6360_ldo2: LDO2 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo3: LDO3 {
++ mt6360_ldo3: ldo3 {
+ regulator-name = "vmc_pmu";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -396,7 +396,7 @@ mt6360_ldo3: LDO3 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo5: LDO5 {
++ mt6360_ldo5: ldo5 {
+ regulator-name = "vmch_pmu";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+@@ -404,7 +404,7 @@ mt6360_ldo5: LDO5 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo6: LDO6 {
++ mt6360_ldo6: ldo6 {
+ regulator-name = "mt6360_ldo6"; /* Test point */
+ regulator-min-microvolt = <500000>;
+ regulator-max-microvolt = <2100000>;
+@@ -412,7 +412,7 @@ mt6360_ldo6: LDO6 {
+ MT6360_OPMODE_LP>;
+ };
+
+- mt6360_ldo7: LDO7 {
++ mt6360_ldo7: ldo7 {
+ regulator-name = "emi_vmddr_en";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+--
+2.51.0
+
--- /dev/null
+From 084db61cca1c70989d91c9938ebf4553f380d9de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 79ae7e999c13a28c493d4492d93f5ff7c9fb66de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Aug 2025 15:51:30 +0100
+Subject: arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio key's pin control
+ node
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 3e5df910b592d47734b6dcd03d57498d4766bf6c ]
+
+Adding pin control node to the child won't parse the pins during driver
+bind. Fix the issue by moving it to parent node.
+
+This issue is observed while adding Schmitt input enable for PS0 pin on
+later patch. Currently the reset value of the PIN is set to NMI function
+and hence there is no breakage.
+
+Fixes: 9e95446b0cf9 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250817145135.166591-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
+index 1e67f0a2a945c..9f6716fa10860 100644
+--- a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
++++ b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
+@@ -90,10 +90,10 @@ &i2c0 {
+ };
+
+ &keys {
+- key-sleep {
+- pinctrl-0 = <&nmi_pins>;
+- pinctrl-names = "default";
++ pinctrl-0 = <&nmi_pins>;
++ pinctrl-names = "default";
+
++ key-sleep {
+ interrupts-extended = <&icu 0 IRQ_TYPE_EDGE_FALLING>;
+ linux,code = <KEY_SLEEP>;
+ label = "SLEEP";
+--
+2.51.0
+
--- /dev/null
+From facc6f88f14e4ef29a4e40b10a7c75d1cfd19286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 13:19:53 +0100
+Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
+
+On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
+are deleting a wrong and nonexistent node. Fixing the wrong node would
+invoke a dtb warning message, as channel0 is a required property.
+Disable CAN-FD channel0 instead of deleting the node.
+
+Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+index 345b779e4f601..f3d7eff0d2f2a 100644
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+@@ -48,7 +48,10 @@ sound_card {
+ #if (SW_SCIF_CAN || SW_RSPI_CAN)
+ &canfd {
+ pinctrl-0 = <&can1_pins>;
+- /delete-node/ channel@0;
++
++ channel0 {
++ status = "disabled";
++ };
+ };
+ #else
+ &canfd {
+--
+2.51.0
+
--- /dev/null
+From f1926178758cf8a6655281436f82c37c33318f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 01:58:11 +0200
+Subject: arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on
+ EVTB1
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ]
+
+Invert the polarity of microSD voltage selector on Retronix R-Car V4H
+Sparrow Hawk board. The voltage selector was not populated on prototype
+EVTA1 boards, and is implemented slightly different on EVTB1 boards. As
+the EVTA1 boards are from a limited run and generally not available,
+update the DT to make it compatible with EVTB1 microSD voltage selector.
+
+Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250727235905.290427-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+index 9ba23129e65ec..18411dfb524fd 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+@@ -185,7 +185,7 @@ vcc_sdhi: regulator-vcc-sdhi {
+ regulator-max-microvolt = <3300000>;
+ gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>;
+ gpios-states = <1>;
+- states = <3300000 0>, <1800000 1>;
++ states = <1800000 0>, <3300000 1>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 1c48dbf5f0f41b6494540a918bd92cf511652a41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 21:28:04 +0200
+Subject: arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ]
+
+The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply
+for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the
+change in IO voltage. Since the VDDQ18_25_AVB power rail is shared,
+all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to
+be configured the same way. As the EVTA1 boards are from a limited run
+and generally not available, update the DT to make it compatible with
+EVTB1 IO voltage settings.
+
+Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250806192821.133302-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+index 18411dfb524fd..2c1ab75e4d910 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
++++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+@@ -556,6 +556,10 @@ pins-mii {
+ drive-strength = <21>;
+ };
+
++ pins-vddq18-25-avb {
++ pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0";
++ power-source = <1800>;
++ };
+ };
+
+ /* Page 28 / CANFD_IF */
+--
+2.51.0
+
--- /dev/null
+From 97790638fa9f6ce1e2b1961539b37a411dd8cc8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 00:30:23 +0400
+Subject: arm64: dts: rockchip: Add RTC on rk3576-evb1-v10
+
+From: Alexey Charkov <alchark@gmail.com>
+
+[ Upstream commit 0adaae77862932a19cc14c086d7fd15ec0ef7703 ]
+
+Add the I2C connected RTC chip to the Rockchip RK3576 EVB1 board.
+
+Apart from the realtime clock functionality, it also provides a 32 kHz
+clock source for the onboard WiFi chip.
+
+Tested-by: Pavel Zhovner <pavel@flipperdevices.com>
+Signed-off-by: Alexey Charkov <alchark@gmail.com>
+Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-1-d13c83422971@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3576-evb1-v10.dts | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+index 56527c56830e3..bfefd37a1ab8c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+@@ -680,6 +680,22 @@ regulator-state-mem {
+ };
+ };
+
++&i2c2 {
++ status = "okay";
++
++ hym8563: rtc@51 {
++ compatible = "haoyu,hym8563";
++ reg = <0x51>;
++ clock-output-names = "hym8563";
++ interrupt-parent = <&gpio0>;
++ interrupts = <RK_PA0 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&rtc_int>;
++ wakeup-source;
++ #clock-cells = <0>;
++ };
++};
++
+ &mdio0 {
+ rgmii_phy0: phy@1 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+@@ -708,6 +724,12 @@ &pcie1 {
+ };
+
+ &pinctrl {
++ hym8563 {
++ rtc_int: rtc-int {
++ rockchip,pins = <0 RK_PA0 RK_FUNC_GPIO &pcfg_pull_up>;
++ };
++ };
++
+ usb {
+ usb_host_pwren: usb-host-pwren {
+ rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
+--
+2.51.0
+
--- /dev/null
+From 6b864b0f4300a4d2aa880eab2bfc07563b103feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 00:30:24 +0400
+Subject: arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10
+
+From: Alexey Charkov <alchark@gmail.com>
+
+[ Upstream commit ebf8183ad08afc4fcabe1379a5098354829d950d ]
+
+Add device tree nodes to enable the onboard Ampak AP6275P WiFi chip
+connected over a PCIe link on Rockchip RK3576 EVB1.
+
+It takes an external 32 kHz clock from the RTC chip and requires the
+WIFI_REG_ON signal to be enabled before the bus is enumerated to
+initialize properly.
+
+Tested-by: Pavel Zhovner <pavel@flipperdevices.com>
+Signed-off-by: Alexey Charkov <alchark@gmail.com>
+Link: https://lore.kernel.org/r/20250813-evb1-rtcwifibt-v1-2-d13c83422971@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3576-evb1-v10.dts | 58 +++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+index bfefd37a1ab8c..3007e0179611b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+@@ -232,6 +232,20 @@ vcc_ufs_s0: regulator-vcc-ufs-s0 {
+ regulator-max-microvolt = <3300000>;
+ vin-supply = <&vcc_sys>;
+ };
++
++ vcc_wifi_reg_on: regulator-wifi-reg-on {
++ compatible = "regulator-fixed";
++ enable-active-high;
++ gpios = <&gpio1 RK_PC6 GPIO_ACTIVE_HIGH>;
++ pinctrl-0 = <&wifi_reg_on>;
++ pinctrl-names = "default";
++ regulator-name = "wifi_reg_on";
++ regulator-always-on;
++ regulator-boot-on;
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ vin-supply = <&vcc_1v8_s3>;
++ };
+ };
+
+ &cpu_l0 {
+@@ -242,6 +256,10 @@ &cpu_b0 {
+ cpu-supply = <&vdd_cpu_big_s0>;
+ };
+
++&combphy0_ps {
++ status = "okay";
++};
++
+ &combphy1_psu {
+ status = "okay";
+ };
+@@ -712,6 +730,30 @@ rgmii_phy1: phy@1 {
+ };
+ };
+
++&pcie0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pcie0_rst>;
++ reset-gpios = <&gpio2 RK_PB4 GPIO_ACTIVE_HIGH>;
++ vpcie3v3-supply = <&vcc_3v3_s3>;
++ status = "okay";
++
++ pcie@0,0 {
++ reg = <0x0 0 0 0 0>;
++ bus-range = <0x0 0xf>;
++ device_type = "pci";
++ ranges;
++ #address-cells = <3>;
++ #size-cells = <2>;
++
++ wifi: wifi@0,0 {
++ compatible = "pci14e4,449d";
++ reg = <0x10000 0 0 0 0>;
++ clocks = <&hym8563>;
++ clock-names = "lpo";
++ };
++ };
++};
++
+ &pcie1 {
+ reset-gpios = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>;
+ vpcie3v3-supply = <&vcc3v3_pcie1>;
+@@ -730,6 +772,12 @@ rtc_int: rtc-int {
+ };
+ };
+
++ pcie0 {
++ pcie0_rst: pcie0-rst {
++ rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb {
+ usb_host_pwren: usb-host-pwren {
+ rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
+@@ -743,6 +791,16 @@ usbc0_int: usbc0-int {
+ rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_up>;
+ };
+ };
++
++ wifi {
++ wifi_reg_on: wifi-reg-on {
++ rockchip,pins = <1 RK_PC6 RK_FUNC_GPIO &pcfg_pull_up>;
++ };
++
++ wifi_wake_host: wifi-wake-host {
++ rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_down>;
++ };
++ };
+ };
+
+ &sdmmc {
+--
+2.51.0
+
--- /dev/null
+From c54a6686066361074e6bb027bc9ee0cb5ed6929b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 15:54:51 +0200
+Subject: arm64: dts: rockchip: Fix network on rk3576 evb1 board
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 843367c7ed196bd0806c8776cba108aaf6923b82 ]
+
+The RK3576 EVB1 has a RTL8211F PHY for each GMAC interface with
+a dedicated reset line and the 25MHz clock provided by the SoC.
+The current description results in non-working Ethernet as the
+clocks are only enabled by the PHY driver, but probing the right
+PHY driver currently requires that the PHY ID register can be read
+for automatic identification.
+
+This fixes up the network description to get the network functionality
+working reliably and cleans up usage of deprecated DT properties while
+at it.
+
+Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20250910-rk3576-evb-network-v1-1-68ed4df272a2@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3576-evb1-v10.dts | 38 ++++++++++++++-----
+ 1 file changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+index 3007e0179611b..012c21b58a5a1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+@@ -275,9 +275,6 @@ ð0m0_rx_bus2
+ ð0m0_rgmii_clk
+ ð0m0_rgmii_bus
+ ðm0_clk0_25m_out>;
+- snps,reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
+- snps,reset-active-low;
+- snps,reset-delays-us = <0 20000 100000>;
+ tx_delay = <0x21>;
+ status = "okay";
+ };
+@@ -293,9 +290,6 @@ ð1m0_rx_bus2
+ ð1m0_rgmii_clk
+ ð1m0_rgmii_bus
+ ðm0_clk1_25m_out>;
+- snps,reset-gpio = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
+- snps,reset-active-low;
+- snps,reset-delays-us = <0 20000 100000>;
+ tx_delay = <0x20>;
+ status = "okay";
+ };
+@@ -715,18 +709,32 @@ hym8563: rtc@51 {
+ };
+
+ &mdio0 {
+- rgmii_phy0: phy@1 {
+- compatible = "ethernet-phy-ieee802.3-c22";
++ rgmii_phy0: ethernet-phy@1 {
++ compatible = "ethernet-phy-id001c.c916";
+ reg = <0x1>;
+ clocks = <&cru REFCLKO25M_GMAC0_OUT>;
++ assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>;
++ assigned-clock-rates = <25000000>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&rgmii_phy0_rst>;
++ reset-assert-us = <20000>;
++ reset-deassert-us = <100000>;
++ reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+ &mdio1 {
+- rgmii_phy1: phy@1 {
+- compatible = "ethernet-phy-ieee802.3-c22";
++ rgmii_phy1: ethernet-phy@1 {
++ compatible = "ethernet-phy-id001c.c916";
+ reg = <0x1>;
+ clocks = <&cru REFCLKO25M_GMAC1_OUT>;
++ assigned-clocks = <&cru REFCLKO25M_GMAC1_OUT>;
++ assigned-clock-rates = <25000000>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&rgmii_phy1_rst>;
++ reset-assert-us = <20000>;
++ reset-deassert-us = <100000>;
++ reset-gpios = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+@@ -772,6 +780,16 @@ rtc_int: rtc-int {
+ };
+ };
+
++ network {
++ rgmii_phy0_rst: rgmii-phy0-rst {
++ rockchip,pins = <2 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++
++ rgmii_phy1_rst: rgmii-phy1-rst {
++ rockchip,pins = <3 RK_PA3 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ pcie0 {
+ pcie0_rst: pcie0-rst {
+ rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
+--
+2.51.0
+
--- /dev/null
+From 412ca986e7b4e889faef864cf51cc2503cc479c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 22:01:11 +0530
+Subject: arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU
+ R5F cores
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ]
+
+The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi
+for its MCU domain, but it does not override the firmware-name property
+for its R5F cores. This causes the wrong firmware binaries to be
+referenced.
+
+Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the
+firmware-name property with correct names for J742s2.
+
+Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family")
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Link: https://patch.msgid.link/20250823163111.2237199-1-b-padhi@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++
+ arch/arm64/boot/dts/ti/k3-j742s2.dtsi | 1 +
+ 2 files changed, 18 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+new file mode 100644
+index 0000000000000..61db2348d6a47
+--- /dev/null
++++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: GPL-2.0-only OR MIT
++/*
++ * Device Tree Source for J742S2 SoC Family
++ *
++ * TRM: https://www.ti.com/lit/pdf/spruje3
++ *
++ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/
++ *
++ */
++
++&mcu_r5fss0_core0 {
++ firmware-name = "j742s2-mcu-r5f0_0-fw";
++};
++
++&mcu_r5fss0_core1 {
++ firmware-name = "j742s2-mcu-r5f0_1-fw";
++};
+diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+index 7a72f82f56d68..d265df1abade1 100644
+--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+@@ -96,3 +96,4 @@ cpu3: cpu@3 {
+ };
+
+ #include "k3-j742s2-main.dtsi"
++#include "k3-j742s2-mcu-wakeup.dtsi"
+--
+2.51.0
+
--- /dev/null
+From bd6bdbda25d6ca3e5e709608285d70c7a93657c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:11:08 +0530
+Subject: arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros
+
+From: Akashdeep Kaur <a-kaur@ti.com>
+
+[ Upstream commit 2e79ee4d64e9ba4a3fc90e91dfd715407efab16d ]
+
+Currently, DS_IO_OVERRIDE_EN_SHIFT macro is not defined anywhere but
+used for defining other macro.
+Replace this undefined macro with valid macro. Rename the existing macro
+to reflect the actual behavior.
+
+Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")
+
+Reviewed-by: Kendall Willis <k-willis@ti.com>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Akashdeep Kaur <a-kaur@ti.com>
+Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")
+Link: https://patch.msgid.link/20250909044108.2541534-5-a-kaur@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-pinctrl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-pinctrl.h b/arch/arm64/boot/dts/ti/k3-pinctrl.h
+index c0f09be8d3f94..146b780f3bd4a 100644
+--- a/arch/arm64/boot/dts/ti/k3-pinctrl.h
++++ b/arch/arm64/boot/dts/ti/k3-pinctrl.h
+@@ -55,8 +55,8 @@
+
+ #define PIN_DS_FORCE_DISABLE (0 << FORCE_DS_EN_SHIFT)
+ #define PIN_DS_FORCE_ENABLE (1 << FORCE_DS_EN_SHIFT)
+-#define PIN_DS_IO_OVERRIDE_DISABLE (0 << DS_IO_OVERRIDE_EN_SHIFT)
+-#define PIN_DS_IO_OVERRIDE_ENABLE (1 << DS_IO_OVERRIDE_EN_SHIFT)
++#define PIN_DS_ISO_OVERRIDE_DISABLE (0 << ISO_OVERRIDE_EN_SHIFT)
++#define PIN_DS_ISO_OVERRIDE_ENABLE (1 << ISO_OVERRIDE_EN_SHIFT)
+ #define PIN_DS_OUT_ENABLE (0 << DS_OUT_DIS_SHIFT)
+ #define PIN_DS_OUT_DISABLE (1 << DS_OUT_DIS_SHIFT)
+ #define PIN_DS_OUT_VALUE_ZERO (0 << DS_OUT_VAL_SHIFT)
+--
+2.51.0
+
--- /dev/null
+From cbbcd71b4c72a1c55a92d7d5ebbbc9bdfd176f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 19:58:05 +0530
+Subject: arm64: dts: ti: k3: Rename rproc reserved-mem nodes to 'memory@addr'
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit aee0678597c63e5427e91b2e49a6c5ed4951f277 ]
+
+Currently, the reserved memory carveouts used by remote processors are
+named like 'rproc-name-<dma>-memory-region@addr'. While it is
+descriptive, the node label already serves that purpose. Rename reserved
+memory nodes to generic 'memory@addr' to align with the device tree
+specifications. This is done for all TI K3 based boards.
+
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://patch.msgid.link/20250908142826.1828676-14-b-padhi@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Stable-dep-of: 79a1778c7819 ("Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/ti/k3-am62-phycore-som.dtsi | 10 ++--
+ .../boot/dts/ti/k3-am62-pocketbeagle2.dts | 6 +--
+ arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +-
+ .../arm64/boot/dts/ti/k3-am625-beagleplay.dts | 2 +-
+ .../boot/dts/ti/k3-am62a-phycore-som.dtsi | 12 ++---
+ arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 12 ++---
+ arch/arm64/boot/dts/ti/k3-am62d2-evm.dts | 14 +++---
+ arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi | 2 +-
+ arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 8 ++--
+ .../arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 8 ++--
+ .../boot/dts/ti/k3-am64-phycore-som.dtsi | 22 ++++-----
+ arch/arm64/boot/dts/ti/k3-am642-evm.dts | 22 ++++-----
+ arch/arm64/boot/dts/ti/k3-am642-sk.dts | 22 ++++-----
+ arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi | 16 +++----
+ .../arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi | 18 +++----
+ .../boot/dts/ti/k3-am65-iot2050-common.dtsi | 10 ++--
+ .../arm64/boot/dts/ti/k3-am654-base-board.dts | 10 ++--
+ .../arm64/boot/dts/ti/k3-am67a-beagley-ai.dts | 22 ++++-----
+ .../boot/dts/ti/k3-am68-phycore-som.dtsi | 34 ++++++-------
+ arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi | 34 ++++++-------
+ arch/arm64/boot/dts/ti/k3-am69-sk.dts | 48 +++++++++----------
+ arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi | 18 +++----
+ .../boot/dts/ti/k3-j721e-beagleboneai64.dts | 38 +++++++--------
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 38 +++++++--------
+ arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi | 38 +++++++--------
+ arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi | 34 ++++++-------
+ arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 22 ++++-----
+ arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 4 +-
+ .../dts/ti/k3-j784s4-j742s2-evm-common.dtsi | 44 ++++++++---------
+ 29 files changed, 285 insertions(+), 285 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+index 10e6b5c08619e..737ff54c3cd2f 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+@@ -46,31 +46,31 @@ ramoops@9c700000 {
+ pmsg-size = <0x8000>;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@9c800000 {
++ rtos_ipc_memory_region: memory@9c800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c800000 0x00 0x00300000>;
+ no-map;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
++ mcu_m4fss_dma_memory_region: memory@9cb00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cb00000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
++ mcu_m4fss_memory_region: memory@9cc00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cc00000 0x00 0xe00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9da00000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
++ wkup_r5fss0_core0_memory_region: memory@9db00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9db00000 0x00 0xc00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+index 2e4cf65ee3239..1c95947430d3e 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+@@ -54,13 +54,13 @@ linux,cma {
+ linux,cma-default;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
++ mcu_m4fss_dma_memory_region: memory@9cb00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cb00000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
++ mcu_m4fss_memory_region: memory@9cc00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cc00000 0x00 0xe00000>;
+ no-map;
+@@ -78,7 +78,7 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9db00000 0x00 0xc00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+index bc2289d747745..2b8b2c76e9946 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+@@ -206,7 +206,7 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9db00000 0x00 0xc00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+index 72b09f9c69d8c..7028d9835c4a8 100644
+--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
++++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+@@ -83,7 +83,7 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9db00000 0x00 0xc00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+index 5dc5d2cb20ccd..175fa5048a0bc 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+@@ -59,37 +59,37 @@ linux,cma {
+ linux,cma-default;
+ };
+
+- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
++ c7x_0_dma_memory_region: memory@99800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99800000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_0_memory_region: c7x-memory@99900000 {
++ c7x_0_memory_region: memory@99900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b800000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
++ mcu_r5fss0_core0_memory_region: memory@9b900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c800000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
++ wkup_r5fss0_core0_memory_region: memory@9c900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c900000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+index bceead5e288e6..4761c3dc2d8e6 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+@@ -53,37 +53,37 @@ linux,cma {
+ linux,cma-default;
+ };
+
+- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
++ c7x_0_dma_memory_region: memory@99800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99800000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_0_memory_region: c7x-memory@99900000 {
++ c7x_0_memory_region: memory@99900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b800000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
++ mcu_r5fss0_core0_memory_region: memory@9b900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c800000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
++ wkup_r5fss0_core0_memory_region: memory@9c900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c900000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+index daea18b0bc61c..19a7ca7ee173a 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+@@ -58,37 +58,37 @@ secure_tfa_ddr: tfa@80000000 {
+ no-map;
+ };
+
+- c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
++ c7x_0_dma_memory_region: memory@99800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99800000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_0_memory_region: c7x-memory@99900000 {
++ c7x_0_memory_region: memory@99900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x99900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b800000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
++ mcu_r5fss0_core0_memory_region: memory@9b900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c800000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
++ wkup_r5fss0_core0_memory_region: memory@9c900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c900000 0x00 0xf00000>;
+ no-map;
+@@ -100,7 +100,7 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a0000000 {
++ rtos_ipc_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x01000000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
+index a2fdc6741da2c..3963dbc1faeff 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
+@@ -162,7 +162,7 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
++ wkup_r5fss0_core0_memory_region: memory@9c900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c900000 0x00 0x01e00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+index 899da7896563b..2e081c329d6c2 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+@@ -49,25 +49,25 @@ reserved-memory {
+ #size-cells = <2>;
+ ranges;
+
+- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@9b800000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b800000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@9b900000 {
++ mcu_r5fss0_core0_memory_region: memory@9b900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9b900000 0x00 0xf00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c800000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-memory@9c900000 {
++ wkup_r5fss0_core0_memory_region: memory@9c900000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9c900000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+index 13e1d36123d51..8eed8be2e8bad 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+@@ -58,25 +58,25 @@ linux,cma {
+ linux,cma-default;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
++ mcu_m4fss_dma_memory_region: memory@9cb00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cb00000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@9cc00000 {
++ mcu_m4fss_memory_region: memory@9cc00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9cc00000 0x00 0xe00000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9da00000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
++ wkup_r5fss0_core0_memory_region: memory@9db00000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0x9db00000 0x00 0xc00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
+index d9d491b12c33a..97ad433e49394 100644
+--- a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
+@@ -41,67 +41,67 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ main_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ main_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss1_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss1_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
++ mcu_m4fss_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@a4100000 {
++ mcu_m4fss_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x00800000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-evm.dts b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
+index e01866372293b..ccb04a3d97c9a 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
+@@ -53,67 +53,67 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ main_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ main_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss1_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss1_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
++ mcu_m4fss_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@a4100000 {
++ mcu_m4fss_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x00800000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-sk.dts b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
+index 1deaa0be0085c..1982608732ee2 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
+@@ -51,67 +51,67 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ main_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ main_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss1_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss1_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
++ mcu_m4fss_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_m4fss_memory_region: m4f-memory@a4100000 {
++ mcu_m4fss_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x00800000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
+index a5cec9a075109..dfe570e0b7071 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
+@@ -115,49 +115,49 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ main_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ main_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss1_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss1_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
+index 828d815d6bdfc..a8d5144ab1b33 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
+@@ -31,55 +31,55 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ main_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ main_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss1_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss1_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x00800000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+index e5136ed947651..211eb9d93159d 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+@@ -47,31 +47,31 @@ secure_ddr: secure-ddr@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa0000000 0 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa0100000 0 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa1000000 0 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa1100000 0 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a2000000 {
++ rtos_ipc_memory_region: memory@a2000000 {
+ reg = <0x00 0xa2000000 0x00 0x00200000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
+index e589690c7c821..dac36ca77a30e 100644
+--- a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
+@@ -50,31 +50,31 @@ secure_ddr: secure-ddr@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa0000000 0 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa0100000 0 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa1000000 0 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0 0xa1100000 0 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a2000000 {
++ rtos_ipc_memory_region: memory@a2000000 {
+ reg = <0x00 0xa2000000 0x00 0x00100000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
+index bf9b23df1da2a..859294b9a2f31 100644
+--- a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
++++ b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
+@@ -50,67 +50,67 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ wkup_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
++ mcu_r5fss0_core0_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
++ c7x_0_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_0_memory_region: c7x-memory@a3100000 {
++ c7x_0_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
++ c7x_1_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_1_memory_region: c7x-memory@a4100000 {
++ c7x_1_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x1c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
+index fd715fee8170e..71f56f0f5363c 100644
+--- a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
+@@ -49,103 +49,103 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
++ c71_0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a6100000 {
++ c71_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
++ c71_1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_1_memory_region: c71-memory@a7100000 {
++ c71_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a8000000 {
++ rtos_ipc_memory_region: memory@a8000000 {
+ reg = <0x00 0xa8000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
+index 4ca2d4e2fb9b0..ecc7b3a100d00 100644
+--- a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
+@@ -27,103 +27,103 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
++ c71_0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a6100000 {
++ c71_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
++ c71_1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_1_memory_region: c71-memory@a7100000 {
++ c71_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a8000000 {
++ rtos_ipc_memory_region: memory@a8000000 {
+ reg = <0x00 0xa8000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+index 612ac27643d2c..922866b96e66a 100644
+--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+@@ -49,145 +49,145 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
++ main_r5fss2_core0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
++ main_r5fss2_core0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
++ main_r5fss2_core1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
++ main_r5fss2_core1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
++ c71_0_dma_memory_region: memory@a8000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a8100000 {
++ c71_0_memory_region: memory@a8100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_1_dma_memory_region: c71-dma-memory@a9000000 {
++ c71_1_dma_memory_region: memory@a9000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa9000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_1_memory_region: c71-memory@a9100000 {
++ c71_1_memory_region: memory@a9100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa9100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_2_dma_memory_region: c71-dma-memory@aa000000 {
++ c71_2_dma_memory_region: memory@aa000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xaa000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_2_memory_region: c71-memory@aa100000 {
++ c71_2_memory_region: memory@aa100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xaa100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_3_dma_memory_region: c71-dma-memory@ab000000 {
++ c71_3_dma_memory_region: memory@ab000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xab000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_3_memory_region: c71-memory@ab100000 {
++ c71_3_memory_region: memory@ab100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xab100000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
+index 291ab9bb414d7..e8cec315e381b 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
+@@ -29,55 +29,55 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a4000000 {
++ rtos_ipc_memory_region: memory@a4000000 {
+ reg = <0x00 0xa4000000 0x00 0x00800000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+index fb899c99753ec..6a1b32169678e 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+@@ -51,115 +51,115 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_0_dma_memory_region: c66-dma-memory@a6000000 {
++ c66_0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_0_memory_region: c66-memory@a6100000 {
++ c66_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_1_dma_memory_region: c66-dma-memory@a7000000 {
++ c66_1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_1_memory_region: c66-memory@a7100000 {
++ c66_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
++ c71_0_dma_memory_region: memory@a8000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a8100000 {
++ c71_0_memory_region: memory@a8100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@aa000000 {
++ rtos_ipc_memory_region: memory@aa000000 {
+ reg = <0x00 0xaa000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index ffef3d1cfd553..d1b0257048de2 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -48,115 +48,115 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_0_dma_memory_region: c66-dma-memory@a6000000 {
++ c66_0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_0_memory_region: c66-memory@a6100000 {
++ c66_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_1_dma_memory_region: c66-dma-memory@a7000000 {
++ c66_1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_1_memory_region: c66-memory@a7100000 {
++ c66_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
++ c71_0_dma_memory_region: memory@a8000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a8100000 {
++ c71_0_memory_region: memory@a8100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@aa000000 {
++ rtos_ipc_memory_region: memory@aa000000 {
+ reg = <0x00 0xaa000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
+index 0722f6361cc8b..ef11a5fb6ad56 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
+@@ -29,115 +29,115 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_1_dma_memory_region: c66-dma-memory@a6000000 {
++ c66_1_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_0_memory_region: c66-memory@a6100000 {
++ c66_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c66_0_dma_memory_region: c66-dma-memory@a7000000 {
++ c66_0_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c66_1_memory_region: c66-memory@a7100000 {
++ c66_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
++ c71_0_dma_memory_region: memory@a8000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a8100000 {
++ c71_0_memory_region: memory@a8100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@aa000000 {
++ rtos_ipc_memory_region: memory@aa000000 {
+ reg = <0x00 0xaa000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
+index 54fc5c4f8c3f5..391e8e3ac2680 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
+@@ -31,103 +31,103 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a6000000 {
++ c71_0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a6100000 {
++ c71_0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_1_dma_memory_region: c71-dma-memory@a7000000 {
++ c71_1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_1_memory_region: c71-memory@a7100000 {
++ c71_1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a8000000 {
++ rtos_ipc_memory_region: memory@a8000000 {
+ reg = <0x00 0xa8000000 0x00 0x01c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
+index 9d8abfa9afd27..4cfe5c88e48f5 100644
+--- a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
+@@ -52,67 +52,67 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ wkup_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
++ mcu_r5fss0_core0_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
++ c7x_0_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_0_memory_region: c7x-memory@a3100000 {
++ c7x_0_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
++ c7x_1_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c7x_1_memory_region: c7x-memory@a4100000 {
++ c7x_1_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- rtos_ipc_memory_region: ipc-memories@a5000000 {
++ rtos_ipc_memory_region: memory@a5000000 {
+ reg = <0x00 0xa5000000 0x00 0x1c00000>;
+ alignment = <0x1000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+index a84bde08f85e4..2ed1ec6d53c88 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+@@ -28,13 +28,13 @@ reserved_memory: reserved-memory {
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+- c71_3_dma_memory_region: c71-dma-memory@ab000000 {
++ c71_3_dma_memory_region: memory@ab000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xab000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_3_memory_region: c71-memory@ab100000 {
++ c71_3_memory_region: memory@ab100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xab100000 0x00 0xf00000>;
+ no-map;
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
+index fa656b7b13a1d..877b50991ee69 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
+@@ -35,133 +35,133 @@ secure_ddr: optee@9e800000 {
+ no-map;
+ };
+
+- mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
++ mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
++ mcu_r5fss0_core0_memory_region: memory@a0100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa0100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
++ mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1000000 0x00 0x100000>;
+ no-map;
+ };
+
+- mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
++ mcu_r5fss0_core1_memory_region: memory@a1100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa1100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
++ main_r5fss0_core0_dma_memory_region: memory@a2000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
++ main_r5fss0_core0_memory_region: memory@a2100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa2100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
++ main_r5fss0_core1_dma_memory_region: memory@a3000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
++ main_r5fss0_core1_memory_region: memory@a3100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa3100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
++ main_r5fss1_core0_dma_memory_region: memory@a4000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
++ main_r5fss1_core0_memory_region: memory@a4100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa4100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
++ main_r5fss1_core1_dma_memory_region: memory@a5000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
++ main_r5fss1_core1_memory_region: memory@a5100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa5100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
++ main_r5fss2_core0_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
++ main_r5fss2_core0_memory_region: memory@a6100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
++ main_r5fss2_core1_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+ };
+
+- main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
++ main_r5fss2_core1_memory_region: memory@a7100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_0_dma_memory_region: c71-dma-memory@a8000000 {
++ c71_0_dma_memory_region: memory@a8000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_0_memory_region: c71-memory@a8100000 {
++ c71_0_memory_region: memory@a8100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa8100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_1_dma_memory_region: c71-dma-memory@a9000000 {
++ c71_1_dma_memory_region: memory@a9000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa9000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_1_memory_region: c71-memory@a9100000 {
++ c71_1_memory_region: memory@a9100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa9100000 0x00 0xf00000>;
+ no-map;
+ };
+
+- c71_2_dma_memory_region: c71-dma-memory@aa000000 {
++ c71_2_dma_memory_region: memory@aa000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xaa000000 0x00 0x100000>;
+ no-map;
+ };
+
+- c71_2_memory_region: c71-memory@aa100000 {
++ c71_2_memory_region: memory@aa100000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xaa100000 0x00 0xf00000>;
+ no-map;
+--
+2.51.0
+
--- /dev/null
+From 830999f17be0c2a47f32424e3cbfe1dbf23ce8e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 62594e7966ab0..b384d38654e65 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -47,7 +47,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From f3d4497997ef924d2d3ba5848f00d0ab44ccda2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 0f3b8f44e7011..bc846558480e4 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -68,7 +68,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From 87a1f6665e35a635d844fb9e3a7d8a49d268eee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 67c62844ca2a9..604a35d380e9a 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From e41e52799321482f8fdc87d6beeb326b0ea4951c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:48:53 +0800
+Subject: ASoC: Intel: hda-sdw-bpt: set persistent_buffer false
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 8b184c34806e5da4d4847fabd3faeff38b47e70a ]
+
+The persistent_buffer agreement is false when hda_cl_prepare() is
+called. We should use the same value when hda_cl_cleanup() is called.
+
+Fixes: 5d5cb86fb46ea ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev>
+Link: https://patch.msgid.link/20250915024853.1153518-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-sdw-bpt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-sdw-bpt.c b/sound/soc/sof/intel/hda-sdw-bpt.c
+index 1327f1cad0bcd..ff5abccf0d88b 100644
+--- a/sound/soc/sof/intel/hda-sdw-bpt.c
++++ b/sound/soc/sof/intel/hda-sdw-bpt.c
+@@ -150,7 +150,7 @@ static int hda_sdw_bpt_dma_deprepare(struct device *dev, struct hdac_ext_stream
+ u32 mask;
+ int ret;
+
+- ret = hda_cl_cleanup(sdev->dev, dmab_bdl, true, sdw_bpt_stream);
++ ret = hda_cl_cleanup(sdev->dev, dmab_bdl, false, sdw_bpt_stream);
+ if (ret < 0) {
+ dev_err(sdev->dev, "%s: SDW BPT DMA cleanup failed\n",
+ __func__);
+--
+2.51.0
+
--- /dev/null
+From f09777265746d76f9e9e871e9c0e08c3b5bbfc16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:02:35 +0100
+Subject: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]
+
+In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
+is not NULL before calling it.
+
+The original code assumed that if include_sidecar is true, the codec
+on that link has an add_sidecar callback. But there could be other
+codecs on the same link that do not have an add_sidecar callback.
+
+Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250919140235.1071941-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 28f03a5f29f74..c013e31d098e7 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -841,7 +841,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
+ (*codec_conf)++;
+ }
+
+- if (sof_end->include_sidecar) {
++ if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
+ ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
+ if (ret)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 9a8fd8f49114d061cbd7b45cf2917c2230cad447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 22:34:02 +0300
+Subject: ASoC: qcom: sc8280xp: use sa8775p/ subdir for QCS9100 / QCS9075
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit ba0c67d3c4b0ce5ec5e6de35e6433b22eecb1f6a ]
+
+All firmware for the Lemans platform aka QCS9100 aka QCS9075 is for
+historical reasons located in the qcom/sa8775p/ subdir inside
+linux-firmware. The only exceptions to this rule are audio topology
+files. While it's not too late, change the subdir to point to the
+sa8775p/ subdir, so that all firmware for that platform is present at
+the same location.
+
+Fixes: 5b5bf5922f4c ("ASoC: qcom: sc8280xp: Add sound card support for QCS9100 and QCS9075")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250924-lemans-evk-topo-v2-1-7d44909a5758@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sc8280xp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
+index 288ccd7f8866a..6847ae4acbd18 100644
+--- a/sound/soc/qcom/sc8280xp.c
++++ b/sound/soc/qcom/sc8280xp.c
+@@ -191,8 +191,8 @@ static const struct of_device_id snd_sc8280xp_dt_match[] = {
+ {.compatible = "qcom,qcm6490-idp-sndcard", "qcm6490"},
+ {.compatible = "qcom,qcs6490-rb3gen2-sndcard", "qcs6490"},
+ {.compatible = "qcom,qcs8275-sndcard", "qcs8300"},
+- {.compatible = "qcom,qcs9075-sndcard", "qcs9075"},
+- {.compatible = "qcom,qcs9100-sndcard", "qcs9100"},
++ {.compatible = "qcom,qcs9075-sndcard", "sa8775p"},
++ {.compatible = "qcom,qcs9100-sndcard", "sa8775p"},
+ {.compatible = "qcom,sc8280xp-sndcard", "sc8280xp"},
+ {.compatible = "qcom,sm8450-sndcard", "sm8450"},
+ {.compatible = "qcom,sm8550-sndcard", "sm8550"},
+--
+2.51.0
+
--- /dev/null
+From c03e96ed6cc8ad5d30f5071f609e6d06012ec7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 17:05:25 +0100
+Subject: ASoC: SOF: ipc4-pcm: Fix incorrect comparison with number of
+ tdm_slots
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 62a7b3bbb6b873fdcc85a37efbd0102d66c8a73e ]
+
+In ipc4_ssp_dai_config_pcm_params_match() when comparing params_channels()
+against hw_config->tdm_slots the comparison should be a <= not a ==.
+
+The number of TDM slots must be enough for the number of required channels.
+But it can be greater. There are various reason why a I2S/TDM link has more
+TDM slots than a particular audio stream needs.
+
+The original comparison would fail on systems that had more TDM slots.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: 8a07944a77e9 ("ASoC: SOF: ipc4-pcm: Look for best matching hw_config for SSP")
+Link: https://patch.msgid.link/20250819160525.423416-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
+index 374dc10d10fd5..86f7377fb92fa 100644
+--- a/sound/soc/sof/ipc4-pcm.c
++++ b/sound/soc/sof/ipc4-pcm.c
+@@ -639,14 +639,14 @@ static int ipc4_ssp_dai_config_pcm_params_match(struct snd_sof_dev *sdev,
+
+ if (params_rate(params) == le32_to_cpu(hw_config->fsync_rate) &&
+ params_width(params) == le32_to_cpu(hw_config->tdm_slot_width) &&
+- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) {
++ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) {
+ current_config = le32_to_cpu(hw_config->id);
+ partial_match = false;
+ /* best match found */
+ break;
+ } else if (current_config < 0 &&
+ params_rate(params) == le32_to_cpu(hw_config->fsync_rate) &&
+- params_channels(params) == le32_to_cpu(hw_config->tdm_slots)) {
++ params_channels(params) <= le32_to_cpu(hw_config->tdm_slots)) {
+ current_config = le32_to_cpu(hw_config->id);
+ partial_match = true;
+ /* keep looking for better match */
+--
+2.51.0
+
--- /dev/null
+From b06f21a47e6b1dc8a7fc88e7d8df6612588555ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:38 +0800
+Subject: blk-mq: check invalid nr_requests in queue_requests_store()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit b46d4c447db76e36906ed59ebb9b3ef8f3383322 ]
+
+queue_requests_store() is the only caller of
+blk_mq_update_nr_requests(), and blk_mq_update_nr_requests() is the
+only caller of blk_mq_tag_update_depth(), however, they all have
+checkings for nr_requests input by user.
+
+Make code cleaner by moving all the checkings to the top function:
+
+1) nr_requests > reserved tags;
+2) if there is elevator, 4 <= nr_requests <= 2048;
+3) if elevator is none, 4 <= nr_requests <= tag_set->queue_depth;
+
+Meanwhile, case 2 is the only case tags can grow and -ENOMEM might be
+returned.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-tag.c | 16 +---------------
+ block/blk-mq.c | 8 ++------
+ block/blk-mq.h | 2 +-
+ block/blk-sysfs.c | 13 +++++++++++++
+ 4 files changed, 17 insertions(+), 22 deletions(-)
+
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index 5cffa5668d0c3..725210f27471c 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -584,14 +584,10 @@ void blk_mq_free_tags(struct blk_mq_tags *tags)
+ }
+
+ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
+- struct blk_mq_tags **tagsptr, unsigned int tdepth,
+- bool can_grow)
++ struct blk_mq_tags **tagsptr, unsigned int tdepth)
+ {
+ struct blk_mq_tags *tags = *tagsptr;
+
+- if (tdepth <= tags->nr_reserved_tags)
+- return -EINVAL;
+-
+ /*
+ * If we are allowed to grow beyond the original size, allocate
+ * a new set of tags before freeing the old one.
+@@ -600,16 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
+ struct blk_mq_tag_set *set = hctx->queue->tag_set;
+ struct blk_mq_tags *new;
+
+- if (!can_grow)
+- return -EINVAL;
+-
+- /*
+- * We need some sort of upper limit, set it high enough that
+- * no valid use cases should require more.
+- */
+- if (tdepth > MAX_SCHED_RQ)
+- return -EINVAL;
+-
+ /*
+ * Only the sbitmap needs resizing since we allocated the max
+ * initially.
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index f5e713224d819..a81ef562014d6 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4932,9 +4932,6 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ int ret = 0;
+ unsigned long i;
+
+- if (q->nr_requests == nr)
+- return 0;
+-
+ blk_mq_quiesce_queue(q);
+
+ queue_for_each_hw_ctx(q, hctx, i) {
+@@ -4946,10 +4943,9 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ */
+ if (hctx->sched_tags) {
+ ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
+- nr, true);
++ nr);
+ } else {
+- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr,
+- false);
++ ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr);
+ }
+ if (ret)
+ goto out;
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index affb2e14b56e3..2b3ade60c90b2 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -171,7 +171,7 @@ void blk_mq_put_tag(struct blk_mq_tags *tags, struct blk_mq_ctx *ctx,
+ unsigned int tag);
+ void blk_mq_put_tags(struct blk_mq_tags *tags, int *tag_array, int nr_tags);
+ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
+- struct blk_mq_tags **tags, unsigned int depth, bool can_grow);
++ struct blk_mq_tags **tags, unsigned int depth);
+ void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set,
+ unsigned int size);
+ void blk_mq_tag_update_sched_shared_tags(struct request_queue *q);
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 4a7f1a349998b..b61e956a868e7 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -78,12 +78,25 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+
+ memflags = blk_mq_freeze_queue(q);
+ mutex_lock(&q->elevator_lock);
++
++ if (nr == q->nr_requests)
++ goto unlock;
++
+ if (nr < BLKDEV_MIN_RQ)
+ nr = BLKDEV_MIN_RQ;
+
++ if (nr <= q->tag_set->reserved_tags ||
++ (q->elevator && nr > MAX_SCHED_RQ) ||
++ (!q->elevator && nr > q->tag_set->queue_depth)) {
++ ret = -EINVAL;
++ goto unlock;
++ }
++
+ err = blk_mq_update_nr_requests(disk->queue, nr);
+ if (err)
+ ret = err;
++
++unlock:
+ mutex_unlock(&q->elevator_lock);
+ blk_mq_unfreeze_queue(q, memflags);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From a85c5b0ef6a7d30c89a778061a78456613c4a968 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 24656980f4431..5c399ac562eae 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From 1aabc76a426066f50dc1b2880fe06626264b21b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:40 +0800
+Subject: blk-mq: cleanup shared tags case in blk_mq_update_nr_requests()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 7f2799c546dba9e12f9ff4d07936601e416c640d ]
+
+For shared tags case, all hctx->sched_tags/tags are the same, it doesn't
+make sense to call into blk_mq_tag_update_depth() multiple times for the
+same tags.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-tag.c | 7 -------
+ block/blk-mq.c | 43 ++++++++++++++++++++++---------------------
+ 2 files changed, 22 insertions(+), 28 deletions(-)
+
+diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
+index 725210f27471c..aed84c5d5c2b2 100644
+--- a/block/blk-mq-tag.c
++++ b/block/blk-mq-tag.c
+@@ -596,13 +596,6 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx,
+ struct blk_mq_tag_set *set = hctx->queue->tag_set;
+ struct blk_mq_tags *new;
+
+- /*
+- * Only the sbitmap needs resizing since we allocated the max
+- * initially.
+- */
+- if (blk_mq_is_shared_tags(set->flags))
+- return 0;
+-
+ new = blk_mq_alloc_map_and_rqs(set, hctx->queue_num, tdepth);
+ if (!new)
+ return -ENOMEM;
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index a81ef562014d6..bcb7495893a09 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4934,34 +4934,35 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+
+ blk_mq_quiesce_queue(q);
+
+- queue_for_each_hw_ctx(q, hctx, i) {
+- if (!hctx->tags)
+- continue;
+- /*
+- * If we're using an MQ scheduler, just update the scheduler
+- * queue depth. This is similar to what the old code would do.
+- */
+- if (hctx->sched_tags) {
+- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
+- nr);
+- } else {
+- ret = blk_mq_tag_update_depth(hctx, &hctx->tags, nr);
+- }
+- if (ret)
+- goto out;
+- }
+-
+- q->nr_requests = nr;
+- if (q->elevator && q->elevator->type->ops.depth_updated)
+- q->elevator->type->ops.depth_updated(q);
+-
+ if (blk_mq_is_shared_tags(set->flags)) {
+ if (q->elevator)
+ blk_mq_tag_update_sched_shared_tags(q);
+ else
+ blk_mq_tag_resize_shared_tags(set, nr);
++ } else {
++ queue_for_each_hw_ctx(q, hctx, i) {
++ if (!hctx->tags)
++ continue;
++ /*
++ * If we're using an MQ scheduler, just update the
++ * scheduler queue depth. This is similar to what the
++ * old code would do.
++ */
++ if (hctx->sched_tags)
++ ret = blk_mq_tag_update_depth(hctx,
++ &hctx->sched_tags, nr);
++ else
++ ret = blk_mq_tag_update_depth(hctx,
++ &hctx->tags, nr);
++ if (ret)
++ goto out;
++ }
+ }
+
++ q->nr_requests = nr;
++ if (q->elevator && q->elevator->type->ops.depth_updated)
++ q->elevator->type->ops.depth_updated(q);
++
+ out:
+ blk_mq_unquiesce_queue(q);
+
+--
+2.51.0
+
--- /dev/null
+From 8d44fb78b7eddd3c3780060d37d4cd100f6f0235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:39 +0800
+Subject: blk-mq: convert to serialize updating nr_requests with
+ update_nr_hwq_lock
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 626ff4f8ebcb7207f01e7810acb85812ccf06bd8 ]
+
+request_queue->nr_requests can be changed by:
+
+a) switch elevator by updating nr_hw_queues
+b) switch elevator by elevator sysfs attribute
+c) configue queue sysfs attribute nr_requests
+
+Current lock order is:
+
+1) update_nr_hwq_lock, case a,b
+2) freeze_queue
+3) elevator_lock, case a,b,c
+
+And update nr_requests is seriablized by elevator_lock() already,
+however, in the case c, we'll have to allocate new sched_tags if
+nr_requests grow, and do this with elevator_lock held and queue
+freezed has the risk of deadlock.
+
+Hence use update_nr_hwq_lock instead, make it possible to allocate
+memory if tags grow, meanwhile also prevent nr_requests to be changed
+concurrently.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-sysfs.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index b61e956a868e7..163264e4ec629 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -68,6 +68,7 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+ int ret, err;
+ unsigned int memflags;
+ struct request_queue *q = disk->queue;
++ struct blk_mq_tag_set *set = q->tag_set;
+
+ if (!queue_is_mq(q))
+ return -EINVAL;
+@@ -76,8 +77,11 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+ if (ret < 0)
+ return ret;
+
+- memflags = blk_mq_freeze_queue(q);
+- mutex_lock(&q->elevator_lock);
++ /*
++ * Serialize updating nr_requests with concurrent queue_requests_store()
++ * and switching elevator.
++ */
++ down_write(&set->update_nr_hwq_lock);
+
+ if (nr == q->nr_requests)
+ goto unlock;
+@@ -85,20 +89,31 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+ if (nr < BLKDEV_MIN_RQ)
+ nr = BLKDEV_MIN_RQ;
+
+- if (nr <= q->tag_set->reserved_tags ||
++ /*
++ * Switching elevator is protected by update_nr_hwq_lock:
++ * - read lock is held from elevator sysfs attribute;
++ * - write lock is held from updating nr_hw_queues;
++ * Hence it's safe to access q->elevator here with write lock held.
++ */
++ if (nr <= set->reserved_tags ||
+ (q->elevator && nr > MAX_SCHED_RQ) ||
+- (!q->elevator && nr > q->tag_set->queue_depth)) {
++ (!q->elevator && nr > set->queue_depth)) {
+ ret = -EINVAL;
+ goto unlock;
+ }
+
++ memflags = blk_mq_freeze_queue(q);
++ mutex_lock(&q->elevator_lock);
++
+ err = blk_mq_update_nr_requests(disk->queue, nr);
+ if (err)
+ ret = err;
+
+-unlock:
+ mutex_unlock(&q->elevator_lock);
+ blk_mq_unfreeze_queue(q, memflags);
++
++unlock:
++ up_write(&set->update_nr_hwq_lock);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8e4b94cbbc4679163dfb0679351e62ef5db0e11a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:06:11 +0800
+Subject: blk-mq: fix elevator depth_updated method
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 7d337eef4affc5e26e0570513168c69ddbc40f92 ]
+
+Current depth_updated has some problems:
+
+1) depth_updated() will be called for each hctx, while all elevators
+will update async_depth for the disk level, this is not related to hctx;
+2) In blk_mq_update_nr_requests(), if previous hctx update succeed and
+this hctx update failed, q->nr_requests will not be updated, while
+async_depth is already updated with new nr_reqeuests in previous
+depth_updated();
+3) All elevators are using q->nr_requests to calculate async_depth now,
+however, q->nr_requests is still the old value when depth_updated() is
+called from blk_mq_update_nr_requests();
+
+Those problems are first from error path, then mq-deadline, and recently
+for bfq and kyber, fix those problems by:
+
+- pass in request_queue instead of hctx;
+- move depth_updated() after q->nr_requests is updated in
+ blk_mq_update_nr_requests();
+- add depth_updated() call inside init_sched() method to initialize
+ async_depth;
+- remove init_hctx() method for mq-deadline and bfq that is useless now;
+
+Fixes: 77f1e0a52d26 ("bfq: update internal depth state when queue depth changes")
+Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code")
+Fixes: 42e6c6ce03fd ("lib/sbitmap: convert shallow_depth from one word to the whole sbitmap")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Link: https://lore.kernel.org/r/20250821060612.1729939-2-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 22 +++++-----------------
+ block/blk-mq-sched.h | 11 +++++++++++
+ block/blk-mq.c | 23 ++++++++++++-----------
+ block/elevator.h | 2 +-
+ block/kyber-iosched.c | 19 +++++++++----------
+ block/mq-deadline.c | 16 +++-------------
+ 6 files changed, 41 insertions(+), 52 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 50e51047e1fe5..4a8d3d96bfe49 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -7109,9 +7109,10 @@ void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
+ * See the comments on bfq_limit_depth for the purpose of
+ * the depths set in the function. Return minimum shallow depth we'll use.
+ */
+-static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
++static void bfq_depth_updated(struct request_queue *q)
+ {
+- unsigned int nr_requests = bfqd->queue->nr_requests;
++ struct bfq_data *bfqd = q->elevator->elevator_data;
++ unsigned int nr_requests = q->nr_requests;
+
+ /*
+ * In-word depths if no bfq_queue is being weight-raised:
+@@ -7143,21 +7144,8 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+ bfqd->async_depths[1][0] = max((nr_requests * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+ bfqd->async_depths[1][1] = max((nr_requests * 6) >> 4, 1U);
+-}
+-
+-static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
+-{
+- struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
+- struct blk_mq_tags *tags = hctx->sched_tags;
+
+- bfq_update_depths(bfqd, &tags->bitmap_tags);
+- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
+-}
+-
+-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
+-{
+- bfq_depth_updated(hctx);
+- return 0;
++ blk_mq_set_min_shallow_depth(q, 1);
+ }
+
+ static void bfq_exit_queue(struct elevator_queue *e)
+@@ -7369,6 +7357,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_queue *eq)
+ goto out_free;
+ bfq_init_root_group(bfqd->root_group, bfqd);
+ bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
++ bfq_depth_updated(q);
+
+ /* We dispatch from request queue wide instead of hw queue */
+ blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
+@@ -7628,7 +7617,6 @@ static struct elevator_type iosched_bfq_mq = {
+ .request_merged = bfq_request_merged,
+ .has_work = bfq_has_work,
+ .depth_updated = bfq_depth_updated,
+- .init_hctx = bfq_init_hctx,
+ .init_sched = bfq_init_queue,
+ .exit_sched = bfq_exit_queue,
+ },
+diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
+index b554e1d559508..fe83187f41db4 100644
+--- a/block/blk-mq-sched.h
++++ b/block/blk-mq-sched.h
+@@ -92,4 +92,15 @@ static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
+ return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
+ }
+
++static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
++ unsigned int depth)
++{
++ struct blk_mq_hw_ctx *hctx;
++ unsigned long i;
++
++ queue_for_each_hw_ctx(q, hctx, i)
++ sbitmap_queue_min_shallow_depth(&hctx->sched_tags->bitmap_tags,
++ depth);
++}
++
+ #endif
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index ba3a4b77f5786..9055cd6247004 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4951,20 +4951,21 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ false);
+ }
+ if (ret)
+- break;
+- if (q->elevator && q->elevator->type->ops.depth_updated)
+- q->elevator->type->ops.depth_updated(hctx);
++ goto out;
+ }
+- if (!ret) {
+- q->nr_requests = nr;
+- if (blk_mq_is_shared_tags(set->flags)) {
+- if (q->elevator)
+- blk_mq_tag_update_sched_shared_tags(q);
+- else
+- blk_mq_tag_resize_shared_tags(set, nr);
+- }
++
++ q->nr_requests = nr;
++ if (q->elevator && q->elevator->type->ops.depth_updated)
++ q->elevator->type->ops.depth_updated(q);
++
++ if (blk_mq_is_shared_tags(set->flags)) {
++ if (q->elevator)
++ blk_mq_tag_update_sched_shared_tags(q);
++ else
++ blk_mq_tag_resize_shared_tags(set, nr);
+ }
+
++out:
+ blk_mq_unquiesce_queue(q);
+
+ return ret;
+diff --git a/block/elevator.h b/block/elevator.h
+index adc5c157e17e5..c4d20155065e8 100644
+--- a/block/elevator.h
++++ b/block/elevator.h
+@@ -37,7 +37,7 @@ struct elevator_mq_ops {
+ void (*exit_sched)(struct elevator_queue *);
+ int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int);
+ void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int);
+- void (*depth_updated)(struct blk_mq_hw_ctx *);
++ void (*depth_updated)(struct request_queue *);
+
+ bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
+ bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int);
+diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
+index 70cbc7b2deb40..18efd6ef2a2b9 100644
+--- a/block/kyber-iosched.c
++++ b/block/kyber-iosched.c
+@@ -399,6 +399,14 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q)
+ return ERR_PTR(ret);
+ }
+
++static void kyber_depth_updated(struct request_queue *q)
++{
++ struct kyber_queue_data *kqd = q->elevator->elevator_data;
++
++ kqd->async_depth = q->nr_requests * KYBER_ASYNC_PERCENT / 100U;
++ blk_mq_set_min_shallow_depth(q, kqd->async_depth);
++}
++
+ static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
+ {
+ struct kyber_queue_data *kqd;
+@@ -413,6 +421,7 @@ static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
+
+ eq->elevator_data = kqd;
+ q->elevator = eq;
++ kyber_depth_updated(q);
+
+ return 0;
+ }
+@@ -440,15 +449,6 @@ static void kyber_ctx_queue_init(struct kyber_ctx_queue *kcq)
+ INIT_LIST_HEAD(&kcq->rq_list[i]);
+ }
+
+-static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx)
+-{
+- struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data;
+- struct blk_mq_tags *tags = hctx->sched_tags;
+-
+- kqd->async_depth = hctx->queue->nr_requests * KYBER_ASYNC_PERCENT / 100U;
+- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth);
+-}
+-
+ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+ {
+ struct kyber_hctx_data *khd;
+@@ -493,7 +493,6 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+ khd->batching = 0;
+
+ hctx->sched_data = khd;
+- kyber_depth_updated(hctx);
+
+ return 0;
+
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index b9b7cdf1d3c98..2e689b2c40213 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -507,22 +507,12 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
+ }
+
+ /* Called by blk_mq_update_nr_requests(). */
+-static void dd_depth_updated(struct blk_mq_hw_ctx *hctx)
++static void dd_depth_updated(struct request_queue *q)
+ {
+- struct request_queue *q = hctx->queue;
+ struct deadline_data *dd = q->elevator->elevator_data;
+- struct blk_mq_tags *tags = hctx->sched_tags;
+
+ dd->async_depth = q->nr_requests;
+-
+- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
+-}
+-
+-/* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */
+-static int dd_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+-{
+- dd_depth_updated(hctx);
+- return 0;
++ blk_mq_set_min_shallow_depth(q, 1);
+ }
+
+ static void dd_exit_sched(struct elevator_queue *e)
+@@ -587,6 +577,7 @@ static int dd_init_sched(struct request_queue *q, struct elevator_queue *eq)
+ blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
+
+ q->elevator = eq;
++ dd_depth_updated(q);
+ return 0;
+ }
+
+@@ -1048,7 +1039,6 @@ static struct elevator_type mq_deadline = {
+ .has_work = dd_has_work,
+ .init_sched = dd_init_sched,
+ .exit_sched = dd_exit_sched,
+- .init_hctx = dd_init_hctx,
+ },
+
+ #ifdef CONFIG_BLK_DEBUG_FS
+--
+2.51.0
+
--- /dev/null
+From 87f0c67499efb618b8bc8bdf80973f640b63bd4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:43 +0800
+Subject: blk-mq: fix potential deadlock while nr_requests grown
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit b86433721f46d934940528f28d49c1dedb690df1 ]
+
+Allocate and free sched_tags while queue is freezed can deadlock[1],
+this is a long term problem, hence allocate memory before freezing
+queue and free memory after queue is unfreezed.
+
+[1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/
+Fixes: e3a2b3f931f5 ("blk-mq: allow changing of queue depth through sysfs")
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 22 +++++++++-------------
+ block/blk-mq.h | 5 ++++-
+ block/blk-sysfs.c | 29 +++++++++++++++++++++--------
+ 3 files changed, 34 insertions(+), 22 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 1bafbdced7bd5..f8a8a23b90402 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4925,11 +4925,13 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)
+ }
+ EXPORT_SYMBOL(blk_mq_free_tag_set);
+
+-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
++struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,
++ struct elevator_tags *et,
++ unsigned int nr)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
++ struct elevator_tags *old_et = NULL;
+ struct blk_mq_hw_ctx *hctx;
+- int ret = 0;
+ unsigned long i;
+
+ blk_mq_quiesce_queue(q);
+@@ -4964,24 +4966,18 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ }
+ } else {
+ /* Non-shared sched tags, and tags grow */
+- queue_for_each_hw_ctx(q, hctx, i) {
+- if (!hctx->sched_tags)
+- continue;
+- ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
+- nr);
+- if (ret)
+- goto out;
+- }
++ queue_for_each_hw_ctx(q, hctx, i)
++ hctx->sched_tags = et->tags[i];
++ old_et = q->elevator->et;
++ q->elevator->et = et;
+ }
+
+ q->nr_requests = nr;
+ if (q->elevator && q->elevator->type->ops.depth_updated)
+ q->elevator->type->ops.depth_updated(q);
+
+-out:
+ blk_mq_unquiesce_queue(q);
+-
+- return ret;
++ return old_et;
+ }
+
+ /*
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 731f4578d9a84..6c9d03625ba12 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -6,6 +6,7 @@
+ #include "blk-stat.h"
+
+ struct blk_mq_tag_set;
++struct elevator_tags;
+
+ struct blk_mq_ctxs {
+ struct kobject kobj;
+@@ -45,7 +46,9 @@ void blk_mq_submit_bio(struct bio *bio);
+ int blk_mq_poll(struct request_queue *q, blk_qc_t cookie, struct io_comp_batch *iob,
+ unsigned int flags);
+ void blk_mq_exit_queue(struct request_queue *q);
+-int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
++struct elevator_tags *blk_mq_update_nr_requests(struct request_queue *q,
++ struct elevator_tags *tags,
++ unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *,
+ bool);
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 163264e4ec629..9b03261b3e042 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -64,11 +64,12 @@ static ssize_t queue_requests_show(struct gendisk *disk, char *page)
+ static ssize_t
+ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+ {
+- unsigned long nr;
+- int ret, err;
+- unsigned int memflags;
+ struct request_queue *q = disk->queue;
+ struct blk_mq_tag_set *set = q->tag_set;
++ struct elevator_tags *et = NULL;
++ unsigned int memflags;
++ unsigned long nr;
++ int ret;
+
+ if (!queue_is_mq(q))
+ return -EINVAL;
+@@ -102,16 +103,28 @@ queue_requests_store(struct gendisk *disk, const char *page, size_t count)
+ goto unlock;
+ }
+
++ if (!blk_mq_is_shared_tags(set->flags) && q->elevator &&
++ nr > q->elevator->et->nr_requests) {
++ /*
++ * Tags will grow, allocate memory before freezing queue to
++ * prevent deadlock.
++ */
++ et = blk_mq_alloc_sched_tags(set, q->nr_hw_queues, nr);
++ if (!et) {
++ ret = -ENOMEM;
++ goto unlock;
++ }
++ }
++
+ memflags = blk_mq_freeze_queue(q);
+ mutex_lock(&q->elevator_lock);
+-
+- err = blk_mq_update_nr_requests(disk->queue, nr);
+- if (err)
+- ret = err;
+-
++ et = blk_mq_update_nr_requests(q, et, nr);
+ mutex_unlock(&q->elevator_lock);
+ blk_mq_unfreeze_queue(q, memflags);
+
++ if (et)
++ blk_mq_free_sched_tags(et, set);
++
+ unlock:
+ up_write(&set->update_nr_hwq_lock);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 65bfd5d449da4c6f82ed95be4742e6f47a812f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:37 +0800
+Subject: blk-mq: remove useless checkings in blk_mq_update_nr_requests()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 8bd7195fea6d9662aa3b32498a3828bfd9b63185 ]
+
+1) queue_requests_store() is the only caller of
+blk_mq_update_nr_requests(), where queue is already freezed, no need to
+check mq_freeze_depth;
+2) q->tag_set must be set for request based device, and queue_is_mq() is
+already checked in blk_mq_queue_attr_visible(), no need to check
+q->tag_set.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 19b50110376c6..f5e713224d819 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4929,21 +4929,14 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+ struct blk_mq_hw_ctx *hctx;
+- int ret;
++ int ret = 0;
+ unsigned long i;
+
+- if (WARN_ON_ONCE(!q->mq_freeze_depth))
+- return -EINVAL;
+-
+- if (!set)
+- return -EINVAL;
+-
+ if (q->nr_requests == nr)
+ return 0;
+
+ blk_mq_quiesce_queue(q);
+
+- ret = 0;
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx->tags)
+ continue;
+--
+2.51.0
+
--- /dev/null
+From 59b21d7c278ea71427d22f7ac6f857e709210b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:42 +0800
+Subject: blk-mq-sched: add new parameter nr_requests in
+ blk_mq_alloc_sched_tags()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 6293e336f6d7d3f3415346ce34993b3398846166 ]
+
+This helper only support to allocate the default number of requests,
+add a new parameter to support specific number of requests.
+
+Prepare to fix potential deadlock in the case nr_requests grow.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sched.c | 14 +++++---------
+ block/blk-mq-sched.h | 2 +-
+ block/blk-mq.h | 11 +++++++++++
+ block/elevator.c | 3 ++-
+ 4 files changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index e2ce4a28e6c9e..d06bb137a7437 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -454,7 +454,7 @@ void blk_mq_free_sched_tags_batch(struct xarray *et_table,
+ }
+
+ struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
+- unsigned int nr_hw_queues)
++ unsigned int nr_hw_queues, unsigned int nr_requests)
+ {
+ unsigned int nr_tags;
+ int i;
+@@ -470,13 +470,8 @@ struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
+ nr_tags * sizeof(struct blk_mq_tags *), gfp);
+ if (!et)
+ return NULL;
+- /*
+- * Default to double of smaller one between hw queue_depth and
+- * 128, since we don't split into sync/async like the old code
+- * did. Additionally, this is a per-hw queue depth.
+- */
+- et->nr_requests = 2 * min_t(unsigned int, set->queue_depth,
+- BLKDEV_DEFAULT_RQ);
++
++ et->nr_requests = nr_requests;
+ et->nr_hw_queues = nr_hw_queues;
+
+ if (blk_mq_is_shared_tags(set->flags)) {
+@@ -521,7 +516,8 @@ int blk_mq_alloc_sched_tags_batch(struct xarray *et_table,
+ * concurrently.
+ */
+ if (q->elevator) {
+- et = blk_mq_alloc_sched_tags(set, nr_hw_queues);
++ et = blk_mq_alloc_sched_tags(set, nr_hw_queues,
++ blk_mq_default_nr_requests(set));
+ if (!et)
+ goto out_unwind;
+ if (xa_insert(et_table, q->id, et, gfp))
+diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
+index fe83187f41db4..8e21a6b1415d9 100644
+--- a/block/blk-mq-sched.h
++++ b/block/blk-mq-sched.h
+@@ -24,7 +24,7 @@ void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e);
+ void blk_mq_sched_free_rqs(struct request_queue *q);
+
+ struct elevator_tags *blk_mq_alloc_sched_tags(struct blk_mq_tag_set *set,
+- unsigned int nr_hw_queues);
++ unsigned int nr_hw_queues, unsigned int nr_requests);
+ int blk_mq_alloc_sched_tags_batch(struct xarray *et_table,
+ struct blk_mq_tag_set *set, unsigned int nr_hw_queues);
+ void blk_mq_free_sched_tags(struct elevator_tags *et,
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 2b3ade60c90b2..731f4578d9a84 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -109,6 +109,17 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(blk_opf_t opf,
+ return ctx->hctxs[blk_mq_get_hctx_type(opf)];
+ }
+
++/*
++ * Default to double of smaller one between hw queue_depth and
++ * 128, since we don't split into sync/async like the old code
++ * did. Additionally, this is a per-hw queue depth.
++ */
++static inline unsigned int blk_mq_default_nr_requests(
++ struct blk_mq_tag_set *set)
++{
++ return 2 * min_t(unsigned int, set->queue_depth, BLKDEV_DEFAULT_RQ);
++}
++
+ /*
+ * sysfs helpers
+ */
+diff --git a/block/elevator.c b/block/elevator.c
+index fe96c6f4753ca..e2ebfbf107b3a 100644
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -669,7 +669,8 @@ static int elevator_change(struct request_queue *q, struct elv_change_ctx *ctx)
+ lockdep_assert_held(&set->update_nr_hwq_lock);
+
+ if (strncmp(ctx->name, "none", 4)) {
+- ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues);
++ ctx->et = blk_mq_alloc_sched_tags(set, set->nr_hw_queues,
++ blk_mq_default_nr_requests(set));
+ if (!ctx->et)
+ return -ENOMEM;
+ }
+--
+2.51.0
+
--- /dev/null
+From 1b1def4a10e818e49c5a3ea60c9a7eb196ca0f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:04:41 +0800
+Subject: blk-mq: split bitmap grow and resize case in
+ blk_mq_update_nr_requests()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit e63200404477456ec60c62dd8b3b1092aba2e211 ]
+
+No functional changes are intended, make code cleaner and prepare to fix
+the grow case in following patches.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 39 +++++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index bcb7495893a09..1bafbdced7bd5 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4935,25 +4935,40 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
+ blk_mq_quiesce_queue(q);
+
+ if (blk_mq_is_shared_tags(set->flags)) {
++ /*
++ * Shared tags, for sched tags, we allocate max initially hence
++ * tags can't grow, see blk_mq_alloc_sched_tags().
++ */
+ if (q->elevator)
+ blk_mq_tag_update_sched_shared_tags(q);
+ else
+ blk_mq_tag_resize_shared_tags(set, nr);
+- } else {
++ } else if (!q->elevator) {
++ /*
++ * Non-shared hardware tags, nr is already checked from
++ * queue_requests_store() and tags can't grow.
++ */
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (!hctx->tags)
+ continue;
+- /*
+- * If we're using an MQ scheduler, just update the
+- * scheduler queue depth. This is similar to what the
+- * old code would do.
+- */
+- if (hctx->sched_tags)
+- ret = blk_mq_tag_update_depth(hctx,
+- &hctx->sched_tags, nr);
+- else
+- ret = blk_mq_tag_update_depth(hctx,
+- &hctx->tags, nr);
++ sbitmap_queue_resize(&hctx->tags->bitmap_tags,
++ nr - hctx->tags->nr_reserved_tags);
++ }
++ } else if (nr <= q->elevator->et->nr_requests) {
++ /* Non-shared sched tags, and tags don't grow. */
++ queue_for_each_hw_ctx(q, hctx, i) {
++ if (!hctx->sched_tags)
++ continue;
++ sbitmap_queue_resize(&hctx->sched_tags->bitmap_tags,
++ nr - hctx->sched_tags->nr_reserved_tags);
++ }
++ } else {
++ /* Non-shared sched tags, and tags grow */
++ queue_for_each_hw_ctx(q, hctx, i) {
++ if (!hctx->sched_tags)
++ continue;
++ ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
++ nr);
+ if (ret)
+ goto out;
+ }
+--
+2.51.0
+
--- /dev/null
+From 7160d885d9668d3c314be7e3b34743ddd32e2a94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 18:24:11 +0800
+Subject: blk-throttle: fix access race during throttle policy activation
+
+From: Han Guangjiang <hanguangjiang@lixiang.com>
+
+[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ]
+
+On repeated cold boots we occasionally hit a NULL pointer crash in
+blk_should_throtl() when throttling is consulted before the throttle
+policy is fully enabled for the queue. Checking only q->td != NULL is
+insufficient during early initialization, so blkg_to_pd() for the
+throttle policy can still return NULL and blkg_to_tg() becomes NULL,
+which later gets dereferenced.
+
+ Unable to handle kernel NULL pointer dereference
+ at virtual address 0000000000000156
+ ...
+ pc : submit_bio_noacct+0x14c/0x4c8
+ lr : submit_bio_noacct+0x48/0x4c8
+ sp : ffff800087f0b690
+ x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0
+ x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70
+ x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
+ x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff
+ x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c
+ x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60
+ x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002
+ x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500
+ x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a
+ Call trace:
+ submit_bio_noacct+0x14c/0x4c8
+ verity_map+0x178/0x2c8
+ __map_bio+0x228/0x250
+ dm_submit_bio+0x1c4/0x678
+ __submit_bio+0x170/0x230
+ submit_bio_noacct_nocheck+0x16c/0x388
+ submit_bio_noacct+0x16c/0x4c8
+ submit_bio+0xb4/0x210
+ f2fs_submit_read_bio+0x4c/0xf0
+ f2fs_mpage_readpages+0x3b0/0x5f0
+ f2fs_readahead+0x90/0xe8
+
+Tighten blk_throtl_activated() to also require that the throttle policy
+bit is set on the queue:
+
+ return q->td != NULL &&
+ test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);
+
+This prevents blk_should_throtl() from accessing throttle group state
+until policy data has been attached to blkgs.
+
+Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration")
+Co-developed-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Liang Jie <liangjie@lixiang.com>
+Signed-off-by: Han Guangjiang <hanguangjiang@lixiang.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 ------
+ block/blk-cgroup.h | 6 ++++++
+ block/blk-throttle.c | 6 +-----
+ block/blk-throttle.h | 18 +++++++++++-------
+ 4 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index fe9ebd6a2e14d..7246fc2563152 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void)
+ return task_css(current, io_cgrp_id);
+ }
+
+-static bool blkcg_policy_enabled(struct request_queue *q,
+- const struct blkcg_policy *pol)
+-{
+- return pol && test_bit(pol->plid, q->blkcg_pols);
+-}
+-
+ static void blkg_free_workfn(struct work_struct *work)
+ {
+ struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 81868ad86330c..83367086cb6ae 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
+ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
+ }
+
++static inline bool blkcg_policy_enabled(struct request_queue *q,
++ const struct blkcg_policy *pol)
++{
++ return pol && test_bit(pol->plid, q->blkcg_pols);
++}
++
+ void blk_cgroup_bio_start(struct bio *bio);
+ void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta);
+ #else /* CONFIG_BLK_CGROUP */
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 397b6a410f9e5..cfa1cd60d2c5f 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk)
+ INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
+ throtl_service_queue_init(&td->service_queue);
+
+- /*
+- * Freeze queue before activating policy, to synchronize with IO path,
+- * which is protected by 'q_usage_counter'.
+- */
+ memflags = blk_mq_freeze_queue(disk->queue);
+ blk_mq_quiesce_queue(disk->queue);
+
+ q->td = td;
+ td->queue = q;
+
+- /* activate policy */
++ /* activate policy, blk_throtl_activated() will return true */
+ ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
+ if (ret) {
+ q->td = NULL;
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index 3b27755bfbff1..9d7a42c039a15 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk);
+
+ static inline bool blk_throtl_activated(struct request_queue *q)
+ {
+- return q->td != NULL;
++ /*
++ * q->td guarantees that the blk-throttle module is already loaded,
++ * and the plid of blk-throttle is assigned.
++ * blkcg_policy_enabled() guarantees that the policy is activated
++ * in the request_queue.
++ */
++ return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl);
+ }
+
+ static inline bool blk_should_throtl(struct bio *bio)
+@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio)
+ struct throtl_grp *tg;
+ int rw = bio_data_dir(bio);
+
+- /*
+- * This is called under bio_queue_enter(), and it's synchronized with
+- * the activation of blk-throtl, which is protected by
+- * blk_mq_freeze_queue().
+- */
+ if (!blk_throtl_activated(bio->bi_bdev->bd_queue))
+ return false;
+
+@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio)
+
+ static inline bool blk_throtl_bio(struct bio *bio)
+ {
+-
++ /*
++ * block throttling takes effect if the policy is activated
++ * in the bio's request_queue.
++ */
+ if (!blk_should_throtl(bio))
+ return false;
+
+--
+2.51.0
+
--- /dev/null
+From 545300ce34f0aaa57f4edcd2e136475366397e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 15:55:39 +0800
+Subject: blk-throttle: fix throtl_data leak during disk release
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ]
+
+Tightening the throttle activation check in blk_throtl_activated() to
+require both q->td presence and policy bit set introduced a memory leak
+during disk release:
+
+blkg_destroy_all() clears the policy bit first during queue deactivation,
+causing subsequent blk_throtl_exit() to skip throtl_data cleanup when
+blk_throtl_activated() fails policy check.
+
+Idealy we should avoid modifying blk_throtl_exit() activation check because
+it's intuitive that blk-throtl start from blk_throtl_init() and end in
+blk_throtl_exit(). However, call blk_throtl_exit() before
+blkg_destroy_all() will make a long term deadlock problem easier to
+trigger[1], hence fix this problem by checking if q->td is NULL from
+blk_throtl_exit(), and remove policy deactivation as well since it's
+useless.
+
+[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=9ADiCjAqza9w@mail.gmail.com/#t
+
+Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Closes: https://lore.kernel.org/all/CAHj4cs-p-ZwBEKigBj7T6hQCOo-H68-kVwCrV6ZvRovrr9Z+HA@mail.gmail.com/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-throttle.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index f510ae072868c..2c5b64b1a724a 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk)
+ {
+ struct request_queue *q = disk->queue;
+
+- if (!blk_throtl_activated(q))
++ /*
++ * blkg_destroy_all() already deactivate throtl policy, just check and
++ * free throtl data.
++ */
++ if (!q->td)
+ return;
+
+ timer_delete_sync(&q->td->service_queue.pending_timer);
+ throtl_shutdown_wq(q);
+- blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
+ kfree(q->td);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 808f4405b55b10ef2c9ed621a70c15429b386fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 14:30:41 +0800
+Subject: block: cleanup bio_issue
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 1733e88874838ddebf7774440c285700865e6b08 ]
+
+Now that bio->bi_issue is only used by blk-iolatency to get bio issue
+time, replace bio_issue with u64 time directly and remove bio_issue to
+make code cleaner.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 1f963bdd6420 ("block: initialize bio issue time in blk_mq_submit_bio()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 2 +-
+ block/blk-cgroup.h | 2 +-
+ block/blk-iolatency.c | 14 +++----------
+ block/blk.h | 42 ---------------------------------------
+ include/linux/blk_types.h | 7 ++-----
+ 5 files changed, 7 insertions(+), 60 deletions(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index 3b371a5da159e..1904683f7ab05 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -261,7 +261,7 @@ void bio_init(struct bio *bio, struct block_device *bdev, struct bio_vec *table,
+ bio->bi_private = NULL;
+ #ifdef CONFIG_BLK_CGROUP
+ bio->bi_blkg = NULL;
+- bio->bi_issue.value = 0;
++ bio->issue_time_ns = 0;
+ if (bdev)
+ bio_associate_blkg(bio);
+ #ifdef CONFIG_BLK_CGROUP_IOCOST
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 83367086cb6ae..8328427e31657 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -372,7 +372,7 @@ static inline void blkg_put(struct blkcg_gq *blkg)
+
+ static inline void blkcg_bio_issue_init(struct bio *bio)
+ {
+- bio_issue_init(&bio->bi_issue, bio_sectors(bio));
++ bio->issue_time_ns = blk_time_get_ns();
+ }
+
+ static inline void blkcg_use_delay(struct blkcg_gq *blkg)
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 2f8fdecdd7a9b..554b191a68921 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -485,19 +485,11 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio)
+ mod_timer(&blkiolat->timer, jiffies + HZ);
+ }
+
+-static void iolatency_record_time(struct iolatency_grp *iolat,
+- struct bio_issue *issue, u64 now,
+- bool issue_as_root)
++static void iolatency_record_time(struct iolatency_grp *iolat, u64 start,
++ u64 now, bool issue_as_root)
+ {
+- u64 start = bio_issue_time(issue);
+ u64 req_time;
+
+- /*
+- * Have to do this so we are truncated to the correct time that our
+- * issue is truncated to.
+- */
+- now = __bio_issue_time(now);
+-
+ if (now <= start)
+ return;
+
+@@ -625,7 +617,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ * submitted, so do not account for it.
+ */
+ if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) {
+- iolatency_record_time(iolat, &bio->bi_issue, now,
++ iolatency_record_time(iolat, bio->issue_time_ns, now,
+ issue_as_root);
+ window_start = atomic64_read(&iolat->window_start);
+ if (now > window_start &&
+diff --git a/block/blk.h b/block/blk.h
+index 46f566f9b1266..0268deb222688 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -680,48 +680,6 @@ static inline ktime_t blk_time_get(void)
+ return ns_to_ktime(blk_time_get_ns());
+ }
+
+-/*
+- * From most significant bit:
+- * 1 bit: reserved for other usage, see below
+- * 12 bits: original size of bio
+- * 51 bits: issue time of bio
+- */
+-#define BIO_ISSUE_RES_BITS 1
+-#define BIO_ISSUE_SIZE_BITS 12
+-#define BIO_ISSUE_RES_SHIFT (64 - BIO_ISSUE_RES_BITS)
+-#define BIO_ISSUE_SIZE_SHIFT (BIO_ISSUE_RES_SHIFT - BIO_ISSUE_SIZE_BITS)
+-#define BIO_ISSUE_TIME_MASK ((1ULL << BIO_ISSUE_SIZE_SHIFT) - 1)
+-#define BIO_ISSUE_SIZE_MASK \
+- (((1ULL << BIO_ISSUE_SIZE_BITS) - 1) << BIO_ISSUE_SIZE_SHIFT)
+-#define BIO_ISSUE_RES_MASK (~((1ULL << BIO_ISSUE_RES_SHIFT) - 1))
+-
+-/* Reserved bit for blk-throtl */
+-#define BIO_ISSUE_THROTL_SKIP_LATENCY (1ULL << 63)
+-
+-static inline u64 __bio_issue_time(u64 time)
+-{
+- return time & BIO_ISSUE_TIME_MASK;
+-}
+-
+-static inline u64 bio_issue_time(struct bio_issue *issue)
+-{
+- return __bio_issue_time(issue->value);
+-}
+-
+-static inline sector_t bio_issue_size(struct bio_issue *issue)
+-{
+- return ((issue->value & BIO_ISSUE_SIZE_MASK) >> BIO_ISSUE_SIZE_SHIFT);
+-}
+-
+-static inline void bio_issue_init(struct bio_issue *issue,
+- sector_t size)
+-{
+- size &= (1ULL << BIO_ISSUE_SIZE_BITS) - 1;
+- issue->value = ((issue->value & BIO_ISSUE_RES_MASK) |
+- (blk_time_get_ns() & BIO_ISSUE_TIME_MASK) |
+- ((u64)size << BIO_ISSUE_SIZE_SHIFT));
+-}
+-
+ void bdev_release(struct file *bdev_file);
+ int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder,
+ const struct blk_holder_ops *hops, struct file *bdev_file);
+diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
+index 09b99d52fd365..f78145be77df5 100644
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -198,10 +198,6 @@ static inline bool blk_path_error(blk_status_t error)
+ return true;
+ }
+
+-struct bio_issue {
+- u64 value;
+-};
+-
+ typedef __u32 __bitwise blk_opf_t;
+
+ typedef unsigned int blk_qc_t;
+@@ -242,7 +238,8 @@ struct bio {
+ * on release of the bio.
+ */
+ struct blkcg_gq *bi_blkg;
+- struct bio_issue bi_issue;
++ /* Time that this bio was issued. */
++ u64 issue_time_ns;
+ #ifdef CONFIG_BLK_CGROUP_IOCOST
+ u64 bi_iocost_cost;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 4d33212f4033569fc8d2fa557986e1fa4b7690a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 14:30:46 +0800
+Subject: block: factor out a helper bio_submit_split_bioset()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit e37b5596a19be9a150cb194ec32e78f295a3574b ]
+
+No functional changes are intended, some drivers like mdraid will split
+bio by internal processing, prepare to unify bio split codes.
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 59 ++++++++++++++++++++++++++++--------------
+ include/linux/blkdev.h | 2 ++
+ 2 files changed, 42 insertions(+), 19 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 5538356770a47..51fe4ed5b7c0b 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -104,33 +104,54 @@ static unsigned int bio_allowed_max_sectors(const struct queue_limits *lim)
+ return round_down(UINT_MAX, lim->logical_block_size) >> SECTOR_SHIFT;
+ }
+
++/*
++ * bio_submit_split_bioset - Submit a bio, splitting it at a designated sector
++ * @bio: the original bio to be submitted and split
++ * @split_sectors: the sector count at which to split
++ * @bs: the bio set used for allocating the new split bio
++ *
++ * The original bio is modified to contain the remaining sectors and submitted.
++ * The caller is responsible for submitting the returned bio.
++ *
++ * If succeed, the newly allocated bio representing the initial part will be
++ * returned, on failure NULL will be returned and original bio will fail.
++ */
++struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
++ struct bio_set *bs)
++{
++ struct bio *split = bio_split(bio, split_sectors, GFP_NOIO, bs);
++
++ if (IS_ERR(split)) {
++ bio->bi_status = errno_to_blk_status(PTR_ERR(split));
++ bio_endio(bio);
++ return NULL;
++ }
++
++ bio_chain(split, bio);
++ trace_block_split(split, bio->bi_iter.bi_sector);
++ WARN_ON_ONCE(bio_zone_write_plugging(bio));
++ submit_bio_noacct(bio);
++
++ return split;
++}
++EXPORT_SYMBOL_GPL(bio_submit_split_bioset);
++
+ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
+ {
+- if (unlikely(split_sectors < 0))
+- goto error;
++ if (unlikely(split_sectors < 0)) {
++ bio->bi_status = errno_to_blk_status(split_sectors);
++ bio_endio(bio);
++ return NULL;
++ }
+
+ if (split_sectors) {
+- struct bio *split;
+-
+- split = bio_split(bio, split_sectors, GFP_NOIO,
++ bio = bio_submit_split_bioset(bio, split_sectors,
+ &bio->bi_bdev->bd_disk->bio_split);
+- if (IS_ERR(split)) {
+- split_sectors = PTR_ERR(split);
+- goto error;
+- }
+- split->bi_opf |= REQ_NOMERGE;
+- bio_chain(split, bio);
+- trace_block_split(split, bio->bi_iter.bi_sector);
+- WARN_ON_ONCE(bio_zone_write_plugging(bio));
+- submit_bio_noacct(bio);
+- return split;
++ if (bio)
++ bio->bi_opf |= REQ_NOMERGE;
+ }
+
+ return bio;
+-error:
+- bio->bi_status = errno_to_blk_status(split_sectors);
+- bio_endio(bio);
+- return NULL;
+ }
+
+ struct bio *bio_split_discard(struct bio *bio, const struct queue_limits *lim,
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index fe1797bbec420..cc221318712e7 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -999,6 +999,8 @@ extern int blk_register_queue(struct gendisk *disk);
+ extern void blk_unregister_queue(struct gendisk *disk);
+ void submit_bio_noacct(struct bio *bio);
+ struct bio *bio_split_to_limits(struct bio *bio);
++struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
++ struct bio_set *bs);
+
+ extern int blk_lld_busy(struct request_queue *q);
+ extern int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags);
+--
+2.51.0
+
--- /dev/null
+From 13030179ce722324faba15aa4731f4afb774949e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 14:30:55 +0800
+Subject: block: fix ordering of recursive split IO
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit b2f5974079d82a4761f002e80601064d4e39a81f ]
+
+Currently, split bio will be chained to original bio, and original bio
+will be resubmitted to the tail of current->bio_list, waiting for
+split bio to be issued. However, if split bio get split again, the IO
+order will be messed up. This problem, on the one hand, will cause
+performance degradation, especially for mdraid with large IO size; on
+the other hand, will cause write errors for zoned block devices[1].
+
+For example, in raid456 IO will first be split by max_sector from
+md_submit_bio(), and then later be split again by chunksize for internal
+handling:
+
+For example, assume max_sectors is 1M, and chunksize is 512k
+
+1) issue a 2M IO:
+
+bio issuing: 0+2M
+current->bio_list: NULL
+
+2) md_submit_bio() split by max_sector:
+
+bio issuing: 0+1M
+current->bio_list: 1M+1M
+
+3) chunk_aligned_read() split by chunksize:
+
+bio issuing: 0+512k
+current->bio_list: 1M+1M -> 512k+512k
+
+4) after first bio issued, __submit_bio_noacct() will contuine issuing
+next bio:
+
+bio issuing: 1M+1M
+current->bio_list: 512k+512k
+bio issued: 0+512k
+
+5) chunk_aligned_read() split by chunksize:
+
+bio issuing: 1M+512k
+current->bio_list: 512k+512k -> 1536k+512k
+bio issued: 0+512k
+
+6) no split afterwards, finally the issue order is:
+
+0+512k -> 1M+512k -> 512k+512k -> 1536k+512k
+
+This behaviour will cause large IO read on raid456 endup to be small
+discontinuous IO in underlying disks. Fix this problem by placing split
+bio to the head of current->bio_list.
+
+Test script: test on 8 disk raid5 with 64k chunksize
+dd if=/dev/md0 of=/dev/null bs=4480k iflag=direct
+
+Test results:
+Before this patch
+1) iostat results:
+Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util
+md0 52430.00 3276.87 0.00 0.00 0.62 64.00 32.60 80.10
+sd* 4487.00 409.00 2054.00 31.40 0.82 93.34 3.68 71.20
+2) blktrace G stage:
+ 8,0 0 486445 11.357392936 843 G R 14071424 + 128 [dd]
+ 8,0 0 486451 11.357466360 843 G R 14071168 + 128 [dd]
+ 8,0 0 486454 11.357515868 843 G R 14071296 + 128 [dd]
+ 8,0 0 486468 11.357968099 843 G R 14072192 + 128 [dd]
+ 8,0 0 486474 11.358031320 843 G R 14071936 + 128 [dd]
+ 8,0 0 486480 11.358096298 843 G R 14071552 + 128 [dd]
+ 8,0 0 486490 11.358303858 843 G R 14071808 + 128 [dd]
+3) io seek for sdx:
+Noted io seek is the result from blktrace D stage, statistic of:
+ABS((offset of next IO) - (offset + len of previous IO))
+
+Read|Write seek
+cnt 55175, zero cnt 25079
+ >=(KB) .. <(KB) : count ratio |distribution |
+ 0 .. 1 : 25079 45.5% |########################################|
+ 1 .. 2 : 0 0.0% | |
+ 2 .. 4 : 0 0.0% | |
+ 4 .. 8 : 0 0.0% | |
+ 8 .. 16 : 0 0.0% | |
+ 16 .. 32 : 0 0.0% | |
+ 32 .. 64 : 12540 22.7% |##################### |
+ 64 .. 128 : 2508 4.5% |##### |
+ 128 .. 256 : 0 0.0% | |
+ 256 .. 512 : 10032 18.2% |################# |
+ 512 .. 1024 : 5016 9.1% |######### |
+
+After this patch:
+1) iostat results:
+Device r/s rMB/s rrqm/s %rrqm r_await rareq-sz aqu-sz %util
+md0 87965.00 5271.88 0.00 0.00 0.16 61.37 14.03 90.60
+sd* 6020.00 658.44 5117.00 45.95 0.44 112.00 2.68 86.50
+2) blktrace G stage:
+ 8,0 0 206296 5.354894072 664 G R 7156992 + 128 [dd]
+ 8,0 0 206305 5.355018179 664 G R 7157248 + 128 [dd]
+ 8,0 0 206316 5.355204438 664 G R 7157504 + 128 [dd]
+ 8,0 0 206319 5.355241048 664 G R 7157760 + 128 [dd]
+ 8,0 0 206333 5.355500923 664 G R 7158016 + 128 [dd]
+ 8,0 0 206344 5.355837806 664 G R 7158272 + 128 [dd]
+ 8,0 0 206353 5.355960395 664 G R 7158528 + 128 [dd]
+ 8,0 0 206357 5.356020772 664 G R 7158784 + 128 [dd]
+3) io seek for sdx
+Read|Write seek
+cnt 28644, zero cnt 21483
+ >=(KB) .. <(KB) : count ratio |distribution |
+ 0 .. 1 : 21483 75.0% |########################################|
+ 1 .. 2 : 0 0.0% | |
+ 2 .. 4 : 0 0.0% | |
+ 4 .. 8 : 0 0.0% | |
+ 8 .. 16 : 0 0.0% | |
+ 16 .. 32 : 0 0.0% | |
+ 32 .. 64 : 7161 25.0% |############## |
+
+BTW, this looks like a long term problem from day one, and large
+sequential IO read is pretty common case like video playing.
+
+And even with this patch, in this test case IO is merged to at most 128k
+is due to block layer plug limit BLK_PLUG_FLUSH_SIZE, increase such
+limit can get even better performance. However, we'll figure out how to do
+this properly later.
+
+[1] https://lore.kernel.org/all/e40b076d-583d-406b-b223-005910a9f46f@acm.org/
+
+Fixes: d89d87965dcb ("When stacked block devices are in-use (e.g. md or dm), the recursive calls")
+Reported-by: Tie Ren <tieren@fnnas.com>
+Closes: https://lore.kernel.org/all/7dro5o7u5t64d6bgiansesjavxcuvkq5p2pok7dtwkav7b7ape@3isfr44b6352/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 16 ++++++++++------
+ block/blk-merge.c | 2 +-
+ block/blk-throttle.c | 2 +-
+ block/blk.h | 2 +-
+ 4 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 03a5d4c9cbf72..14ae73eebe0d7 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -727,7 +727,7 @@ static void __submit_bio_noacct_mq(struct bio *bio)
+ current->bio_list = NULL;
+ }
+
+-void submit_bio_noacct_nocheck(struct bio *bio)
++void submit_bio_noacct_nocheck(struct bio *bio, bool split)
+ {
+ blk_cgroup_bio_start(bio);
+
+@@ -746,12 +746,16 @@ void submit_bio_noacct_nocheck(struct bio *bio)
+ * to collect a list of requests submited by a ->submit_bio method while
+ * it is active, and then process them after it returned.
+ */
+- if (current->bio_list)
+- bio_list_add(¤t->bio_list[0], bio);
+- else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO))
++ if (current->bio_list) {
++ if (split)
++ bio_list_add_head(¤t->bio_list[0], bio);
++ else
++ bio_list_add(¤t->bio_list[0], bio);
++ } else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) {
+ __submit_bio_noacct_mq(bio);
+- else
++ } else {
+ __submit_bio_noacct(bio);
++ }
+ }
+
+ static blk_status_t blk_validate_atomic_write_op_size(struct request_queue *q,
+@@ -872,7 +876,7 @@ void submit_bio_noacct(struct bio *bio)
+
+ if (blk_throtl_bio(bio))
+ return;
+- submit_bio_noacct_nocheck(bio);
++ submit_bio_noacct_nocheck(bio, false);
+ return;
+
+ not_supported:
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index c411045fcf03a..77488f11a9441 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -134,7 +134,7 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
+ if (should_fail_bio(bio))
+ bio_io_error(bio);
+ else if (!blk_throtl_bio(bio))
+- submit_bio_noacct_nocheck(bio);
++ submit_bio_noacct_nocheck(bio, true);
+
+ return split;
+ }
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index cfa1cd60d2c5f..f510ae072868c 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -1224,7 +1224,7 @@ static void blk_throtl_dispatch_work_fn(struct work_struct *work)
+ if (!bio_list_empty(&bio_list_on_stack)) {
+ blk_start_plug(&plug);
+ while ((bio = bio_list_pop(&bio_list_on_stack)))
+- submit_bio_noacct_nocheck(bio);
++ submit_bio_noacct_nocheck(bio, false);
+ blk_finish_plug(&plug);
+ }
+ }
+diff --git a/block/blk.h b/block/blk.h
+index 18cc3c2afdd4d..d9efc8693aa48 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -54,7 +54,7 @@ bool blk_queue_start_drain(struct request_queue *q);
+ bool __blk_freeze_queue_start(struct request_queue *q,
+ struct task_struct *owner);
+ int __bio_queue_enter(struct request_queue *q, struct bio *bio);
+-void submit_bio_noacct_nocheck(struct bio *bio);
++void submit_bio_noacct_nocheck(struct bio *bio, bool split);
+ void bio_await_chain(struct bio *bio);
+
+ static inline bool blk_try_enter_queue(struct request_queue *q, bool pm)
+--
+2.51.0
+
--- /dev/null
+From 22ec32e8a8fa85cdb92f607b96fba5bb83310848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:34:59 +0000
+Subject: block: fix stacking of atomic writes when atomics are not supported
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit f2d8c5a2f79c28569edf4948b611052253b5e99a ]
+
+Atomic writes support may not always be possible when stacking devices
+which support atomic writes. Such as case is a different atomic write
+boundary between stacked devices (which is not supported).
+
+In the case that atomic writes cannot supported, the top device queue HW
+limits are set to 0.
+
+However, in blk_stack_atomic_writes_limits(), we detect that we are
+stacking the first bottom device by checking the top device
+atomic_write_hw_max value == 0. This get confused with the case of atomic
+writes not supported, above.
+
+Make the distinction between stacking the first bottom device and no
+atomics supported by initializing stacked device atomic_write_hw_max =
+UINT_MAX and checking that for stacking the first bottom device.
+
+Fixes: d7f36dc446e8 ("block: Support atomic writes limits for stacked devices")
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 6760dbf130b24..8fa52914e16b0 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -56,6 +56,7 @@ void blk_set_stacking_limits(struct queue_limits *lim)
+ lim->max_user_wzeroes_unmap_sectors = UINT_MAX;
+ lim->max_hw_zone_append_sectors = UINT_MAX;
+ lim->max_user_discard_sectors = UINT_MAX;
++ lim->atomic_write_hw_max = UINT_MAX;
+ }
+ EXPORT_SYMBOL(blk_set_stacking_limits);
+
+@@ -232,6 +233,10 @@ static void blk_validate_atomic_write_limits(struct queue_limits *lim)
+ if (!(lim->features & BLK_FEAT_ATOMIC_WRITES))
+ goto unsupported;
+
++ /* UINT_MAX indicates stacked limits in initial state */
++ if (lim->atomic_write_hw_max == UINT_MAX)
++ goto unsupported;
++
+ if (!lim->atomic_write_hw_max)
+ goto unsupported;
+
+@@ -723,18 +728,14 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
+ if (!blk_atomic_write_start_sect_aligned(start, b))
+ goto unsupported;
+
+- /*
+- * If atomic_write_hw_max is set, we have already stacked 1x bottom
+- * device, so check for compliance.
+- */
+- if (t->atomic_write_hw_max) {
++ /* UINT_MAX indicates no stacking of bottom devices yet */
++ if (t->atomic_write_hw_max == UINT_MAX) {
++ if (!blk_stack_atomic_writes_head(t, b))
++ goto unsupported;
++ } else {
+ if (!blk_stack_atomic_writes_tail(t, b))
+ goto unsupported;
+- return;
+ }
+-
+- if (!blk_stack_atomic_writes_head(t, b))
+- goto unsupported;
+ blk_stack_atomic_writes_chunk_sectors(t);
+ return;
+
+--
+2.51.0
+
--- /dev/null
+From 2fa3b8836e8379e459490d6110d1e1f0c0a6ae31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 14:30:42 +0800
+Subject: block: initialize bio issue time in blk_mq_submit_bio()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 1f963bdd6420b6080bcfd0ee84a75c96f35545a6 ]
+
+bio->issue_time_ns is only used by blk-iolatency, which can only be
+enabled for rq-based disk, hence it's not necessary to initialize
+the time for bio-based disk.
+
+Meanwhile, if bio is split by blk_crypto_fallback_split_bio_if_needed(),
+the issue time is not initialized for new split bio, this can be fixed
+as well.
+
+Noted the next patch will optimize better that bio issue time will
+only be used when blk-iolatency is really enabled by the disk.
+
+Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.h | 6 ------
+ block/blk-core.c | 1 -
+ block/blk-merge.c | 1 -
+ block/blk-mq.c | 8 ++++++++
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 8328427e31657..1cce3294634d1 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -370,11 +370,6 @@ static inline void blkg_put(struct blkcg_gq *blkg)
+ if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css), \
+ (p_blkg)->q)))
+
+-static inline void blkcg_bio_issue_init(struct bio *bio)
+-{
+- bio->issue_time_ns = blk_time_get_ns();
+-}
+-
+ static inline void blkcg_use_delay(struct blkcg_gq *blkg)
+ {
+ if (WARN_ON_ONCE(atomic_read(&blkg->use_delay) < 0))
+@@ -497,7 +492,6 @@ static inline struct blkg_policy_data *blkg_to_pd(struct blkcg_gq *blkg,
+ static inline struct blkcg_gq *pd_to_blkg(struct blkg_policy_data *pd) { return NULL; }
+ static inline void blkg_get(struct blkcg_gq *blkg) { }
+ static inline void blkg_put(struct blkcg_gq *blkg) { }
+-static inline void blkcg_bio_issue_init(struct bio *bio) { }
+ static inline void blk_cgroup_bio_start(struct bio *bio) { }
+ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; }
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index a27185cd8edea..e5af6eda5a459 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -730,7 +730,6 @@ static void __submit_bio_noacct_mq(struct bio *bio)
+ void submit_bio_noacct_nocheck(struct bio *bio)
+ {
+ blk_cgroup_bio_start(bio);
+- blkcg_bio_issue_init(bio);
+
+ if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) {
+ trace_block_bio_queue(bio);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 70d704615be52..5538356770a47 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -119,7 +119,6 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
+ goto error;
+ }
+ split->bi_opf |= REQ_NOMERGE;
+- blkcg_bio_issue_init(split);
+ bio_chain(split, bio);
+ trace_block_split(split, bio->bi_iter.bi_sector);
+ WARN_ON_ONCE(bio_zone_write_plugging(bio));
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 9055cd6247004..19b50110376c6 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -396,6 +396,13 @@ static inline void blk_mq_rq_time_init(struct request *rq, u64 alloc_time_ns)
+ #endif
+ }
+
++static inline void blk_mq_bio_issue_init(struct bio *bio)
++{
++#ifdef CONFIG_BLK_CGROUP
++ bio->issue_time_ns = blk_time_get_ns();
++#endif
++}
++
+ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
+ struct blk_mq_tags *tags, unsigned int tag)
+ {
+@@ -3168,6 +3175,7 @@ void blk_mq_submit_bio(struct bio *bio)
+ if (!bio_integrity_prep(bio))
+ goto queue_exit;
+
++ blk_mq_bio_issue_init(bio);
+ if (blk_mq_attempt_bio_merge(q, bio, nr_segs))
+ goto queue_exit;
+
+--
+2.51.0
+
--- /dev/null
+From f0afc7868f942db52eace27e1ea6e74aed1fb760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 14:30:54 +0800
+Subject: block: skip unnecessary checks for split bio
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 0b64682e78f7a53ea863e368b1aa66f05767858d ]
+
+Lots of checks are already done while submitting this bio the first
+time, and there is no need to check them again when this bio is
+resubmitted after split.
+
+Hence open code should_fail_bio() and blk_throtl_bio() that are still
+necessary from submit_bio_split_bioset().
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 2 +-
+ block/blk-merge.c | 6 +++++-
+ block/blk.h | 1 +
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index e5af6eda5a459..03a5d4c9cbf72 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -539,7 +539,7 @@ static inline void bio_check_ro(struct bio *bio)
+ }
+ }
+
+-static noinline int should_fail_bio(struct bio *bio)
++int should_fail_bio(struct bio *bio)
+ {
+ if (should_fail_request(bdev_whole(bio->bi_bdev), bio->bi_iter.bi_size))
+ return -EIO;
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 51fe4ed5b7c0b..c411045fcf03a 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -130,7 +130,11 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
+ bio_chain(split, bio);
+ trace_block_split(split, bio->bi_iter.bi_sector);
+ WARN_ON_ONCE(bio_zone_write_plugging(bio));
+- submit_bio_noacct(bio);
++
++ if (should_fail_bio(bio))
++ bio_io_error(bio);
++ else if (!blk_throtl_bio(bio))
++ submit_bio_noacct_nocheck(bio);
+
+ return split;
+ }
+diff --git a/block/blk.h b/block/blk.h
+index 0268deb222688..18cc3c2afdd4d 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -615,6 +615,7 @@ extern const struct address_space_operations def_blk_aops;
+ int disk_register_independent_access_ranges(struct gendisk *disk);
+ void disk_unregister_independent_access_ranges(struct gendisk *disk);
+
++int should_fail_bio(struct bio *bio);
+ #ifdef CONFIG_FAIL_MAKE_REQUEST
+ bool should_fail_request(struct block_device *part, unsigned int bytes);
+ #else /* CONFIG_FAIL_MAKE_REQUEST */
+--
+2.51.0
+
--- /dev/null
+From f6911f1cb732ffc43b29e4ab0489258c21b9adec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:34:58 +0000
+Subject: block: update validation of atomic writes boundary for stacked
+ devices
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit bfd4037296bd7e1f95394a2e3daf8e3c1796c3b3 ]
+
+In commit 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked
+atomic write limits"), it was missed to use a chunk sectors limit check
+in blk_stack_atomic_writes_boundary_head(), so update that function to
+do the proper check.
+
+Fixes: 63d092d1c1b1 ("block: use chunk_sectors when evaluating stacked atomic write limits")
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 693bc8d20acf3..6760dbf130b24 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -643,18 +643,24 @@ static bool blk_stack_atomic_writes_tail(struct queue_limits *t,
+ static bool blk_stack_atomic_writes_boundary_head(struct queue_limits *t,
+ struct queue_limits *b)
+ {
++ unsigned int boundary_sectors;
++
++ if (!b->atomic_write_hw_boundary || !t->chunk_sectors)
++ return true;
++
++ boundary_sectors = b->atomic_write_hw_boundary >> SECTOR_SHIFT;
++
+ /*
+ * Ensure atomic write boundary is aligned with chunk sectors. Stacked
+- * devices store chunk sectors in t->io_min.
++ * devices store any stripe size in t->chunk_sectors.
+ */
+- if (b->atomic_write_hw_boundary > t->io_min &&
+- b->atomic_write_hw_boundary % t->io_min)
++ if (boundary_sectors > t->chunk_sectors &&
++ boundary_sectors % t->chunk_sectors)
+ return false;
+- if (t->io_min > b->atomic_write_hw_boundary &&
+- t->io_min % b->atomic_write_hw_boundary)
++ if (t->chunk_sectors > boundary_sectors &&
++ t->chunk_sectors % boundary_sectors)
+ return false;
+
+- t->atomic_write_hw_boundary = b->atomic_write_hw_boundary;
+ return true;
+ }
+
+@@ -695,13 +701,13 @@ static void blk_stack_atomic_writes_chunk_sectors(struct queue_limits *t)
+ static bool blk_stack_atomic_writes_head(struct queue_limits *t,
+ struct queue_limits *b)
+ {
+- if (b->atomic_write_hw_boundary &&
+- !blk_stack_atomic_writes_boundary_head(t, b))
++ if (!blk_stack_atomic_writes_boundary_head(t, b))
+ return false;
+
+ t->atomic_write_hw_unit_max = b->atomic_write_hw_unit_max;
+ t->atomic_write_hw_unit_min = b->atomic_write_hw_unit_min;
+ t->atomic_write_hw_max = b->atomic_write_hw_max;
++ t->atomic_write_hw_boundary = b->atomic_write_hw_boundary;
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fbc31a615c94f0a00effb0cc05257d4a76a8a658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index d6438e6c276dc..693bc8d20acf3 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -763,7 +763,8 @@ static void blk_stack_atomic_writes_limits(struct queue_limits *t,
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
+
+--
+2.51.0
+
--- /dev/null
+From 8498588fb2bba51d28d1c63efa061f235161cb24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 12:18:49 +0530
+Subject: Bluetooth: btintel_pcie: Refactor Device Coredump
+
+From: Kiran K <kiran.k@intel.com>
+
+[ Upstream commit 58fddb364dd5c4e9bf223a2113a42538d9c040de ]
+
+As device coredumps are not HCI traces, maintain the device coredump at
+the driver level and eliminate the dependency on hdev_devcd*()
+
+Signed-off-by: Kiran K <kiran.k@intel.com>
+Fixes: 07e6bddb54b4 ("Bluetooth: btintel_pcie: Add support for device coredump")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btintel_pcie.c | 220 +++++++++++--------------------
+ drivers/bluetooth/btintel_pcie.h | 2 +
+ 2 files changed, 77 insertions(+), 145 deletions(-)
+
+diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
+index 6e7bbbd35279f..585de143ab255 100644
+--- a/drivers/bluetooth/btintel_pcie.c
++++ b/drivers/bluetooth/btintel_pcie.c
+@@ -15,6 +15,7 @@
+ #include <linux/interrupt.h>
+
+ #include <linux/unaligned.h>
++#include <linux/devcoredump.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -554,25 +555,6 @@ static void btintel_pcie_mac_init(struct btintel_pcie_data *data)
+ btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
+ }
+
+-static int btintel_pcie_add_dmp_data(struct hci_dev *hdev, const void *data, int size)
+-{
+- struct sk_buff *skb;
+- int err;
+-
+- skb = alloc_skb(size, GFP_ATOMIC);
+- if (!skb)
+- return -ENOMEM;
+-
+- skb_put_data(skb, data, size);
+- err = hci_devcd_append(hdev, skb);
+- if (err) {
+- bt_dev_err(hdev, "Failed to append data in the coredump");
+- return err;
+- }
+-
+- return 0;
+-}
+-
+ static int btintel_pcie_get_mac_access(struct btintel_pcie_data *data)
+ {
+ u32 reg;
+@@ -617,30 +599,35 @@ static void btintel_pcie_release_mac_access(struct btintel_pcie_data *data)
+ btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
+ }
+
+-static void btintel_pcie_copy_tlv(struct sk_buff *skb, enum btintel_pcie_tlv_type type,
+- void *data, int size)
++static void *btintel_pcie_copy_tlv(void *dest, enum btintel_pcie_tlv_type type,
++ void *data, size_t size)
+ {
+ struct intel_tlv *tlv;
+
+- tlv = skb_put(skb, sizeof(*tlv) + size);
++ tlv = dest;
+ tlv->type = type;
+ tlv->len = size;
+ memcpy(tlv->val, data, tlv->len);
++ return dest + sizeof(*tlv) + size;
+ }
+
+ static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data)
+ {
+- u32 offset, prev_size, wr_ptr_status, dump_size, i;
++ u32 offset, prev_size, wr_ptr_status, dump_size, data_len;
+ struct btintel_pcie_dbgc *dbgc = &data->dbgc;
+- u8 buf_idx, dump_time_len, fw_build;
+ struct hci_dev *hdev = data->hdev;
++ u8 *pdata, *p, buf_idx;
+ struct intel_tlv *tlv;
+ struct timespec64 now;
+- struct sk_buff *skb;
+ struct tm tm_now;
+- char buf[256];
+- u16 hdr_len;
+- int ret;
++ char fw_build[128];
++ char ts[128];
++ char vendor[64];
++ char driver[64];
++
++ if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
++ return -EOPNOTSUPP;
++
+
+ wr_ptr_status = btintel_pcie_rd_dev_mem(data, BTINTEL_PCIE_DBGC_CUR_DBGBUFF_STATUS);
+ offset = wr_ptr_status & BTINTEL_PCIE_DBG_OFFSET_BIT_MASK;
+@@ -657,88 +644,84 @@ static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data)
+ else
+ return -EINVAL;
+
++ snprintf(vendor, sizeof(vendor), "Vendor: Intel\n");
++ snprintf(driver, sizeof(driver), "Driver: %s\n",
++ data->dmp_hdr.driver_name);
++
+ ktime_get_real_ts64(&now);
+ time64_to_tm(now.tv_sec, 0, &tm_now);
+- dump_time_len = snprintf(buf, sizeof(buf), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d",
++ snprintf(ts, sizeof(ts), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d",
+ tm_now.tm_mday, tm_now.tm_mon + 1, tm_now.tm_year + 1900,
+ tm_now.tm_hour, tm_now.tm_min, tm_now.tm_sec);
+
+- fw_build = snprintf(buf + dump_time_len, sizeof(buf) - dump_time_len,
++ snprintf(fw_build, sizeof(fw_build),
+ "Firmware Timestamp: Year %u WW %02u buildtype %u build %u",
+ 2000 + (data->dmp_hdr.fw_timestamp >> 8),
+ data->dmp_hdr.fw_timestamp & 0xff, data->dmp_hdr.fw_build_type,
+ data->dmp_hdr.fw_build_num);
+
+- hdr_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) +
+- sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) +
+- sizeof(*tlv) + dump_time_len +
+- sizeof(*tlv) + fw_build;
++ data_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) +
++ sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) +
++ sizeof(*tlv) + strlen(ts) +
++ sizeof(*tlv) + strlen(fw_build) +
++ sizeof(*tlv) + strlen(vendor) +
++ sizeof(*tlv) + strlen(driver);
+
+- dump_size = hdr_len + sizeof(hdr_len);
++ /*
++ * sizeof(u32) - signature
++ * sizeof(data_len) - to store tlv data size
++ * data_len - TLV data
++ */
++ dump_size = sizeof(u32) + sizeof(data_len) + data_len;
+
+- skb = alloc_skb(dump_size, GFP_KERNEL);
+- if (!skb)
+- return -ENOMEM;
+
+ /* Add debug buffers data length to dump size */
+ dump_size += BTINTEL_PCIE_DBGC_BUFFER_SIZE * dbgc->count;
+
+- ret = hci_devcd_init(hdev, dump_size);
+- if (ret) {
+- bt_dev_err(hdev, "Failed to init devcoredump, err %d", ret);
+- kfree_skb(skb);
+- return ret;
+- }
++ pdata = vmalloc(dump_size);
++ if (!pdata)
++ return -ENOMEM;
++ p = pdata;
++
++ *(u32 *)p = BTINTEL_PCIE_MAGIC_NUM;
++ p += sizeof(u32);
+
+- skb_put_data(skb, &hdr_len, sizeof(hdr_len));
++ *(u32 *)p = data_len;
++ p += sizeof(u32);
+
+- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt,
+- sizeof(data->dmp_hdr.cnvi_bt));
+
+- btintel_pcie_copy_tlv(skb, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr,
+- sizeof(data->dmp_hdr.write_ptr));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_VENDOR, vendor, strlen(vendor));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_DRIVER, driver, strlen(driver));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_DUMP_TIME, ts, strlen(ts));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_BUILD, fw_build,
++ strlen(fw_build));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt,
++ sizeof(data->dmp_hdr.cnvi_bt));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr,
++ sizeof(data->dmp_hdr.write_ptr));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr,
++ sizeof(data->dmp_hdr.wrap_ctr));
+
+ data->dmp_hdr.wrap_ctr = btintel_pcie_rd_dev_mem(data,
+ BTINTEL_PCIE_DBGC_DBGBUFF_WRAP_ARND);
+
+- btintel_pcie_copy_tlv(skb, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr,
+- sizeof(data->dmp_hdr.wrap_ctr));
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason,
+- sizeof(data->dmp_hdr.trigger_reason));
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1,
+- sizeof(data->dmp_hdr.fw_git_sha1));
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top,
+- sizeof(data->dmp_hdr.cnvr_top));
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top,
+- sizeof(data->dmp_hdr.cnvi_top));
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_DUMP_TIME, buf, dump_time_len);
+-
+- btintel_pcie_copy_tlv(skb, BTINTEL_FW_BUILD, buf + dump_time_len, fw_build);
+-
+- ret = hci_devcd_append(hdev, skb);
+- if (ret)
+- goto exit_err;
+-
+- for (i = 0; i < dbgc->count; i++) {
+- ret = btintel_pcie_add_dmp_data(hdev, dbgc->bufs[i].data,
+- BTINTEL_PCIE_DBGC_BUFFER_SIZE);
+- if (ret)
+- break;
+- }
+-
+-exit_err:
+- hci_devcd_complete(hdev);
+- return ret;
++ p = btintel_pcie_copy_tlv(p, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason,
++ sizeof(data->dmp_hdr.trigger_reason));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1,
++ sizeof(data->dmp_hdr.fw_git_sha1));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top,
++ sizeof(data->dmp_hdr.cnvr_top));
++ p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top,
++ sizeof(data->dmp_hdr.cnvi_top));
++
++ memcpy(p, dbgc->bufs[0].data, dbgc->count * BTINTEL_PCIE_DBGC_BUFFER_SIZE);
++ dev_coredumpv(&hdev->dev, pdata, dump_size, GFP_KERNEL);
++ return 0;
+ }
+
+ static void btintel_pcie_dump_traces(struct hci_dev *hdev)
+@@ -760,51 +743,6 @@ static void btintel_pcie_dump_traces(struct hci_dev *hdev)
+ bt_dev_err(hdev, "Failed to dump traces: (%d)", ret);
+ }
+
+-static void btintel_pcie_dump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
+-{
+- struct btintel_pcie_data *data = hci_get_drvdata(hdev);
+- u16 len = skb->len;
+- u16 *hdrlen_ptr;
+- char buf[80];
+-
+- hdrlen_ptr = skb_put_zero(skb, sizeof(len));
+-
+- snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
+- INTEL_HW_VARIANT(data->dmp_hdr.cnvi_bt));
+- skb_put_data(skb, buf, strlen(buf));
+-
+- snprintf(buf, sizeof(buf), "Firmware Build Number: %u\n",
+- data->dmp_hdr.fw_build_num);
+- skb_put_data(skb, buf, strlen(buf));
+-
+- snprintf(buf, sizeof(buf), "Driver: %s\n", data->dmp_hdr.driver_name);
+- skb_put_data(skb, buf, strlen(buf));
+-
+- snprintf(buf, sizeof(buf), "Vendor: Intel\n");
+- skb_put_data(skb, buf, strlen(buf));
+-
+- *hdrlen_ptr = skb->len - len;
+-}
+-
+-static void btintel_pcie_dump_notify(struct hci_dev *hdev, int state)
+-{
+- struct btintel_pcie_data *data = hci_get_drvdata(hdev);
+-
+- switch (state) {
+- case HCI_DEVCOREDUMP_IDLE:
+- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE;
+- break;
+- case HCI_DEVCOREDUMP_ACTIVE:
+- data->dmp_hdr.state = HCI_DEVCOREDUMP_ACTIVE;
+- break;
+- case HCI_DEVCOREDUMP_TIMEOUT:
+- case HCI_DEVCOREDUMP_ABORT:
+- case HCI_DEVCOREDUMP_DONE:
+- data->dmp_hdr.state = HCI_DEVCOREDUMP_IDLE;
+- break;
+- }
+-}
+-
+ /* This function enables BT function by setting BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT bit in
+ * BTINTEL_PCIE_CSR_FUNC_CTRL_REG register and wait for MSI-X with
+ * BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0.
+@@ -1378,6 +1316,11 @@ static void btintel_pcie_rx_work(struct work_struct *work)
+ struct btintel_pcie_data, rx_work);
+ struct sk_buff *skb;
+
++ if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) {
++ btintel_pcie_dump_traces(data->hdev);
++ clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
++ }
++
+ if (test_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags)) {
+ /* Unlike usb products, controller will not send hardware
+ * exception event on exception. Instead controller writes the
+@@ -1390,11 +1333,6 @@ static void btintel_pcie_rx_work(struct work_struct *work)
+ clear_bit(BTINTEL_PCIE_HWEXP_INPROGRESS, &data->flags);
+ }
+
+- if (test_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) {
+- btintel_pcie_dump_traces(data->hdev);
+- clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags);
+- }
+-
+ /* Process the sk_buf in queue and send to the HCI layer */
+ while ((skb = skb_dequeue(&data->rx_skb_q))) {
+ btintel_pcie_recv_frame(data, skb);
+@@ -2184,13 +2122,6 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev)
+ if (ver_tlv.img_type == 0x02 || ver_tlv.img_type == 0x03)
+ data->dmp_hdr.fw_git_sha1 = ver_tlv.git_sha1;
+
+- err = hci_devcd_register(hdev, btintel_pcie_dump_traces, btintel_pcie_dump_hdr,
+- btintel_pcie_dump_notify);
+- if (err) {
+- bt_dev_err(hdev, "Failed to register coredump (%d)", err);
+- goto exit_error;
+- }
+-
+ btintel_print_fseq_info(hdev);
+ exit_error:
+ kfree_skb(skb);
+@@ -2319,7 +2250,6 @@ static void btintel_pcie_removal_work(struct work_struct *wk)
+ btintel_pcie_synchronize_irqs(data);
+
+ flush_work(&data->rx_work);
+- flush_work(&data->hdev->dump.dump_rx);
+
+ bt_dev_dbg(data->hdev, "Release bluetooth interface");
+ btintel_pcie_release_hdev(data);
+diff --git a/drivers/bluetooth/btintel_pcie.h b/drivers/bluetooth/btintel_pcie.h
+index 0fa876c5b954a..04b21f968ad30 100644
+--- a/drivers/bluetooth/btintel_pcie.h
++++ b/drivers/bluetooth/btintel_pcie.h
+@@ -132,6 +132,8 @@ enum btintel_pcie_tlv_type {
+ BTINTEL_CNVI_TOP,
+ BTINTEL_DUMP_TIME,
+ BTINTEL_FW_BUILD,
++ BTINTEL_VENDOR,
++ BTINTEL_DRIVER
+ };
+
+ /* causes for the MBOX interrupts */
+--
+2.51.0
+
--- /dev/null
+From 404b0b26b9cd58c32d0a20bdd62658c998aa3830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 12:30:05 -0400
+Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
+ advertisements
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
+
+When creating an advertisement for BIG the address shall not be
+non-resolvable since in case of acting as BASS/Broadcast Assistant the
+address must be the same as the connection in order to use the PAST
+method and even when PAST/BASS are not in the picture a Periodic
+Advertisement can still be synchronized thus the same argument as to
+connectable advertisements still stand.
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 7a7d498908584..eefdb6134ca53 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+ struct hci_rp_le_set_ext_adv_params rp;
+- bool connectable;
++ bool connectable, require_privacy;
+ u32 flags;
+ bdaddr_t random_addr;
+ u8 own_addr_type;
+@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ return -EPERM;
+
+ /* Set require_privacy to true only when non-connectable
+- * advertising is used. In that case it is fine to use a
+- * non-resolvable private address.
++ * advertising is used and it is not periodic.
++ * In that case it is fine to use a non-resolvable private address.
+ */
+- err = hci_get_random_address(hdev, !connectable,
++ require_privacy = !connectable && !(adv && adv->periodic);
++
++ err = hci_get_random_address(hdev, require_privacy,
+ adv_use_rpa(hdev, flags), adv,
+ &own_addr_type, &random_addr);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 176475e51e4f8d34cb5bdb24a0393985bda4e4af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:22 +0300
+Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
+
+For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
+skb is leaked.
+
+Free skb after copying its data.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 9170c46eb47c6..88602f19decac 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -2416,7 +2416,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+ skb->len);
+ conn->rx_len -= skb->len;
+- return;
++ break;
+
+ case ISO_END:
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+--
+2.51.0
+
--- /dev/null
+From 57d37564233799eeff3828169c0095491ab70635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:27:51 -0400
+Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
+
+This attempt to fix similar issue to sco_conn_free where if the
+conn->sk is not set to NULL may lead to UAF on iso_conn_free.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 5ce823ca3aaf4..c047a15e3fa39 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -750,6 +750,13 @@ static void iso_sock_kill(struct sock *sk)
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ if (iso_pi(sk)->conn) {
++ iso_conn_lock(iso_pi(sk)->conn);
++ iso_pi(sk)->conn->sk = NULL;
++ iso_conn_unlock(iso_pi(sk)->conn);
++ }
++
+ /* Kill poor orphan */
+ bt_sock_unlink(&iso_sk_list, sk);
+ sock_set_flag(sk, SOCK_DEAD);
+--
+2.51.0
+
--- /dev/null
+From af6b752fe5c4b0c8edf85821e1afe861ceec4966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:21 +0300
+Subject: Bluetooth: ISO: free rx_skb if not consumed
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]
+
+If iso_conn is freed when RX is incomplete, free any leftover skb piece.
+
+Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index c047a15e3fa39..9170c46eb47c6 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
+ /* Ensure no more work items will run since hci_conn has been dropped */
+ disable_delayed_work_sync(&conn->timeout_work);
+
++ kfree_skb(conn->rx_skb);
++
+ kfree(conn);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9340e23db147f00439cf32c02504fd05db898fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 225140fcb3d6c..a3d16eece0d23 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4542,13 +4542,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ return -ENOMEM;
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev && hci_dev_le_state_simultaneous(hdev)) {
+--
+2.51.0
+
--- /dev/null
+From 892a8fdf08c308a2c8d93b29f5a2e8542b3159f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:33:03 +0000
+Subject: bonding: fix xfrm offload feature setup on active-backup mode
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 5b66169f6be4847008c0aea50885ff0632151479 ]
+
+The active-backup bonding mode supports XFRM ESP offload. However, when
+a bond is added using command like `ip link add bond0 type bond mode 1
+miimon 100`, the `ethtool -k` command shows that the XFRM ESP offload is
+disabled. This occurs because, in bond_newlink(), we change bond link
+first and register bond device later. So the XFRM feature update in
+bond_option_mode_set() is not called as the bond device is not yet
+registered, leading to the offload feature not being set successfully.
+
+To resolve this issue, we can modify the code order in bond_newlink() to
+ensure that the bond device is registered first before changing the bond
+link parameters. This change will allow the XFRM ESP offload feature to be
+correctly enabled.
+
+Fixes: 007ab5345545 ("bonding: fix feature flag setting at init time")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20250925023304.472186-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 2 +-
+ drivers/net/bonding/bond_netlink.c | 16 +++++++++-------
+ include/net/bonding.h | 1 +
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 57be04f6cb11a..f4f0feddd9fa0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4411,7 +4411,7 @@ void bond_work_init_all(struct bonding *bond)
+ INIT_DELAYED_WORK(&bond->slave_arr_work, bond_slave_arr_handler);
+ }
+
+-static void bond_work_cancel_all(struct bonding *bond)
++void bond_work_cancel_all(struct bonding *bond)
+ {
+ cancel_delayed_work_sync(&bond->mii_work);
+ cancel_delayed_work_sync(&bond->arp_work);
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index 57fff2421f1b5..7a9d73ec8e91c 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -579,20 +579,22 @@ static int bond_newlink(struct net_device *bond_dev,
+ struct rtnl_newlink_params *params,
+ struct netlink_ext_ack *extack)
+ {
++ struct bonding *bond = netdev_priv(bond_dev);
+ struct nlattr **data = params->data;
+ struct nlattr **tb = params->tb;
+ int err;
+
+- err = bond_changelink(bond_dev, tb, data, extack);
+- if (err < 0)
++ err = register_netdevice(bond_dev);
++ if (err)
+ return err;
+
+- err = register_netdevice(bond_dev);
+- if (!err) {
+- struct bonding *bond = netdev_priv(bond_dev);
++ netif_carrier_off(bond_dev);
++ bond_work_init_all(bond);
+
+- netif_carrier_off(bond_dev);
+- bond_work_init_all(bond);
++ err = bond_changelink(bond_dev, tb, data, extack);
++ if (err) {
++ bond_work_cancel_all(bond);
++ unregister_netdevice(bond_dev);
+ }
+
+ return err;
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index e06f0d63b2c17..bd56ad976cfb0 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -711,6 +711,7 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
+ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave);
+ void bond_slave_arr_work_rearm(struct bonding *bond, unsigned long delay);
+ void bond_work_init_all(struct bonding *bond);
++void bond_work_cancel_all(struct bonding *bond);
+
+ #ifdef CONFIG_PROC_FS
+ void bond_create_proc_entry(struct bonding *bond);
+--
+2.51.0
+
--- /dev/null
+From b4c531d3aa3206702313f308b201af247d3f9930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 23:26:53 +0000
+Subject: bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]
+
+The current implementation seems incorrect and does NOT match the
+comment above, use bpf_jit_binary_pack_finalize() instead.
+
+Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Acked-by: Song Liu <song@kernel.org>
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20250916232653.101004-1-hengqi.chen@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 52ffe115a8c47..4ef9b7b8fb404 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -3064,8 +3064,7 @@ void bpf_jit_free(struct bpf_prog *prog)
+ * before freeing it.
+ */
+ if (jit_data) {
+- bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
+- sizeof(jit_data->header->size));
++ bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+ kfree(jit_data);
+ }
+ prog->bpf_func -= cfi_get_offset();
+--
+2.51.0
+
--- /dev/null
+From 3860cd5b1139d2f8ec2f9f5e5f8350753f9453a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:22:50 -0700
+Subject: bpf: dont report verifier bug for missing bpf_scc_visit on
+ speculative path
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+[ Upstream commit a3c73d629ea1373af3c0c954d41fd1af555492e3 ]
+
+Syzbot generated a program that triggers a verifier_bug() call in
+maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a
+state with insn_idx in some SCC, there should be an instance of struct
+bpf_scc_visit allocated for that SCC. Turns out the assumption does
+not hold for speculative execution paths. See example in the next
+patch.
+
+maybe_scc_exit() is called from update_branch_counts() for states that
+reach branch count of zero, meaning that path exploration for a
+particular path is finished. Path exploration can finish in one of
+three ways:
+a. Verification error is found. In this case, update_branch_counts()
+ is called only for non-speculative paths.
+b. Top level BPF_EXIT is reached. Such instructions are never a part of
+ an SCC, so compute_scc_callchain() in maybe_scc_exit() will return
+ false, and maybe_scc_exit() will return early.
+c. A checkpoint is reached and matched. Checkpoints are created by
+ is_state_visited(), which calls maybe_enter_scc(), which allocates
+ bpf_scc_visit instances for checkpoints within SCCs.
+
+Hence, for non-speculative symbolic execution paths, the assumption
+still holds: if maybe_scc_exit() is called for a state within an SCC,
+bpf_scc_visit instance must exist.
+
+This patch removes the verifier_bug() call for speculative paths.
+
+Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges")
+Reported-by: syzbot+3afc814e8df1af64b653@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/bpf/68c85acd.050a0220.2ff435.03a4.GAE@google.com/
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20250916212251.3490455-1-eddyz87@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9fb1f957a0937..6ad0dc226183a 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1946,9 +1946,24 @@ static int maybe_exit_scc(struct bpf_verifier_env *env, struct bpf_verifier_stat
+ return 0;
+ visit = scc_visit_lookup(env, callchain);
+ if (!visit) {
+- verifier_bug(env, "scc exit: no visit info for call chain %s",
+- format_callchain(env, callchain));
+- return -EFAULT;
++ /*
++ * If path traversal stops inside an SCC, corresponding bpf_scc_visit
++ * must exist for non-speculative paths. For non-speculative paths
++ * traversal stops when:
++ * a. Verification error is found, maybe_exit_scc() is not called.
++ * b. Top level BPF_EXIT is reached. Top level BPF_EXIT is not a member
++ * of any SCC.
++ * c. A checkpoint is reached and matched. Checkpoints are created by
++ * is_state_visited(), which calls maybe_enter_scc(), which allocates
++ * bpf_scc_visit instances for checkpoints within SCCs.
++ * (c) is the only case that can reach this point.
++ */
++ if (!st->speculative) {
++ verifier_bug(env, "scc exit: no visit info for call chain %s",
++ format_callchain(env, callchain));
++ return -EFAULT;
++ }
++ return 0;
+ }
+ if (visit->entry_state != st)
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From d637034fbdc8fb0a4e0dc0839f8647eeda193df7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 19:12:00 +0200
+Subject: bpf: Enforce expected_attach_type for tailcall compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
+
+Yinhao et al. recently reported:
+
+ Our fuzzer tool discovered an uninitialized pointer issue in the
+ bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
+ This leads to a NULL pointer dereference when a BPF program attempts to
+ deference the txq member of struct xdp_buff object.
+
+The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
+entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
+neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
+of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
+to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
+egress_ifindex, and the latter is only allowed to be accessed under mentioned
+expected_attach_type. progB is then inserted into the tailcall which progA
+calls.
+
+The underlying issue goes beyond XDP though. Another example are programs
+of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
+as sock_addr_func_proto() have different logic depending on the programs'
+expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
+should not be allowed doing a tailcall into a program which calls bpf_bind()
+out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
+
+In short, specifying expected_attach_type allows to open up additional
+functionality or restrictions beyond what the basic bpf_prog_type enables.
+The use of tailcalls must not violate these constraints. Fix it by enforcing
+expected_attach_type in __bpf_prog_map_compatible().
+
+Note that we only enforce this for tailcall maps, but not for BPF devmaps or
+cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
+cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
+these situations are not prone to this issue.
+
+Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
+Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
+Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index cc700925b802f..84826dc0a3268 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -285,6 +285,7 @@ struct bpf_map_owner {
+ bool xdp_has_frags;
+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
+ const struct btf_type *attach_func_proto;
++ enum bpf_attach_type expected_attach_type;
+ };
+
+ struct bpf_map {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index e4568d44e8279..f6dd071f5e38c 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2393,6 +2393,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ map->owner->type = prog_type;
+ map->owner->jited = fp->jited;
+ map->owner->xdp_has_frags = aux->xdp_has_frags;
++ map->owner->expected_attach_type = fp->expected_attach_type;
+ map->owner->attach_func_proto = aux->attach_func_proto;
+ for_each_cgroup_storage_type(i) {
+ map->owner->storage_cookie[i] =
+@@ -2404,6 +2405,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ ret = map->owner->type == prog_type &&
+ map->owner->jited == fp->jited &&
+ map->owner->xdp_has_frags == aux->xdp_has_frags;
++ if (ret &&
++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
++ map->owner->expected_attach_type != fp->expected_attach_type)
++ ret = false;
+ for_each_cgroup_storage_type(i) {
+ if (!ret)
+ break;
+--
+2.51.0
+
--- /dev/null
+From ed18936959f8071f504aa3c21d2ea86f52fdaf16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index da391e2b0788d..2d326d35c3871 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -9284,13 +9284,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 12873d9458267246162e045999fa695770ed5f78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 10:14:26 +0200
+Subject: bpf: Mark kfuncs as __noclone
+
+From: Andrea Righi <arighi@nvidia.com>
+
+[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]
+
+Some distributions (e.g., CachyOS) support building the kernel with -O3,
+but doing so may break kfuncs, resulting in their symbols not being
+properly exported.
+
+In fact, with gcc -O3, some kfuncs may be optimized away despite being
+annotated as noinline. This happens because gcc can still clone the
+function during IPA optimizations, e.g., by duplicating or inlining it
+into callers, and then dropping the standalone symbol. This breaks BTF
+ID resolution since resolve_btfids relies on the presence of a global
+symbol for each kfunc.
+
+Currently, this is not an issue for upstream, because we don't allow
+building the kernel with -O3, but it may be safer to address it anyway,
+to prevent potential issues in the future if compilers become more
+aggressive with optimizations.
+
+Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
+cloned and remain distinct, globally visible symbols, regardless of
+the optimization level.
+
+Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
+Acked-by: David Vernet <void@manifault.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrea Righi <arighi@nvidia.com>
+Link: https://lore.kernel.org/r/20250924081426.156934-1-arighi@nvidia.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/btf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/btf.h b/include/linux/btf.h
+index 9eda6b113f9b4..f06976ffb63f9 100644
+--- a/include/linux/btf.h
++++ b/include/linux/btf.h
+@@ -86,7 +86,7 @@
+ * as to avoid issues such as the compiler inlining or eliding either a static
+ * kfunc, or a global kfunc in an LTO build.
+ */
+-#define __bpf_kfunc __used __retain noinline
++#define __bpf_kfunc __used __retain __noclone noinline
+
+ #define __bpf_kfunc_start_defs() \
+ __diag_push(); \
+--
+2.51.0
+
--- /dev/null
+From d9fd833798db839be187606e9949021b3ef4f0c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 23:04:33 +0800
+Subject: bpf: Reject negative offsets for ALU ops
+
+From: Yazhou Tang <tangyazhou518@outlook.com>
+
+[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
+
+When verifying BPF programs, the check_alu_op() function validates
+instructions with ALU operations. The 'offset' field in these
+instructions is a signed 16-bit integer.
+
+The existing check 'insn->off > 1' was intended to ensure the offset is
+either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
+signed, this check incorrectly accepts all negative values (e.g., -1).
+
+This commit tightens the validation by changing the condition to
+'(insn->off != 0 && insn->off != 1)'. This ensures that any value
+other than the explicitly permitted 0 and 1 is rejected, hardening the
+verifier against malformed BPF programs.
+
+Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
+Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 299e43dac873e..ed1457c273409 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15755,7 +15755,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ } else { /* all other ALU ops: and, sub, xor, add, ... */
+
+ if (BPF_SRC(insn->code) == BPF_X) {
+- if (insn->imm != 0 || insn->off > 1 ||
++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+@@ -15765,7 +15765,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ if (err)
+ return err;
+ } else {
+- if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 2a8de15a1bf7cb70b796f6c640f1fd63342d3579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:14:29 +0800
+Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
+
+Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
+called all the way from graph tracer, which disables preemption in
+function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
+need to use migrate_disable. As a result, some overhead may will be reduced.
+And add cant_sleep check for __this_cpu_inc_return.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 3ae52978cae61..606007c387c52 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2728,20 +2728,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ struct pt_regs *regs;
+ int err;
+
++ /*
++ * graph tracer framework ensures we won't migrate, so there is no need
++ * to use migrate_disable for bpf_prog_run again. The check here just for
++ * __this_cpu_inc_return.
++ */
++ cant_sleep();
++
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+ bpf_prog_inc_misses_counter(link->link.prog);
+ err = 1;
+ goto out;
+ }
+
+- migrate_disable();
+ rcu_read_lock();
+ regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr());
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
+ rcu_read_unlock();
+- migrate_enable();
+
+ out:
+ __this_cpu_dec(bpf_prog_active);
+--
+2.51.0
+
--- /dev/null
+From d36cc320b0322c5623c03777797b2b0a278dec65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:56:38 +0800
+Subject: bpf: Remove preempt_disable in bpf_try_get_buffers
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit 4223bf833c8495e40ae2886acbc0ecbe88fa6306 ]
+
+Now BPF program will run with migration disabled, so it is safe
+to access this_cpu_inc_return(bpf_bprintf_nest_level).
+
+Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250819125638.2544715-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 8af62cb243d9e..9c750a6a895bf 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -774,11 +774,9 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
+ {
+ int nest_level;
+
+- preempt_disable();
+ nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
+ if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
+ this_cpu_dec(bpf_bprintf_nest_level);
+- preempt_enable();
+ return -EBUSY;
+ }
+ *bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
+@@ -791,7 +789,6 @@ void bpf_put_buffers(void)
+ if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
+ return;
+ this_cpu_dec(bpf_bprintf_nest_level);
+- preempt_enable();
+ }
+
+ void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
+--
+2.51.0
+
--- /dev/null
+From 295c137bb9814f2dc178da05e5213b72ed6d03f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:12:14 +0000
+Subject: bpf/selftests: Fix test_tcpnotify_user
+
+From: Matt Bobrowski <mattbobrowski@google.com>
+
+[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
+
+Based on a bisect, it appears that commit 7ee988770326 ("timers:
+Implement the hierarchical pull model") has somehow inadvertently
+broken BPF selftest test_tcpnotify_user. The error that is being
+generated by this test is as follows:
+
+ FAILED: Wrong stats Expected 10 calls, got 8
+
+It looks like the change allows timer functions to be run on CPUs
+different from the one they are armed on. The test had pinned itself
+to CPU 0, and in the past the retransmit attempts also occurred on CPU
+0. The test had set the max_entries attribute for
+BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
+bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
+likely to be in range. With the change to allow timers to run on other
+CPUs, the current CPU tasked with performing the retransmit might be
+bumped and in turn fall out of range, as the event will be filtered
+out via __bpf_perf_event_output() using:
+
+ if (unlikely(index >= array->map.max_entries))
+ return -E2BIG;
+
+A possible change would be to explicitly set the max_entries attribute
+for perf_event_map in test_tcpnotify_kern.c to a value that's at least
+as large as the number of CPUs. As it turns out however, if the field
+is left unset, then the libbpf will determine the number of CPUs available
+on the underlying system and update the max_entries attribute accordingly
+in map_set_def_max_entries().
+
+A further problem with the test is that it has a thread that continues
+running up until the program exits. The main thread cleans up some
+LIBBPF data structures, while the other thread continues to use them,
+which inevitably will trigger a SIGSEGV. This can be dealt with by
+telling the thread to run for as long as necessary and doing a
+pthread_join on it before exiting the program.
+
+Finally, I don't think binding the process to CPU 0 is meaningful for
+this test any more, so get rid of that.
+
+Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
+Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
+ .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+index 540181c115a85..ef00d38b0a8d2 100644
+--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+@@ -23,7 +23,6 @@ struct {
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+- __uint(max_entries, 2);
+ __type(key, int);
+ __type(value, __u32);
+ } perf_event_map SEC(".maps");
+diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+index 595194453ff8f..35b4893ccdf8a 100644
+--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+@@ -15,20 +15,18 @@
+ #include <bpf/libbpf.h>
+ #include <sys/ioctl.h>
+ #include <linux/rtnetlink.h>
+-#include <signal.h>
+ #include <linux/perf_event.h>
+-#include <linux/err.h>
+
+-#include "bpf_util.h"
+ #include "cgroup_helpers.h"
+
+ #include "test_tcpnotify.h"
+-#include "trace_helpers.h"
+ #include "testing_helpers.h"
+
+ #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+
+ pthread_t tid;
++static bool exit_thread;
++
+ int rx_callbacks;
+
+ static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
+@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
+ {
+ int err;
+
+- while (1) {
++ while (!exit_thread) {
+ err = perf_buffer__poll(pb, 100);
+ if (err < 0 && err != -EINTR) {
+ printf("failed perf_buffer__poll: %d\n", err);
+@@ -78,15 +76,10 @@ int main(int argc, char **argv)
+ int error = EXIT_FAILURE;
+ struct bpf_object *obj;
+ char test_script[80];
+- cpu_set_t cpuset;
+ __u32 key = 0;
+
+ libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(0, &cpuset);
+- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
+-
+ cg_fd = cgroup_setup_and_join(cg_path);
+ if (cg_fd < 0)
+ goto err;
+@@ -151,6 +144,13 @@ int main(int argc, char **argv)
+
+ sleep(10);
+
++ exit_thread = true;
++ int ret = pthread_join(tid, NULL);
++ if (ret) {
++ printf("FAILED: pthread_join\n");
++ goto err;
++ }
++
+ if (verify_result(&g)) {
+ printf("FAILED: Wrong stats Expected %d calls, got %d\n",
+ g.ncalls, rx_callbacks);
+--
+2.51.0
+
--- /dev/null
+From 2f7189adc66936b329ddc22a3f88fbbc550fa759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 00:47:38 +0530
+Subject: bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 34904582b502a86fdb4d7984b12cacd2faabbe0d ]
+
+In check_alu_op(), the verifier currently calls check_reg_arg() and
+adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations.
+However, if the destination register holds a pointer, these scalar
+adjustments are unnecessary and potentially incorrect.
+
+This patch adds a check to skip the adjustment logic when the destination
+register contains a pointer.
+
+Reported-by: syzbot+d36d5ae81e1b0a53ef58@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58
+Fixes: aced132599b3 ("bpf: Add range tracking for BPF_NEG")
+Suggested-by: KaFai Wan <kafai.wan@linux.dev>
+Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20251001191739.2323644-2-listout@listout.xyz
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 6ad0dc226183a..299e43dac873e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -15592,7 +15592,8 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ }
+
+ /* check dest operand */
+- if (opcode == BPF_NEG) {
++ if (opcode == BPF_NEG &&
++ regs[insn->dst_reg].type == SCALAR_VALUE) {
+ err = check_reg_arg(env, insn->dst_reg, DST_OP_NO_MARK);
+ err = err ?: adjust_scalar_min_max_vals(env, insn,
+ ®s[insn->dst_reg],
+--
+2.51.0
+
--- /dev/null
+From e26e123149656a7bc12d9d66e276db2ebe0ce692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:58:20 +0200
+Subject: bpf: Tidy verifier bug message
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ]
+
+Yonghong noticed that error messages for potential verifier bugs often
+have a '(1)' at the end. This is happening because verifier_bug_if(cond,
+env, fmt, args...) prints "(" #cond ")\n" as part of the message and
+verifier_bug() is defined as:
+
+ #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
+
+Hence, verifier_bug() always ends up displaying '(1)'. This small patch
+fixes it by having verifier_bug_if conditionally call verifier_bug
+instead of the other way around.
+
+Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs")
+Reported-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/bpf/aJo9THBrzo8jFXsh@mail.gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf_verifier.h | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 94defa405c85e..fe9a841fdf0cf 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -875,13 +875,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
+ #define verifier_bug_if(cond, env, fmt, args...) \
+ ({ \
+ bool __cond = (cond); \
+- if (unlikely(__cond)) { \
+- BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args); \
+- bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args); \
+- } \
++ if (unlikely(__cond)) \
++ verifier_bug(env, fmt " (" #cond ")", ##args); \
+ (__cond); \
+ })
+-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
++#define verifier_bug(env, fmt, args...) \
++ ({ \
++ BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args); \
++ bpf_log(&env->log, "verifier bug: " fmt "\n", ##args); \
++ })
+
+ static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env)
+ {
+--
+2.51.0
+
--- /dev/null
+From ec1ac8a0879d127fb32708399eaabdee4db87e22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:29:42 +0930
+Subject: btrfs: fix symbolic link reading when bs > ps
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 67378b754608a3524d125bfa5744508a49fe48be ]
+
+[BUG DURING BS > PS TEST]
+When running the following script on a btrfs whose block size is larger
+than page size, e.g. 8K block size and 4K page size, it will trigger a
+kernel BUG:
+
+ # mkfs.btrfs -s 8k $dev
+ # mount $dev $mnt
+ # mkdir $mnt/dir
+ # ln -s dir $mnt/link
+ # ls $mnt/link
+
+The call trace looks like this:
+
+ BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing
+ BTRFS info (device dm-2): checking UUID tree
+ BTRFS info (device dm-2): enabling ssd optimizations
+ BTRFS info (device dm-2): enabling free space tree
+ ------------[ cut here ]------------
+ kernel BUG at /home/adam/linux/include/linux/highmem.h:275!
+ Oops: invalid opcode: 0000 [#1] SMP
+ CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G OE 6.17.0-rc4-custom+ #283 PREEMPT(full)
+ Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
+ RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs]
+ Call Trace:
+ <TASK>
+ btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
+ btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
+ btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
+ filemap_read_folio+0x37/0xe0
+ do_read_cache_folio+0x94/0x3e0
+ __page_get_link.isra.0+0x20/0x90
+ page_get_link+0x16/0x40
+ step_into+0x69b/0x830
+ path_lookupat+0xa7/0x170
+ filename_lookup+0xf7/0x200
+ ? set_ptes.isra.0+0x36/0x70
+ vfs_statx+0x7a/0x160
+ do_statx+0x63/0xa0
+ __x64_sys_statx+0x90/0xe0
+ do_syscall_64+0x82/0xae0
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ </TASK>
+
+Please note bs > ps support is still under development and the
+enablement patch is not even in btrfs development branch.
+
+[CAUSE]
+Btrfs reuses its data folio read path to handle symbolic links, as the
+symbolic link target is stored as an inline data extent.
+
+But for newly created inodes, btrfs only set the minimal order if the
+target inode is a regular file.
+
+Thus for above newly created symbolic link, it doesn't properly respect
+the minimal folio order, and triggered the above crash.
+
+[FIX]
+Call btrfs_set_inode_mapping_order() unconditionally inside
+btrfs_create_new_inode().
+
+For symbolic links this will fix the crash as now the folio will meet
+the minimal order.
+
+For regular files this brings no change.
+
+For directory/bdev/char and all the other types of inodes, they won't
+go through the data read path, thus no effect either.
+
+Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 18db1053cdf08..cd8a09e3d1dc0 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -6479,6 +6479,7 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
+ if (!args->subvol)
+ btrfs_inherit_iflags(BTRFS_I(inode), BTRFS_I(dir));
+
++ btrfs_set_inode_mapping_order(BTRFS_I(inode));
+ if (S_ISREG(inode->i_mode)) {
+ if (btrfs_test_opt(fs_info, NODATASUM))
+ BTRFS_I(inode)->flags |= BTRFS_INODE_NODATASUM;
+@@ -6486,7 +6487,6 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
+ BTRFS_I(inode)->flags |= BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_NODATASUM;
+ btrfs_update_inode_mapping_flags(BTRFS_I(inode));
+- btrfs_set_inode_mapping_order(BTRFS_I(inode));
+ }
+
+ ret = btrfs_insert_inode_locked(inode);
+--
+2.51.0
+
--- /dev/null
+From 8e3e786c9b4029340b8468eecad2318973417284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 08:40:45 +0930
+Subject: btrfs: return any hit error from extent_writepage_io()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]
+
+Since the support of bs < ps support, extent_writepage_io() will submit
+multiple blocks inside the folio.
+
+But if we hit error submitting one sector, but the next sector can still
+be submitted successfully, the function extent_writepage_io() will still
+return 0.
+
+This will make btrfs to silently ignore the error without setting error
+flag for the filemap.
+
+Fix it by recording the first error hit, and always return that value.
+
+Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
+Reviewed-by: Daniel Vacek <neelx@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index b21cb72835ccf..4eafe3817e11c 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1621,7 +1621,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ unsigned long range_bitmap = 0;
+ bool submitted_io = false;
+- bool error = false;
++ int found_error = 0;
+ const u64 folio_start = folio_pos(folio);
+ const unsigned int blocks_per_folio = btrfs_blocks_per_folio(fs_info, folio);
+ u64 cur;
+@@ -1685,7 +1685,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ */
+ btrfs_mark_ordered_io_finished(inode, folio, cur,
+ fs_info->sectorsize, false);
+- error = true;
++ if (!found_error)
++ found_error = ret;
+ continue;
+ }
+ submitted_io = true;
+@@ -1702,11 +1703,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
+ * If we hit any error, the corresponding sector will have its dirty
+ * flag cleared and writeback finished, thus no need to handle the error case.
+ */
+- if (!submitted_io && !error) {
++ if (!submitted_io && !found_error) {
+ btrfs_folio_set_writeback(fs_info, folio, start, len);
+ btrfs_folio_clear_writeback(fs_info, folio, start, len);
+ }
+- return ret;
++ return found_error;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 0ea52100752639b7e1b2abfdf420ecd336e713aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 10:08:51 +0530
+Subject: cdx: don't select CONFIG_GENERIC_MSI_IRQ
+
+From: Nipun Gupta <nipun.gupta@amd.com>
+
+[ Upstream commit ab1d8dda32e9507ca3bfb6b43661aeaa27f7bd82 ]
+
+x86 does not use CONFIG_GENERIC_MSI_IRQ, and trying to enable it anyway
+results in a build failure:
+
+In file included from include/linux/ssb/ssb.h:10,
+ from drivers/ssb/pcihost_wrapper.c:18:
+include/linux/gpio/driver.h:41:33: error: field 'msiinfo' has incomplete type
+ 41 | msi_alloc_info_t msiinfo;
+ | ^~~~~~~
+In file included from include/linux/kvm_host.h:19,
+ from arch/x86/events/intel/core.c:17:
+include/linux/msi.h:528:33: error: field 'alloc_info' has incomplete type
+ 528 | msi_alloc_info_t alloc_info;
+
+Change the driver to actually build without this symbol and remove the
+incorrect 'select' statements.
+
+Fixes: e8b18c11731d ("cdx: Fix missing GENERIC_MSI_IRQ on compile test")
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
+Signed-off-by: Arnd Bergmann <arnd@kernel.org>
+Signed-off-by: Nipun Gupta <nipun.gupta@amd.com>
+Link: https://lore.kernel.org/r/20250826043852.2206008-1-nipun.gupta@amd.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cdx/Kconfig | 1 -
+ drivers/cdx/cdx.c | 4 ++--
+ drivers/cdx/controller/Kconfig | 1 -
+ drivers/cdx/controller/cdx_controller.c | 3 ++-
+ 4 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cdx/Kconfig b/drivers/cdx/Kconfig
+index 3af41f51cf38b..1f1e360507d7d 100644
+--- a/drivers/cdx/Kconfig
++++ b/drivers/cdx/Kconfig
+@@ -8,7 +8,6 @@
+ config CDX_BUS
+ bool "CDX Bus driver"
+ depends on OF && ARM64 || COMPILE_TEST
+- select GENERIC_MSI_IRQ
+ help
+ Driver to enable Composable DMA Transfer(CDX) Bus. CDX bus
+ exposes Fabric devices which uses composable DMA IP to the
+diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
+index 092306ca2541c..3d50f8cd9c0bd 100644
+--- a/drivers/cdx/cdx.c
++++ b/drivers/cdx/cdx.c
+@@ -310,7 +310,7 @@ static int cdx_probe(struct device *dev)
+ * Setup MSI device data so that generic MSI alloc/free can
+ * be used by the device driver.
+ */
+- if (cdx->msi_domain) {
++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) {
+ error = msi_setup_device_data(&cdx_dev->dev);
+ if (error)
+ return error;
+@@ -833,7 +833,7 @@ int cdx_device_add(struct cdx_dev_params *dev_params)
+ ((cdx->id << CDX_CONTROLLER_ID_SHIFT) | (cdx_dev->bus_num & CDX_BUS_NUM_MASK)),
+ cdx_dev->dev_num);
+
+- if (cdx->msi_domain) {
++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ) && cdx->msi_domain) {
+ cdx_dev->num_msi = dev_params->num_msi;
+ dev_set_msi_domain(&cdx_dev->dev, cdx->msi_domain);
+ }
+diff --git a/drivers/cdx/controller/Kconfig b/drivers/cdx/controller/Kconfig
+index 0641a4c21e660..a480b62cbd1f7 100644
+--- a/drivers/cdx/controller/Kconfig
++++ b/drivers/cdx/controller/Kconfig
+@@ -10,7 +10,6 @@ if CDX_BUS
+ config CDX_CONTROLLER
+ tristate "CDX bus controller"
+ depends on HAS_DMA
+- select GENERIC_MSI_IRQ
+ select REMOTEPROC
+ select RPMSG
+ help
+diff --git a/drivers/cdx/controller/cdx_controller.c b/drivers/cdx/controller/cdx_controller.c
+index fca83141e3e66..5e3fd89b6b561 100644
+--- a/drivers/cdx/controller/cdx_controller.c
++++ b/drivers/cdx/controller/cdx_controller.c
+@@ -193,7 +193,8 @@ static int xlnx_cdx_probe(struct platform_device *pdev)
+ cdx->ops = &cdx_ops;
+
+ /* Create MSI domain */
+- cdx->msi_domain = cdx_msi_domain_init(&pdev->dev);
++ if (IS_ENABLED(CONFIG_GENERIC_MSI_IRQ))
++ cdx->msi_domain = cdx_msi_domain_init(&pdev->dev);
+ if (!cdx->msi_domain) {
+ ret = dev_err_probe(&pdev->dev, -ENODEV, "cdx_msi_domain_init() failed");
+ goto cdx_msi_fail;
+--
+2.51.0
+
--- /dev/null
+From c49513d2d5052b7134ccbb0b8d271c4dff22f6fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 13:19:35 +0200
+Subject: clocksource/drivers/tegra186: Avoid 64-bit division
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 409f8fe03e08f92bf5be96cedbcd7a3e8fb2eeaf ]
+
+The newly added function causes a build failure on 32-bit targets with
+older compiler version such as gcc-10:
+
+arm-linux-gnueabi-ld: drivers/clocksource/timer-tegra186.o: in function `tegra186_wdt_get_timeleft':
+timer-tegra186.c:(.text+0x3c2): undefined reference to `__aeabi_uldivmod'
+
+The calculation can trivially be changed to avoid the division entirely,
+as USEC_PER_SEC is a multiple of 5. Change both such calculation for
+consistency, even though gcc apparently managed to optimize the other one
+properly already.
+
+[dlezcano : Fixed conflict with 20250614175556.922159-2-linux@roeck-us.net ]
+
+Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250620111939.3395525-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-tegra186.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
+index 7b506de654386..47bdb1e320af9 100644
+--- a/drivers/clocksource/timer-tegra186.c
++++ b/drivers/clocksource/timer-tegra186.c
+@@ -159,7 +159,7 @@ static void tegra186_wdt_enable(struct tegra186_wdt *wdt)
+ tmr_writel(wdt->tmr, TMRCSSR_SRC_USEC, TMRCSSR);
+
+ /* configure timer (system reset happens on the fifth expiration) */
+- value = TMRCR_PTV(wdt->base.timeout * USEC_PER_SEC / 5) |
++ value = TMRCR_PTV(wdt->base.timeout * (USEC_PER_SEC / 5)) |
+ TMRCR_PERIODIC | TMRCR_ENABLE;
+ tmr_writel(wdt->tmr, value, TMRCR);
+
+--
+2.51.0
+
--- /dev/null
+From f4bb3c5a56c9f393391b86328979b39dddfd028b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Jun 2025 10:55:55 -0700
+Subject: clocksource/drivers/timer-tegra186: Avoid 64-bit divide operation
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 916aa36042db8ee230543ffe0d192f900e8b8c9f ]
+
+Building the driver on xtensa fails with
+
+tensa-linux-ld: drivers/clocksource/timer-tegra186.o:
+ in function `tegra186_timer_remove':
+timer-tegra186.c:(.text+0x350):
+ undefined reference to `__udivdi3'
+
+Avoid the problem by rearranging the offending code to avoid the 64-bit
+divide operation.
+
+Fixes: 28c842c8b0f5 ("clocksource/drivers/timer-tegra186: Add WDIOC_GETTIMELEFT support")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Cc: Pohsun Su <pohsuns@nvidia.com>
+Cc: Robert Lin <robelin@nvidia.com>
+Link: https://lore.kernel.org/r/20250614175556.922159-1-linux@roeck-us.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-tegra186.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-tegra186.c b/drivers/clocksource/timer-tegra186.c
+index e5394f98a02e6..7b506de654386 100644
+--- a/drivers/clocksource/timer-tegra186.c
++++ b/drivers/clocksource/timer-tegra186.c
+@@ -267,7 +267,7 @@ static unsigned int tegra186_wdt_get_timeleft(struct watchdog_device *wdd)
+ * counter value to the time of the counter expirations that
+ * remain.
+ */
+- timeleft += (((u64)wdt->base.timeout * USEC_PER_SEC) / 5) * (4 - expiration);
++ timeleft += ((u64)wdt->base.timeout * (USEC_PER_SEC / 5)) * (4 - expiration);
+
+ /*
+ * Convert the current counter value to seconds,
+--
+2.51.0
+
--- /dev/null
+From 6a43de5dc8cb428e0af3d37602e60aac018abb2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:40 +0100
+Subject: coresight: Appropriately disable programming clocks
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 1abc1b212effe920f4729353880c8e03f1d76b4b ]
+
+Some CoreSight components have programming clocks (pclk) and are enabled
+using clk_get() and clk_prepare_enable(). However, in many cases, these
+clocks are not disabled when modules exit and only released by clk_put().
+
+To fix the issue, this commit refactors programming clock by replacing
+clk_get() and clk_prepare_enable() with devm_clk_get_optional_enabled()
+for enabling APB clock. If the "apb_pclk" clock is not found, a NULL
+pointer is returned, and the function proceeds to attempt enabling the
+"apb" clock.
+
+Since ACPI platforms rely on firmware to manage clocks, returning a NULL
+pointer in this case leaves clock management to the firmware rather than
+the driver. This effectively avoids a clock imbalance issue during
+module removal - where the clock could be disabled twice: once during
+the ACPI runtime suspend and again during the devm resource release.
+
+Callers are updated to reuse the returned error value.
+
+With the change, programming clocks are managed as resources in driver
+model layer, allowing clock cleanup to be handled automatically. As a
+result, manual cleanup operations are no longer needed and are removed
+from the Coresight drivers.
+
+Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-4-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 9 ++------
+ .../hwtracing/coresight/coresight-cpu-debug.c | 6 +----
+ .../hwtracing/coresight/coresight-ctcu-core.c | 10 ++-------
+ .../coresight/coresight-etm4x-core.c | 9 ++------
+ .../hwtracing/coresight/coresight-funnel.c | 6 +----
+ .../coresight/coresight-replicator.c | 6 +----
+ drivers/hwtracing/coresight/coresight-stm.c | 4 +---
+ .../hwtracing/coresight/coresight-tmc-core.c | 4 +---
+ drivers/hwtracing/coresight/coresight-tpiu.c | 4 +---
+ include/linux/coresight.h | 22 ++++++++-----------
+ 10 files changed, 21 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index af2a55f0c907c..4c345ff2cff14 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -636,7 +636,7 @@ static int catu_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ pm_runtime_get_noresume(&pdev->dev);
+ pm_runtime_set_active(&pdev->dev);
+@@ -645,11 +645,8 @@ static int catu_platform_probe(struct platform_device *pdev)
+ dev_set_drvdata(&pdev->dev, drvdata);
+ ret = __catu_probe(&pdev->dev, res);
+ pm_runtime_put(&pdev->dev);
+- if (ret) {
++ if (ret)
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+- }
+
+ return ret;
+ }
+@@ -663,8 +660,6 @@ static void catu_platform_remove(struct platform_device *pdev)
+
+ __catu_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+index a871d997330b0..e39dfb886688e 100644
+--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c
++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c
+@@ -699,7 +699,7 @@ static int debug_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+ pm_runtime_get_noresume(&pdev->dev);
+@@ -710,8 +710,6 @@ static int debug_platform_probe(struct platform_device *pdev)
+ if (ret) {
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+ return ret;
+ }
+@@ -725,8 +723,6 @@ static void debug_platform_remove(struct platform_device *pdev)
+
+ __debug_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/hwtracing/coresight/coresight-ctcu-core.c b/drivers/hwtracing/coresight/coresight-ctcu-core.c
+index c6bafc96db963..de279efe34058 100644
+--- a/drivers/hwtracing/coresight/coresight-ctcu-core.c
++++ b/drivers/hwtracing/coresight/coresight-ctcu-core.c
+@@ -209,7 +209,7 @@ static int ctcu_probe(struct platform_device *pdev)
+
+ drvdata->apb_clk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->apb_clk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->apb_clk);
+
+ cfgs = of_device_get_match_data(dev);
+ if (cfgs) {
+@@ -233,12 +233,8 @@ static int ctcu_probe(struct platform_device *pdev)
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
+- clk_put(drvdata->apb_clk);
+-
++ if (IS_ERR(drvdata->csdev))
+ return PTR_ERR(drvdata->csdev);
+- }
+
+ return 0;
+ }
+@@ -275,8 +271,6 @@ static void ctcu_platform_remove(struct platform_device *pdev)
+
+ ctcu_remove(pdev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->apb_clk))
+- clk_put(drvdata->apb_clk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 81f20a167e001..4b98a7bf4cb73 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2309,14 +2309,12 @@ static int etm4_probe_platform_dev(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ if (res) {
+ drvdata->base = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(drvdata->base)) {
+- clk_put(drvdata->pclk);
++ if (IS_ERR(drvdata->base))
+ return PTR_ERR(drvdata->base);
+- }
+ }
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+@@ -2423,9 +2421,6 @@ static void etm4_remove_platform_dev(struct platform_device *pdev)
+ if (drvdata)
+ etm4_remove_dev(drvdata);
+ pm_runtime_disable(&pdev->dev);
+-
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ static const struct amba_id etm4_ids[] = {
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
+index b1922dbe9292b..36fc4e991458c 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -240,7 +240,7 @@ static int funnel_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ /*
+ * Map the device base for dynamic-funnel, which has been
+@@ -284,8 +284,6 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ out_disable_clk:
+ if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+ clk_disable_unprepare(drvdata->atclk);
+- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
+ return ret;
+ }
+
+@@ -355,8 +353,6 @@ static void funnel_platform_remove(struct platform_device *pdev)
+
+ funnel_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ static const struct of_device_id funnel_match[] = {
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
+index 06efd2b01a0f7..6dd24eb10a94b 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -247,7 +247,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ /*
+ * Map the device base for dynamic-replicator, which has been
+@@ -296,8 +296,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ out_disable_clk:
+ if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+ clk_disable_unprepare(drvdata->atclk);
+- if (ret && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
+ return ret;
+ }
+
+@@ -335,8 +333,6 @@ static void replicator_platform_remove(struct platform_device *pdev)
+
+ replicator_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
+index e45c6c7204b44..88ee453b28154 100644
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -851,7 +851,7 @@ static int __stm_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+ dev_set_drvdata(dev, drvdata);
+
+ base = devm_ioremap_resource(dev, res);
+@@ -1033,8 +1033,6 @@ static void stm_platform_remove(struct platform_device *pdev)
+
+ __stm_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 0b5e7635a084d..e867198b03e82 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -991,7 +991,7 @@ static int tmc_platform_probe(struct platform_device *pdev)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(&pdev->dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+
+ dev_set_drvdata(&pdev->dev, drvdata);
+ pm_runtime_get_noresume(&pdev->dev);
+@@ -1015,8 +1015,6 @@ static void tmc_platform_remove(struct platform_device *pdev)
+
+ __tmc_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index 3e01592884280..b2559c6fac6d2 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -153,7 +153,7 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+- return -ENODEV;
++ return PTR_ERR(drvdata->pclk);
+ dev_set_drvdata(dev, drvdata);
+
+ /* Validity for the resource is already checked by the AMBA core */
+@@ -293,8 +293,6 @@ static void tpiu_platform_remove(struct platform_device *pdev)
+
+ __tpiu_remove(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- if (!IS_ERR_OR_NULL(drvdata->pclk))
+- clk_put(drvdata->pclk);
+ }
+
+ #ifdef CONFIG_ACPI
+diff --git a/include/linux/coresight.h b/include/linux/coresight.h
+index 4ac65c68bbf44..1e652e1578419 100644
+--- a/include/linux/coresight.h
++++ b/include/linux/coresight.h
+@@ -6,6 +6,7 @@
+ #ifndef _LINUX_CORESIGHT_H
+ #define _LINUX_CORESIGHT_H
+
++#include <linux/acpi.h>
+ #include <linux/amba/bus.h>
+ #include <linux/clk.h>
+ #include <linux/device.h>
+@@ -480,26 +481,21 @@ static inline bool is_coresight_device(void __iomem *base)
+ * Returns:
+ *
+ * clk - Clock is found and enabled
+- * NULL - clock is not found
++ * NULL - Clock is controlled by firmware (ACPI device only)
+ * ERROR - Clock is found but failed to enable
+ */
+ static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
+ {
+ struct clk *pclk;
+- int ret;
+
+- pclk = clk_get(dev, "apb_pclk");
+- if (IS_ERR(pclk)) {
+- pclk = clk_get(dev, "apb");
+- if (IS_ERR(pclk))
+- return NULL;
+- }
++ /* Firmware controls clocks for an ACPI device. */
++ if (has_acpi_companion(dev))
++ return NULL;
++
++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
++ if (!pclk)
++ pclk = devm_clk_get_optional_enabled(dev, "apb");
+
+- ret = clk_prepare_enable(pclk);
+- if (ret) {
+- clk_put(pclk);
+- return ERR_PTR(ret);
+- }
+ return pclk;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c70457cdd3e349c0a79b493da4a2ea1799217923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:41 +0100
+Subject: coresight: Appropriately disable trace bus clocks
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a8f2d480f19d912f15dbac7038cd578d6b8b4d74 ]
+
+Some CoreSight components have trace bus clocks 'atclk' and are enabled
+using clk_prepare_enable(). These clocks are not disabled when modules
+exit.
+
+As atclk is optional, use devm_clk_get_optional_enabled() to manage it.
+The benefit is the driver model layer can automatically disable and
+release clocks.
+
+Check the returned value with IS_ERR() to detect errors but leave the
+NULL pointer case if the clock is not found. And remove the error
+handling codes which are no longer needed.
+
+Fixes: d1839e687773 ("coresight: etm: retrieve and handle atclk")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-5-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etb10.c | 10 +++---
+ .../coresight/coresight-etm3x-core.c | 9 ++---
+ .../hwtracing/coresight/coresight-funnel.c | 36 ++++++-------------
+ .../coresight/coresight-replicator.c | 34 ++++++------------
+ drivers/hwtracing/coresight/coresight-stm.c | 9 ++---
+ drivers/hwtracing/coresight/coresight-tpiu.c | 10 ++----
+ 6 files changed, 34 insertions(+), 74 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index d5efb085b30d3..8e81b41eb2226 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -730,12 +730,10 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ dev_set_drvdata(dev, drvdata);
+
+ /* validity for the resource is already checked by the AMBA core */
+diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+index 1c6204e144221..baba2245b1dfb 100644
+--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c
+@@ -832,12 +832,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
+
+ spin_lock_init(&drvdata->spinlock);
+
+- drvdata->atclk = devm_clk_get(&adev->dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->cpu = coresight_get_cpu(dev);
+ if (drvdata->cpu < 0)
+diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
+index 36fc4e991458c..b044a4125310b 100644
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -213,7 +213,6 @@ ATTRIBUTE_GROUPS(coresight_funnel);
+
+ static int funnel_probe(struct device *dev, struct resource *res)
+ {
+- int ret;
+ void __iomem *base;
+ struct coresight_platform_data *pdata = NULL;
+ struct funnel_drvdata *drvdata;
+@@ -231,12 +230,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+@@ -248,10 +244,8 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ */
+ if (res) {
+ base = devm_ioremap_resource(dev, res);
+- if (IS_ERR(base)) {
+- ret = PTR_ERR(base);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(base))
++ return PTR_ERR(base);
+ drvdata->base = base;
+ desc.groups = coresight_funnel_groups;
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+@@ -261,10 +255,9 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ dev_set_drvdata(dev, drvdata);
+
+ pdata = coresight_get_platform_data(dev);
+- if (IS_ERR(pdata)) {
+- ret = PTR_ERR(pdata);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(pdata))
++ return PTR_ERR(pdata);
++
+ dev->platform_data = pdata;
+
+ raw_spin_lock_init(&drvdata->spinlock);
+@@ -274,17 +267,10 @@ static int funnel_probe(struct device *dev, struct resource *res)
+ desc.pdata = pdata;
+ desc.dev = dev;
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- ret = PTR_ERR(drvdata->csdev);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(drvdata->csdev))
++ return PTR_ERR(drvdata->csdev);
+
+- ret = 0;
+-
+-out_disable_clk:
+- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+- clk_disable_unprepare(drvdata->atclk);
+- return ret;
++ return 0;
+ }
+
+ static int funnel_remove(struct device *dev)
+diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
+index 6dd24eb10a94b..9e8bd36e7a9a2 100644
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -219,7 +219,6 @@ static const struct attribute_group *replicator_groups[] = {
+
+ static int replicator_probe(struct device *dev, struct resource *res)
+ {
+- int ret = 0;
+ struct coresight_platform_data *pdata = NULL;
+ struct replicator_drvdata *drvdata;
+ struct coresight_desc desc = { 0 };
+@@ -238,12 +237,9 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+@@ -255,10 +251,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ */
+ if (res) {
+ base = devm_ioremap_resource(dev, res);
+- if (IS_ERR(base)) {
+- ret = PTR_ERR(base);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(base))
++ return PTR_ERR(base);
+ drvdata->base = base;
+ desc.groups = replicator_groups;
+ desc.access = CSDEV_ACCESS_IOMEM(base);
+@@ -272,10 +266,8 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ dev_set_drvdata(dev, drvdata);
+
+ pdata = coresight_get_platform_data(dev);
+- if (IS_ERR(pdata)) {
+- ret = PTR_ERR(pdata);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(pdata))
++ return PTR_ERR(pdata);
+ dev->platform_data = pdata;
+
+ raw_spin_lock_init(&drvdata->spinlock);
+@@ -286,17 +278,11 @@ static int replicator_probe(struct device *dev, struct resource *res)
+ desc.dev = dev;
+
+ drvdata->csdev = coresight_register(&desc);
+- if (IS_ERR(drvdata->csdev)) {
+- ret = PTR_ERR(drvdata->csdev);
+- goto out_disable_clk;
+- }
++ if (IS_ERR(drvdata->csdev))
++ return PTR_ERR(drvdata->csdev);
+
+ replicator_reset(drvdata);
+-
+-out_disable_clk:
+- if (ret && !IS_ERR_OR_NULL(drvdata->atclk))
+- clk_disable_unprepare(drvdata->atclk);
+- return ret;
++ return 0;
+ }
+
+ static int replicator_remove(struct device *dev)
+diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
+index 88ee453b28154..57fbe3ad0fb20 100644
+--- a/drivers/hwtracing/coresight/coresight-stm.c
++++ b/drivers/hwtracing/coresight/coresight-stm.c
+@@ -842,12 +842,9 @@ static int __stm_probe(struct device *dev, struct resource *res)
+ if (!drvdata)
+ return -ENOMEM;
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
+index b2559c6fac6d2..8d6179c83e5d3 100644
+--- a/drivers/hwtracing/coresight/coresight-tpiu.c
++++ b/drivers/hwtracing/coresight/coresight-tpiu.c
+@@ -128,7 +128,6 @@ static const struct coresight_ops tpiu_cs_ops = {
+
+ static int __tpiu_probe(struct device *dev, struct resource *res)
+ {
+- int ret;
+ void __iomem *base;
+ struct coresight_platform_data *pdata = NULL;
+ struct tpiu_drvdata *drvdata;
+@@ -144,12 +143,9 @@ static int __tpiu_probe(struct device *dev, struct resource *res)
+
+ spin_lock_init(&drvdata->spinlock);
+
+- drvdata->atclk = devm_clk_get(dev, "atclk"); /* optional */
+- if (!IS_ERR(drvdata->atclk)) {
+- ret = clk_prepare_enable(drvdata->atclk);
+- if (ret)
+- return ret;
+- }
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
+
+ drvdata->pclk = coresight_get_enable_apb_pclk(dev);
+ if (IS_ERR(drvdata->pclk))
+--
+2.51.0
+
--- /dev/null
+From 202e88efc89003b6de420157e123266ae7464c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:42 +0100
+Subject: coresight: Avoid enable programming clock duplicately
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit d091c6312561821f216ced63a7ad17c946b6d335 ]
+
+The programming clock is enabled by AMBA bus driver before a dynamic
+probe. As a result, a CoreSight driver may redundantly enable the same
+clock.
+
+To avoid this, add a check for device type and skip enabling the
+programming clock for AMBA devices. The returned NULL pointer will be
+tolerated by the drivers.
+
+Fixes: 73d779a03a76 ("coresight: etm4x: Change etm4_platform_driver driver for MMIO devices")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-6-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/coresight.h | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/coresight.h b/include/linux/coresight.h
+index 1e652e1578419..bb49080ec8f96 100644
+--- a/include/linux/coresight.h
++++ b/include/linux/coresight.h
+@@ -481,20 +481,23 @@ static inline bool is_coresight_device(void __iomem *base)
+ * Returns:
+ *
+ * clk - Clock is found and enabled
+- * NULL - Clock is controlled by firmware (ACPI device only)
++ * NULL - Clock is controlled by firmware (ACPI device only) or when managed
++ * by the AMBA bus driver instead
+ * ERROR - Clock is found but failed to enable
+ */
+ static inline struct clk *coresight_get_enable_apb_pclk(struct device *dev)
+ {
+- struct clk *pclk;
++ struct clk *pclk = NULL;
+
+ /* Firmware controls clocks for an ACPI device. */
+ if (has_acpi_companion(dev))
+ return NULL;
+
+- pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
+- if (!pclk)
+- pclk = devm_clk_get_optional_enabled(dev, "apb");
++ if (!dev_is_amba(dev)) {
++ pclk = devm_clk_get_optional_enabled(dev, "apb_pclk");
++ if (!pclk)
++ pclk = devm_clk_get_optional_enabled(dev, "apb");
++ }
+
+ return pclk;
+ }
+--
+2.51.0
+
--- /dev/null
+From 60ce713d9eb425d58cdd7fbaf088988259f30c0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:38 +0100
+Subject: coresight: catu: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]
+
+The atclk is an optional clock for the CoreSight CATU, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the CATU driver, and dynamically
+control the clock during suspend and resume.
+
+The checks for driver data and clocks in suspend and resume are not
+needed, remove them. Add error handling in the resume function.
+
+Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-2-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-catu.h | 1 +
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index 5058432233da1..af2a55f0c907c 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -520,6 +520,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
+ struct coresight_platform_data *pdata = NULL;
+ void __iomem *base;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
+ if (!catu_desc.name)
+ return -ENOMEM;
+@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int catu_runtime_resume(struct device *dev)
+ {
+ struct catu_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
+index 755776cd19c5b..6e6b7aac206dc 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.h
++++ b/drivers/hwtracing/coresight/coresight-catu.h
+@@ -62,6 +62,7 @@
+
+ struct catu_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ int irq;
+--
+2.51.0
+
--- /dev/null
+From 857ea1992c12decf0535c5e28848e392818ecf51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 01:24:45 -0700
+Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
+
+From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+
+[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
+
+The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
+To avoid invalid accesses, introduce a check on numextinsel
+(derived from TRCIDR5[11:9]) before reading or writing to this register.
+
+Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
+Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index cbea200489c8f..b4f1834a1af1e 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -529,7 +529,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+ etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
+@@ -1424,6 +1425,7 @@ static void etm4_init_arch_data(void *info)
+ etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
+ /* NUMEXTIN, bits[8:0] number of external inputs implemented */
+ drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
+ /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
+ drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
+ /* ATBTRIG, bit[22] implementation can support ATB triggers? */
+@@ -1853,7 +1855,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
+- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
++
++ if (drvdata->numextinsel)
++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
+@@ -1985,7 +1989,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index ac649515054d9..823914fefa90a 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -162,6 +162,7 @@
+ #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
+
+ #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
+ #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
+ #define TRCIDR5_ATBTRIG BIT(22)
+ #define TRCIDR5_LPOVERRIDE BIT(23)
+@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
+ u8 nr_cntr;
+ u8 nr_ext_inp;
+ u8 numcidc;
++ u8 numextinsel;
+ u8 numvmidc;
+ u8 nrseqstate;
+ u8 nr_event;
+--
+2.51.0
+
--- /dev/null
+From 80781dfb954dd66f795ee3fa1cc5b1a73f540c6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:39 +0100
+Subject: coresight: etm4x: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
+
+The atclk is an optional clock for the CoreSight ETMv4, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the ETMv4 driver, and dynamically
+control the clock during suspend and resume.
+
+No need to check the driver data and clock pointer in the runtime
+suspend and resume, so remove checks. And add error handling in the
+resume function.
+
+Add a minor fix to the comment format when adding the atclk field.
+
+Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++-
+ 2 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index b4f1834a1af1e..81f20a167e001 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2221,6 +2221,10 @@ static int etm4_probe(struct device *dev)
+ if (WARN_ON(!drvdata))
+ return -ENOMEM;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
+ pm_save_enable = coresight_loses_context_with_cpu(dev) ?
+ PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
+@@ -2469,8 +2473,8 @@ static int etm4_runtime_suspend(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
+
+ return 0;
+ }
+@@ -2478,11 +2482,17 @@ static int etm4_runtime_suspend(struct device *dev)
+ static int etm4_runtime_resume(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
+
+- return 0;
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 823914fefa90a..13ec9ecef46f5 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -920,7 +920,8 @@ struct etmv4_save_state {
+
+ /**
+ * struct etm4_drvdata - specifics associated to an ETM component
+- * @pclk APB clock if present, otherwise NULL
++ * @pclk: APB clock if present, otherwise NULL
++ * @atclk: Optional clock for the core parts of the ETMv4.
+ * @base: Memory mapped base address for this component.
+ * @csdev: Component vitals needed by the framework.
+ * @spinlock: Only one at a time pls.
+@@ -989,6 +990,7 @@ struct etmv4_save_state {
+ */
+ struct etmv4_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ raw_spinlock_t spinlock;
+--
+2.51.0
+
--- /dev/null
+From 73a93141d52ed468c3725e680976d3708a311652 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 20:20:22 +0800
+Subject: coresight: Fix incorrect handling for return value of devm_kzalloc
+
+From: Lin Yujun <linyujun809@h-partners.com>
+
+[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]
+
+The return value of devm_kzalloc could be an null pointer,
+use "!desc.pdata" to fix incorrect handling return value
+of devm_kzalloc.
+
+Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
+Signed-off-by: Lin Yujun <linyujun809@h-partners.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250908122022.1315399-1-linyujun809@h-partners.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 3dd2e1b4809dc..43643d2c5bdd0 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -1281,7 +1281,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
+ * into the device for that purpose.
+ */
+ desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
+- if (IS_ERR(desc.pdata))
++ if (!desc.pdata)
+ goto cpu_clear;
+
+ desc.type = CORESIGHT_DEV_TYPE_SINK;
+--
+2.51.0
+
--- /dev/null
+From 4484a46df828dac073ad8f3acdd796a4c1fd7c38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 11:30:25 +0100
+Subject: coresight: fix indentation error in
+ cscfg_remove_owned_csdev_configs()
+
+From: Yeoreum Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit 21dd3f8bc24b6adc57f09fff5430b0039dd00492 ]
+
+Fix wrong indentation in cscfg_remove_owned_csdev_configs()
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506102238.XQfScl5x-lkp@intel.com/
+Fixes: 53b9e2659719 ("coresight: holding cscfg_csdev_lock while removing cscfg from csdev")
+Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250611103025.939020-1-yeoreum.yun@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-syscfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
+index 83dad24e0116d..6836b05986e80 100644
+--- a/drivers/hwtracing/coresight/coresight-syscfg.c
++++ b/drivers/hwtracing/coresight/coresight-syscfg.c
+@@ -395,7 +395,7 @@ static void cscfg_remove_owned_csdev_configs(struct coresight_device *csdev, voi
+ if (list_empty(&csdev->config_csdev_list))
+ return;
+
+- guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
++ guard(raw_spinlock_irqsave)(&csdev->cscfg_csdev_lock);
+
+ list_for_each_entry_safe(config_csdev, tmp, &csdev->config_csdev_list, node) {
+ if (config_csdev->config_desc->load_owner == load_owner)
+--
+2.51.0
+
--- /dev/null
+From c2743fd98325f76a70f6ed0b28f5410057b6a281 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 10:55:27 +0100
+Subject: coresight: Fix missing include for FIELD_GET
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 08d24e076d0fb9f90522ef69bf6cdae06e0919de ]
+
+Include the header for FIELD_GET which is only sometimes transitively
+included on some configs and kernel releases.
+
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Closes: https://lists.linaro.org/archives/list/lkft-triage@lists.linaro.org/thread/6GKMK52PPRJVEYMEUHJP6BXF4CJAXOFL/
+Fixes: a4e65842e114 ("coresight: Only check bottom two claim bits")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250707-james-coresight-bitfield-include-v1-1-aa0f4220ecfd@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 1 +
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 1 +
+ drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 1 +
+ drivers/hwtracing/coresight/ultrasoc-smb.h | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index fa758cc218275..c2db94f2ab237 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -3,6 +3,7 @@
+ * Copyright (c) 2012, The Linux Foundation. All rights reserved.
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/build_bug.h>
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 42e5d37403add..cbea200489c8f 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -4,6 +4,7 @@
+ */
+
+ #include <linux/acpi.h>
++#include <linux/bitfield.h>
+ #include <linux/bitops.h>
+ #include <linux/kernel.h>
+ #include <linux/kvm_host.h>
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+index ab251865b893d..e9eeea6240d55 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+@@ -4,6 +4,7 @@
+ * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/coresight.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/pm_runtime.h>
+diff --git a/drivers/hwtracing/coresight/ultrasoc-smb.h b/drivers/hwtracing/coresight/ultrasoc-smb.h
+index c4c111275627b..323f0ccb6878c 100644
+--- a/drivers/hwtracing/coresight/ultrasoc-smb.h
++++ b/drivers/hwtracing/coresight/ultrasoc-smb.h
+@@ -7,6 +7,7 @@
+ #ifndef _ULTRASOC_SMB_H
+ #define _ULTRASOC_SMB_H
+
++#include <linux/bitfield.h>
+ #include <linux/miscdevice.h>
+ #include <linux/spinlock.h>
+
+--
+2.51.0
+
--- /dev/null
+From 7a7292c9f442efec87b6a21c98511a174251ed17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:26:19 +0800
+Subject: coresight: Only register perf symlink for sinks with alloc_buffer
+
+From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+
+[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
+
+Ensure that etm_perf_add_symlink_sink() is only called for devices
+that implement the alloc_buffer operation. This prevents invalid
+symlink creation for dummy sinks that do not implement alloc_buffer.
+
+Without this check, perf may attempt to use a dummy sink that lacks
+alloc_buffer operationsu to initialise perf's ring buffer, leading
+to runtime failures.
+
+Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
+Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index c2db94f2ab237..1accd7cbd54bf 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1375,8 +1375,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
+ goto out_unlock;
+ }
+
+- if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
++ sink_ops(csdev)->alloc_buffer) {
+ ret = etm_perf_add_symlink_sink(csdev);
+
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From eb5d366cb7266b5050ce0a7a5168ed38827c02b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:37 +0100
+Subject: coresight: tmc: Support atclk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]
+
+The atclk is an optional clock for the CoreSight TMC, but the driver
+misses to initialize it. In most cases, TMC shares the atclk clock with
+other CoreSight components. Since these components enable the clock
+before the TMC device is initialized, the TMC continues properly,
+which is why we don’t observe any lockup issues.
+
+This change enables atclk in probe of the TMC driver. Given the clock
+is optional, it is possible to return NULL if the clock does not exist.
+IS_ERR() is tolerant for this case.
+
+Dynamically disable and enable atclk during suspend and resume. The
+clock pointers will never be error values if the driver has successfully
+probed, and the case of a NULL pointer case will be handled by the clock
+core layer. The driver data is always valid after probe. Therefore,
+remove the related checks. Also in the resume flow adds error handling.
+
+Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-1-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-tmc-core.c | 22 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-tmc.h | 2 ++
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
+index 88afb16bb6bec..0b5e7635a084d 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
+@@ -789,6 +789,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
+ struct coresight_desc desc = { 0 };
+ struct coresight_dev_list *dev_list = NULL;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ ret = -ENOMEM;
+
+ /* Validity for the resource is already checked by the AMBA core */
+@@ -1020,18 +1024,26 @@ static int tmc_runtime_suspend(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
++
+ return 0;
+ }
+
+ static int tmc_runtime_resume(struct device *dev)
+ {
+ struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
+
+- if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
+- return 0;
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
++
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
+index 6541a27a018e6..cbb4ba4391585 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.h
++++ b/drivers/hwtracing/coresight/coresight-tmc.h
+@@ -210,6 +210,7 @@ struct tmc_resrv_buf {
+
+ /**
+ * struct tmc_drvdata - specifics associated to an TMC component
++ * @atclk: optional clock for the core parts of the TMC.
+ * @pclk: APB clock if present, otherwise NULL
+ * @base: memory mapped base address for this component.
+ * @csdev: component vitals needed by the framework.
+@@ -244,6 +245,7 @@ struct tmc_resrv_buf {
+ * Used by ETR/ETF.
+ */
+ struct tmc_drvdata {
++ struct clk *atclk;
+ struct clk *pclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+--
+2.51.0
+
--- /dev/null
+From 27dc0497a63e0c26d23e08159627ad8f7a3ac3a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 07:53:04 +0800
+Subject: coresight: tpda: fix the logic to setup the element size
+
+From: Jie Gan <jie.gan@oss.qualcomm.com>
+
+[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]
+
+Some TPDM devices support both CMB and DSB datasets, requiring
+the system to enable the port with both corresponding element sizes.
+
+Currently, the logic treats tpdm_read_element_size as successful if
+the CMB element size is retrieved correctly, regardless of whether
+the DSB element size is obtained. This behavior causes issues
+when parsing data from TPDM devices that depend on both element sizes.
+
+To address this, the function should explicitly fail if the DSB
+element size cannot be read correctly.
+
+Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250906-fix_element_size_issue-v2-1-dbb0ac2541a9@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
+index 0633f04beb240..333b3cb236859 100644
+--- a/drivers/hwtracing/coresight/coresight-tpda.c
++++ b/drivers/hwtracing/coresight/coresight-tpda.c
+@@ -71,6 +71,8 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+ if (tpdm_data->dsb) {
+ rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
+ "qcom,dsb-element-bits", &drvdata->dsb_esize);
++ if (rc)
++ goto out;
+ }
+
+ if (tpdm_data->cmb) {
+@@ -78,6 +80,7 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
+ "qcom,cmb-element-bits", &drvdata->cmb_esize);
+ }
+
++out:
+ if (rc)
+ dev_warn_once(&csdev->dev,
+ "Failed to read TPDM Element size: %d\n", rc);
+--
+2.51.0
+
--- /dev/null
+From ccccaefe39037b38532a5ab481663de77b6931f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 11:19:05 +0100
+Subject: coresight: trbe: Add ISB after TRBLIMITR write
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 52c0164b2526bce7013fca193e076f6d9eec9c95 ]
+
+DEN0154 states that hardware will be allowed to ignore writes to TRB*
+registers while the trace buffer is enabled. Add an ISB to ensure that
+it's disabled before clearing the other registers.
+
+This is purely defensive because it's expected that arm_trbe_disable()
+would be called before teardown which has the required ISB.
+
+Fixes: a2b579c41fe9 ("coresight: trbe: Remove redundant disable call")
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250609-james-cs-trblimitr-isb-v1-1-3a2aa4ee6770@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 8f426f94e32a1..f78c9b9dc0087 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -258,6 +258,7 @@ static void trbe_drain_and_disable_local(struct trbe_cpudata *cpudata)
+ static void trbe_reset_local(struct trbe_cpudata *cpudata)
+ {
+ write_sysreg_s(0, SYS_TRBLIMITR_EL1);
++ isb();
+ trbe_drain_buffer();
+ write_sysreg_s(0, SYS_TRBPTR_EL1);
+ write_sysreg_s(0, SYS_TRBBASER_EL1);
+--
+2.51.0
+
--- /dev/null
+From ecec4b6f19589e48bf1c4cbdca40a211fa756332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 8267dd1a2130d..8f426f94e32a1 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -23,7 +23,8 @@
+ #include "coresight-self-hosted-trace.h"
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From c6985e88e964b76efaf225eebaee4652084ff150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index f78c9b9dc0087..3dd2e1b4809dc 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -749,12 +749,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -764,7 +764,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From 45088de5363a00a6270c0292f5d40b5c26653da0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index ef078426bfd51..38c165d526d14 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/pm_qos.h>
+ #include <linux/slab.h>
+@@ -424,6 +425,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3c9e2ac7861ce020d75a2bd9f1e54ee8c6b6d7e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 17:22:12 +0200
+Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
+
+Make sure to drop the reference to the saw device taken by
+of_find_device_by_node() after retrieving its driver data during
+probe().
+
+Also drop the reference to the CPU node sooner to avoid leaking it in
+case there is no saw node or device.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index 5f386761b1562..f60a4cf536423 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
+ return -ENODEV;
+
+ saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++ of_node_put(cpu_node);
+ if (!saw_node)
+ return -ENODEV;
+
+ pdev = of_find_device_by_node(saw_node);
+ of_node_put(saw_node);
+- of_node_put(cpu_node);
+ if (!pdev)
+ return -ENODEV;
+
+ data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ put_device(&pdev->dev);
+ return -ENOMEM;
++ }
+
+ data->spm = dev_get_drvdata(&pdev->dev);
++ put_device(&pdev->dev);
+ if (!data->spm)
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From eb4adbbf6ac3a7d1259dd62947ca7c4469d725f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:12:26 +0000
+Subject: cpuset: fix failure to enable isolated partition when containing
+ isolcpus
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ]
+
+The 'isolcpus' parameter specified at boot time can be assigned to an
+isolated partition. While it is valid put the 'isolcpus' in an isolated
+partition, attempting to change a member cpuset to an isolated partition
+will fail if the cpuset contains any 'isolcpus'.
+
+For example, the system boots with 'isolcpus=9', and the following
+configuration works correctly:
+
+ # cd /sys/fs/cgroup/
+ # mkdir test
+ # echo 1 > test/cpuset.cpus
+ # echo isolated > test/cpuset.cpus.partition
+ # cat test/cpuset.cpus.partition
+ isolated
+ # echo 9 > test/cpuset.cpus
+ # cat test/cpuset.cpus.partition
+ isolated
+ # cat test/cpuset.cpus
+ 9
+
+However, the following steps to convert a member cpuset to an isolated
+partition will fail:
+
+ # cd /sys/fs/cgroup/
+ # mkdir test
+ # echo 9 > test/cpuset.cpus
+ # echo isolated > test/cpuset.cpus.partition
+ # cat test/cpuset.cpus.partition
+ isolated invalid (partition config conflicts with housekeeping setup)
+
+The issue occurs because the new partition state (new_prs) is used for
+validation against housekeeping constraints before it has been properly
+updated. To resolve this, move the assignment of new_prs before the
+housekeeping validation check when enabling a root partition.
+
+Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Reviewed-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 27adb04df675d..fef93032fe7e4 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
+ xcpus = tmp->delmask;
+ if (compute_effective_exclusive_cpumask(cs, xcpus, NULL))
+ WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus));
++ new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
+
+ /*
+ * Enabling partition root is not allowed if its
+@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
+
+ deleting = true;
+ subparts_delta++;
+- new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
+ } else if (cmd == partcmd_disable) {
+ /*
+ * May need to add cpus back to parent's effective_cpus
+--
+2.51.0
+
--- /dev/null
+From 2d088a49206a38857f390268ad1aa81830c82280 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 10:53:33 +1000
+Subject: cramfs: fix incorrect physical page address calculation
+
+From: Alistair Popple <apopple@nvidia.com>
+
+[ Upstream commit 20a8e0454d833d80d0c0cae304841a50a2a126bd ]
+
+Commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality")
+incorrectly replaced the pfn with the physical address when calling
+vmf_insert_mixed(). Instead the phys_to_pfn_t() call should have been
+replaced with PHYS_PFN().
+
+Found by inspection after a similar issue was noted in fuse virtio_fs.
+
+Link: https://lkml.kernel.org/r/20250923005333.3165032-1-apopple@nvidia.com
+Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality")
+Signed-off-by: Alistair Popple <apopple@nvidia.com>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Cc: Haiyue Wang <haiyuewa@163.com>
+Cc: Nicolas Pitre <nico@fluxnic.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cramfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index b002e9b734f99..56c8005b24a34 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -412,7 +412,7 @@ static int cramfs_physmem_mmap(struct file *file, struct vm_area_struct *vma)
+ vm_fault_t vmf;
+ unsigned long off = i * PAGE_SIZE;
+ vmf = vmf_insert_mixed(vma, vma->vm_start + off,
+- address + off);
++ PHYS_PFN(address + off));
+ if (vmf & VM_FAULT_ERROR)
+ ret = vm_fault_to_errno(vmf, 0);
+ }
+--
+2.51.0
+
--- /dev/null
+From c3ba96a697e5ff3cd4bf98c04190f6ce4e59c1f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:12:43 -0600
+Subject: crypto: comp - Use same definition of context alloc and free ops
+
+From: Dan Moulding <dan@danm.net>
+
+[ Upstream commit f75f66683ded09f7135aef2e763c245a07c8271a ]
+
+In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation
+code into acomp"), the crypto_acomp_streams struct was made to rely on
+having the alloc_ctx and free_ctx operations defined in the same order
+as the scomp_alg struct. But in that same commit, the alloc_ctx and
+free_ctx members of scomp_alg may be randomized by structure layout
+randomization, since they are contained in a pure ops structure
+(containing only function pointers). If the pointers within scomp_alg
+are randomized, but those in crypto_acomp_streams are not, then
+the order may no longer match. This fixes the problem by removing the
+union from scomp_alg so that both crypto_acomp_streams and scomp_alg
+will share the same definition of alloc_ctx and free_ctx, ensuring
+they will always have the same layout.
+
+Signed-off-by: Dan Moulding <dan@danm.net>
+Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
+Fixes: 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/842.c | 6 ++++--
+ crypto/lz4.c | 6 ++++--
+ crypto/lz4hc.c | 6 ++++--
+ crypto/lzo-rle.c | 6 ++++--
+ crypto/lzo.c | 6 ++++--
+ drivers/crypto/nx/nx-common-powernv.c | 6 ++++--
+ drivers/crypto/nx/nx-common-pseries.c | 6 ++++--
+ include/crypto/internal/scompress.h | 11 +----------
+ 8 files changed, 29 insertions(+), 24 deletions(-)
+
+diff --git a/crypto/842.c b/crypto/842.c
+index 8c257c40e2b90..4007e87bed806 100644
+--- a/crypto/842.c
++++ b/crypto/842.c
+@@ -54,8 +54,10 @@ static int crypto842_sdecompress(struct crypto_scomp *tfm,
+ }
+
+ static struct scomp_alg scomp = {
+- .alloc_ctx = crypto842_alloc_ctx,
+- .free_ctx = crypto842_free_ctx,
++ .streams = {
++ .alloc_ctx = crypto842_alloc_ctx,
++ .free_ctx = crypto842_free_ctx,
++ },
+ .compress = crypto842_scompress,
+ .decompress = crypto842_sdecompress,
+ .base = {
+diff --git a/crypto/lz4.c b/crypto/lz4.c
+index 7a984ae5ae52e..57b713516aefa 100644
+--- a/crypto/lz4.c
++++ b/crypto/lz4.c
+@@ -68,8 +68,10 @@ static int lz4_sdecompress(struct crypto_scomp *tfm, const u8 *src,
+ }
+
+ static struct scomp_alg scomp = {
+- .alloc_ctx = lz4_alloc_ctx,
+- .free_ctx = lz4_free_ctx,
++ .streams = {
++ .alloc_ctx = lz4_alloc_ctx,
++ .free_ctx = lz4_free_ctx,
++ },
+ .compress = lz4_scompress,
+ .decompress = lz4_sdecompress,
+ .base = {
+diff --git a/crypto/lz4hc.c b/crypto/lz4hc.c
+index 9c61d05b62142..bb84f8a68cb58 100644
+--- a/crypto/lz4hc.c
++++ b/crypto/lz4hc.c
+@@ -66,8 +66,10 @@ static int lz4hc_sdecompress(struct crypto_scomp *tfm, const u8 *src,
+ }
+
+ static struct scomp_alg scomp = {
+- .alloc_ctx = lz4hc_alloc_ctx,
+- .free_ctx = lz4hc_free_ctx,
++ .streams = {
++ .alloc_ctx = lz4hc_alloc_ctx,
++ .free_ctx = lz4hc_free_ctx,
++ },
+ .compress = lz4hc_scompress,
+ .decompress = lz4hc_sdecompress,
+ .base = {
+diff --git a/crypto/lzo-rle.c b/crypto/lzo-rle.c
+index ba013f2d5090d..794e7ec49536b 100644
+--- a/crypto/lzo-rle.c
++++ b/crypto/lzo-rle.c
+@@ -70,8 +70,10 @@ static int lzorle_sdecompress(struct crypto_scomp *tfm, const u8 *src,
+ }
+
+ static struct scomp_alg scomp = {
+- .alloc_ctx = lzorle_alloc_ctx,
+- .free_ctx = lzorle_free_ctx,
++ .streams = {
++ .alloc_ctx = lzorle_alloc_ctx,
++ .free_ctx = lzorle_free_ctx,
++ },
+ .compress = lzorle_scompress,
+ .decompress = lzorle_sdecompress,
+ .base = {
+diff --git a/crypto/lzo.c b/crypto/lzo.c
+index 7867e2c67c4ed..d43242b24b4e8 100644
+--- a/crypto/lzo.c
++++ b/crypto/lzo.c
+@@ -70,8 +70,10 @@ static int lzo_sdecompress(struct crypto_scomp *tfm, const u8 *src,
+ }
+
+ static struct scomp_alg scomp = {
+- .alloc_ctx = lzo_alloc_ctx,
+- .free_ctx = lzo_free_ctx,
++ .streams = {
++ .alloc_ctx = lzo_alloc_ctx,
++ .free_ctx = lzo_free_ctx,
++ },
+ .compress = lzo_scompress,
+ .decompress = lzo_sdecompress,
+ .base = {
+diff --git a/drivers/crypto/nx/nx-common-powernv.c b/drivers/crypto/nx/nx-common-powernv.c
+index fd0a98b2fb1b2..0493041ea0885 100644
+--- a/drivers/crypto/nx/nx-common-powernv.c
++++ b/drivers/crypto/nx/nx-common-powernv.c
+@@ -1043,8 +1043,10 @@ static struct scomp_alg nx842_powernv_alg = {
+ .base.cra_priority = 300,
+ .base.cra_module = THIS_MODULE,
+
+- .alloc_ctx = nx842_powernv_crypto_alloc_ctx,
+- .free_ctx = nx842_crypto_free_ctx,
++ .streams = {
++ .alloc_ctx = nx842_powernv_crypto_alloc_ctx,
++ .free_ctx = nx842_crypto_free_ctx,
++ },
+ .compress = nx842_crypto_compress,
+ .decompress = nx842_crypto_decompress,
+ };
+diff --git a/drivers/crypto/nx/nx-common-pseries.c b/drivers/crypto/nx/nx-common-pseries.c
+index f528e072494a2..fc0222ebe8072 100644
+--- a/drivers/crypto/nx/nx-common-pseries.c
++++ b/drivers/crypto/nx/nx-common-pseries.c
+@@ -1020,8 +1020,10 @@ static struct scomp_alg nx842_pseries_alg = {
+ .base.cra_priority = 300,
+ .base.cra_module = THIS_MODULE,
+
+- .alloc_ctx = nx842_pseries_crypto_alloc_ctx,
+- .free_ctx = nx842_crypto_free_ctx,
++ .streams = {
++ .alloc_ctx = nx842_pseries_crypto_alloc_ctx,
++ .free_ctx = nx842_crypto_free_ctx,
++ },
+ .compress = nx842_crypto_compress,
+ .decompress = nx842_crypto_decompress,
+ };
+diff --git a/include/crypto/internal/scompress.h b/include/crypto/internal/scompress.h
+index 533d6c16a4914..6a2c5f2e90f95 100644
+--- a/include/crypto/internal/scompress.h
++++ b/include/crypto/internal/scompress.h
+@@ -18,11 +18,8 @@ struct crypto_scomp {
+ /**
+ * struct scomp_alg - synchronous compression algorithm
+ *
+- * @alloc_ctx: Function allocates algorithm specific context
+- * @free_ctx: Function frees context allocated with alloc_ctx
+ * @compress: Function performs a compress operation
+ * @decompress: Function performs a de-compress operation
+- * @base: Common crypto API algorithm data structure
+ * @streams: Per-cpu memory for algorithm
+ * @calg: Cmonn algorithm data structure shared with acomp
+ */
+@@ -34,13 +31,7 @@ struct scomp_alg {
+ unsigned int slen, u8 *dst, unsigned int *dlen,
+ void *ctx);
+
+- union {
+- struct {
+- void *(*alloc_ctx)(void);
+- void (*free_ctx)(void *ctx);
+- };
+- struct crypto_acomp_streams streams;
+- };
++ struct crypto_acomp_streams streams;
+
+ union {
+ struct COMP_ALG_COMMON;
+--
+2.51.0
+
--- /dev/null
+From 7b0f8828fc251dba636017c5e97594ed224b7fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:06 +0800
+Subject: crypto: hisilicon - check the sva module status while enabling or
+ disabling address prefetch
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 1f9128f121a872f27251be60ccccfd98c136d72e ]
+
+After enabling address prefetch, check the sva module status. If all
+previous prefetch requests from the sva module are not completed, then
+disable the address prefetch to ensure normal execution of new task
+operations. After disabling address prefetch, check if all requests
+from the sva module have been completed.
+
+Fixes: a5c164b195a8 ("crypto: hisilicon/qm - support address prefetching")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 63 ++++++++++++++----
+ drivers/crypto/hisilicon/sec2/sec_main.c | 48 +++++++++++++-
+ drivers/crypto/hisilicon/zip/zip_main.c | 79 +++++++++++++++++++----
+ 3 files changed, 164 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 34f84978180f0..7b60e89015bdf 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -78,6 +78,11 @@
+ #define HPRE_PREFETCH_ENABLE (~(BIT(0) | BIT(30)))
+ #define HPRE_PREFETCH_DISABLE BIT(30)
+ #define HPRE_SVA_DISABLE_READY (BIT(4) | BIT(8))
++#define HPRE_SVA_PREFTCH_DFX4 0x301144
++#define HPRE_WAIT_SVA_READY 500000
++#define HPRE_READ_SVA_STATUS_TIMES 3
++#define HPRE_WAIT_US_MIN 10
++#define HPRE_WAIT_US_MAX 20
+
+ /* clock gate */
+ #define HPRE_CLKGATE_CTL 0x301a10
+@@ -466,6 +471,33 @@ struct hisi_qp *hpre_create_qp(u8 type)
+ return NULL;
+ }
+
++static int hpre_wait_sva_ready(struct hisi_qm *qm)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + HPRE_SVA_PREFTCH_DFX4);
++ if (val)
++ count = 0;
++ else if (++count == HPRE_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(HPRE_WAIT_US_MIN, HPRE_WAIT_US_MAX);
++ } while (++try_times < HPRE_WAIT_SVA_READY);
++
++ if (try_times == HPRE_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static void hpre_config_pasid(struct hisi_qm *qm)
+ {
+ u32 val1, val2;
+@@ -563,7 +595,7 @@ static void disable_flr_of_bme(struct hisi_qm *qm)
+ writel(PEH_AXUSER_CFG_ENABLE, qm->io_base + QM_PEH_AXUSER_CFG_ENABLE);
+ }
+
+-static void hpre_open_sva_prefetch(struct hisi_qm *qm)
++static void hpre_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -571,20 +603,21 @@ static void hpre_open_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+- /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
+- val &= HPRE_PREFETCH_ENABLE;
++ val |= HPRE_PREFETCH_DISABLE;
+ writel(val, qm->io_base + HPRE_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
+- val, !(val & HPRE_PREFETCH_DISABLE),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
++ val, !(val & HPRE_SVA_DISABLE_READY),
+ HPRE_REG_RD_INTVRL_US,
+ HPRE_REG_RD_TMOUT_US);
+ if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)hpre_wait_sva_ready(qm);
+ }
+
+-static void hpre_close_sva_prefetch(struct hisi_qm *qm)
++static void hpre_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -592,16 +625,24 @@ static void hpre_close_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
++ /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HPRE_PREFETCH_CFG);
+- val |= HPRE_PREFETCH_DISABLE;
++ val &= HPRE_PREFETCH_ENABLE;
+ writel(val, qm->io_base + HPRE_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_SVA_PREFTCH_DFX,
+- val, !(val & HPRE_SVA_DISABLE_READY),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HPRE_PREFETCH_CFG,
++ val, !(val & HPRE_PREFETCH_DISABLE),
+ HPRE_REG_RD_INTVRL_US,
+ HPRE_REG_RD_TMOUT_US);
++ if (ret) {
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ hpre_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = hpre_wait_sva_ready(qm);
+ if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ hpre_close_sva_prefetch(qm);
+ }
+
+ static void hpre_enable_clock_gate(struct hisi_qm *qm)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index ddb20f380b546..348f1f52956dc 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -93,6 +93,16 @@
+ #define SEC_PREFETCH_ENABLE (~(BIT(0) | BIT(1) | BIT(11)))
+ #define SEC_PREFETCH_DISABLE BIT(1)
+ #define SEC_SVA_DISABLE_READY (BIT(7) | BIT(11))
++#define SEC_SVA_PREFETCH_INFO 0x301ED4
++#define SEC_SVA_STALL_NUM GENMASK(23, 8)
++#define SEC_SVA_PREFETCH_NUM GENMASK(2, 0)
++#define SEC_WAIT_SVA_READY 500000
++#define SEC_READ_SVA_STATUS_TIMES 3
++#define SEC_WAIT_US_MIN 10
++#define SEC_WAIT_US_MAX 20
++#define SEC_WAIT_QP_US_MIN 1000
++#define SEC_WAIT_QP_US_MAX 2000
++#define SEC_MAX_WAIT_TIMES 2000
+
+ #define SEC_DELAY_10_US 10
+ #define SEC_POLL_TIMEOUT_US 1000
+@@ -464,6 +474,33 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static int sec_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + offset);
++ if (val & mask)
++ count = 0;
++ else if (++count == SEC_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(SEC_WAIT_US_MIN, SEC_WAIT_US_MAX);
++ } while (++try_times < SEC_WAIT_SVA_READY);
++
++ if (try_times == SEC_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static void sec_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+@@ -481,6 +518,8 @@ static void sec_close_sva_prefetch(struct hisi_qm *qm)
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+ if (ret)
+ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)sec_wait_sva_ready(qm, SEC_SVA_PREFETCH_INFO, SEC_SVA_STALL_NUM);
+ }
+
+ static void sec_open_sva_prefetch(struct hisi_qm *qm)
+@@ -499,8 +538,15 @@ static void sec_open_sva_prefetch(struct hisi_qm *qm)
+ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+ val, !(val & SEC_PREFETCH_DISABLE),
+ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
++ if (ret) {
+ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ sec_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = sec_wait_sva_ready(qm, SEC_SVA_TRANS, SEC_SVA_PREFETCH_NUM);
++ if (ret)
++ sec_close_sva_prefetch(qm);
+ }
+
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 480fa590664a8..341c4564e21aa 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -95,10 +95,16 @@
+ #define HZIP_PREFETCH_ENABLE (~(BIT(26) | BIT(17) | BIT(0)))
+ #define HZIP_SVA_PREFETCH_DISABLE BIT(26)
+ #define HZIP_SVA_DISABLE_READY (BIT(26) | BIT(30))
++#define HZIP_SVA_PREFETCH_NUM GENMASK(18, 16)
++#define HZIP_SVA_STALL_NUM GENMASK(15, 0)
+ #define HZIP_SHAPER_RATE_COMPRESS 750
+ #define HZIP_SHAPER_RATE_DECOMPRESS 140
+-#define HZIP_DELAY_1_US 1
+-#define HZIP_POLL_TIMEOUT_US 1000
++#define HZIP_DELAY_1_US 1
++#define HZIP_POLL_TIMEOUT_US 1000
++#define HZIP_WAIT_SVA_READY 500000
++#define HZIP_READ_SVA_STATUS_TIMES 3
++#define HZIP_WAIT_US_MIN 10
++#define HZIP_WAIT_US_MAX 20
+
+ /* clock gating */
+ #define HZIP_PEH_CFG_AUTO_GATE 0x3011A8
+@@ -462,7 +468,34 @@ static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ }
+
+-static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
++static int hisi_zip_wait_sva_ready(struct hisi_qm *qm, __u32 offset, __u32 mask)
++{
++ u32 val, try_times = 0;
++ u8 count = 0;
++
++ /*
++ * Read the register value every 10-20us. If the value is 0 for three
++ * consecutive times, the SVA module is ready.
++ */
++ do {
++ val = readl(qm->io_base + offset);
++ if (val & mask)
++ count = 0;
++ else if (++count == HZIP_READ_SVA_STATUS_TIMES)
++ break;
++
++ usleep_range(HZIP_WAIT_US_MIN, HZIP_WAIT_US_MAX);
++ } while (++try_times < HZIP_WAIT_SVA_READY);
++
++ if (try_times == HZIP_WAIT_SVA_READY) {
++ pci_err(qm->pdev, "failed to wait sva prefetch ready\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
++static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -470,19 +503,20 @@ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
+- /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
+- val &= HZIP_PREFETCH_ENABLE;
++ val |= HZIP_SVA_PREFETCH_DISABLE;
+ writel(val, qm->io_base + HZIP_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
+- val, !(val & HZIP_SVA_PREFETCH_DISABLE),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
++ val, !(val & HZIP_SVA_DISABLE_READY),
+ HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
+ if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++
++ (void)hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_STALL_NUM);
+ }
+
+-static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
++static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ u32 val;
+ int ret;
+@@ -490,15 +524,23 @@ static void hisi_zip_close_sva_prefetch(struct hisi_qm *qm)
+ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+ return;
+
++ /* Enable prefetch */
+ val = readl_relaxed(qm->io_base + HZIP_PREFETCH_CFG);
+- val |= HZIP_SVA_PREFETCH_DISABLE;
++ val &= HZIP_PREFETCH_ENABLE;
+ writel(val, qm->io_base + HZIP_PREFETCH_CFG);
+
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_SVA_TRANS,
+- val, !(val & HZIP_SVA_DISABLE_READY),
++ ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_PREFETCH_CFG,
++ val, !(val & HZIP_SVA_PREFETCH_DISABLE),
+ HZIP_DELAY_1_US, HZIP_POLL_TIMEOUT_US);
++ if (ret) {
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++ hisi_zip_close_sva_prefetch(qm);
++ return;
++ }
++
++ ret = hisi_zip_wait_sva_ready(qm, HZIP_SVA_TRANS, HZIP_SVA_PREFETCH_NUM);
+ if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ hisi_zip_close_sva_prefetch(qm);
+ }
+
+ static void hisi_zip_enable_clock_gate(struct hisi_qm *qm)
+@@ -522,6 +564,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ void __iomem *base = qm->io_base;
+ u32 dcomp_bm, comp_bm;
+ u32 zip_core_en;
++ int ret;
+
+ /* qm user domain */
+ writel(AXUSER_BASE, base + QM_ARUSER_M_CFG_1);
+@@ -576,7 +619,15 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+- return hisi_dae_set_user_domain(qm);
++ ret = hisi_dae_set_user_domain(qm);
++ if (ret)
++ goto close_sva_prefetch;
++
++ return 0;
++
++close_sva_prefetch:
++ hisi_zip_close_sva_prefetch(qm);
++ return ret;
+ }
+
+ static void hisi_zip_master_ooo_ctrl(struct hisi_qm *qm, bool enable)
+--
+2.51.0
+
--- /dev/null
+From 07ac31c2cfece203d76ab0f7d7d1cc154b6f61c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:07 +0800
+Subject: crypto: hisilicon/qm - check whether the input function and PF are on
+ the same device
+
+From: Zhushuai Yin <yinzhushuai@huawei.com>
+
+[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
+
+Function rate limiting is set through physical function driver.
+Users configure by providing function information and rate limit values.
+Before configuration, it is necessary to check whether the
+provided function and PF belong to the same device.
+
+Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
+Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index a5cc0ccd94f1f..2f96c673b60a5 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3826,6 +3826,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
+ }
+
+ pdev = container_of(dev, struct pci_dev, dev);
++ if (pci_physfn(pdev) != qm->pdev) {
++ pci_err(qm->pdev, "the pdev input does not match the pf!\n");
++ return -EINVAL;
++ }
+
+ *fun_index = pdev->devfn;
+
+--
+2.51.0
+
--- /dev/null
+From 5a83a18e6426f291e20096bb1d7a929300c82cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:08 +0800
+Subject: crypto: hisilicon/qm - request reserved interrupt for virtual
+ function
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 9228facb308157ac0bdd264b873187896f7a9c7a ]
+
+The device interrupt vector 3 is an error interrupt for
+physical function and a reserved interrupt for virtual function.
+However, the driver has not registered the reserved interrupt for
+virtual function. When allocating interrupts, the number of interrupts
+is allocated based on powers of two, which includes this interrupt.
+When the system enables GICv4 and the virtual function passthrough
+to the virtual machine, releasing the interrupt in the driver
+triggers a warning.
+
+The WARNING report is:
+WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4
+
+Therefore, register a reserved interrupt for VF and set the
+IRQF_NO_AUTOEN flag to avoid that warning.
+
+Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 38 +++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 2f96c673b60a5..102aff9ea19a0 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4732,6 +4732,15 @@ void hisi_qm_reset_done(struct pci_dev *pdev)
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_reset_done);
+
++static irqreturn_t qm_rsvd_irq(int irq, void *data)
++{
++ struct hisi_qm *qm = data;
++
++ dev_info(&qm->pdev->dev, "Reserved interrupt, ignore!\n");
++
++ return IRQ_HANDLED;
++}
++
+ static irqreturn_t qm_abnormal_irq(int irq, void *data)
+ {
+ struct hisi_qm *qm = data;
+@@ -5015,7 +5024,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
+ struct pci_dev *pdev = qm->pdev;
+ u32 irq_vector, val;
+
+- if (qm->fun_type == QM_HW_VF)
++ if (qm->fun_type == QM_HW_VF && qm->ver < QM_HW_V3)
+ return;
+
+ val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
+@@ -5032,17 +5041,28 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
+ u32 irq_vector, val;
+ int ret;
+
+- if (qm->fun_type == QM_HW_VF)
+- return 0;
+-
+ val = qm->cap_tables.qm_cap_table[QM_ABNORMAL_IRQ].cap_val;
+ if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ return 0;
+-
+ irq_vector = val & QM_IRQ_VECTOR_MASK;
++
++ /* For VF, this is a reserved interrupt in V3 version. */
++ if (qm->fun_type == QM_HW_VF) {
++ if (qm->ver < QM_HW_V3)
++ return 0;
++
++ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_rsvd_irq,
++ IRQF_NO_AUTOEN, qm->dev_name, qm);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to request reserved irq, ret = %d!\n", ret);
++ return ret;
++ }
++ return 0;
++ }
++
+ ret = request_irq(pci_irq_vector(pdev, irq_vector), qm_abnormal_irq, 0, qm->dev_name, qm);
+ if (ret)
+- dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d", ret);
++ dev_err(&qm->pdev->dev, "failed to request abnormal irq, ret = %d!\n", ret);
+
+ return ret;
+ }
+@@ -5408,6 +5428,12 @@ static int hisi_qm_pci_init(struct hisi_qm *qm)
+ pci_set_master(pdev);
+
+ num_vec = qm_get_irq_num(qm);
++ if (!num_vec) {
++ dev_err(dev, "Device irq num is zero!\n");
++ ret = -EINVAL;
++ goto err_get_pci_res;
++ }
++ num_vec = roundup_pow_of_two(num_vec);
+ ret = pci_alloc_irq_vectors(pdev, num_vec, num_vec, PCI_IRQ_MSI);
+ if (ret < 0) {
+ dev_err(dev, "Failed to enable MSI vectors!\n");
+--
+2.51.0
+
--- /dev/null
+From d1db9e9b19916c13a3075e15eec94dd3d4cace58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:54 +0800
+Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
+
+When the initialization of qm->debug.acc_diff_reg fails,
+the probe process does not exit. However, after qm->debug.qm_diff_regs is
+freed, it is not set to NULL. This can lead to a double free when the
+remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
+should be set to NULL after it is freed.
+
+Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+index 45e130b901eb5..17eb236e9ee4d 100644
+--- a/drivers/crypto/hisilicon/debugfs.c
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
+ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ ret = PTR_ERR(qm->debug.acc_diff_regs);
+ qm->debug.acc_diff_regs = NULL;
++ qm->debug.qm_diff_regs = NULL;
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e33392536f0008c2e25e1697add3eece592137c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:05 +0800
+Subject: crypto: hisilicon - re-enable address prefetch after device resuming
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
+
+When the device resumes from a suspended state, it will revert to its
+initial state and requires re-enabling. Currently, the address prefetch
+function is not re-enabled after device resuming. Move the address prefetch
+enable to the initialization process. In this way, the address prefetch
+can be enabled when the device resumes by calling the initialization
+process.
+
+Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
+ drivers/crypto/hisilicon/qm.c | 3 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
+ 4 files changed, 43 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index f5b47e5ff48a4..34f84978180f0 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -721,6 +721,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+
+ /* Config data buffer pasid needed by Kunpeng 920 */
+ hpre_config_pasid(qm);
++ hpre_open_sva_prefetch(qm);
+
+ hpre_enable_clock_gate(qm);
+
+@@ -1450,8 +1451,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ if (ret)
+ return ret;
+
+- hpre_open_sva_prefetch(qm);
+-
+ hisi_qm_dev_err_init(qm);
+ ret = hpre_show_last_regs_init(qm);
+ if (ret)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 2e4ee7ecfdfbb..a5cc0ccd94f1f 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4447,9 +4447,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
+ {
+ u32 value;
+
+- if (qm->err_ini->open_sva_prefetch)
+- qm->err_ini->open_sva_prefetch(qm);
+-
+ if (qm->ver >= QM_HW_V3)
+ return;
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 72cf48d1f3ab8..ddb20f380b546 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -464,6 +464,45 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static void sec_close_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val |= SEC_PREFETCH_DISABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
++ val, !(val & SEC_SVA_DISABLE_READY),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++}
++
++static void sec_open_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ /* Enable prefetch */
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val &= SEC_PREFETCH_ENABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
++ val, !(val & SEC_PREFETCH_DISABLE),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++}
++
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+ {
+ u32 reg;
+@@ -497,45 +536,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base +
+ SEC_INTERFACE_USER_CTRL1_REG);
+ }
+-}
+-
+-static void sec_open_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- /* Enable prefetch */
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val &= SEC_PREFETCH_ENABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+- val, !(val & SEC_PREFETCH_DISABLE),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
+-}
+-
+-static void sec_close_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val |= SEC_PREFETCH_DISABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+- val, !(val & SEC_SVA_DISABLE_READY),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ sec_open_sva_prefetch(qm);
+ }
+
+ static void sec_enable_clock_gate(struct hisi_qm *qm)
+@@ -1152,7 +1153,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ if (ret)
+ return ret;
+
+- sec_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ sec_debug_regs_clear(qm);
+ ret = sec_show_last_regs_init(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index fb7b19927dd32..480fa590664a8 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
+ writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
+ }
++ hisi_zip_open_sva_prefetch(qm);
+
+ /* let's open all compression/decompression cores */
+
+@@ -572,6 +573,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
+ FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+
++ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+ return hisi_dae_set_user_domain(qm);
+@@ -1243,9 +1245,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- hisi_zip_set_high_perf(qm);
+-
+- hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ hisi_zip_debug_regs_clear(qm);
+
+--
+2.51.0
+
--- /dev/null
+From f365f5fa510f2be67aff9dc638efe480d06feb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:04 +0800
+Subject: crypto: hisilicon/zip - remove unnecessary validation for
+ high-performance mode configurations
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
+
+When configuring the high-performance mode register, there is no
+need to verify whether the register has been successfully
+enabled, as there is no possibility of a write failure for this
+register.
+
+Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index d8ba23b7cc7dd..fb7b19927dd32 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -448,10 +448,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ return false;
+ }
+
+-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ {
+ u32 val;
+- int ret;
+
+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ if (perf_mode == HZIP_HIGH_COMP_PERF)
+@@ -461,13 +460,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+
+ /* Set perf mode */
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
+- val, val == perf_mode, HZIP_DELAY_1_US,
+- HZIP_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to set perf mode\n");
+-
+- return ret;
+ }
+
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+@@ -1251,9 +1243,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- ret = hisi_zip_set_high_perf(qm);
+- if (ret)
+- return ret;
++ hisi_zip_set_high_perf(qm);
+
+ hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+--
+2.51.0
+
--- /dev/null
+From f565753abaaf812c98f16182238cd280585ddf85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 14:03:30 +0200
+Subject: crypto: keembay - Add missing check after sg_nents_for_len()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
+
+sg_nents_for_len() returns an int which is negative in case of error.
+
+Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+index 8f9e21ced0fe1..48281d8822603 100644
+--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ struct device *dev = rctx->hcu_dev->dev;
+ unsigned int remainder = 0;
+ unsigned int total;
+- size_t nents;
++ int nents;
+ size_t count;
+ int rc;
+ int i;
+@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ /* Determine the number of scatter gather list entries to process. */
+ nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
+
++ if (nents < 0)
++ return nents;
++
+ /* If there are entries to process, map them. */
+ if (nents) {
+ rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
+--
+2.51.0
+
--- /dev/null
+From c6ddade15ea2f53e6a10117f668085f7fe7a9069 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:24:57 +0200
+Subject: crypto: octeontx2 - Call strscpy() with correct size argument
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]
+
+In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
+of the source string rather than the size of the destination buffer.
+
+This is fine as long as the destination buffer is larger than the source
+string, but we should still use the destination buffer size instead to
+call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
+we can safely omit the size argument and let strscpy() infer it using
+sizeof().
+
+Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+index cc47e361089a0..ebdf4efa09d4d 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+@@ -1615,7 +1615,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
+ return -EINVAL;
+ }
+ err_msg = "Invalid engine group format";
+- strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
++ strscpy(tmp_buf, ctx->val.vstr);
+ start = tmp_buf;
+
+ has_se = has_ie = has_ae = false;
+--
+2.51.0
+
--- /dev/null
+From e97124c6abeffc1caeb0d2be67548eead4be5f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 23:22:38 +0300
+Subject: dm vdo: return error on corrupted metadata in start_restoring_volume
+ functions
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]
+
+The return values of VDO_ASSERT calls that validate metadata are not acted
+upon.
+
+Return UDS_CORRUPT_DATA in case of an error.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Reviewed-by: Matthew Sakai <msakai@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
+index 12f954a0c5325..afb062e1f1fb4 100644
+--- a/drivers/md/dm-vdo/indexer/volume-index.c
++++ b/drivers/md/dm-vdo/indexer/volume-index.c
+@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
+ "%zu bytes decoded of %zu expected", offset,
+ sizeof(buffer));
+ if (result != VDO_SUCCESS)
+- result = UDS_CORRUPT_DATA;
++ return UDS_CORRUPT_DATA;
+
+ if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
+ return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
+--
+2.51.0
+
--- /dev/null
+From b63231b105d7b9525185872193ba61da60ce8a3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 11:07:38 -0500
+Subject: dmaengine: Fix dma_async_tx_descriptor->tx_submit documentation
+
+From: Nathan Lynch <nathan.lynch@amd.com>
+
+[ Upstream commit 7ea95d55e63176899eb96f7aaa34a5646f501b2c ]
+
+Commit 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc
+warnings") inserted new documentation for @desc_free in the middle of
+@tx_submit's description.
+
+Put @tx_submit's description back together, matching the indentation
+style of the rest of the documentation for dma_async_tx_descriptor.
+
+Fixes: 790fb9956eea ("linux/dmaengine.h: fix a few kernel-doc warnings")
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
+Link: https://lore.kernel.org/r/20250826-dma_async_tx_desc-tx_submit-doc-fix-v1-1-18a4b51697db@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dmaengine.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index 6de7c05d6bd8c..99efe2b9b4ea9 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -594,9 +594,9 @@ struct dma_descriptor_metadata_ops {
+ * @phys: physical address of the descriptor
+ * @chan: target channel for this operation
+ * @tx_submit: accept the descriptor, assign ordered cookie and mark the
++ * descriptor pending. To be pushed on .issue_pending() call
+ * @desc_free: driver's callback function to free a resusable descriptor
+ * after completion
+- * descriptor pending. To be pushed on .issue_pending() call
+ * @callback: routine to call after this operation is complete
+ * @callback_result: error result from a DMA transaction
+ * @callback_param: general parameter to pass to the callback routine
+--
+2.51.0
+
--- /dev/null
+From 351f3eae38b3d32e41c625470d9ab5ba890293fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 16:44:23 +0200
+Subject: docs: iio: ad3552r: Fix malformed code-block directive
+
+From: Jorge Marques <jorge.marques@analog.com>
+
+[ Upstream commit 788c57f4766bd5802af9918ea350053a91488c60 ]
+
+Missing required double dot and line break.
+
+Fixes: ede84c455659 ("docs: iio: add documentation for ad3552r driver")
+Signed-off-by: Jorge Marques <jorge.marques@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250818-docs-ad3552r-code-block-fix-v1-1-4430cbc26676@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/iio/ad3552r.rst | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/iio/ad3552r.rst b/Documentation/iio/ad3552r.rst
+index f5d59e4e86c7e..4274e35f503d9 100644
+--- a/Documentation/iio/ad3552r.rst
++++ b/Documentation/iio/ad3552r.rst
+@@ -64,7 +64,8 @@ specific debugfs path ``/sys/kernel/debug/iio/iio:deviceX``.
+ Usage examples
+ --------------
+
+-. code-block:: bash
++.. code-block:: bash
++
+ root:/sys/bus/iio/devices/iio:device0# cat data_source
+ normal
+ root:/sys/bus/iio/devices/iio:device0# echo -n ramp-16bit > data_source
+--
+2.51.0
+
--- /dev/null
+From 9db7b7d75d505e69bd6d0732f9201b5a3d439460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 5765eb3e9efa7..a30f4bed11b4e 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From f89d73219b082877b7f125af9b3cef02597ade11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 45d512939c408..67b01d5797377 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -887,7 +887,6 @@ int register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8c9e57e7a409013be623e6b9760fba2fa101ff0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 3399594136b2a..45d512939c408 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -885,6 +885,11 @@ int register_one_node(int nid)
+ node_devices[nid] = node;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From 9def92f835da7c8cfea68ce4c4d7fb2d19218ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 12:14:01 +0530
+Subject: drm/amd/display: Add NULL pointer checks in dc_stream cursor
+ attribute functions
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11 ]
+
+The function dc_stream_set_cursor_attributes() currently dereferences
+the `stream` pointer and nested members `stream->ctx->dc->current_state`
+without checking for NULL.
+
+All callers of these functions, such as in
+`dcn30_apply_idle_power_optimizations()` and
+`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
+before calling these functions.
+
+Fixes below:
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
+error: we previously assumed 'stream' could be null (see line 334)
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
+ 327 bool dc_stream_program_cursor_attributes(
+ 328 struct dc_stream_state *stream,
+ 329 const struct dc_cursor_attributes *attributes)
+ 330 {
+ 331 struct dc *dc;
+ 332 bool reset_idle_optimizations = false;
+ 333
+ 334 dc = stream ? stream->ctx->dc : NULL;
+ ^^^^^^
+The old code assumed stream could be NULL.
+
+ 335
+--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {
+ ^^^^^^
+The refactor added an unchecked dereference.
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
+ 313 bool dc_stream_set_cursor_attributes(
+ 314 struct dc_stream_state *stream,
+ 315 const struct dc_cursor_attributes *attributes)
+ 316 {
+ 317 bool result = false;
+ 318
+ 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
+This function used to check for if stream as NULL and return false at
+the start. Probably we should add that back.
+
+Fixes: 4465dd0e41e8 ("drm/amd/display: Refactor SubVP cursor limiting logic")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Alvin Lee <alvin.lee2@amd.com>
+Cc: Ray Wu <ray.wu@amd.com>
+Cc: Dillon Varone <dillon.varone@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: ChiaHsuan Chung <chiahsuan.chung@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Daniel Wheeler <daniel.wheeler@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Wenjing Liu <wenjing.liu@amd.com>
+Cc: Jun Lei <Jun.Lei@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Dillon Varone <Dillon.varone@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+index 4d6bc9fd4faa8..9ac2d41f8fcae 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -316,6 +316,9 @@ bool dc_stream_set_cursor_attributes(
+ {
+ bool result = false;
+
++ if (!stream)
++ return false;
++
+ if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
+ stream->cursor_attributes = *attributes;
+ result = true;
+@@ -331,7 +334,10 @@ bool dc_stream_program_cursor_attributes(
+ struct dc *dc;
+ bool reset_idle_optimizations = false;
+
+- dc = stream ? stream->ctx->dc : NULL;
++ if (!stream)
++ return false;
++
++ dc = stream->ctx->dc;
+
+ if (dc_stream_set_cursor_attributes(stream, attributes)) {
+ dc_z10_restore(dc);
+--
+2.51.0
+
--- /dev/null
+From 0c8246cdbe65a281290556f047e4ee5304e16a32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:02:18 +0530
+Subject: drm/amd/display: Reduce Stack Usage by moving 'audio_output' into
+ 'stream_res' v4
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 1cf1205ef2685cf43db3785706b017d1e54e0bec ]
+
+The function `dp_retrain_link_dp_test` currently allocates a large
+audio_output array on the stack, causing the stack frame size to exceed
+the compiler limit (1080 bytes > 1024 bytes).
+
+This change prevents stack overflow issues:
+amdgpu/../display/dc/link/accessories/link_dp_cts.c:65:13: warning: stack frame size (1080) exceeds limit (1024) in 'dp_retrain_link_dp_test' [-Wframe-larger-than]
+static void dp_retrain_link_dp_test(struct dc_link *link,
+
+v2: Move audio-related data like `audio_output` is kept "per pipe" to
+ manage the audio for that specific display pipeline/display output path
+ (stream). (Wenjing)
+
+v3: Update in all the places where `build_audio_output` is currently
+ called with a separate audio_output variable on the stack & wherever
+ `audio_output` is passed to other functions
+ `dce110_apply_single_controller_ctx_to_hw()` &
+ `dce110_setup_audio_dto()` (like `az_configure`, `wall_dto_setup`)
+ replace with usage of `pipe_ctx->stream_res.audio_output`
+ to centralize audio data per pipe.
+
+v4: Remove empty lines before `build_audio_output`. (Alex)
+
+Fixes: 9c6669c2e21a ("drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO")
+Cc: Wayne Lin <wayne.lin@amd.com>
+Cc: George Shen <george.shen@amd.com>
+Cc: Michael Strauss <michael.strauss@amd.com>
+Cc: Alvin Lee <Alvin.Lee2@amd.com>
+Cc: Ray Wu <ray.wu@amd.com>
+Cc: Wenjing Liu <wenjing.liu@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 32 ++++++++-----------
+ .../gpu/drm/amd/display/dc/inc/core_types.h | 5 +--
+ .../display/dc/link/accessories/link_dp_cts.c | 12 +++----
+ .../dc/resource/dcn31/dcn31_resource.c | 5 ++-
+ .../dc/resource/dcn31/dcn31_resource.h | 3 +-
+ 5 files changed, 26 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 4ea13d0bf815e..c69194e04ff93 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1600,19 +1600,17 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw(
+ }
+
+ if (pipe_ctx->stream_res.audio != NULL) {
+- struct audio_output audio_output = {0};
++ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
+
+- build_audio_output(context, pipe_ctx, &audio_output);
+-
+- link_hwss->setup_audio_output(pipe_ctx, &audio_output,
++ link_hwss->setup_audio_output(pipe_ctx, &pipe_ctx->stream_res.audio_output,
+ pipe_ctx->stream_res.audio->inst);
+
+ pipe_ctx->stream_res.audio->funcs->az_configure(
+ pipe_ctx->stream_res.audio,
+ pipe_ctx->stream->signal,
+- &audio_output.crtc_info,
++ &pipe_ctx->stream_res.audio_output.crtc_info,
+ &pipe_ctx->stream->audio_info,
+- &audio_output.dp_link_info);
++ &pipe_ctx->stream_res.audio_output.dp_link_info);
+
+ if (dc->config.disable_hbr_audio_dp2)
+ if (pipe_ctx->stream_res.audio->funcs->az_disable_hbr_audio &&
+@@ -2386,9 +2384,7 @@ static void dce110_setup_audio_dto(
+ if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A)
+ continue;
+ if (pipe_ctx->stream_res.audio != NULL) {
+- struct audio_output audio_output;
+-
+- build_audio_output(context, pipe_ctx, &audio_output);
++ build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
+
+ if (dc->res_pool->dccg && dc->res_pool->dccg->funcs->set_audio_dtbclk_dto) {
+ struct dtbclk_dto_params dto_params = {0};
+@@ -2399,14 +2395,14 @@ static void dce110_setup_audio_dto(
+ pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
+ pipe_ctx->stream_res.audio,
+ pipe_ctx->stream->signal,
+- &audio_output.crtc_info,
+- &audio_output.pll_info);
++ &pipe_ctx->stream_res.audio_output.crtc_info,
++ &pipe_ctx->stream_res.audio_output.pll_info);
+ } else
+ pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
+ pipe_ctx->stream_res.audio,
+ pipe_ctx->stream->signal,
+- &audio_output.crtc_info,
+- &audio_output.pll_info);
++ &pipe_ctx->stream_res.audio_output.crtc_info,
++ &pipe_ctx->stream_res.audio_output.pll_info);
+ break;
+ }
+ }
+@@ -2426,15 +2422,15 @@ static void dce110_setup_audio_dto(
+ continue;
+
+ if (pipe_ctx->stream_res.audio != NULL) {
+- struct audio_output audio_output = {0};
+-
+- build_audio_output(context, pipe_ctx, &audio_output);
++ build_audio_output(context,
++ pipe_ctx,
++ &pipe_ctx->stream_res.audio_output);
+
+ pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
+ pipe_ctx->stream_res.audio,
+ pipe_ctx->stream->signal,
+- &audio_output.crtc_info,
+- &audio_output.pll_info);
++ &pipe_ctx->stream_res.audio_output.crtc_info,
++ &pipe_ctx->stream_res.audio_output.pll_info);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+index f0d7185153b2a..f896cce87b8d4 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+@@ -228,8 +228,7 @@ struct resource_funcs {
+ enum dc_status (*update_dc_state_for_encoder_switch)(struct dc_link *link,
+ struct dc_link_settings *link_setting,
+ uint8_t pipe_count,
+- struct pipe_ctx *pipes,
+- struct audio_output *audio_output);
++ struct pipe_ctx *pipes);
+ };
+
+ struct audio_support{
+@@ -361,6 +360,8 @@ struct stream_resource {
+ uint8_t gsl_group;
+
+ struct test_pattern_params test_pattern_params;
++
++ struct audio_output audio_output;
+ };
+
+ struct plane_resource {
+diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+index 2956c2b3ad1aa..b12d61701d4d9 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
++++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+@@ -75,7 +75,6 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
+ bool is_hpo_acquired;
+ uint8_t count;
+ int i;
+- struct audio_output audio_output[MAX_PIPES];
+
+ needs_divider_update = (link->dc->link_srv->dp_get_encoding_format(link_setting) !=
+ link->dc->link_srv->dp_get_encoding_format((const struct dc_link_settings *) &link->cur_link_settings));
+@@ -99,7 +98,7 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
+ if (needs_divider_update && link->dc->res_pool->funcs->update_dc_state_for_encoder_switch) {
+ link->dc->res_pool->funcs->update_dc_state_for_encoder_switch(link,
+ link_setting, count,
+- *pipes, &audio_output[0]);
++ *pipes);
+ for (i = 0; i < count; i++) {
+ pipes[i]->clock_source->funcs->program_pix_clk(
+ pipes[i]->clock_source,
+@@ -111,15 +110,16 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
+ const struct link_hwss *link_hwss = get_link_hwss(
+ link, &pipes[i]->link_res);
+
+- link_hwss->setup_audio_output(pipes[i], &audio_output[i],
+- pipes[i]->stream_res.audio->inst);
++ link_hwss->setup_audio_output(pipes[i],
++ &pipes[i]->stream_res.audio_output,
++ pipes[i]->stream_res.audio->inst);
+
+ pipes[i]->stream_res.audio->funcs->az_configure(
+ pipes[i]->stream_res.audio,
+ pipes[i]->stream->signal,
+- &audio_output[i].crtc_info,
++ &pipes[i]->stream_res.audio_output.crtc_info,
+ &pipes[i]->stream->audio_info,
+- &audio_output[i].dp_link_info);
++ &pipes[i]->stream_res.audio_output.dp_link_info);
+
+ if (link->dc->config.disable_hbr_audio_dp2 &&
+ pipes[i]->stream_res.audio->funcs->az_disable_hbr_audio &&
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+index 3ed7f50554e21..ca17e5d8fdc2a 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+@@ -2239,8 +2239,7 @@ struct resource_pool *dcn31_create_resource_pool(
+ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
+ struct dc_link_settings *link_setting,
+ uint8_t pipe_count,
+- struct pipe_ctx *pipes,
+- struct audio_output *audio_output)
++ struct pipe_ctx *pipes)
+ {
+ struct dc_state *state = link->dc->current_state;
+ int i;
+@@ -2255,7 +2254,7 @@ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
+
+ // Setup audio
+ if (pipes[i].stream_res.audio != NULL)
+- build_audio_output(state, &pipes[i], &audio_output[i]);
++ build_audio_output(state, &pipes[i], &pipes[i].stream_res.audio_output);
+ }
+ #else
+ /* This DCN requires rate divider updates and audio reprogramming to allow DP1<-->DP2 link rate switching,
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
+index c32c85ef0ba47..7e8fde65528f1 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
+@@ -69,8 +69,7 @@ unsigned int dcn31_get_det_buffer_size(
+ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
+ struct dc_link_settings *link_setting,
+ uint8_t pipe_count,
+- struct pipe_ctx *pipes,
+- struct audio_output *audio_output);
++ struct pipe_ctx *pipes);
+
+ /*temp: B0 specific before switch to dcn313 headers*/
+ #ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL
+--
+2.51.0
+
--- /dev/null
+From e7c1176ea3a7cabcc9f1cd9b7407f85491caf171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:50:14 +0800
+Subject: drm/amd/display: Remove redundant semicolons
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
+
+Remove unnecessary semicolons.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 9ba6cb67655f4..6c75aa82327ac 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ if (dual_plane) {
+ unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
+ num_pipes, pipe_idx);
+- ;
+ if (src->sw_mode == dm_sw_linear)
+ ASSERT(p1_pte_row_height_linear >= 8);
+
+--
+2.51.0
+
--- /dev/null
+From 8311ae80cd5ea70aa337a148ee59038a0d38fa76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:07 +0200
+Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
+
+Based on some comments in dm_pp_display_configuration
+above the crtc_index and line_time fields, these values
+are programmed to the SMC to work around an SMC hang
+when it switches MCLK.
+
+According to Alex, the Windows driver programs them to:
+mclk_change_block_cp_min = 200 / line_time
+mclk_change_block_cp_max = 100 / line_time
+Let's use the same for the sake of consistency.
+
+Previously we used the watermark values, but it seemed buggy
+as the code was mixing up low/high and A/B watermarks, and
+was not saving a low watermark value on DCE 6, so
+mclk_change_block_cp_max would be always zero previously.
+
+Split this change off from the previous si_upload_smc_data
+to make it easier to bisect, in case it causes any issues.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 6736c592dfdc6..fb008c5980d67 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5833,8 +5833,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ crtc_index = amdgpu_crtc->crtc_id;
+
+ if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6fe3b62b4130ee8bd556df7e0bfbfbbd95ef9c79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:09 +0200
+Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
+
+According to pp_pm_compute_clocks the non-DC display code
+has "issues with mclk switching with refresh rates over 120 hz".
+The workaround is to disable MCLK switching in this case.
+
+Do the same for legacy DPM.
+
+Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 42efe838fa85c..2d2d2d5e67634 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ (amdgpu_crtc->v_border * 2));
+
+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* we have issues with mclk switching with
++ * refresh rates over 120 hz on the non-DC code.
++ */
++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
++ vblank_time_us = 0;
++
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 27c780ca8b8a4aea58860c954c8c3fbc6babe822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:10 +0200
+Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
+ (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
+
+Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
+switching on Oland when two 4K 60Hz monitors are connected")
+
+This is an ad-hoc DPM fix, necessary because we don't have
+proper bandwidth calculation for DCE 6.
+
+We define "high pixelclock" for SI as higher than necessary
+for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
+this category.
+
+When two high pixel clock displays are connected to Oland,
+additionally disable shader clock switching, which results in
+a higher voltage, thereby addressing some visible flickering.
+
+v2:
+Add more comments.
+v3:
+Split into two commits for easier review.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index c11c4cc111df5..4236700fc1ad1 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3449,12 +3449,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ {
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
++ struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+ u16 vddc, vddci, min_vce_voltage = 0;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+ u32 max_sclk = 0, max_mclk = 0;
++ u32 high_pixelclock_count = 0;
+ int i;
+
+ if (adev->asic_type == CHIP_HAINAN) {
+@@ -3482,6 +3484,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ }
+ }
+
++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
++ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
++ * Find number of such displays connected.
++ */
++ for (i = 0; i < adev->mode_info.num_crtc; i++) {
++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
++ !adev->mode_info.crtcs[i]->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
++
++ if (conn->pixelclock_for_modeset > 297000)
++ high_pixelclock_count++;
++ }
++
++ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
++ * They are necessary because we don't have something like dce_calcs
++ * for these GPUs to calculate bandwidth requirements.
++ */
++ if (high_pixelclock_count) {
++ /* On Oland, we observe some flickering when two 4K 60Hz
++ * displays are connected, possibly because voltage is too low.
++ * Raise the voltage by requiring a higher SCLK.
++ * (Voltage cannot be adjusted independently without also SCLK.)
++ */
++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
++ disable_sclk_switching = true;
++ }
++
+ if (rps->vce_active) {
+ rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
+ rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
+--
+2.51.0
+
--- /dev/null
+From 93c5e796d35c532ed159cba3e8773b09a48b5bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:04 +0200
+Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
+
+Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
+is unsupported, to make sure it is properly turned off.
+
+v3:
+Simplify si_disable_ulv further.
+Always check the return value of amdgpu_si_send_msg_to_smc.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 52e732be59e36..e71070a23b915 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5637,14 +5637,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
+
+ static int si_disable_ulv(struct amdgpu_device *adev)
+ {
+- struct si_power_info *si_pi = si_get_pi(adev);
+- struct si_ulv_param *ulv = &si_pi->ulv;
++ PPSMC_Result r;
+
+- if (ulv->supported)
+- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
+- 0 : -EINVAL;
+-
+- return 0;
++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
+ }
+
+ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+--
+2.51.0
+
--- /dev/null
+From f1c71135d38990efecc3e5a9b29c05c7ebe0783a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:06 +0200
+Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
+
+The si_upload_smc_data function uses si_write_smc_soft_register
+to set some register values in the SMC, and expects the result
+to be PPSMC_Result_OK which is 1.
+
+The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
+checking the result of a command sent to the SMC.
+However, the si_write_smc_soft_register actually doesn't send
+any commands to the SMC and returns zero on success,
+so this check was incorrect.
+
+Fix that by not checking the return value, just like other
+calls to si_write_smc_soft_register.
+
+v3:
+Additionally, when no display is plugged in, there is no need
+to restrict MCLK switching, so program the registers to zero.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index e71070a23b915..6736c592dfdc6 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5813,9 +5813,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+ struct amdgpu_crtc *amdgpu_crtc = NULL;
+ int i;
+-
+- if (adev->pm.dpm.new_active_crtc_count == 0)
+- return 0;
++ u32 crtc_index = 0;
++ u32 mclk_change_block_cp_min = 0;
++ u32 mclk_change_block_cp_max = 0;
+
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+@@ -5824,26 +5824,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ }
+ }
+
+- if (amdgpu_crtc == NULL)
+- return 0;
++ /* When a display is plugged in, program these so that the SMC
++ * performs MCLK switching when it doesn't cause flickering.
++ * When no display is plugged in, there is no need to restrict
++ * MCLK switching, so program them to zero.
++ */
++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
++ crtc_index = amdgpu_crtc->crtc_id;
+
+- if (amdgpu_crtc->line_time <= 0)
+- return 0;
++ if (amdgpu_crtc->line_time) {
++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ }
++ }
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_crtc_index,
+- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_crtc_index,
++ crtc_index);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
++ mclk_change_block_cp_min);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
++ mclk_change_block_cp_max);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From b6afb4db4582d325de784bb1b4a47c3da680ca4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:08 +0200
+Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
+
+Some parts of the code base expect that MCLK switching is turned
+off when the vblank time is set to zero.
+
+According to pp_pm_compute_clocks the non-DC code has issues
+with MCLK switching with refresh rates over 120 Hz.
+
+v3:
+Add code comment to explain this better.
+Add an if statement instead of changing the switch_limit.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index fb008c5980d67..c11c4cc111df5 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3085,7 +3085,13 @@ static bool si_dpm_vblank_too_short(void *handle)
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+- if (vblank_time < switch_limit)
++ /* Consider zero vblank time too short and disable MCLK switching.
++ * Note that the vblank time is set to maximum when no displays are attached,
++ * so we'll still enable MCLK switching in that case.
++ */
++ if (vblank_time == 0)
++ return true;
++ else if (vblank_time < switch_limit)
+ return true;
+ else
+ return false;
+--
+2.51.0
+
--- /dev/null
+From bbd90d289cc3b4b8e3c0bfe4f19fa3278b4fbd67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 13:52:50 +0530
+Subject: drm/amdgpu: Check vcn state before profile switch
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 9c0442286f84a5036958b3d8eb00bf0bb070dbd1 ]
+
+The patch uses power state of VCN instances for requesting video
+profile.
+
+In idle worker of a vcn instance, when there is no outstanding
+submisssion or fence, the instance is put to power gated state. When
+all instances are powered off that means video profile is no longer
+required. A request is made to turn off video profile.
+
+A job submission starts with begin_use of ring, and at that time
+vcn instance state is changed to power on. Subsequently a check is
+made for active video profile, and if not active, a request is made.
+
+Fixes: 3b669df92c85 ("drm/amdgpu/vcn: adjust workload profile handling")
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 80 ++++++++++++++++---------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 3 +
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 27 +--------
+ 3 files changed, 56 insertions(+), 54 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index e965b624efdb1..e5e40d10bb14b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -410,6 +410,54 @@ int amdgpu_vcn_resume(struct amdgpu_device *adev, int i)
+ return 0;
+ }
+
++void amdgpu_vcn_get_profile(struct amdgpu_device *adev)
++{
++ int r;
++
++ mutex_lock(&adev->vcn.workload_profile_mutex);
++
++ if (adev->vcn.workload_profile_active) {
++ mutex_unlock(&adev->vcn.workload_profile_mutex);
++ return;
++ }
++ r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
++ true);
++ if (r)
++ dev_warn(adev->dev,
++ "(%d) failed to enable video power profile mode\n", r);
++ else
++ adev->vcn.workload_profile_active = true;
++ mutex_unlock(&adev->vcn.workload_profile_mutex);
++}
++
++void amdgpu_vcn_put_profile(struct amdgpu_device *adev)
++{
++ bool pg = true;
++ int r, i;
++
++ mutex_lock(&adev->vcn.workload_profile_mutex);
++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
++ if (adev->vcn.inst[i].cur_state != AMD_PG_STATE_GATE) {
++ pg = false;
++ break;
++ }
++ }
++
++ if (pg) {
++ r = amdgpu_dpm_switch_power_profile(
++ adev, PP_SMC_POWER_PROFILE_VIDEO, false);
++ if (r)
++ dev_warn(
++ adev->dev,
++ "(%d) failed to disable video power profile mode\n",
++ r);
++ else
++ adev->vcn.workload_profile_active = false;
++ }
++
++ mutex_unlock(&adev->vcn.workload_profile_mutex);
++}
++
+ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
+ {
+ struct amdgpu_vcn_inst *vcn_inst =
+@@ -417,7 +465,6 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
+ struct amdgpu_device *adev = vcn_inst->adev;
+ unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0};
+ unsigned int i = vcn_inst->inst, j;
+- int r = 0;
+
+ if (adev->vcn.harvest_config & (1 << i))
+ return;
+@@ -446,15 +493,8 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
+ mutex_lock(&vcn_inst->vcn_pg_lock);
+ vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE);
+ mutex_unlock(&vcn_inst->vcn_pg_lock);
+- mutex_lock(&adev->vcn.workload_profile_mutex);
+- if (adev->vcn.workload_profile_active) {
+- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+- false);
+- if (r)
+- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r);
+- adev->vcn.workload_profile_active = false;
+- }
+- mutex_unlock(&adev->vcn.workload_profile_mutex);
++ amdgpu_vcn_put_profile(adev);
++
+ } else {
+ schedule_delayed_work(&vcn_inst->idle_work, VCN_IDLE_TIMEOUT);
+ }
+@@ -464,30 +504,11 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+ struct amdgpu_vcn_inst *vcn_inst = &adev->vcn.inst[ring->me];
+- int r = 0;
+
+ atomic_inc(&vcn_inst->total_submission_cnt);
+
+ cancel_delayed_work_sync(&vcn_inst->idle_work);
+
+- /* We can safely return early here because we've cancelled the
+- * the delayed work so there is no one else to set it to false
+- * and we don't care if someone else sets it to true.
+- */
+- if (adev->vcn.workload_profile_active)
+- goto pg_lock;
+-
+- mutex_lock(&adev->vcn.workload_profile_mutex);
+- if (!adev->vcn.workload_profile_active) {
+- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+- true);
+- if (r)
+- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r);
+- adev->vcn.workload_profile_active = true;
+- }
+- mutex_unlock(&adev->vcn.workload_profile_mutex);
+-
+-pg_lock:
+ mutex_lock(&vcn_inst->vcn_pg_lock);
+ vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_UNGATE);
+
+@@ -515,6 +536,7 @@ void amdgpu_vcn_ring_begin_use(struct amdgpu_ring *ring)
+ vcn_inst->pause_dpg_mode(vcn_inst, &new_state);
+ }
+ mutex_unlock(&vcn_inst->vcn_pg_lock);
++ amdgpu_vcn_get_profile(adev);
+ }
+
+ void amdgpu_vcn_ring_end_use(struct amdgpu_ring *ring)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+index b3fb1d0e43fc9..6d9acd36041d0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+@@ -565,4 +565,7 @@ int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
+ const struct amdgpu_hwip_reg_entry *reg, u32 count);
+ void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block);
+ void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p);
++void amdgpu_vcn_get_profile(struct amdgpu_device *adev);
++void amdgpu_vcn_put_profile(struct amdgpu_device *adev);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index bc30a5326866c..f13ed3c1e29c2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -116,7 +116,6 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work)
+ struct amdgpu_device *adev = vcn_inst->adev;
+ unsigned int fences = 0, fence[AMDGPU_MAX_VCN_INSTANCES] = {0};
+ unsigned int i, j;
+- int r = 0;
+
+ for (i = 0; i < adev->vcn.num_vcn_inst; ++i) {
+ struct amdgpu_vcn_inst *v = &adev->vcn.inst[i];
+@@ -149,15 +148,7 @@ static void vcn_v2_5_idle_work_handler(struct work_struct *work)
+ if (!fences && !atomic_read(&adev->vcn.inst[0].total_submission_cnt)) {
+ amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
+ AMD_PG_STATE_GATE);
+- mutex_lock(&adev->vcn.workload_profile_mutex);
+- if (adev->vcn.workload_profile_active) {
+- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+- false);
+- if (r)
+- dev_warn(adev->dev, "(%d) failed to disable video power profile mode\n", r);
+- adev->vcn.workload_profile_active = false;
+- }
+- mutex_unlock(&adev->vcn.workload_profile_mutex);
++ amdgpu_vcn_put_profile(adev);
+ } else {
+ schedule_delayed_work(&adev->vcn.inst[0].idle_work, VCN_IDLE_TIMEOUT);
+ }
+@@ -167,7 +158,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+ struct amdgpu_vcn_inst *v = &adev->vcn.inst[ring->me];
+- int r = 0;
+
+ atomic_inc(&adev->vcn.inst[0].total_submission_cnt);
+
+@@ -177,20 +167,6 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
+ * the delayed work so there is no one else to set it to false
+ * and we don't care if someone else sets it to true.
+ */
+- if (adev->vcn.workload_profile_active)
+- goto pg_lock;
+-
+- mutex_lock(&adev->vcn.workload_profile_mutex);
+- if (!adev->vcn.workload_profile_active) {
+- r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+- true);
+- if (r)
+- dev_warn(adev->dev, "(%d) failed to switch to video power profile mode\n", r);
+- adev->vcn.workload_profile_active = true;
+- }
+- mutex_unlock(&adev->vcn.workload_profile_mutex);
+-
+-pg_lock:
+ mutex_lock(&adev->vcn.inst[0].vcn_pg_lock);
+ amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCN,
+ AMD_PG_STATE_UNGATE);
+@@ -218,6 +194,7 @@ static void vcn_v2_5_ring_begin_use(struct amdgpu_ring *ring)
+ v->pause_dpg_mode(v, &new_state);
+ }
+ mutex_unlock(&adev->vcn.inst[0].vcn_pg_lock);
++ amdgpu_vcn_get_profile(adev);
+ }
+
+ static void vcn_v2_5_ring_end_use(struct amdgpu_ring *ring)
+--
+2.51.0
+
--- /dev/null
+From 2dfdb47c318e966248d2c16e009a38da2563da6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:49:35 +0200
+Subject: drm/amdgpu: Fix allocating extra dwords for rings (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ae5c2bee1680436d9bf8bfaca7416496adff0ee0 ]
+
+Rename extra_dw to extra_bytes and document what it's for.
+
+The value is already used as if it were bytes in vcn_v4_0.c
+and in amdgpu_ring_init. Just adjust the dword count in
+jpeg_v1_0.c so that it becomes a byte count.
+
+v2:
+Rename extra_dw to extra_bytes as discussed during review.
+
+Fixes: c8c1a1d2ef04 ("drm/amdgpu: define and add extra dword for jpeg ring")
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 3 ++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 13 ++++++++++++-
+ drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 2 +-
+ 4 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+index 486c3646710cc..8f6ce948c6841 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -364,7 +364,8 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
+
+ /* Allocate ring buffer */
+ if (ring->ring_obj == NULL) {
+- r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_dw, PAGE_SIZE,
++ r = amdgpu_bo_create_kernel(adev, ring->ring_size + ring->funcs->extra_bytes,
++ PAGE_SIZE,
+ AMDGPU_GEM_DOMAIN_GTT,
+ &ring->ring_obj,
+ &ring->gpu_addr,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+index 7670f5d82b9e4..12783ea3ba0f1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+@@ -211,7 +211,18 @@ struct amdgpu_ring_funcs {
+ bool support_64bit_ptrs;
+ bool no_user_fence;
+ bool secure_submission_supported;
+- unsigned extra_dw;
++
++ /**
++ * @extra_bytes:
++ *
++ * Optional extra space in bytes that is added to the ring size
++ * when allocating the BO that holds the contents of the ring.
++ * This space isn't used for command submission to the ring,
++ * but is just there to satisfy some hardware requirements or
++ * implement workarounds. It's up to the implementation of each
++ * specific ring to initialize this space.
++ */
++ unsigned extra_bytes;
+
+ /* ring read/write ptr handling */
+ u64 (*get_rptr)(struct amdgpu_ring *ring);
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+index 9e428e669ada6..b5bb7f4d607c1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v1_0.c
+@@ -557,7 +557,7 @@ static const struct amdgpu_ring_funcs jpeg_v1_0_decode_ring_vm_funcs = {
+ .nop = PACKET0(0x81ff, 0),
+ .support_64bit_ptrs = false,
+ .no_user_fence = true,
+- .extra_dw = 64,
++ .extra_bytes = 256,
+ .get_rptr = jpeg_v1_0_decode_ring_get_rptr,
+ .get_wptr = jpeg_v1_0_decode_ring_get_wptr,
+ .set_wptr = jpeg_v1_0_decode_ring_set_wptr,
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+index 706f3b2f484f7..ac55549e20be6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+@@ -1984,7 +1984,7 @@ static struct amdgpu_ring_funcs vcn_v4_0_unified_ring_vm_funcs = {
+ .type = AMDGPU_RING_TYPE_VCN_ENC,
+ .align_mask = 0x3f,
+ .nop = VCN_ENC_CMD_NO_OP,
+- .extra_dw = sizeof(struct amdgpu_vcn_rb_metadata),
++ .extra_bytes = sizeof(struct amdgpu_vcn_rb_metadata),
+ .get_rptr = vcn_v4_0_unified_ring_get_rptr,
+ .get_wptr = vcn_v4_0_unified_ring_get_wptr,
+ .set_wptr = vcn_v4_0_unified_ring_set_wptr,
+--
+2.51.0
+
--- /dev/null
+From ffb35d618348b4d11ff5919c8982217e136a825d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit b08425fa77ad2f305fe57a33dceb456be03b653f ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 02138aa557935..dfb6cfd837606 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.51.0
+
--- /dev/null
+From 9f3d2ef17612d723f5ca1e37838920419fb1d554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:28:26 +0800
+Subject: drm/amdgpu: Fix jpeg v4.0.3 poison irq call trace on sriov guest
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit d3d73bdb02e8cc4a1b2b721a42908504cd18ebf9 ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini.
+
+[25209.467154] Call Trace:
+[25209.467156] <TASK>
+[25209.467158] ? srso_alias_return_thunk+0x5/0x7f
+[25209.467162] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.467166] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.467171] ? jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
+[25209.467300] ? show_regs.part.0+0x23/0x29
+[25209.467303] ? show_regs.cold+0x8/0xd
+[25209.467304] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467403] ? __warn+0x8c/0x100
+[25209.467407] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467503] ? report_bug+0xa4/0xd0
+[25209.467508] ? handle_bug+0x39/0x90
+[25209.467511] ? exc_invalid_op+0x19/0x70
+[25209.467513] ? asm_exc_invalid_op+0x1b/0x20
+[25209.467518] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.467613] ? amdgpu_irq_put+0x5f/0xc0 [amdgpu]
+[25209.467709] jpeg_v4_0_3_hw_fini+0x6f/0x90 [amdgpu]
+[25209.467805] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
+[25209.467971] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
+
+Fixes: 1b2231de4163 ("drm/amdgpu: Register aqua vanjaram jpeg poison irq")
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+index b86288a69e7b7..a78144773fabb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+@@ -444,7 +444,7 @@ static int jpeg_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
+ ret = jpeg_v4_0_3_set_powergating_state(ip_block, AMD_PG_STATE_GATE);
+ }
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG))
++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev))
+ amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 40c28076ab47b5cec131dbd90ebbdedd4a1dee3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 10:16:25 +0200
+Subject: drm/amdgpu: fix link error for !PM_SLEEP
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4d22db6d070ed3934f02ed15391283f6feb258ad ]
+
+When power management is not enabled in the kernel build, the newly
+added hibernation changes cause a link failure:
+
+arm-linux-gnueabi-ld: drivers/gpu/drm/amd/amdgpu/amdgpu_drv.o: in function `amdgpu_pmops_thaw':
+amdgpu_drv.c:(.text+0x1514): undefined reference to `pm_hibernate_is_recovering'
+
+Make the power management code in this driver conditional on
+CONFIG_PM and CONFIG_PM_SLEEP
+
+Fixes: 530694f54dd5 ("drm/amdgpu: do not resume device in thaw for normal hibernation")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20250714081635.4071570-1-arnd@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 395c6be901ce7..dbbb3407fa13b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2964,15 +2964,15 @@ long amdgpu_drm_ioctl(struct file *filp,
+ }
+
+ static const struct dev_pm_ops amdgpu_pm_ops = {
+- .prepare = amdgpu_pmops_prepare,
+- .complete = amdgpu_pmops_complete,
+- .suspend = amdgpu_pmops_suspend,
+- .suspend_noirq = amdgpu_pmops_suspend_noirq,
+- .resume = amdgpu_pmops_resume,
+- .freeze = amdgpu_pmops_freeze,
+- .thaw = amdgpu_pmops_thaw,
+- .poweroff = amdgpu_pmops_poweroff,
+- .restore = amdgpu_pmops_restore,
++ .prepare = pm_sleep_ptr(amdgpu_pmops_prepare),
++ .complete = pm_sleep_ptr(amdgpu_pmops_complete),
++ .suspend = pm_sleep_ptr(amdgpu_pmops_suspend),
++ .suspend_noirq = pm_sleep_ptr(amdgpu_pmops_suspend_noirq),
++ .resume = pm_sleep_ptr(amdgpu_pmops_resume),
++ .freeze = pm_sleep_ptr(amdgpu_pmops_freeze),
++ .thaw = pm_sleep_ptr(amdgpu_pmops_thaw),
++ .poweroff = pm_sleep_ptr(amdgpu_pmops_poweroff),
++ .restore = pm_sleep_ptr(amdgpu_pmops_restore),
+ .runtime_suspend = amdgpu_pmops_runtime_suspend,
+ .runtime_resume = amdgpu_pmops_runtime_resume,
+ .runtime_idle = amdgpu_pmops_runtime_idle,
+@@ -3117,7 +3117,7 @@ static struct pci_driver amdgpu_kms_pci_driver = {
+ .probe = amdgpu_pci_probe,
+ .remove = amdgpu_pci_remove,
+ .shutdown = amdgpu_pci_shutdown,
+- .driver.pm = &amdgpu_pm_ops,
++ .driver.pm = pm_ptr(&amdgpu_pm_ops),
+ .err_handler = &amdgpu_pci_err_handler,
+ .dev_groups = amdgpu_sysfs_groups,
+ };
+--
+2.51.0
+
--- /dev/null
+From ed1dfcc06276f5e859c2d91bf3f52e32faa86001 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:54:50 +0800
+Subject: drm/amdgpu: Fix vcn v4.0.3 poison irq call trace on sriov guest
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 58364f01db4a155356f92cce1474761d7a0eda3d ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini.
+
+[25209.468816] Call Trace:
+[25209.468817] <TASK>
+[25209.468818] ? srso_alias_return_thunk+0x5/0x7f
+[25209.468820] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.468822] ? show_trace_log_lvl+0x28e/0x2ea
+[25209.468825] ? vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
+[25209.468936] ? show_regs.part.0+0x23/0x29
+[25209.468939] ? show_regs.cold+0x8/0xd
+[25209.468940] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469038] ? __warn+0x8c/0x100
+[25209.469040] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469135] ? report_bug+0xa4/0xd0
+[25209.469138] ? handle_bug+0x39/0x90
+[25209.469140] ? exc_invalid_op+0x19/0x70
+[25209.469142] ? asm_exc_invalid_op+0x1b/0x20
+[25209.469146] ? amdgpu_irq_put+0x9e/0xc0 [amdgpu]
+[25209.469241] vcn_v4_0_3_hw_fini+0xaf/0xe0 [amdgpu]
+[25209.469343] amdgpu_ip_block_hw_fini+0x34/0x61 [amdgpu]
+[25209.469511] amdgpu_device_fini_hw+0x3b3/0x467 [amdgpu]
+
+Fixes: 4c4a89149608 ("drm/amdgpu: Register aqua vanjaram vcn poison irq")
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+index 2a3663b551af9..52613205669e1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -391,7 +391,7 @@ static int vcn_v4_0_3_hw_fini(struct amdgpu_ip_block *ip_block)
+ vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+ }
+
+- if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++ if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
+ amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 88dbca0bc9ee7e76d26d8e34b36a4e26abc0f913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 5dbaebb592b30..2e79a3afc7748 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @ip_block: Pointer to the amdgpu_ip_block for this hw instance.
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ {
+@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(struct amdgpu_ip_block *ip_block)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From fbd1324830ace453a6115f2dd0eb606dad75d332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 11:30:52 +0530
+Subject: drm/amdgpu/vcn: Add regdump helper functions
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit de55cbff5ce93c316b0113535752e43079761f2c ]
+
+Add generic helper functions for vcn devcoredump support
+which can be re-used for all vcn versions.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Acked-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 87 +++++++++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 8 +++
+ 2 files changed, 95 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index f1f67521c29ca..b497a67141384 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -92,6 +92,7 @@ MODULE_FIRMWARE(FIRMWARE_VCN5_0_0);
+ MODULE_FIRMWARE(FIRMWARE_VCN5_0_1);
+
+ static void amdgpu_vcn_idle_work_handler(struct work_struct *work);
++static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev);
+
+ int amdgpu_vcn_early_init(struct amdgpu_device *adev, int i)
+ {
+@@ -285,6 +286,10 @@ int amdgpu_vcn_sw_fini(struct amdgpu_device *adev, int i)
+ amdgpu_ucode_release(&adev->vcn.inst[0].fw);
+ adev->vcn.inst[i].fw = NULL;
+ }
++
++ if (adev->vcn.reg_list)
++ amdgpu_vcn_reg_dump_fini(adev);
++
+ mutex_destroy(&adev->vcn.inst[i].vcn_pg_lock);
+ mutex_destroy(&adev->vcn.inst[i].vcn1_jpeg1_workaround);
+
+@@ -1527,3 +1532,85 @@ int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring,
+
+ return amdgpu_vcn_reset_engine(adev, ring->me);
+ }
++
++int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
++ const struct amdgpu_hwip_reg_entry *reg, u32 count)
++{
++ adev->vcn.ip_dump = kcalloc(adev->vcn.num_vcn_inst * count,
++ sizeof(uint32_t), GFP_KERNEL);
++ if (!adev->vcn.ip_dump)
++ return -ENOMEM;
++ adev->vcn.reg_list = reg;
++ adev->vcn.reg_count = count;
++
++ return 0;
++}
++
++static void amdgpu_vcn_reg_dump_fini(struct amdgpu_device *adev)
++{
++ kfree(adev->vcn.ip_dump);
++ adev->vcn.reg_list = NULL;
++ adev->vcn.reg_count = 0;
++}
++
++void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block)
++{
++ struct amdgpu_device *adev = ip_block->adev;
++ int i, j;
++ bool is_powered;
++ u32 inst_off;
++
++ if (!adev->vcn.ip_dump)
++ return;
++
++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
++ if (adev->vcn.harvest_config & (1 << i))
++ continue;
++
++ inst_off = i * adev->vcn.reg_count;
++ /* mmUVD_POWER_STATUS is always readable and is the first in reg_list */
++ adev->vcn.ip_dump[inst_off] =
++ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[0], i));
++ is_powered = (adev->vcn.ip_dump[inst_off] &
++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) !=
++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF;
++
++ if (is_powered)
++ for (j = 1; j < adev->vcn.reg_count; j++)
++ adev->vcn.ip_dump[inst_off + j] =
++ RREG32(SOC15_REG_ENTRY_OFFSET_INST(adev->vcn.reg_list[j], i));
++ }
++}
++
++void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p)
++{
++ struct amdgpu_device *adev = ip_block->adev;
++ int i, j;
++ bool is_powered;
++ u32 inst_off;
++
++ if (!adev->vcn.ip_dump)
++ return;
++
++ drm_printf(p, "num_instances:%d\n", adev->vcn.num_vcn_inst);
++ for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
++ if (adev->vcn.harvest_config & (1 << i)) {
++ drm_printf(p, "\nHarvested Instance:VCN%d Skipping dump\n", i);
++ continue;
++ }
++
++ inst_off = i * adev->vcn.reg_count;
++ is_powered = (adev->vcn.ip_dump[inst_off] &
++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF) !=
++ UVD_POWER_STATUS__UVD_POWER_STATUS_TILES_OFF;
++
++ if (is_powered) {
++ drm_printf(p, "\nActive Instance:VCN%d\n", i);
++ for (j = 0; j < adev->vcn.reg_count; j++)
++ drm_printf(p, "%-50s \t 0x%08x\n", adev->vcn.reg_list[j].reg_name,
++ adev->vcn.ip_dump[inst_off + j]);
++ } else {
++ drm_printf(p, "\nInactive Instance:VCN%d\n", i);
++ }
++ }
++}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+index 0bc0a94d7cf0f..b3fb1d0e43fc9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+@@ -237,6 +237,8 @@
+
+ #define AMDGPU_DRM_KEY_INJECT_WORKAROUND_VCNFW_ASD_HANDSHAKING 2
+
++struct amdgpu_hwip_reg_entry;
++
+ enum amdgpu_vcn_caps {
+ AMDGPU_VCN_RRMT_ENABLED,
+ };
+@@ -362,6 +364,8 @@ struct amdgpu_vcn {
+
+ bool workload_profile_active;
+ struct mutex workload_profile_mutex;
++ u32 reg_count;
++ const struct amdgpu_hwip_reg_entry *reg_list;
+ };
+
+ struct amdgpu_fw_shared_rb_ptrs_struct {
+@@ -557,4 +561,8 @@ int vcn_set_powergating_state(struct amdgpu_ip_block *ip_block,
+ int amdgpu_vcn_ring_reset(struct amdgpu_ring *ring,
+ unsigned int vmid,
+ struct amdgpu_fence *guilty_fence);
++int amdgpu_vcn_reg_dump_init(struct amdgpu_device *adev,
++ const struct amdgpu_hwip_reg_entry *reg, u32 count);
++void amdgpu_vcn_dump_ip_state(struct amdgpu_ip_block *ip_block);
++void amdgpu_vcn_print_ip_state(struct amdgpu_ip_block *ip_block, struct drm_printer *p);
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 624cc130002a879fb5d022ac877a871fe886660d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:35:10 +0530
+Subject: drm/amdgpu/vcn: Hold pg_lock before vcn power off
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 111821e4b5a3105c42c7c99f4abd4d8af9f64248 ]
+
+Acquire vcn_pg_lock before changes to vcn power state
+and release it after power off in idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 9c0442286f84 ("drm/amdgpu: Check vcn state before profile switch")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index b497a67141384..e965b624efdb1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -443,7 +443,9 @@ static void amdgpu_vcn_idle_work_handler(struct work_struct *work)
+ fences += fence[i];
+
+ if (!fences && !atomic_read(&vcn_inst->total_submission_cnt)) {
++ mutex_lock(&vcn_inst->vcn_pg_lock);
+ vcn_inst->set_pg_state(vcn_inst, AMD_PG_STATE_GATE);
++ mutex_unlock(&vcn_inst->vcn_pg_lock);
+ mutex_lock(&adev->vcn.workload_profile_mutex);
+ if (adev->vcn.workload_profile_active) {
+ r = amdgpu_dpm_switch_power_profile(adev, PP_SMC_POWER_PROFILE_VIDEO,
+--
+2.51.0
+
--- /dev/null
+From b2228170c9d3d8ba1ef2e65c87b6767ffb50c698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index a0f22ea6d15af..3d8b20828c068 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -4239,7 +4239,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 25eedef35ea593a899bb1a152adc203374875fe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:07 +0300
+Subject: drm/bridge: cdns-dsi: Fix the _atomic_check()
+
+From: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+
+[ Upstream commit 04864af849d9ae0dd020798f5b3632d9cf26fa03 ]
+
+Use the "adjusted_mode" for the dsi configuration check, as that is the
+more appropriate display_mode for validation, and later bridge enable.
+
+Also, fix the mode_valid_check parameter from false to true, as the dsi
+configuration check is taking place during the check-phase, and the
+crtc_* mode values are not expected to be populated yet.
+
+Fixes: a53d987756ea ("drm/bridge: cdns-dsi: Move DSI mode check to _atomic_check()")
+Signed-off-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-1-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index a57ca8c3bdaea..695b6246b280f 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -997,10 +997,10 @@ static int cdns_dsi_bridge_atomic_check(struct drm_bridge *bridge,
+ struct cdns_dsi_input *input = bridge_to_cdns_dsi_input(bridge);
+ struct cdns_dsi *dsi = input_to_dsi(input);
+ struct cdns_dsi_bridge_state *dsi_state = to_cdns_dsi_bridge_state(bridge_state);
+- const struct drm_display_mode *mode = &crtc_state->mode;
++ const struct drm_display_mode *adjusted_mode = &crtc_state->adjusted_mode;
+ struct cdns_dsi_cfg *dsi_cfg = &dsi_state->dsi_cfg;
+
+- return cdns_dsi_check_conf(dsi, mode, dsi_cfg, false);
++ return cdns_dsi_check_conf(dsi, adjusted_mode, dsi_cfg, true);
+ }
+
+ static struct drm_bridge_state *
+--
+2.51.0
+
--- /dev/null
+From b452591ec6e4b8f271b3ce233eeced241c058c79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:58:25 -0700
+Subject: drm/bridge: it6505: select REGMAP_I2C
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
+
+Fix
+
+ aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
+ ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
+index b9e0ca85226a6..a6d6e62071a0e 100644
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -122,6 +122,7 @@ config DRM_ITE_IT6505
+ select EXTCON
+ select CRYPTO
+ select CRYPTO_HASH
++ select REGMAP_I2C
+ help
+ ITE IT6505 DisplayPort bridge chip driver.
+
+--
+2.51.0
+
--- /dev/null
+From 4ae8d6d905932e574e8026750ad17715f0e43ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jul 2025 13:58:13 +0300
+Subject: drm/display: bridge-connector: correct CEC bridge pointers in
+ drm_bridge_connector_init
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 92e34a5241ddf4b084df20e6953275d16f156aa8 ]
+
+The bridge used in drm_bridge_connector_init() for CEC init does not
+correctly point to the required HDMI CEC bridge, which can lead to
+errors during CEC initialization.
+
+Fixes: 65a2575a68e4 ("drm/display: bridge-connector: hook in CEC notifier support")
+Fixes: a74288c8ded7 ("drm/display: bridge-connector: handle CEC adapters")
+Reported-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Closes: http://lore.kernel.org/r/20250718164156.194702d9@booty/
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://lore.kernel.org/r/20250719-fix-cec-bridges-v1-1-a60b1333c87d@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_bridge_connector.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/display/drm_bridge_connector.c b/drivers/gpu/drm/display/drm_bridge_connector.c
+index 5eb7e9bfe3611..8c915427d0538 100644
+--- a/drivers/gpu/drm/display/drm_bridge_connector.c
++++ b/drivers/gpu/drm/display/drm_bridge_connector.c
+@@ -816,6 +816,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
+
+ if (bridge_connector->bridge_hdmi_cec &&
+ bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER) {
++ bridge = bridge_connector->bridge_hdmi_cec;
++
+ ret = drmm_connector_hdmi_cec_notifier_register(connector,
+ NULL,
+ bridge->hdmi_cec_dev);
+@@ -825,6 +827,8 @@ struct drm_connector *drm_bridge_connector_init(struct drm_device *drm,
+
+ if (bridge_connector->bridge_hdmi_cec &&
+ bridge_connector->bridge_hdmi_cec->ops & DRM_BRIDGE_OP_HDMI_CEC_ADAPTER) {
++ bridge = bridge_connector->bridge_hdmi_cec;
++
+ ret = drmm_connector_hdmi_cec_register(connector,
+ &drm_bridge_connector_hdmi_cec_funcs,
+ bridge->hdmi_cec_adapter_name,
+--
+2.51.0
+
--- /dev/null
+From 57f53906aa1c7ee002c171a2395ae45912128260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 17:42:24 -0300
+Subject: drm/dp: drm_edp_backlight_set_level: do not always send 3-byte
+ commands
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit 4aa8961b1b9c7498550b41168a91cf1558133dd3 ]
+
+At least some panels using the LSB register are not happy with the
+unconditional increase of the command buffer to 3 bytes.
+
+With the BOE NE14QDM in my Dell Latitude 7455, the recent patches for
+luminance based brightness have introduced a regression: the brightness
+range stopped being contiguous and became nonsensical (it probably was
+interpreting the last 2 bytes of the buffer and not the first 2).
+
+Change from using a fixed sizeof() to a length variable that's only
+set to 3 when luminance is used. Let's leave the default as 2 even for
+the single-byte version, since that's how it worked before.
+
+Fixes: f2db78e37fe7 ("drm/dp: Modify drm_edp_backlight_set_level")
+Signed-off-by: Val Packett <val@packett.cool>
+Tested-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://lore.kernel.org/r/20250706204446.8918-1-val@packett.cool
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_helper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c
+index 1ecc3df7e3167..4aaeae4fa03c3 100644
+--- a/drivers/gpu/drm/display/drm_dp_helper.c
++++ b/drivers/gpu/drm/display/drm_dp_helper.c
+@@ -3962,6 +3962,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
+ int ret;
+ unsigned int offset = DP_EDP_BACKLIGHT_BRIGHTNESS_MSB;
+ u8 buf[3] = { 0 };
++ size_t len = 2;
+
+ /* The panel uses the PWM for controlling brightness levels */
+ if (!(bl->aux_set || bl->luminance_set))
+@@ -3974,6 +3975,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
+ buf[1] = (level & 0x00ff00) >> 8;
+ buf[2] = (level & 0xff0000) >> 16;
+ offset = DP_EDP_PANEL_TARGET_LUMINANCE_VALUE;
++ len = 3;
+ } else if (bl->lsb_reg_used) {
+ buf[0] = (level & 0xff00) >> 8;
+ buf[1] = (level & 0x00ff);
+@@ -3981,7 +3983,7 @@ int drm_edp_backlight_set_level(struct drm_dp_aux *aux, const struct drm_edp_bac
+ buf[0] = level;
+ }
+
+- ret = drm_dp_dpcd_write_data(aux, offset, buf, sizeof(buf));
++ ret = drm_dp_dpcd_write_data(aux, offset, buf, len);
+ if (ret < 0) {
+ drm_err(aux->drm_dev,
+ "%s: Failed to write aux backlight level: %d\n",
+--
+2.51.0
+
--- /dev/null
+From 22f5e165fa6a30bd6895852531e10af058ea5abf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:30:55 +0800
+Subject: drm/msm: Do not validate SSPP when it is not ready
+
+From: Jun Nie <jun.nie@linaro.org>
+
+[ Upstream commit 6fc616723bb5fd4289d7422fa013da062b44ae55 ]
+
+Current code will validate current plane and previous plane to
+confirm they can share a SSPP with multi-rect mode. The SSPP
+is already allocated for previous plane, while current plane
+is not associated with any SSPP yet. Null pointer is referenced
+when validating the SSPP of current plane. Skip SSPP validation
+for current plane.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+Mem abort info:
+ ESR = 0x0000000096000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x04: level 0 translation fault
+Data abort info:
+ ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000
+[0000000000000020] pgd=0000000000000000, p4d=0000000000000000
+Internal error: Oops: 0000000096000004 [#1] SMP
+Modules linked in:
+CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT
+Tainted: [S]=CPU_OUT_OF_SPEC
+Hardware name: SM8650 EV1 rev1 4slam 2et (DT)
+pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
+pc : dpu_plane_is_multirect_capable+0x68/0x90
+lr : dpu_assign_plane_resources+0x288/0x410
+sp : ffff800093dcb770
+x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000
+x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800
+x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080
+x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff
+x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200
+x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000
+x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950
+x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000
+x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438
+x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000
+Call trace:
+ dpu_plane_is_multirect_capable+0x68/0x90 (P)
+ dpu_crtc_atomic_check+0x5bc/0x650
+ drm_atomic_helper_check_planes+0x13c/0x220
+ drm_atomic_helper_check+0x58/0xb8
+ msm_atomic_check+0xd8/0xf0
+ drm_atomic_check_only+0x4a8/0x968
+ drm_atomic_commit+0x50/0xd8
+ drm_atomic_helper_update_plane+0x140/0x188
+ __setplane_atomic+0xfc/0x148
+ drm_mode_setplane+0x164/0x378
+ drm_ioctl_kernel+0xc0/0x140
+ drm_ioctl+0x20c/0x500
+ __arm64_sys_ioctl+0xbc/0xf8
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0x48/0xf8
+ do_el0_svc+0x28/0x40
+ el0_svc+0x30/0xd0
+ el0t_64_sync_handler+0x144/0x168
+ el0t_64_sync+0x198/0x1a0
+Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)
+---[ end trace 0000000000000000 ]---
+
+Fixes: 3ed12a3664b36 ("drm/msm/dpu: allow sharing SSPP between planes")
+Signed-off-by: Jun Nie <jun.nie@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/669224/
+Link: https://lore.kernel.org/r/20250819-v6-16-rc2-quad-pipe-upstream-v15-1-2c7a85089db8@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index 6859e8ef6b055..f54cf0faa1c7c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -922,6 +922,9 @@ static int dpu_plane_is_multirect_capable(struct dpu_hw_sspp *sspp,
+ if (MSM_FORMAT_IS_YUV(fmt))
+ return false;
+
++ if (!sspp)
++ return true;
++
+ if (!test_bit(DPU_SSPP_SMART_DMA_V1, &sspp->cap->features) &&
+ !test_bit(DPU_SSPP_SMART_DMA_V2, &sspp->cap->features))
+ return false;
+@@ -1028,6 +1031,7 @@ static int dpu_plane_try_multirect_shared(struct dpu_plane_state *pstate,
+ prev_pipe->multirect_mode != DPU_SSPP_MULTIRECT_NONE)
+ return false;
+
++ /* Do not validate SSPP of current plane when it is not ready */
+ if (!dpu_plane_is_multirect_capable(pipe->sspp, pipe_cfg, fmt) ||
+ !dpu_plane_is_multirect_capable(prev_pipe->sspp, prev_pipe_cfg, prev_fmt))
+ return false;
+--
+2.51.0
+
--- /dev/null
+From 8ad9bef77a490b6a32f7c92132b3709601652df9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:20:45 +0800
+Subject: drm/msm/dpu: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
+
+Change 'ret' from unsigned long to int, as storing negative error codes
+in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
+errors.
+
+Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/671100/
+Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+index 56a5b596554db..46f348972a975 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+@@ -446,7 +446,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+ static int dpu_encoder_phys_wb_wait_for_commit_done(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- unsigned long ret;
++ int ret;
+ struct dpu_encoder_wait_info wait_info;
+ struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+--
+2.51.0
+
--- /dev/null
+From 235b7a7cf13b463afbb39572c08c85bdfa4856e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 17:20:00 +0530
+Subject: drm/msm: Fix bootup splat with separate_gpu_drm modparam
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+[ Upstream commit f028bcafb6dfb4c2bb656cbff9e6a66222d3d3d7 ]
+
+The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses
+drm_gem_obj.gpuva.list, which is not initialized when the drm driver
+does not support DRIVER_GEM_GPUVA feature. Enable it for msm_kms
+drm driver to fix the splat seen when msm.separate_gpu_drm=1 modparam
+is set:
+
+[ 9.506020] Unable to handle kernel paging request at virtual address fffffffffffffff0
+[ 9.523160] Mem abort info:
+[ 9.523161] ESR = 0x0000000096000006
+[ 9.523163] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 9.523165] SET = 0, FnV = 0
+[ 9.523166] EA = 0, S1PTW = 0
+[ 9.523167] FSC = 0x06: level 2 translation fault
+[ 9.523169] Data abort info:
+[ 9.523170] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
+[ 9.523171] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[ 9.523172] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[ 9.523174] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000ad370f000
+[ 9.523176] [fffffffffffffff0] pgd=0000000000000000, p4d=0000000ad4787403, pud=0000000ad4788403, pmd=0000000000000000
+[ 9.523184] Internal error: Oops: 0000000096000006 [#1] SMP
+[ 9.592968] CPU: 9 UID: 0 PID: 448 Comm: (udev-worker) Not tainted 6.17.0-rc4-assorted-fix-00005-g0e9bb53a2282-dirty #3 PREEMPT
+[ 9.592970] Hardware name: Qualcomm CRD, BIOS 6.0.240718.BOOT.MXF.2.4-00515-HAMOA-1 07/18/2024
+[ 9.592971] pstate: a1400005 (NzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+[ 9.592973] pc : lookup_vma+0x28/0xe0 [msm]
+[ 9.592996] lr : get_vma_locked+0x2c/0x128 [msm]
+[ 9.763632] sp : ffff800082dab460
+[ 9.763666] Call trace:
+[ 9.763668] lookup_vma+0x28/0xe0 [msm] (P)
+[ 9.763688] get_vma_locked+0x2c/0x128 [msm]
+[ 9.763706] msm_gem_get_and_pin_iova_range+0x68/0x11c [msm]
+[ 9.763723] msm_gem_get_and_pin_iova+0x18/0x24 [msm]
+[ 9.763740] msm_fbdev_driver_fbdev_probe+0xd0/0x258 [msm]
+[ 9.763760] __drm_fb_helper_initial_config_and_unlock+0x288/0x528 [drm_kms_helper]
+[ 9.763771] drm_fb_helper_initial_config+0x44/0x54 [drm_kms_helper]
+[ 9.763779] drm_fbdev_client_hotplug+0x84/0xd4 [drm_client_lib]
+[ 9.763782] drm_client_register+0x58/0x9c [drm]
+[ 9.763806] drm_fbdev_client_setup+0xe8/0xcf0 [drm_client_lib]
+[ 9.763809] drm_client_setup+0xb4/0xd8 [drm_client_lib]
+[ 9.763811] msm_drm_kms_post_init+0x2c/0x3c [msm]
+[ 9.763830] msm_drm_init+0x1a8/0x22c [msm]
+[ 9.763848] msm_drm_bind+0x30/0x3c [msm]
+[ 9.919273] try_to_bring_up_aggregate_device+0x168/0x1d4
+[ 9.919283] __component_add+0xa4/0x170
+[ 9.919286] component_add+0x14/0x20
+[ 9.919288] msm_dp_display_probe_tail+0x4c/0xac [msm]
+[ 9.919315] msm_dp_auxbus_done_probe+0x14/0x20 [msm]
+[ 9.919335] dp_aux_ep_probe+0x4c/0xf0 [drm_dp_aux_bus]
+[ 9.919341] really_probe+0xbc/0x298
+[ 9.919345] __driver_probe_device+0x78/0x12c
+[ 9.919348] driver_probe_device+0x40/0x160
+[ 9.919350] __driver_attach+0x94/0x19c
+[ 9.919353] bus_for_each_dev+0x74/0xd4
+[ 9.919355] driver_attach+0x24/0x30
+[ 9.919358] bus_add_driver+0xe4/0x208
+[ 9.919360] driver_register+0x60/0x128
+[ 9.919363] __dp_aux_dp_driver_register+0x24/0x30 [drm_dp_aux_bus]
+[ 9.919365] atana33xc20_init+0x20/0x1000 [panel_samsung_atna33xc20]
+[ 9.919370] do_one_initcall+0x6c/0x1b0
+[ 9.919374] do_init_module+0x58/0x234
+[ 9.919377] load_module+0x19cc/0x1bd4
+[ 9.919380] init_module_from_file+0x84/0xc4
+[ 9.919382] __arm64_sys_finit_module+0x1b8/0x2cc
+[ 9.919384] invoke_syscall+0x48/0x110
+[ 9.919389] el0_svc_common.constprop.0+0xc8/0xe8
+[ 9.919393] do_el0_svc+0x20/0x2c
+[ 9.919396] el0_svc+0x34/0xf0
+[ 9.919401] el0t_64_sync_handler+0xa0/0xe4
+[ 9.919403] el0t_64_sync+0x198/0x19c
+[ 9.919407] Code: eb0000bf 54000480 d100a003 aa0303e2 (f8418c44)
+[ 9.919410] ---[ end trace 0000000000000000 ]---
+
+Fixes: 217ed15bd399 ("drm/msm: enable separate binding of GPU and display devices")
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/672257/
+Link: https://lore.kernel.org/r/20250902-assorted-sept-1-v1-1-f3ec9baed513@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 9dcc7a596a11d..7e977fec41007 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -826,6 +826,7 @@ static const struct file_operations fops = {
+
+ #define DRIVER_FEATURES_KMS ( \
+ DRIVER_GEM | \
++ DRIVER_GEM_GPUVA | \
+ DRIVER_ATOMIC | \
+ DRIVER_MODESET | \
+ 0 )
+--
+2.51.0
+
--- /dev/null
+From 5c6a0a9acb8dfbabc0a6a2bf36cb5b242949ebd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 17:04:26 -0700
+Subject: drm/msm: Fix missing VM_BIND offset/range validation
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 3a3bef68a6c15d079646a964ebc4dc8bb0aedb06 ]
+
+We need to reject the MAP op if offset+range is larger than the BO size.
+
+Reported-by: Connor Abbott <cwabbott0@gmail.com>
+Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Tested-by: Connor Abbott <cwabbott0@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/669781/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem_vma.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
+index 209154be5efcc..381a0853c05ba 100644
+--- a/drivers/gpu/drm/msm/msm_gem_vma.c
++++ b/drivers/gpu/drm/msm/msm_gem_vma.c
+@@ -1080,6 +1080,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
+
+ op->obj = obj;
+ cnt++;
++
++ if ((op->range + op->obj_offset) > obj->size) {
++ ret = UERR(EINVAL, dev, "invalid range: %016llx + %016llx > %016zx\n",
++ op->range, op->obj_offset, obj->size);
++ goto out_unlock;
++ }
+ }
+
+ *nr_bos = cnt;
+--
+2.51.0
+
--- /dev/null
+From 79076b360c8ecc96ff831f027a1d10f5865e9c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 17:04:25 -0700
+Subject: drm/msm: Fix obj leak in VM_BIND error path
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 278f8904434aa96055e793936b5977c010549e28 ]
+
+If we fail a handle-lookup part way thru, we need to drop the already
+obtained obj references.
+
+Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Tested-by: Connor Abbott <cwabbott0@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/669784/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem_vma.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
+index 00d0f3b7ba327..209154be5efcc 100644
+--- a/drivers/gpu/drm/msm/msm_gem_vma.c
++++ b/drivers/gpu/drm/msm/msm_gem_vma.c
+@@ -1023,6 +1023,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
+ struct drm_device *dev = job->vm->drm;
+ int ret = 0;
+ int cnt = 0;
++ int i = -1;
+
+ if (args->nr_ops == 1) {
+ /* Single op case, the op is inlined: */
+@@ -1056,11 +1057,12 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
+
+ spin_lock(&file->table_lock);
+
+- for (unsigned i = 0; i < args->nr_ops; i++) {
++ for (i = 0; i < args->nr_ops; i++) {
++ struct msm_vm_bind_op *op = &job->ops[i];
+ struct drm_gem_object *obj;
+
+- if (!job->ops[i].handle) {
+- job->ops[i].obj = NULL;
++ if (!op->handle) {
++ op->obj = NULL;
+ continue;
+ }
+
+@@ -1068,15 +1070,15 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
+ * normally use drm_gem_object_lookup(), but for bulk lookup
+ * all under single table_lock just hit object_idr directly:
+ */
+- obj = idr_find(&file->object_idr, job->ops[i].handle);
++ obj = idr_find(&file->object_idr, op->handle);
+ if (!obj) {
+- ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", job->ops[i].handle, i);
++ ret = UERR(EINVAL, dev, "invalid handle %u at index %u\n", op->handle, i);
+ goto out_unlock;
+ }
+
+ drm_gem_object_get(obj);
+
+- job->ops[i].obj = obj;
++ op->obj = obj;
+ cnt++;
+ }
+
+@@ -1085,6 +1087,17 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
+ out_unlock:
+ spin_unlock(&file->table_lock);
+
++ if (ret) {
++ for (; i >= 0; i--) {
++ struct msm_vm_bind_op *op = &job->ops[i];
++
++ if (!op->obj)
++ continue;
++
++ drm_gem_object_put(op->obj);
++ op->obj = NULL;
++ }
++ }
+ out:
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From c50400585a540f05c17e4396f46658d0ad1ac0fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:51:49 +0300
+Subject: drm/msm/mdp4: stop supporting no-IOMMU configuration
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cc64568b522b64fb8f8c607da9eb4e2d9f72d0cf ]
+
+With the switch to GPUVM the msm driver no longer supports the no-IOMMU
+configurations (even without the actual GPU). Return an error in case we
+face the lack of the IOMMU for an MDP4 device.
+
+Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/672557/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+index 0952c7f18abdc..4d1ea9b261917 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+@@ -463,9 +463,9 @@ static int mdp4_kms_init(struct drm_device *dev)
+ ret = PTR_ERR(mmu);
+ goto fail;
+ } else if (!mmu) {
+- DRM_DEV_INFO(dev->dev, "no iommu, fallback to phys "
+- "contig buffers for scanout\n");
+- vm = NULL;
++ DRM_DEV_INFO(dev->dev, "no IOMMU, bailing out\n");
++ ret = -ENODEV;
++ goto fail;
+ } else {
+ vm = msm_gem_vm_create(dev, mmu, "mdp4",
+ 0x1000, 0x100000000 - 0x1000,
+--
+2.51.0
+
--- /dev/null
+From 8294ef7856fd675e4b974f9539f8b06a4804d57b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:51:50 +0300
+Subject: drm/msm: stop supporting no-IOMMU configuration
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit c94fc6d35685587aa0cb9a8d7d7062c73ab04d89 ]
+
+With the switch to GPUVM the msm driver no longer supports the no-IOMMU
+configurations (even without the actual GPU). Return an error in case we
+face the lack of the IOMMU.
+
+Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/672559/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_kms.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
+index 56828d218e88a..4c4dcb095c4df 100644
+--- a/drivers/gpu/drm/msm/msm_kms.c
++++ b/drivers/gpu/drm/msm/msm_kms.c
+@@ -195,14 +195,13 @@ struct drm_gpuvm *msm_kms_init_vm(struct drm_device *dev)
+ iommu_dev = mdp_dev;
+ else
+ iommu_dev = mdss_dev;
+-
+ mmu = msm_iommu_disp_new(iommu_dev, 0);
+ if (IS_ERR(mmu))
+ return ERR_CAST(mmu);
+
+ if (!mmu) {
+- drm_info(dev, "no IOMMU, fallback to phys contig buffers for scanout\n");
+- return NULL;
++ drm_info(dev, "no IOMMU, bailing out\n");
++ return ERR_PTR(-ENODEV);
+ }
+
+ vm = msm_gem_vm_create(dev, mmu, "mdp_kms",
+--
+2.51.0
+
--- /dev/null
+From e08bbe29315047a60e6fd1a72516a38019b90214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 19:49:33 +0800
+Subject: drm/panel: Allow powering on panel follower after panel is enabled
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 2eb22214c132374e11e681c44d7879c91f67f614 ]
+
+Some touch controllers have to be powered on after the panel's backlight
+is enabled. To support these controllers, introduce .panel_enabled() and
+.panel_disabling() to panel_follower_funcs and use them to power on the
+device after the panel and its backlight are enabled.
+
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250818115015.2909525-1-treapking@chromium.org
+Stable-dep-of: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel.c | 73 +++++++++++++++++++++++++++++++------
+ include/drm/drm_panel.h | 14 +++++++
+ 2 files changed, 76 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c
+index c8bb28dccdc1b..d1e6598ea3bc0 100644
+--- a/drivers/gpu/drm/drm_panel.c
++++ b/drivers/gpu/drm/drm_panel.c
+@@ -134,6 +134,9 @@ void drm_panel_prepare(struct drm_panel *panel)
+ panel->prepared = true;
+
+ list_for_each_entry(follower, &panel->followers, list) {
++ if (!follower->funcs->panel_prepared)
++ continue;
++
+ ret = follower->funcs->panel_prepared(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+@@ -179,6 +182,9 @@ void drm_panel_unprepare(struct drm_panel *panel)
+ mutex_lock(&panel->follower_lock);
+
+ list_for_each_entry(follower, &panel->followers, list) {
++ if (!follower->funcs->panel_unpreparing)
++ continue;
++
+ ret = follower->funcs->panel_unpreparing(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+@@ -209,6 +215,7 @@ EXPORT_SYMBOL(drm_panel_unprepare);
+ */
+ void drm_panel_enable(struct drm_panel *panel)
+ {
++ struct drm_panel_follower *follower;
+ int ret;
+
+ if (!panel)
+@@ -219,10 +226,12 @@ void drm_panel_enable(struct drm_panel *panel)
+ return;
+ }
+
++ mutex_lock(&panel->follower_lock);
++
+ if (panel->funcs && panel->funcs->enable) {
+ ret = panel->funcs->enable(panel);
+ if (ret < 0)
+- return;
++ goto exit;
+ }
+ panel->enabled = true;
+
+@@ -230,6 +239,19 @@ void drm_panel_enable(struct drm_panel *panel)
+ if (ret < 0)
+ DRM_DEV_INFO(panel->dev, "failed to enable backlight: %d\n",
+ ret);
++
++ list_for_each_entry(follower, &panel->followers, list) {
++ if (!follower->funcs->panel_enabled)
++ continue;
++
++ ret = follower->funcs->panel_enabled(follower);
++ if (ret < 0)
++ dev_info(panel->dev, "%ps failed: %d\n",
++ follower->funcs->panel_enabled, ret);
++ }
++
++exit:
++ mutex_unlock(&panel->follower_lock);
+ }
+ EXPORT_SYMBOL(drm_panel_enable);
+
+@@ -243,6 +265,7 @@ EXPORT_SYMBOL(drm_panel_enable);
+ */
+ void drm_panel_disable(struct drm_panel *panel)
+ {
++ struct drm_panel_follower *follower;
+ int ret;
+
+ if (!panel)
+@@ -262,6 +285,18 @@ void drm_panel_disable(struct drm_panel *panel)
+ return;
+ }
+
++ mutex_lock(&panel->follower_lock);
++
++ list_for_each_entry(follower, &panel->followers, list) {
++ if (!follower->funcs->panel_disabling)
++ continue;
++
++ ret = follower->funcs->panel_disabling(follower);
++ if (ret < 0)
++ dev_info(panel->dev, "%ps failed: %d\n",
++ follower->funcs->panel_disabling, ret);
++ }
++
+ ret = backlight_disable(panel->backlight);
+ if (ret < 0)
+ DRM_DEV_INFO(panel->dev, "failed to disable backlight: %d\n",
+@@ -270,9 +305,12 @@ void drm_panel_disable(struct drm_panel *panel)
+ if (panel->funcs && panel->funcs->disable) {
+ ret = panel->funcs->disable(panel);
+ if (ret < 0)
+- return;
++ goto exit;
+ }
+ panel->enabled = false;
++
++exit:
++ mutex_unlock(&panel->follower_lock);
+ }
+ EXPORT_SYMBOL(drm_panel_disable);
+
+@@ -539,13 +577,13 @@ EXPORT_SYMBOL(drm_is_panel_follower);
+ * @follower_dev: The 'struct device' for the follower.
+ * @follower: The panel follower descriptor for the follower.
+ *
+- * A panel follower is called right after preparing the panel and right before
+- * unpreparing the panel. It's primary intention is to power on an associated
+- * touchscreen, though it could be used for any similar devices. Multiple
+- * devices are allowed the follow the same panel.
++ * A panel follower is called right after preparing/enabling the panel and right
++ * before unpreparing/disabling the panel. It's primary intention is to power on
++ * an associated touchscreen, though it could be used for any similar devices.
++ * Multiple devices are allowed the follow the same panel.
+ *
+- * If a follower is added to a panel that's already been turned on, the
+- * follower's prepare callback is called right away.
++ * If a follower is added to a panel that's already been prepared/enabled, the
++ * follower's prepared/enabled callback is called right away.
+ *
+ * The "panel" property of the follower points to the panel to be followed.
+ *
+@@ -569,12 +607,18 @@ int drm_panel_add_follower(struct device *follower_dev,
+ mutex_lock(&panel->follower_lock);
+
+ list_add_tail(&follower->list, &panel->followers);
+- if (panel->prepared) {
++ if (panel->prepared && follower->funcs->panel_prepared) {
+ ret = follower->funcs->panel_prepared(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+ follower->funcs->panel_prepared, ret);
+ }
++ if (panel->enabled && follower->funcs->panel_enabled) {
++ ret = follower->funcs->panel_enabled(follower);
++ if (ret < 0)
++ dev_info(panel->dev, "%ps failed: %d\n",
++ follower->funcs->panel_enabled, ret);
++ }
+
+ mutex_unlock(&panel->follower_lock);
+
+@@ -587,7 +631,8 @@ EXPORT_SYMBOL(drm_panel_add_follower);
+ * @follower: The panel follower descriptor for the follower.
+ *
+ * Undo drm_panel_add_follower(). This includes calling the follower's
+- * unprepare function if we're removed from a panel that's currently prepared.
++ * unpreparing/disabling function if we're removed from a panel that's currently
++ * prepared/enabled.
+ *
+ * Return: 0 or an error code.
+ */
+@@ -598,7 +643,13 @@ void drm_panel_remove_follower(struct drm_panel_follower *follower)
+
+ mutex_lock(&panel->follower_lock);
+
+- if (panel->prepared) {
++ if (panel->enabled && follower->funcs->panel_disabling) {
++ ret = follower->funcs->panel_disabling(follower);
++ if (ret < 0)
++ dev_info(panel->dev, "%ps failed: %d\n",
++ follower->funcs->panel_disabling, ret);
++ }
++ if (panel->prepared && follower->funcs->panel_unpreparing) {
+ ret = follower->funcs->panel_unpreparing(follower);
+ if (ret < 0)
+ dev_info(panel->dev, "%ps failed: %d\n",
+diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
+index 843fb756a2950..2407bfa60236f 100644
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -160,6 +160,20 @@ struct drm_panel_follower_funcs {
+ * Called before the panel is powered off.
+ */
+ int (*panel_unpreparing)(struct drm_panel_follower *follower);
++
++ /**
++ * @panel_enabled:
++ *
++ * Called after the panel and the backlight have been enabled.
++ */
++ int (*panel_enabled)(struct drm_panel_follower *follower);
++
++ /**
++ * @panel_disabling:
++ *
++ * Called before the panel and the backlight are disabled.
++ */
++ int (*panel_disabling)(struct drm_panel_follower *follower);
+ };
+
+ struct drm_panel_follower {
+--
+2.51.0
+
--- /dev/null
+From b3fdce942e683917bb0c1730b15f2ca8fc9db76e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 15:25:13 +0800
+Subject: drm/panel-edp: Add 50ms disable delay for four panels
+
+From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+
+[ Upstream commit 1511d3c4d2bb30f784924a877f3cef518bb73077 ]
+
+Add 50ms disable delay for NV116WHM-N49, NV122WUM-N41, and MNC207QS1-1
+to satisfy T9+T10 timing. Add 50ms disable delay for MNE007JA1-2
+as well, since MNE007JA1-2 copies the timing of MNC207QS1-1.
+
+Specifically, it should be noted that the MNE007JA1-2 panel was added
+by someone who did not have the panel documentation, so they simply
+copied the timing from the MNC207QS1-1 panel. Adding an extra 50 ms
+of delay should be safe.
+
+Fixes: 0547692ac146 ("drm/panel-edp: Add several generic edp panels")
+Fixes: 50625eab3972 ("drm/edp-panel: Add panel used by T14s Gen6 Snapdragon")
+Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250723072513.2880369-1-yelangyan@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 09170470b3ef1..d0aa602ecc9de 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1736,10 +1736,11 @@ static const struct panel_delay delay_200_500_e50 = {
+ .enable = 50,
+ };
+
+-static const struct panel_delay delay_200_500_e50_p2e200 = {
++static const struct panel_delay delay_200_500_e50_d50_p2e200 = {
+ .hpd_absent = 200,
+ .unprepare = 500,
+ .enable = 50,
++ .disable = 50,
+ .prepare_to_enable = 200,
+ };
+
+@@ -1941,13 +1942,13 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x09dd, &delay_200_500_e50, "NT116WHM-N21"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a1b, &delay_200_500_e50, "NV133WUM-N63"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a36, &delay_200_500_e200, "Unknown"),
+- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80, "NV116WHM-N49"),
++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a3e, &delay_200_500_e80_d50, "NV116WHM-N49"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0a5d, &delay_200_500_e50, "NV116WHM-N45"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ac5, &delay_200_500_e50, "NV116WHM-N4C"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0ae8, &delay_200_500_e50_p2e80, "NV140WUM-N41"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b09, &delay_200_500_e50_po2e200, "NV140FHM-NZ"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b1e, &delay_200_500_e80, "NE140QDM-N6A"),
+- EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80, "NV122WUM-N41"),
++ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b34, &delay_200_500_e80_d50, "NV122WUM-N41"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b43, &delay_200_500_e200, "NV140FHM-T09"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b56, &delay_200_500_e80, "NT140FHM-N47"),
+ EDP_PANEL_ENTRY('B', 'O', 'E', 0x0b66, &delay_200_500_e80, "NE140WUM-N6G"),
+@@ -1986,8 +1987,8 @@ static const struct edp_panel_entry edp_panels[] = {
+ EDP_PANEL_ENTRY('C', 'M', 'N', 0x14e5, &delay_200_500_e80_d50, "N140HGA-EA1"),
+ EDP_PANEL_ENTRY('C', 'M', 'N', 0x162b, &delay_200_500_e80_d50, "N160JCE-ELL"),
+
+- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_p2e200, "MNC207QS1-1"),
+- EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_p2e200, "MNE007JA1-2"),
++ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1200, &delay_200_500_e50_d50_p2e200, "MNC207QS1-1"),
++ EDP_PANEL_ENTRY('C', 'S', 'O', 0x1413, &delay_200_500_e50_d50_p2e200, "MNE007JA1-2"),
+
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
+--
+2.51.0
+
--- /dev/null
+From df7f5ef70ba3c4377975f063b94f2b8cd9b76a37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 14:16:27 +0800
+Subject: drm/panel-edp: Add disable to 100ms for MNB601LS1-4
+
+From: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+
+[ Upstream commit 9b3700b15cb581d748c3d46e7eb30ffced1642e8 ]
+
+For the MNB601LS1-4 panel, the T9+T10 timing does not meet the
+requirements of the specification, so disable is set to 100ms.
+
+Fixes: 9d8e91439fc3 ("drm/panel-edp: Add CSW MNB601LS1-4")
+Signed-off-by: Langyan Ye <yelangyan@huaqin.corp-partner.google.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250721061627.3816612-1-yelangyan@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index 9a56e208cbddb..09170470b3ef1 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -1828,6 +1828,13 @@ static const struct panel_delay delay_50_500_e200_d200_po2e335 = {
+ .powered_on_to_enable = 335,
+ };
+
++static const struct panel_delay delay_200_500_e50_d100 = {
++ .hpd_absent = 200,
++ .unprepare = 500,
++ .enable = 50,
++ .disable = 100,
++};
++
+ #define EDP_PANEL_ENTRY(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name) \
+ { \
+ .ident = { \
+@@ -1984,7 +1991,7 @@ static const struct edp_panel_entry edp_panels[] = {
+
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1100, &delay_200_500_e80_d50, "MNB601LS1-1"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1103, &delay_200_500_e80_d50, "MNB601LS1-3"),
+- EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50, "MNB601LS1-4"),
++ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1104, &delay_200_500_e50_d100, "MNB601LS1-4"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1448, &delay_200_500_e50, "MNE007QS3-7"),
+ EDP_PANEL_ENTRY('C', 'S', 'W', 0x1457, &delay_80_500_e80_p2e200, "MNE007QS3-8"),
+
+--
+2.51.0
+
--- /dev/null
+From cb55aecb4c7db9f86ec77d0234341c25fe640997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 21:23:41 -0600
+Subject: drm/panel: novatek-nt35560: Fix invalid return value
+
+From: Brigham Campbell <me@brighamcampbell.com>
+
+[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
+
+Fix bug in nt35560_set_brightness() which causes the function to
+erroneously report an error. mipi_dsi_dcs_write() returns either a
+negative value when an error occurred or a positive number of bytes
+written when no error occurred. The buggy code reports an error under
+either condition.
+
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+index 98f0782c84111..17898a29efe87 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
+ par = 0x00;
+ ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
+ &par, 1);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From f142e834f98075f893225df87170f59748c37bb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index ac77d1246b945..811265648a582 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From d6e7aa4918c197a4dce5befcea75c93cde4acb60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:28:49 +0200
+Subject: drm: re-allow no-op changes on non-primary planes in async flips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xaver Hugl <xaver.hugl@kde.org>
+
+[ Upstream commit b065bd213caf6d35b57c5089d6507d7e8598a586 ]
+
+Commit fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to
+async flip") unintentionally disallowed no-op changes on non-primary
+planes that the driver doesn't allow async flips on. This broke async
+flips for compositors that disable the cursor plane in every async
+atomic commit. To fix that, change drm_atomic_set_property to again
+only run atomic_async_check if the plane would actually be changed by
+the atomic commit.
+
+Fixes: fd40a63c63a1 ("drm/atomic: Let drivers decide which planes to async flip")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4263
+Signed-off-by: Xaver Hugl <xaver.hugl@kde.org>
+Reviewed-by: André Almeida <andrealmeid@igalia.com>
+Link: https://lore.kernel.org/r/20250822152849.87843-1-xaver.hugl@kde.org
+[andrealmeid: fix checkpatch warning]
+Signed-off-by: André Almeida <andrealmeid@igalia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c
+index ecc73d52bfae4..85dbdaa4a2e25 100644
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -1078,19 +1078,20 @@ int drm_atomic_set_property(struct drm_atomic_state *state,
+ }
+
+ if (async_flip) {
+- /* check if the prop does a nop change */
+- if ((prop != config->prop_fb_id &&
+- prop != config->prop_in_fence_fd &&
+- prop != config->prop_fb_damage_clips)) {
+- ret = drm_atomic_plane_get_property(plane, plane_state,
+- prop, &old_val);
+- ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
+- }
++ /* no-op changes are always allowed */
++ ret = drm_atomic_plane_get_property(plane, plane_state,
++ prop, &old_val);
++ ret = drm_atomic_check_prop_changes(ret, old_val, prop_value, prop);
+
+- /* ask the driver if this non-primary plane is supported */
+- if (plane->type != DRM_PLANE_TYPE_PRIMARY) {
+- ret = -EINVAL;
++ /* fail everything that isn't no-op or a pure flip */
++ if (ret && prop != config->prop_fb_id &&
++ prop != config->prop_in_fence_fd &&
++ prop != config->prop_fb_damage_clips) {
++ break;
++ }
+
++ if (ret && plane->type != DRM_PLANE_TYPE_PRIMARY) {
++ /* ask the driver if this non-primary plane is supported */
+ if (plane_funcs && plane_funcs->atomic_async_check)
+ ret = plane_funcs->atomic_async_check(plane, state, true);
+
+--
+2.51.0
+
--- /dev/null
+From fdd4d83b9979767dbf1796a052c1335261533aba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 09:48:17 +0100
+Subject: drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit 2650bc4007c15e05f995f472b4fc89e793162bc4 ]
+
+The "skip reset" test waits for the timeout handler to run for the
+duration of 2 * MOCK_TIMEOUT, and because the mock scheduler opted to
+remove the "skip reset" flag once it fires, this gives opportunity for the
+timeout handler to run twice. Second time the job will be removed from the
+mock scheduler job list and the drm_mock_sched_advance() call in the test
+will fail.
+
+Fix it by making the "don't reset" flag persist for the lifetime of the
+job and add a new flag to verify that the code path had executed as
+expected.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Fixes: 1472e7549f84 ("drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG")
+Cc: Maíra Canal <mcanal@igalia.com>
+Cc: Philipp Stanner <phasta@kernel.org>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Philipp Stanner <phasta@kernel.org>
+Link: https://lore.kernel.org/r/20250716084817.56797-1-tvrtko.ursulin@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 2 +-
+ drivers/gpu/drm/scheduler/tests/sched_tests.h | 7 ++++---
+ drivers/gpu/drm/scheduler/tests/tests_basic.c | 4 ++--
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+index 65acffc3fea82..8e9ae7d980eb2 100644
+--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
++++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+@@ -219,7 +219,7 @@ mock_sched_timedout_job(struct drm_sched_job *sched_job)
+ unsigned long flags;
+
+ if (job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET) {
+- job->flags &= ~DRM_MOCK_SCHED_JOB_DONT_RESET;
++ job->flags |= DRM_MOCK_SCHED_JOB_RESET_SKIPPED;
+ return DRM_GPU_SCHED_STAT_NO_HANG;
+ }
+
+diff --git a/drivers/gpu/drm/scheduler/tests/sched_tests.h b/drivers/gpu/drm/scheduler/tests/sched_tests.h
+index 63d4f2ac70749..5b262126b7760 100644
+--- a/drivers/gpu/drm/scheduler/tests/sched_tests.h
++++ b/drivers/gpu/drm/scheduler/tests/sched_tests.h
+@@ -95,9 +95,10 @@ struct drm_mock_sched_job {
+
+ struct completion done;
+
+-#define DRM_MOCK_SCHED_JOB_DONE 0x1
+-#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2
+-#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4
++#define DRM_MOCK_SCHED_JOB_DONE 0x1
++#define DRM_MOCK_SCHED_JOB_TIMEDOUT 0x2
++#define DRM_MOCK_SCHED_JOB_DONT_RESET 0x4
++#define DRM_MOCK_SCHED_JOB_RESET_SKIPPED 0x8
+ unsigned long flags;
+
+ struct list_head link;
+diff --git a/drivers/gpu/drm/scheduler/tests/tests_basic.c b/drivers/gpu/drm/scheduler/tests/tests_basic.c
+index 55eb142bd7c5d..82a41a456b0a8 100644
+--- a/drivers/gpu/drm/scheduler/tests/tests_basic.c
++++ b/drivers/gpu/drm/scheduler/tests/tests_basic.c
+@@ -317,8 +317,8 @@ static void drm_sched_skip_reset(struct kunit *test)
+ KUNIT_ASSERT_FALSE(test, done);
+
+ KUNIT_ASSERT_EQ(test,
+- job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET,
+- 0);
++ job->flags & DRM_MOCK_SCHED_JOB_RESET_SKIPPED,
++ DRM_MOCK_SCHED_JOB_RESET_SKIPPED);
+
+ i = drm_mock_sched_advance(sched, 1);
+ KUNIT_ASSERT_EQ(test, i, 1);
+--
+2.51.0
+
--- /dev/null
+From f994869234875773886741cdb004cdff55ee1835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 23:35:26 +0100
+Subject: drm/vmwgfx: fix missing assignment to ts
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 33f8f321e7aa7715ce19560801ee5223ba8b9a7d ]
+
+The assignment to ts is missing on the call to ktime_to_timespec64.
+Fix this by adding the missing assignment.
+
+Fixes: db6a94b26354 ("drm/vmwgfx: Implement dma_fence_ops properly")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250623223526.281398-1-colin.i.king@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index c2294abbe7534..00be92da55097 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -538,7 +538,7 @@ static void vmw_event_fence_action_seq_passed(struct dma_fence *f,
+ if (likely(eaction->tv_sec != NULL)) {
+ struct timespec64 ts;
+
+- ktime_to_timespec64(f->timestamp);
++ ts = ktime_to_timespec64(f->timestamp);
+ /* monotonic time, so no y2038 overflow */
+ *eaction->tv_sec = ts.tv_sec;
+ *eaction->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+--
+2.51.0
+
--- /dev/null
+From afa9985de0f8909bcf566ca515462335810c8d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:21:33 -0500
+Subject: dt-bindings: vendor-prefixes: Add undocumented vendor prefixes
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 4ed46073274a5b23baf0b992c459762e28faf549 ]
+
+Add various vendor prefixes which are in use in compatible strings
+already. These were found by modifying vendor-prefixes.yaml into a
+schema to check compatible strings.
+
+The added prefixes doesn't include various duplicate prefixes in use
+such as "lge".
+
+Link: https://lore.kernel.org/r/20250821222136.1027269-1-robh@kernel.org
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/vendor-prefixes.yaml | 50 +++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+index 9ec8947dfcad2..ed7fec614473d 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -86,6 +86,8 @@ patternProperties:
+ description: Allegro DVT
+ "^allegromicro,.*":
+ description: Allegro MicroSystems, Inc.
++ "^alliedtelesis,.*":
++ description: Allied Telesis, Inc.
+ "^alliedvision,.*":
+ description: Allied Vision Technologies GmbH
+ "^allo,.*":
+@@ -229,6 +231,8 @@ patternProperties:
+ description: Bitmain Technologies
+ "^blaize,.*":
+ description: Blaize, Inc.
++ "^bluegiga,.*":
++ description: Bluegiga Technologies Ltd.
+ "^blutek,.*":
+ description: BluTek Power
+ "^boe,.*":
+@@ -247,6 +251,8 @@ patternProperties:
+ description: Bticino International
+ "^buffalo,.*":
+ description: Buffalo, Inc.
++ "^buglabs,.*":
++ description: Bug Labs, Inc.
+ "^bur,.*":
+ description: B&R Industrial Automation GmbH
+ "^bytedance,.*":
+@@ -325,6 +331,8 @@ patternProperties:
+ description: Conexant Systems, Inc.
+ "^colorfly,.*":
+ description: Colorful GRP, Shenzhen Xueyushi Technology Ltd.
++ "^compal,.*":
++ description: Compal Electronics, Inc.
+ "^compulab,.*":
+ description: CompuLab Ltd.
+ "^comvetia,.*":
+@@ -353,6 +361,8 @@ patternProperties:
+ description: Guangzhou China Star Optoelectronics Technology Co., Ltd
+ "^csq,.*":
+ description: Shenzen Chuangsiqi Technology Co.,Ltd.
++ "^csr,.*":
++ description: Cambridge Silicon Radio
+ "^ctera,.*":
+ description: CTERA Networks Intl.
+ "^ctu,.*":
+@@ -455,6 +465,8 @@ patternProperties:
+ description: Emtop Embedded Solutions
+ "^eeti,.*":
+ description: eGalax_eMPIA Technology Inc
++ "^egnite,.*":
++ description: egnite GmbH
+ "^einfochips,.*":
+ description: Einfochips
+ "^eink,.*":
+@@ -485,8 +497,12 @@ patternProperties:
+ description: Empire Electronix
+ "^emtrion,.*":
+ description: emtrion GmbH
++ "^enbw,.*":
++ description: Energie Baden-Württemberg AG
+ "^enclustra,.*":
+ description: Enclustra GmbH
++ "^endian,.*":
++ description: Endian SRL
+ "^endless,.*":
+ description: Endless Mobile, Inc.
+ "^ene,.*":
+@@ -554,6 +570,8 @@ patternProperties:
+ description: FocalTech Systems Co.,Ltd
+ "^forlinx,.*":
+ description: Baoding Forlinx Embedded Technology Co., Ltd.
++ "^foxlink,.*":
++ description: Foxlink Group
+ "^freebox,.*":
+ description: Freebox SAS
+ "^freecom,.*":
+@@ -642,6 +660,10 @@ patternProperties:
+ description: Haoyu Microelectronic Co. Ltd.
+ "^hardkernel,.*":
+ description: Hardkernel Co., Ltd
++ "^hce,.*":
++ description: HCE Engineering SRL
++ "^headacoustics,.*":
++ description: HEAD acoustics
+ "^hechuang,.*":
+ description: Shenzhen Hechuang Intelligent Co.
+ "^hideep,.*":
+@@ -725,6 +747,8 @@ patternProperties:
+ description: Shenzhen INANBO Electronic Technology Co., Ltd.
+ "^incircuit,.*":
+ description: In-Circuit GmbH
++ "^incostartec,.*":
++ description: INCOstartec GmbH
+ "^indiedroid,.*":
+ description: Indiedroid
+ "^inet-tek,.*":
+@@ -933,6 +957,8 @@ patternProperties:
+ description: Maxim Integrated Products
+ "^maxlinear,.*":
+ description: MaxLinear Inc.
++ "^maxtor,.*":
++ description: Maxtor Corporation
+ "^mbvl,.*":
+ description: Mobiveil Inc.
+ "^mcube,.*":
+@@ -1096,6 +1122,8 @@ patternProperties:
+ description: Nordic Semiconductor
+ "^nothing,.*":
+ description: Nothing Technology Limited
++ "^novatech,.*":
++ description: NovaTech Automation
+ "^novatek,.*":
+ description: Novatek
+ "^novtech,.*":
+@@ -1191,6 +1219,8 @@ patternProperties:
+ description: Pervasive Displays, Inc.
+ "^phicomm,.*":
+ description: PHICOMM Co., Ltd.
++ "^phontech,.*":
++ description: Phontech
+ "^phytec,.*":
+ description: PHYTEC Messtechnik GmbH
+ "^picochip,.*":
+@@ -1275,6 +1305,8 @@ patternProperties:
+ description: Ramtron International
+ "^raspberrypi,.*":
+ description: Raspberry Pi Foundation
++ "^raumfeld,.*":
++ description: Raumfeld GmbH
+ "^raydium,.*":
+ description: Raydium Semiconductor Corp.
+ "^rda,.*":
+@@ -1313,6 +1345,8 @@ patternProperties:
+ description: ROHM Semiconductor Co., Ltd
+ "^ronbo,.*":
+ description: Ronbo Electronics
++ "^ronetix,.*":
++ description: Ronetix GmbH
+ "^roofull,.*":
+ description: Shenzhen Roofull Technology Co, Ltd
+ "^roseapplepi,.*":
+@@ -1339,8 +1373,12 @@ patternProperties:
+ description: Schindler
+ "^schneider,.*":
+ description: Schneider Electric
++ "^schulercontrol,.*":
++ description: Schuler Group
+ "^sciosense,.*":
+ description: ScioSense B.V.
++ "^sdmc,.*":
++ description: SDMC Technology Co., Ltd
+ "^seagate,.*":
+ description: Seagate Technology PLC
+ "^seeed,.*":
+@@ -1379,6 +1417,8 @@ patternProperties:
+ description: Si-En Technology Ltd.
+ "^si-linux,.*":
+ description: Silicon Linux Corporation
++ "^sielaff,.*":
++ description: Sielaff GmbH & Co.
+ "^siemens,.*":
+ description: Siemens AG
+ "^sifive,.*":
+@@ -1447,6 +1487,8 @@ patternProperties:
+ description: SolidRun
+ "^solomon,.*":
+ description: Solomon Systech Limited
++ "^somfy,.*":
++ description: Somfy Systems Inc.
+ "^sony,.*":
+ description: Sony Corporation
+ "^sophgo,.*":
+@@ -1517,6 +1559,8 @@ patternProperties:
+ "^synopsys,.*":
+ description: Synopsys, Inc. (deprecated, use snps)
+ deprecated: true
++ "^taos,.*":
++ description: Texas Advanced Optoelectronic Solutions Inc.
+ "^tbs,.*":
+ description: TBS Technologies
+ "^tbs-biometrics,.*":
+@@ -1547,6 +1591,8 @@ patternProperties:
+ description: Teltonika Networks
+ "^tempo,.*":
+ description: Tempo Semiconductor
++ "^tenda,.*":
++ description: Shenzhen Tenda Technology Co., Ltd.
+ "^terasic,.*":
+ description: Terasic Inc.
+ "^tesla,.*":
+@@ -1650,6 +1696,8 @@ patternProperties:
+ description: V3 Semiconductor
+ "^vaisala,.*":
+ description: Vaisala
++ "^valve,.*":
++ description: Valve Corporation
+ "^vamrs,.*":
+ description: Vamrs Ltd.
+ "^variscite,.*":
+@@ -1750,6 +1798,8 @@ patternProperties:
+ description: Extreme Engineering Solutions (X-ES)
+ "^xiaomi,.*":
+ description: Xiaomi Technology Co., Ltd.
++ "^xicor,.*":
++ description: Xicor Inc.
+ "^xillybus,.*":
+ description: Xillybus Ltd.
+ "^xingbangda,.*":
+--
+2.51.0
+
--- /dev/null
+From 4e158d638ca7ccaca3f85b152e59f4074e55cc90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 17:29:54 +0800
+Subject: dts: arm: amlogic: fix pwm node for c3
+
+From: Xianwei Zhao <xianwei.zhao@amlogic.com>
+
+[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ]
+
+Fix reg address for c3 pwm node.
+
+Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM")
+Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250717-fix-pwm-node-v2-1-7365ac7d5320@amlogic.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+index cb9ea3ca6ee0f..71b2b3b547f7c 100644
+--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
++++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+@@ -792,7 +792,7 @@ spicc1: spi@52000 {
+ pwm_mn: pwm@54000 {
+ compatible = "amlogic,c3-pwm",
+ "amlogic,meson-s4-pwm";
+- reg = <0x0 54000 0x0 0x24>;
++ reg = <0x0 0x54000 0x0 0x24>;
+ clocks = <&clkc_periphs CLKID_PWM_M>,
+ <&clkc_periphs CLKID_PWM_N>;
+ #pwm-cells = <3>;
+--
+2.51.0
+
--- /dev/null
+From 9b7ae8f961a7c51533f229eada69bdb613f980d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:57:07 +0800
+Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
+
+When loading the i10nm_edac driver on some Intel Granite Rapids servers,
+a call trace may appear as follows:
+
+ UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
+ shift exponent -66 is negative
+ ...
+ __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
+ skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
+ i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
+ skx_register_mci+0x159/0x220 [skx_edac_common]
+ i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
+ ...
+
+This occurs because some BIOS may disable a memory controller if there
+aren't any memory DIMMs populated on this memory controller. The DIMMMTR
+register of this disabled memory controller contains the invalid value
+~0, resulting in the call trace above.
+
+Fix this call trace by skipping DIMM enumeration on a disabled memory
+controller.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
+Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index bf4171ac191d3..9d00f247f4e0e 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -1057,6 +1057,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
+ return !!GET_BITFIELD(mcmtr, 2, 2);
+ }
+
++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
++{
++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
++
++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
++
++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
++}
++
+ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ struct res_config *cfg)
+ {
+@@ -1070,6 +1079,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ if (!imc->mbase)
+ continue;
+
++ if (i10nm_channel_disabled(imc, i)) {
++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
++ continue;
++ }
++
+ ndimms = 0;
+
+ if (res_cfg->type != GNR)
+--
+2.51.0
+
--- /dev/null
+From faacb472a62f8d6f85376334d4bf9899e06d0615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:54:29 +0200
+Subject: efi: Explain OVMF acronym in OVMF_DEBUG_LOG help text
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 05e75ac35ee9e38f96bbfebf1830ec2cace2e7f8 ]
+
+People not very intimate with EFI may not know the meaning of the OVMF
+acronym. Write it in full, to help users with making good decisions
+when configuring their kernels.
+
+Fixes: f393a761763c5427 ("efi: add ovmf debug log driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Richard Lyu <richard.lyu@suse.com>
+Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
+index d528c94c5859b..29e0729299f5b 100644
+--- a/drivers/firmware/efi/Kconfig
++++ b/drivers/firmware/efi/Kconfig
+@@ -267,9 +267,10 @@ config OVMF_DEBUG_LOG
+ bool "Expose OVMF firmware debug log via sysfs"
+ depends on EFI
+ help
+- Recent OVMF versions (edk2-stable202508 + newer) can write
+- their debug log to a memory buffer. This driver exposes the
+- log content via sysfs (/sys/firmware/efi/ovmf_debug_log).
++ Recent versions of the Open Virtual Machine Firmware
++ (edk2-stable202508 + newer) can write their debug log to a memory
++ buffer. This driver exposes the log content via sysfs
++ (/sys/firmware/efi/ovmf_debug_log).
+
+ config UNACCEPTED_MEMORY
+ bool
+--
+2.51.0
+
--- /dev/null
+From b22ce4c634b8f8f486d96abc808dd1c78c148391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:48:51 +0800
+Subject: erofs: avoid reading more for fragment maps
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 ]
+
+Since all real encoded extents (directly handled by the decompression
+subsystem) have a sane, limited maximum decoded length
+(Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied
+if needed.
+
+However, it makes no sense to read more for non-encoded maps, such as
+fragment extents, since such extents can be huge (up to i_size) and
+there is no benefit to reading more at this layer.
+
+For normal images, it does not really matter, but for crafted images
+generated by syzbot, excessively large fragment extents can cause
+read-more to run for an overly long time.
+
+Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com
+Fixes: b44686c8391b ("erofs: fix large fragment handling")
+Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data")
+Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 2d73297003d25..625b8ae8f67f0 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -1835,7 +1835,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
+ map->m_la = end;
+ err = z_erofs_map_blocks_iter(inode, map,
+ EROFS_GET_BLOCKS_READMORE);
+- if (err)
++ if (err || !(map->m_flags & EROFS_MAP_ENCODED))
+ return;
+
+ /* expand ra for the trailing edge if readahead */
+@@ -1847,7 +1847,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
+ end = round_up(end, PAGE_SIZE);
+ } else {
+ end = round_up(map->m_la, PAGE_SIZE);
+- if (!map->m_llen)
++ if (!(map->m_flags & EROFS_MAP_ENCODED) || !map->m_llen)
+ return;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f910a78c4e9df4b9e1776767abb1c108cf438c44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:03:38 +0800
+Subject: f2fs: fix condition in __allow_reserved_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
+
+If reserve_root mount option is not assigned, __allow_reserved_blocks()
+will return false, it's not correct, fix it.
+
+Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index b4b62ac46bc64..dac7d44885e47 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2361,8 +2361,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+ {
+ if (!inode)
+ return true;
+- if (!test_opt(sbi, RESERVE_ROOT))
+- return false;
+ if (IS_NOQUOTA(inode))
+ return true;
+ if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
+@@ -2383,7 +2381,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+ avail_user_block_count = sbi->user_block_count -
+ sbi->current_reserved_blocks;
+
+- if (!__allow_reserved_blocks(sbi, inode, cap))
++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
+ avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+--
+2.51.0
+
--- /dev/null
+From cff0634e0281875732cb4c23d7316927cde1de0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 10:09:39 +0800
+Subject: f2fs: fix to allow removing qf_name
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit ff11d8701b77e303593fd86cf9ef74ef3ac4048e ]
+
+The mount behavior changed after commit d18535132523 ("f2fs: separate the
+options parsing and options checking"), let's fix it.
+
+[Scripts]
+mkfs.f2fs -f /dev/vdb
+mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs
+quotacheck -uc /mnt/f2fs
+umount /mnt/f2fs
+mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs
+mount|grep f2fs
+mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs
+mount|grep f2fs
+dmesg
+
+[Before commit]
+mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
+mount#2: ...,quota,jqfmt=vfsold,...
+kmsg: no output
+
+[After commit]
+mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
+mount#2: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
+kmsg: "user quota file already specified"
+
+[After patch]
+mount#1: ...,quota,jqfmt=vfsold,usrjquota=aquota.user,...
+mount#2: ...,quota,jqfmt=vfsold,...
+kmsg: "remove qf_name aquota.user"
+
+Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")
+Cc: Hongbo Li <lihongbo22@huawei.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index bf0497187bdff..8086a3456e4d3 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1189,8 +1189,11 @@ static int f2fs_check_quota_consistency(struct fs_context *fc,
+ goto err_jquota_change;
+
+ if (old_qname) {
+- if (new_qname &&
+- strcmp(old_qname, new_qname) == 0) {
++ if (!new_qname) {
++ f2fs_info(sbi, "remove qf_name %s",
++ old_qname);
++ continue;
++ } else if (strcmp(old_qname, new_qname) == 0) {
+ ctx->qname_mask &= ~(1 << i);
+ continue;
+ }
+--
+2.51.0
+
--- /dev/null
+From 919ba3fd4ade6fcfbe95f7d3ac65c29d3f341cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 10:04:15 +0800
+Subject: f2fs: fix to avoid migrating empty section
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit d625a2b08c089397d3a03bff13fa8645e4ec7a01 ]
+
+It reports a bug from device w/ zufs:
+
+F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT
+F2FS-fs (dm-64): Stopped filesystem due to reason: 4
+
+Thread A Thread B
+- f2fs_expand_inode_data
+ - f2fs_allocate_pinning_section
+ - f2fs_gc_range
+ - do_garbage_collect w/ segno #x
+ - writepage
+ - f2fs_allocate_data_block
+ - new_curseg
+ - allocate segno #x
+
+The root cause is: fallocate on pinning file may race w/ block allocation
+as above, result in do_garbage_collect() from fallocate() may migrate
+segment which is just allocated by a log, the log will update segment type
+in its in-memory structure, however GC will get segment type from on-disk
+SSA block, once segment type changes by log, we can detect such
+inconsistency, then shutdown filesystem.
+
+In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE),
+however segno #173822 was just allocated as data type segment, so in-memory
+SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA).
+
+Change as below to fix this issue:
+- check whether current section is empty before gc
+- add sanity checks on do_garbage_collect() to avoid any race case, result
+in migrating segment used by log.
+- btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA".
+
+Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices")
+Cc: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index c0f209f746882..5734e03864685 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1794,6 +1794,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+ struct folio *sum_folio = filemap_get_folio(META_MAPPING(sbi),
+ GET_SUM_BLOCK(sbi, segno));
+
++ if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno))) {
++ f2fs_err(sbi, "%s: segment %u is used by log",
++ __func__, segno);
++ f2fs_bug_on(sbi, 1);
++ goto skip;
++ }
++
+ if (get_valid_blocks(sbi, segno, false) == 0)
+ goto freed;
+ if (gc_type == BG_GC && __is_large_section(sbi) &&
+@@ -1805,7 +1812,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+
+ sum = folio_address(sum_folio);
+ if (type != GET_SUM_TYPE((&sum->footer))) {
+- f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SSA and SIT",
++ f2fs_err(sbi, "Inconsistent segment (%u) type [%d, %d] in SIT and SSA",
+ segno, type, GET_SUM_TYPE((&sum->footer)));
+ f2fs_stop_checkpoint(sbi, false,
+ STOP_CP_REASON_CORRUPTED_SUMMARY);
+@@ -2068,6 +2075,13 @@ int f2fs_gc_range(struct f2fs_sb_info *sbi,
+ .iroot = RADIX_TREE_INIT(gc_list.iroot, GFP_NOFS),
+ };
+
++ /*
++ * avoid migrating empty section, as it can be allocated by
++ * log in parallel.
++ */
++ if (!get_valid_blocks(sbi, segno, true))
++ continue;
++
+ if (is_cursec(sbi, GET_SEC_FROM_SEG(sbi, segno)))
+ continue;
+
+--
+2.51.0
+
--- /dev/null
+From b69044f23b43d9b0769db8882d4a750fd6570e76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 10:09:38 +0800
+Subject: f2fs: fix to avoid NULL pointer dereference in
+ f2fs_check_quota_consistency()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 930a9a6ee8e7ffa20af4bffbfc2bbd21d83bf81c ]
+
+syzbot reported a f2fs bug as below:
+
+Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
+KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)}
+RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284
+Call Trace:
+ <TASK>
+ f2fs_check_quota_consistency fs/f2fs/super.c:1188 [inline]
+ f2fs_check_opt_consistency+0x1378/0x2c10 fs/f2fs/super.c:1436
+ __f2fs_remount fs/f2fs/super.c:2653 [inline]
+ f2fs_reconfigure+0x482/0x1770 fs/f2fs/super.c:5297
+ reconfigure_super+0x224/0x890 fs/super.c:1077
+ do_remount fs/namespace.c:3314 [inline]
+ path_mount+0xd18/0xfe0 fs/namespace.c:4112
+ do_mount fs/namespace.c:4133 [inline]
+ __do_sys_mount fs/namespace.c:4344 [inline]
+ __se_sys_mount+0x317/0x410 fs/namespace.c:4321
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+The direct reason is f2fs_check_quota_consistency() may suffer null-ptr-deref
+issue in strcmp().
+
+The bug can be reproduced w/ below scripts:
+mkfs.f2fs -f /dev/vdb
+mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs
+quotacheck -uc /mnt/f2fs/
+umount /mnt/f2fs
+mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs
+mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs
+umount /mnt/f2fs
+
+So, before old_qname and new_qname comparison, we need to check whether
+they are all valid pointers, fix it.
+
+Reported-by: syzbot+d371efea57d5aeab877b@syzkaller.appspotmail.com
+Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")
+Closes: https://lore.kernel.org/linux-f2fs-devel/689ff889.050a0220.e29e5.0037.GAE@google.com
+Cc: Hongbo Li <lihongbo22@huawei.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 9f2ae3ac6078e..bf0497187bdff 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1189,7 +1189,8 @@ static int f2fs_check_quota_consistency(struct fs_context *fc,
+ goto err_jquota_change;
+
+ if (old_qname) {
+- if (strcmp(old_qname, new_qname) == 0) {
++ if (new_qname &&
++ strcmp(old_qname, new_qname) == 0) {
+ ctx->qname_mask &= ~(1 << i);
+ continue;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4b3c04ee2b4b0d4f15d0395eb79e8fe1f1ad2526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 14:29:10 +0800
+Subject: f2fs: fix to avoid overflow while left shift operation
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0fe1c6bec54ea68ed8c987b3890f2296364e77bb ]
+
+Should cast type of folio->index from pgoff_t to loff_t to avoid overflow
+while left shift operation.
+
+Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 5c1f47e45dab4..6cd8902849cf6 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1245,7 +1245,7 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
+
+ for (i = cluster_size - 1; i >= 0; i--) {
+ struct folio *folio = page_folio(rpages[i]);
+- loff_t start = folio->index << PAGE_SHIFT;
++ loff_t start = (loff_t)folio->index << PAGE_SHIFT;
+
+ if (from <= start) {
+ folio_zero_segment(folio, 0, folio_size(folio));
+--
+2.51.0
+
--- /dev/null
+From 8b5f042340daad4c087d533c5049a59080ea9c64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:48:35 +0800
+Subject: f2fs: fix to clear unusable_cap for checkpoint=enable
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 2e8f4c2b2bb12fc3d40762f1bb778e95c6ddbc93 ]
+
+mount -t f2fs -o checkpoint=disable:10% /dev/vdb /mnt/f2fs/
+mount -t f2fs -o remount,checkpoint=enable /dev/vdb /mnt/f2fs/
+
+kernel log:
+F2FS-fs (vdb): Adjust unusable cap for checkpoint=disable = 204440 / 10%
+
+If we has assigned checkpoint=enable mount option, unusable_cap{,_perc}
+parameters of checkpoint=disable should be reset, then calculation and
+log print could be avoid in adjust_unusable_cap_perc().
+
+Fixes: 1ae18f71cb52 ("f2fs: fix checkpoint=disable:%u%%")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index e16c4e2830c29..9f2ae3ac6078e 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -988,6 +988,10 @@ static int f2fs_parse_param(struct fs_context *fc, struct fs_parameter *param)
+ ctx_set_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT);
+ break;
+ case Opt_checkpoint_enable:
++ F2FS_CTX_INFO(ctx).unusable_cap_perc = 0;
++ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap_perc;
++ F2FS_CTX_INFO(ctx).unusable_cap = 0;
++ ctx->spec_mask |= F2FS_SPEC_checkpoint_disable_cap;
+ ctx_clear_opt(ctx, F2FS_MOUNT_DISABLE_CHECKPOINT);
+ break;
+ default:
+--
+2.51.0
+
--- /dev/null
+From 39a25369a03715408c572f8f5982a06c785e8f64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 10:47:09 +0800
+Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
+
+f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
+and page lookup, change as below to mitigate its overhead:
+- check new_size before grabbing invalidate_lock
+- lookup and invalidate pages only in range of [old_size, new_size]
+
+Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 1aae4361d0a89..ffa045b39c01d 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -35,15 +35,23 @@
+ #include <trace/events/f2fs.h>
+ #include <uapi/linux/f2fs.h>
+
+-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
++static void f2fs_zero_post_eof_page(struct inode *inode,
++ loff_t new_size, bool lock)
+ {
+ loff_t old_size = i_size_read(inode);
+
+ if (old_size >= new_size)
+ return;
+
++ if (mapping_empty(inode->i_mapping))
++ return;
++
++ if (lock)
++ filemap_invalidate_lock(inode->i_mapping);
+ /* zero or drop pages only in range of [old_size, new_size] */
+- truncate_pagecache(inode, old_size);
++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
++ if (lock)
++ filemap_invalidate_unlock(inode->i_mapping);
+ }
+
+ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+@@ -114,9 +122,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+
+ f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
+
+ file_update_time(vmf->vma->vm_file);
+ filemap_invalidate_lock_shared(inode->i_mapping);
+@@ -1149,7 +1155,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ filemap_invalidate_lock(inode->i_mapping);
+
+ if (attr->ia_size > old_size)
+- f2fs_zero_post_eof_page(inode, attr->ia_size);
++ f2fs_zero_post_eof_page(inode, attr->ia_size, false);
+ truncate_setsize(inode, attr->ia_size);
+
+ if (attr->ia_size <= old_size)
+@@ -1268,9 +1274,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1555,7 +1559,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(inode->i_mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+
+ f2fs_lock_op(sbi);
+ f2fs_drop_extent_tree(inode);
+@@ -1678,9 +1682,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1814,7 +1816,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+ truncate_pagecache(inode, offset);
+
+ while (!ret && idx > pg_start) {
+@@ -1872,9 +1874,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ f2fs_balance_fs(sbi, true);
+
+@@ -4922,9 +4922,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode,
++ iocb->ki_pos + iov_iter_count(from), true);
+ return count;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3a933f49850a4669d069c348a99eb843e03d94f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:40:24 +0800
+Subject: f2fs: fix to truncate first page in error path of f2fs_truncate()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
+
+syzbot reports a bug as below:
+
+loop0: detected capacity change from 0 to 40427
+F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
+F2FS-fs (loop0): invalid crc value
+F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
+------------[ cut here ]------------
+kernel BUG at fs/inode.c:753!
+RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
+Call Trace:
+ <TASK>
+ evict+0x504/0x9c0 fs/inode.c:810
+ f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
+ get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
+ vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
+ do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
+ do_mount fs/namespace.c:4136 [inline]
+ __do_sys_mount fs/namespace.c:4347 [inline]
+ __se_sys_mount+0x317/0x410 fs/namespace.c:4324
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
+all page cache before destorying inode, that is because in below path, we
+will create page #0 in cache, but missed to drop it in error path, let's fix
+it.
+
+- evict
+ - f2fs_evict_inode
+ - f2fs_truncate
+ - f2fs_convert_inline_inode
+ - f2fs_grab_cache_folio
+ : create page #0 in cache
+ - f2fs_convert_inline_folio
+ : sanity check failed, return -EFSCORRUPTED
+ - clear_inode detects that inode->i_data.nrpages is not zero
+
+Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
+Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 42faaed6a02da..1aae4361d0a89 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -904,8 +904,16 @@ int f2fs_truncate(struct inode *inode)
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+- if (err)
++ if (err) {
++ /*
++ * Always truncate page #0 to avoid page cache
++ * leak in evict() path.
++ */
++ truncate_inode_pages_range(inode->i_mapping,
++ F2FS_BLK_TO_BYTES(0),
++ F2FS_BLK_END_BYTES(0));
+ return err;
++ }
+ }
+
+ err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
+--
+2.51.0
+
--- /dev/null
+From f7ce1c6b4d6736e4c54885bc7cb91d0adbe1a444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:12:50 +0800
+Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
+
+Script to reproduce:
+mkfs.f2fs -O extra_attr,compression /dev/vdb -f
+mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
+cd /mnt/f2fs
+f2fs_io write 1 0 1024 rand dsync testfile
+xfs_io testfile -c "fsync"
+f2fs_io write 1 0 512 rand dsync testfile
+xfs_io testfile -c "fsync"
+cd /
+umount /mnt/f2fs
+mount /dev/vdb /mnt/f2fs
+f2fs_io precache_extents /mnt/f2fs/testfile
+umount /mnt/f2fs
+
+Tracepoint output:
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
+
+During precache_extents, there is off-by-one issue, we should update
+map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
+valid and not contiguous to previous extent.
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 7961e0ddfca3a..838eae39d3b19 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1783,7 +1783,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+- *map->m_next_extent = pgofs + 1;
++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+ }
+ f2fs_put_dnode(&dn);
+ unlock_out:
+--
+2.51.0
+
--- /dev/null
+From c3a746529b1a33f2ed2ae8a25dd9839887cdf8e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:11:06 +0800
+Subject: f2fs: fix to zero data after EOF for compressed file correctly
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0b2cd5092139f499544c77b5107a74e5fdb3a386 ]
+
+generic/091 may fail, then it bisects to the bad commit ba8dac350faf
+("f2fs: fix to zero post-eof page").
+
+What will cause generic/091 to fail is something like below Testcase #1:
+1. write 16k as compressed blocks
+2. truncate to 12k
+3. truncate to 20k
+4. verify data in range of [12k, 16k], however data is not zero as
+expected
+
+Script of Testcase #1
+mkfs.f2fs -f -O extra_attr,compression /dev/vdb
+mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
+dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
+dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
+sync
+truncate -s $((12*1024)) /mnt/f2fs/file
+truncate -s $((20*1024)) /mnt/f2fs/file
+dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
+od /mnt/f2fs/data
+umount /mnt/f2fs
+
+Analisys:
+in step 2), we will redirty all data pages from #0 to #3 in compressed
+cluster, and zero page #3,
+in step 3), f2fs_setattr() will call f2fs_zero_post_eof_page() to drop
+all page cache post eof, includeing dirtied page #3,
+in step 4) when we read data from page #3, it will decompressed cluster
+and extra random data to page #3, finally, we hit the non-zeroed data
+post eof.
+
+However, the commit ba8dac350faf ("f2fs: fix to zero post-eof page") just
+let the issue be reproduced easily, w/o the commit, it can reproduce this
+bug w/ below Testcase #2:
+1. write 16k as compressed blocks
+2. truncate to 8k
+3. truncate to 12k
+4. truncate to 20k
+5. verify data in range of [12k, 16k], however data is not zero as
+expected
+
+Script of Testcase #2
+mkfs.f2fs -f -O extra_attr,compression /dev/vdb
+mount -t f2fs -o compress_extension=* /dev/vdb /mnt/f2fs
+dd if=/dev/zero of=/mnt/f2fs/file bs=12k count=1
+dd if=/dev/random of=/mnt/f2fs/file bs=4k count=1 seek=3 conv=notrunc
+sync
+truncate -s $((8*1024)) /mnt/f2fs/file
+truncate -s $((12*1024)) /mnt/f2fs/file
+truncate -s $((20*1024)) /mnt/f2fs/file
+echo 3 > /proc/sys/vm/drop_caches
+dd if=/mnt/f2fs/file of=/mnt/f2fs/data bs=4k count=1 skip=3
+od /mnt/f2fs/data
+umount /mnt/f2fs
+
+Anlysis:
+in step 2), we will redirty all data pages from #0 to #3 in compressed
+cluster, and zero page #2 and #3,
+in step 3), we will truncate page #3 in page cache,
+in step 4), expand file size,
+in step 5), hit random data post eof w/ the same reason in Testcase #1.
+
+Root Cause:
+In f2fs_truncate_partial_cluster(), after we truncate partial data block
+on compressed cluster, all pages in cluster including the one post eof
+will be dirtied, after another tuncation, dirty page post eof will be
+dropped, however on-disk compressed cluster is still valid, it may
+include non-zero data post eof, result in exposing previous non-zero data
+post eof while reading.
+
+Fix:
+In f2fs_truncate_partial_cluster(), let change as below to fix:
+- call filemap_write_and_wait_range() to flush dirty page
+- call truncate_pagecache() to drop pages or zero partial page post eof
+- call f2fs_do_truncate_blocks() to truncate non-compress cluster to
+ last valid block
+
+Fixes: 3265d3db1f16 ("f2fs: support partial truncation on compressed inode")
+Reported-by: Jan Prusakowski <jprusakowski@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 6cd8902849cf6..72bc05b913af7 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1246,19 +1246,28 @@ int f2fs_truncate_partial_cluster(struct inode *inode, u64 from, bool lock)
+ for (i = cluster_size - 1; i >= 0; i--) {
+ struct folio *folio = page_folio(rpages[i]);
+ loff_t start = (loff_t)folio->index << PAGE_SHIFT;
++ loff_t offset = from > start ? from - start : 0;
+
+- if (from <= start) {
+- folio_zero_segment(folio, 0, folio_size(folio));
+- } else {
+- folio_zero_segment(folio, from - start,
+- folio_size(folio));
++ folio_zero_segment(folio, offset, folio_size(folio));
++
++ if (from >= start)
+ break;
+- }
+ }
+
+ f2fs_compress_write_end(inode, fsdata, start_idx, true);
++
++ err = filemap_write_and_wait_range(inode->i_mapping,
++ round_down(from, cluster_size << PAGE_SHIFT),
++ LLONG_MAX);
++ if (err)
++ return err;
++
++ truncate_pagecache(inode, from);
++
++ err = f2fs_do_truncate_blocks(inode,
++ round_up(from, PAGE_SIZE), lock);
+ }
+- return 0;
++ return err;
+ }
+
+ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+--
+2.51.0
+
--- /dev/null
+From ecd7cf182b123ce66555f91604902752f7b74e38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 18:24:22 +0800
+Subject: f2fs: fix UAF issue in f2fs_merge_page_bio()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit edf7e9040fc52c922db947f9c6c36f07377c52ea ]
+
+As JY reported in bugzilla [1],
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98
+lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4
+CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5
+Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+Workqueue: writeback wb_workfn (flush-254:49)
+Call trace:
+ f2fs_is_cp_guaranteed+0x70/0x98
+ f2fs_inplace_write_data+0x174/0x2f4
+ f2fs_do_write_data_page+0x214/0x81c
+ f2fs_write_single_data_page+0x28c/0x764
+ f2fs_write_data_pages+0x78c/0xce4
+ do_writepages+0xe8/0x2fc
+ __writeback_single_inode+0x4c/0x4b4
+ writeback_sb_inodes+0x314/0x540
+ __writeback_inodes_wb+0xa4/0xf4
+ wb_writeback+0x160/0x448
+ wb_workfn+0x2f0/0x5dc
+ process_scheduled_works+0x1c8/0x458
+ worker_thread+0x334/0x3f0
+ kthread+0x118/0x1ac
+ ret_from_fork+0x10/0x20
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575
+
+The panic was caused by UAF issue w/ below race condition:
+
+kworker
+- writepages
+ - f2fs_write_cache_pages
+ - f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+ - f2fs_inplace_write_data
+ - f2fs_merge_page_bio
+ - add_inu_page
+ : cache page #1 into bio & cache bio in
+ io->bio_list
+ - f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+ - f2fs_inplace_write_data
+ - f2fs_merge_page_bio
+ - add_inu_page
+ : cache page #2 into bio which is linked
+ in io->bio_list
+ write
+ - f2fs_write_begin
+ : write page #1
+ - f2fs_folio_wait_writeback
+ - f2fs_submit_merged_ipu_write
+ - f2fs_submit_write_bio
+ : submit bio which inclues page #1 and #2
+
+ software IRQ
+ - f2fs_write_end_io
+ - fscrypt_free_bounce_page
+ : freed bounced page which belongs to page #2
+ - inc_page_count( , WB_DATA_TYPE(data_folio), false)
+ : data_folio points to fio->encrypted_page
+ the bounced page can be freed before
+ accessing it in f2fs_is_cp_guarantee()
+
+It can reproduce w/ below testcase:
+Run below script in shell #1:
+for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
+-c "pwrite 0 32k" -c "fdatasync"
+
+Run below script in shell #2:
+for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
+-c "pwrite 0 32k" -c "fdatasync"
+
+So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after
+commit page into internal ipu cache.
+
+Fixes: 0b20fcec8651 ("f2fs: cache global IPU bio")
+Reported-by: JY <JY.Ho@mediatek.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 6e39a15a942a9..50c90bd039235 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -911,7 +911,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)
+ if (fio->io_wbc)
+ wbc_account_cgroup_owner(fio->io_wbc, folio, folio_size(folio));
+
+- inc_page_count(fio->sbi, WB_DATA_TYPE(data_folio, false));
++ inc_page_count(fio->sbi, WB_DATA_TYPE(folio, false));
+
+ *fio->last_block = fio->new_blkaddr;
+ *fio->bio = bio;
+--
+2.51.0
+
--- /dev/null
+From 1ba26a9dc7b79c8b5c8e4905507fd81b2585e1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:21 +0800
+Subject: f2fs: fix zero-sized extent for precache extents
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
+
+Script to reproduce:
+f2fs_io write 1 0 1881 rand dsync testfile
+f2fs_io fallocate 0 7708672 4096 testfile
+f2fs_io write 1 1881 1 rand buffered testfile
+fsync testfile
+umount
+mount
+f2fs_io precache_extents testfile
+
+When the data layout is something like this:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+...
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+During precache_extents, we map the last block(valid blkaddr) in dnode1:
+map->m_flags |= F2FS_MAP_MAPPED;
+map->m_pblk = blkaddr(valid blkaddr);
+map->m_len = 1;
+then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
+map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
+
+map->m_len = 1
+ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
+ei.fofs = start_pgofs = 1882
+ei.len = map->m_len - ofs = 1 - 1 = 0
+
+Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
+A,B,C is valid blkaddr
+case1:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case2:
+dnode1: dnode2:
+[0] A [0] C (C!=B+1)
+[1] A+1 [1] C+1
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case3:
+dnode1: dnode2:
+[0] A [0] C (C!=B+2)
+[1] A+1 [1] C+1
+... ....
+[1015] A+1015
+[1016] B (B!=A+1016)
+[1017] B+1 [1017] 0x0
+
+[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 838eae39d3b19..6e39a15a942a9 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1778,9 +1778,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ if (map->m_flags & F2FS_MAP_MAPPED) {
+ unsigned int ofs = start_pgofs - map->m_lblk;
+
+- f2fs_update_read_extent_cache_range(&dn,
+- start_pgofs, map->m_pblk + ofs,
+- map->m_len - ofs);
++ if (map->m_len > ofs)
++ f2fs_update_read_extent_cache_range(&dn,
++ start_pgofs, map->m_pblk + ofs,
++ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+--
+2.51.0
+
--- /dev/null
+From 70d1ab39c003157c6bb45fd210856eff735574a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 16:09:13 +0200
+Subject: fanotify: Validate the return value of mnt_ns_from_dentry() before
+ dereferencing
+
+From: Anderson Nascimento <anderson@allelesecurity.com>
+
+[ Upstream commit 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd ]
+
+The function do_fanotify_mark() does not validate if
+mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.
+This causes a NULL pointer dereference in do_fanotify_mark() if the
+path is not a mount namespace object.
+
+Fix this by checking mnt_ns_from_dentry()'s return value before
+dereferencing it.
+
+Before the patch
+
+$ gcc fanotify_nullptr.c -o fanotify_nullptr
+$ mkdir A
+$ ./fanotify_nullptr
+Fanotify fd: 3
+fanotify_mark: Operation not permitted
+$ unshare -Urm
+Fanotify fd: 3
+Killed
+
+int main(void){
+ int ffd;
+ ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);
+ if(ffd < 0){
+ perror("fanotify_init");
+ exit(EXIT_FAILURE);
+ }
+
+ printf("Fanotify fd: %d\n",ffd);
+
+ if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,
+FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){
+ perror("fanotify_mark");
+ exit(EXIT_FAILURE);
+ }
+
+return 0;
+}
+
+After the patch
+
+$ gcc fanotify_nullptr.c -o fanotify_nullptr
+$ mkdir A
+$ ./fanotify_nullptr
+Fanotify fd: 3
+fanotify_mark: Operation not permitted
+$ unshare -Urm
+Fanotify fd: 3
+fanotify_mark: Invalid argument
+
+[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038
+[ 25.695006] #PF: supervisor read access in kernel mode
+[ 25.695012] #PF: error_code(0x0000) - not-present page
+[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0
+[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI
+[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not
+tainted 6.17.0-rc4 #1 PREEMPT(lazy)
+[ 25.695040] Hardware name: VMware, Inc. VMware Virtual
+Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
+[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950
+[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54
+24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b
+5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28
+85 c9
+[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203
+[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220
+[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180
+[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000
+[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7
+[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0
+[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)
+knlGS:0000000000000000
+[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0
+[ 25.695201] Call Trace:
+[ 25.695209] <TASK>
+[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30
+[ 25.695222] do_syscall_64+0x82/0x2c0
+...
+
+Fixes: 58f5fbeb367f ("fanotify: support watching filesystems and mounts inside userns")
+Link: https://patch.msgid.link/CAPhRvkw4ONypNsJrCnxbKnJbYmLHTDEKFC4C_num_5sVBVa8jg@mail.gmail.com
+Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fanotify/fanotify_user.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index b192ee068a7ac..561339b4cf752 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -1999,7 +1999,10 @@ static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask,
+ user_ns = path.mnt->mnt_sb->s_user_ns;
+ obj = path.mnt->mnt_sb;
+ } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) {
++ ret = -EINVAL;
+ mntns = mnt_ns_from_dentry(path.dentry);
++ if (!mntns)
++ goto path_put_and_out;
+ user_ns = mntns->user_ns;
+ obj = mntns;
+ }
+--
+2.51.0
+
--- /dev/null
+From 75c5a5dfe5a1802e1e39eb3ecffcb32f950d3c40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index b8d1e00a7982c..2dfeb158e848a 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From 062f346be487173ae17de563716e7a4094c438d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:53:43 +0800
+Subject: firmware: arm_scmi: Mark VirtIO ready before registering
+ scmi_virtio_driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Junnan Wu <junnan01.wu@samsung.com>
+
+[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]
+
+After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
+standalone driver”), the VirtIO transport probes independently. During
+scmi_virtio_probe, scmi_probe() is called, which intune invokes
+scmi_protocol_acquire() that sends a message over the virtqueue and
+waits for a reply.
+
+Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
+virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
+Initialization):
+ | The driver MUST NOT send any buffer available notifications to the
+ | device before setting DRIVER_OK.
+
+Some type-1 hypervisors block available-buffer notifications until the
+driver is marked OK. In such cases, scmi_vio_probe stalls in
+scmi_wait_for_reply(), and the probe never completes.
+
+Resolve this by setting DRIVER_OK immediately after the device-specific
+setup, so scmi_probe() can safely send notifications.
+
+Note after splitting the transports into modules, the probe sequence
+changed a bit. We can no longer rely on virtio_device_ready() being
+called by the core in virtio_dev_probe(), because scmi_vio_probe()
+doesn’t complete until the core SCMI stack runs scmi_probe(), which
+immediately issues the initial BASE protocol exchanges.
+
+Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
+Signed-off-by: Junnan Wu <junnan01.wu@samsung.com>
+Message-Id: <20250812075343.3201365-1-junnan01.wu@samsung.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
+index cb934db9b2b4a..326c4a93e44b9 100644
+--- a/drivers/firmware/arm_scmi/transports/virtio.c
++++ b/drivers/firmware/arm_scmi/transports/virtio.c
+@@ -871,6 +871,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
+ /* Ensure initialized scmi_vdev is visible */
+ smp_store_mb(scmi_vdev, vdev);
+
++ /* Set device ready */
++ virtio_device_ready(vdev);
++
+ ret = platform_driver_register(&scmi_virtio_driver);
+ if (ret) {
+ vdev->priv = NULL;
+--
+2.51.0
+
--- /dev/null
+From 38d953fc453ed47ea962d33f0ba2b7afbdd496d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From 9dd0c00351a2f43445d02f115ac627d9e070af56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 08:54:12 -0700
+Subject: Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 ]
+
+There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with
+a working compiler it will fail on some architectures simply because it
+uses the mnemonic "jmp" for testing the inline asm.
+
+And as reported by Geert, not all architectures use that mnemonic, so
+the test fails spuriously on such platforms (including arm and riscv,
+but also several other architectures).
+
+This issue avoided any obvious test failures because the build still
+works thanks to falling back on the old non-asm-goto code, which just
+generates worse code.
+
+Just use an empty asm statement instead.
+
+Reported-and-tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17")
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index e5d6d798994ae..87c868f86a060 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -102,7 +102,7 @@ config CC_HAS_ASM_GOTO_OUTPUT
+ # Detect basic support
+ depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null)
+ # Detect clang (< v17) scoped label issues
+- depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto("jmp %l0"::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto("jmp %l0"::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
++ depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto(""::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto(""::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
+
+ config CC_HAS_ASM_GOTO_TIED_OUTPUT
+ depends on CC_HAS_ASM_GOTO_OUTPUT
+--
+2.51.0
+
--- /dev/null
+From a6602e67153dc9d0f32fdfce533906b8b4f1a7f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 6e86d66197ef2..88550085f7457 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else {
+ /* The size of 'dlcn' can't be > 8. */
+ return -EINVAL;
+ }
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From 466087ee104fca6ea46947e5919f99a1dabbcb44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 10:40:16 -0700
+Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks
+ exist
+
+From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+
+[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
+
+Index allocation requires at least one bit in the $BITMAP attribute to
+track usage of index entries. If the bitmap is empty while index blocks
+are already present, this reflects on-disk corruption.
+
+syzbot triggered this condition using a malformed NTFS image. During a
+rename() operation involving a long filename (which spans multiple
+index entries), the empty bitmap allowed the name to be added without
+valid tracking. Subsequent deletion of the original entry failed with
+-ENOENT, due to unexpected index state.
+
+Reject such cases by verifying that the bitmap is not empty when index
+blocks exist.
+
+Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
+Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
+Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 1bf2a6593dec6..6d1bf890929d9 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
+ bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
+ }
+
++ /*
++ * Index blocks exist, but $BITMAP has zero valid bits.
++ * This implies an on-disk corruption and must be rejected.
++ */
++ if (in->name == I30_NAME &&
++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
++ err = -EINVAL;
++ goto out1;
++ }
++
+ bit = bmp_size << 3;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e6bc4c73a791580557f5cbc2879613dfaa6baf66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 May 2025 13:16:54 -0700
+Subject: fuse: remove unneeded offset assignment when filling write pages
+
+From: Joanne Koong <joannelkoong@gmail.com>
+
+[ Upstream commit 6fd26f50857698c6f07a9e6b149247925fadb8fd ]
+
+With the change in aee03ea7ff98 ("fuse: support large folios for
+writethrough writes"), this old line for setting ap->descs[0].offset is
+now obsolete and unneeded. This should have been removed as part of
+aee03ea7ff98.
+
+Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
+Fixes: aee03ea7ff98 ("fuse: support large folios for writethrough writes")
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 4adcf09d4b01a..c7351ca070652 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1175,7 +1175,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
+ num = min(iov_iter_count(ii), fc->max_write);
+
+ ap->args.in_pages = true;
+- ap->descs[0].offset = offset;
+
+ while (num && ap->num_folios < max_folios) {
+ size_t tmp;
+--
+2.51.0
+
--- /dev/null
+From 5f791ca3f01939353148f10efbe48baf39197c55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 11:49:54 +0530
+Subject: fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ]
+
+Use kvfree() to free memory allocated by kvzalloc() instead of kfree().
+Avoid potential memory management issue considering kvzalloc() can
+internally choose to use either kmalloc() or vmalloc() based on memory
+request and current system memory state. Hence, use more appropriate
+kvfree() which automatically determines correct free method to avoid
+potential hard to debug memory issues. Fix this issue discovered by
+running spatch static analysis tool using coccinelle script -
+scripts/coccinelle/api/kfree_mismatch.cocci
+
+Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw")
+Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Alison Schofield <alison.schofield@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fwctl/mlx5/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c
+index f93aa0cecdb97..4b379f695eb73 100644
+--- a/drivers/fwctl/mlx5/main.c
++++ b/drivers/fwctl/mlx5/main.c
+@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope,
+ */
+ if (ret && ret != -EREMOTEIO) {
+ if (rpc_out != rpc_in)
+- kfree(rpc_out);
++ kvfree(rpc_out);
+ return ERR_PTR(ret);
+ }
+ return rpc_out;
+--
+2.51.0
+
--- /dev/null
+From 95e7fbdad9f1ecc22065d3d4c361e76f9463e45a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 07:28:31 +0800
+Subject: genirq: Add irq_chip_(startup/shutdown)_parent()
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit 7a721a2fee2bce01af26699a87739db8ca8ea3c8 ]
+
+As the MSI controller on SG2044 uses PLIC as the underlying interrupt
+controller, it needs to call irq_enable() and irq_disable() to
+startup/shutdown interrupts. Otherwise, the MSI interrupt can not be
+startup correctly and will not respond any incoming interrupt.
+
+Introduce irq_chip_startup_parent() and irq_chip_shutdown_parent() to allow
+the interrupt controller to call the irq_startup()/irq_shutdown() callbacks
+of the parent interrupt chip.
+
+In case the irq_startup()/irq_shutdown() callbacks are not implemented for
+the parent interrupt chip, this will fallback to irq_chip_enable_parent()
+or irq_chip_disable_parent().
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250813232835.43458-2-inochiama@gmail.com
+Link: https://lore.kernel.org/lkml/20250722224513.22125-1-inochiama@gmail.com/
+Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/irq.h | 2 ++
+ kernel/irq/chip.c | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 39 insertions(+)
+
+diff --git a/include/linux/irq.h b/include/linux/irq.h
+index 1d6b606a81efe..890e1371f5d4c 100644
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -669,6 +669,8 @@ extern int irq_chip_set_parent_state(struct irq_data *data,
+ extern int irq_chip_get_parent_state(struct irq_data *data,
+ enum irqchip_irq_state which,
+ bool *state);
++extern void irq_chip_shutdown_parent(struct irq_data *data);
++extern unsigned int irq_chip_startup_parent(struct irq_data *data);
+ extern void irq_chip_enable_parent(struct irq_data *data);
+ extern void irq_chip_disable_parent(struct irq_data *data);
+ extern void irq_chip_ack_parent(struct irq_data *data);
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index 0d0276378c707..3ffa0d80ddd19 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -1259,6 +1259,43 @@ int irq_chip_get_parent_state(struct irq_data *data,
+ }
+ EXPORT_SYMBOL_GPL(irq_chip_get_parent_state);
+
++/**
++ * irq_chip_shutdown_parent - Shutdown the parent interrupt
++ * @data: Pointer to interrupt specific data
++ *
++ * Invokes the irq_shutdown() callback of the parent if available or falls
++ * back to irq_chip_disable_parent().
++ */
++void irq_chip_shutdown_parent(struct irq_data *data)
++{
++ struct irq_data *parent = data->parent_data;
++
++ if (parent->chip->irq_shutdown)
++ parent->chip->irq_shutdown(parent);
++ else
++ irq_chip_disable_parent(data);
++}
++EXPORT_SYMBOL_GPL(irq_chip_shutdown_parent);
++
++/**
++ * irq_chip_startup_parent - Startup the parent interrupt
++ * @data: Pointer to interrupt specific data
++ *
++ * Invokes the irq_startup() callback of the parent if available or falls
++ * back to irq_chip_enable_parent().
++ */
++unsigned int irq_chip_startup_parent(struct irq_data *data)
++{
++ struct irq_data *parent = data->parent_data;
++
++ if (parent->chip->irq_startup)
++ return parent->chip->irq_startup(parent);
++
++ irq_chip_enable_parent(data);
++ return 0;
++}
++EXPORT_SYMBOL_GPL(irq_chip_startup_parent);
++
+ /**
+ * irq_chip_enable_parent - Enable the parent interrupt (defaults to unmask if
+ * NULL)
+--
+2.51.0
+
--- /dev/null
+From d6e9a3fb3a63360f830e1ad72f33ff18bd6f5909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:59:05 -0700
+Subject: genirq/test: Depend on SPARSE_IRQ
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 0c888bc86d672e551ce5c58b891c8b44f8967643 ]
+
+Some architectures have a static interrupt layout, with a limited number of
+interrupts. Without SPARSE_IRQ, the test may not be able to allocate any
+fake interrupts, and the test will fail. (This occurs on ARCH=m68k, for
+example.)
+
+Additionally, managed-affinity is only supported with CONFIG_SPARSE_IRQ=y,
+so irq_shutdown_depth_test() and irq_cpuhotplug_test() would fail without
+it.
+
+Add a 'SPARSE_IRQ' dependency to avoid these problems.
+
+Many architectures 'select SPARSE_IRQ', so this is easy to miss.
+
+Notably, this also excludes ARCH=um from running any of these tests, even
+though some of them might work.
+
+Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/all/20250822190140.2154646-5-briannorris@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
+index 08088b8e95ae9..a75df2bb9db66 100644
+--- a/kernel/irq/Kconfig
++++ b/kernel/irq/Kconfig
+@@ -147,6 +147,7 @@ config GENERIC_IRQ_KEXEC_CLEAR_VM_FORWARD
+ config IRQ_KUNIT_TEST
+ bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS
+ depends on KUNIT=y
++ depends on SPARSE_IRQ
+ default KUNIT_ALL_TESTS
+ select IRQ_DOMAIN
+ imply SMP
+--
+2.51.0
+
--- /dev/null
+From b08b38119b9d1a03d673c94801f5fbd5dade6cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:59:06 -0700
+Subject: genirq/test: Drop CONFIG_GENERIC_IRQ_MIGRATION assumptions
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit add03fdb9d52411cabb3872fb7692df6f4c67586 ]
+
+Not all platforms use the generic IRQ migration code, even if they select
+GENERIC_IRQ_MIGRATION. (See, for example, powerpc / pseries_cpu_disable().)
+
+If such platforms don't perform managed shutdown the same way, the interrupt
+may not actually shut down, and these tests fail:
+
+[ 4.357022][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:211
+[ 4.357022][ T101] Expected irqd_is_activated(data) to be false, but is true
+[ 4.358128][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:212
+[ 4.358128][ T101] Expected irqd_is_started(data) to be false, but is true
+[ 4.375558][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:216
+[ 4.375558][ T101] Expected irqd_is_activated(data) to be false, but is true
+[ 4.376088][ T101] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:217
+[ 4.376088][ T101] Expected irqd_is_started(data) to be false, but is true
+[ 4.377851][ T1] # irq_cpuhotplug_test: pass:0 fail:1 skip:0 total:1
+[ 4.377901][ T1] not ok 4 irq_cpuhotplug_test
+[ 4.378073][ T1] # irq_test_cases: pass:3 fail:1 skip:0 total:4
+
+Rather than test that PowerPC performs migration the same way as the
+unterrupt core, just drop the state checks. The point of the test was to
+ensure that the code kept |depth| balanced, which still can be tested for.
+
+Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/all/20250822190140.2154646-6-briannorris@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irq_test.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
+index e220e7b2fc187..37568ec714b51 100644
+--- a/kernel/irq/irq_test.c
++++ b/kernel/irq/irq_test.c
+@@ -208,13 +208,9 @@ static void irq_cpuhotplug_test(struct kunit *test)
+ KUNIT_EXPECT_EQ(test, desc->depth, 1);
+
+ KUNIT_EXPECT_EQ(test, remove_cpu(1), 0);
+- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data));
+- KUNIT_EXPECT_FALSE(test, irqd_is_started(data));
+ KUNIT_EXPECT_GE(test, desc->depth, 1);
+ KUNIT_EXPECT_EQ(test, add_cpu(1), 0);
+
+- KUNIT_EXPECT_FALSE(test, irqd_is_activated(data));
+- KUNIT_EXPECT_FALSE(test, irqd_is_started(data));
+ KUNIT_EXPECT_EQ(test, desc->depth, 1);
+
+ enable_irq(virq);
+--
+2.51.0
+
--- /dev/null
+From 4487556ceecee4ff0ed9d48dfb97a097da32fdcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:59:07 -0700
+Subject: genirq/test: Ensure CPU 1 is online for hotplug test
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 8ad25ebfa70e86860559b306bbc923c7db4fcac6 ]
+
+It's possible to run these tests on platforms that think they have a
+hotpluggable CPU1, but for whatever reason, CPU1 is not online and can't be
+brought online:
+
+ # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:210
+ Expected remove_cpu(1) == 0, but
+ remove_cpu(1) == 1 (0x1)
+CPU1: failed to boot: -38
+ # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:214
+ Expected add_cpu(1) == 0, but
+ add_cpu(1) == -38 (0xffffffffffffffda)
+
+Check that CPU1 is actually online before trying to run the test.
+
+Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/all/20250822190140.2154646-7-briannorris@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irq_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
+index 37568ec714b51..f71f46fdcfd5e 100644
+--- a/kernel/irq/irq_test.c
++++ b/kernel/irq/irq_test.c
+@@ -178,6 +178,8 @@ static void irq_cpuhotplug_test(struct kunit *test)
+ kunit_skip(test, "requires more than 1 CPU for CPU hotplug");
+ if (!cpu_is_hotpluggable(1))
+ kunit_skip(test, "CPU 1 must be hotpluggable");
++ if (!cpu_online(1))
++ kunit_skip(test, "CPU 1 must be online");
+
+ cpumask_copy(&affinity.mask, cpumask_of(1));
+
+--
+2.51.0
+
--- /dev/null
+From 3d5f473dff3b1e3718dc015c3d83f7231d011463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 17:45:28 +0800
+Subject: genirq/test: Fix depth tests on architectures with NOREQUEST by
+ default.
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit c9163915a93d40e32c4e4aeb942c0adcb190d72e ]
+
+The new irq KUnit tests fail on some architectures (notably PowerPC and
+32-bit ARM), as the request_irq() call fails due to the ARCH_IRQ_INIT_FLAGS
+containing IRQ_NOREQUEST, yielding the following errors:
+
+[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:88
+[10:17:45] Expected ret == 0, but
+[10:17:45] ret == -22 (0xffffffffffffffea)
+[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:90
+[10:17:45] Expected desc->depth == 0, but
+[10:17:45] desc->depth == 1 (0x1)
+[10:17:45] # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:93
+[10:17:45] Expected desc->depth == 1, but
+[10:17:45] desc->depth == 2 (0x2)
+
+By clearing IRQ_NOREQUEST from the interrupt descriptor, these tests now
+pass on ARM and PowerPC.
+
+Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
+Signed-off-by: David Gow <davidgow@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Link: https://lore.kernel.org/all/20250816094528.3560222-2-davidgow@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irq_test.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
+index a75abebed7f24..e220e7b2fc187 100644
+--- a/kernel/irq/irq_test.c
++++ b/kernel/irq/irq_test.c
+@@ -54,6 +54,9 @@ static void irq_disable_depth_test(struct kunit *test)
+ desc = irq_to_desc(virq);
+ KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+
++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
++ irq_settings_clr_norequest(desc);
++
+ ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
+ KUNIT_EXPECT_EQ(test, ret, 0);
+
+@@ -81,6 +84,9 @@ static void irq_free_disabled_test(struct kunit *test)
+ desc = irq_to_desc(virq);
+ KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+
++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
++ irq_settings_clr_norequest(desc);
++
+ ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
+ KUNIT_EXPECT_EQ(test, ret, 0);
+
+@@ -120,6 +126,9 @@ static void irq_shutdown_depth_test(struct kunit *test)
+ desc = irq_to_desc(virq);
+ KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+
++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
++ irq_settings_clr_norequest(desc);
++
+ data = irq_desc_get_irq_data(desc);
+ KUNIT_ASSERT_PTR_NE(test, data, NULL);
+
+@@ -180,6 +189,9 @@ static void irq_cpuhotplug_test(struct kunit *test)
+ desc = irq_to_desc(virq);
+ KUNIT_ASSERT_PTR_NE(test, desc, NULL);
+
++ /* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
++ irq_settings_clr_norequest(desc);
++
+ data = irq_desc_get_irq_data(desc);
+ KUNIT_ASSERT_PTR_NE(test, data, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From f1e168d846ba580a9b3f3a47c545745e81b09d6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:59:02 -0700
+Subject: genirq/test: Select IRQ_DOMAIN
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit f8a44f9babd054ff19e20a30cab661d716ad5459 ]
+
+These tests use irq_domain_alloc_descs() and so require CONFIG_IRQ_DOMAIN.
+
+Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/all/20250822190140.2154646-2-briannorris@chromium.org
+Closes: https://lore.kernel.org/lkml/ded44edf-eeb7-420c-b8a8-d6543b955e6e@roeck-us.net/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
+index 1da5e9d9da719..08088b8e95ae9 100644
+--- a/kernel/irq/Kconfig
++++ b/kernel/irq/Kconfig
+@@ -148,6 +148,7 @@ config IRQ_KUNIT_TEST
+ bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS
+ depends on KUNIT=y
+ default KUNIT_ALL_TESTS
++ select IRQ_DOMAIN
+ imply SMP
+ help
+ This option enables KUnit tests for the IRQ subsystem API. These are
+--
+2.51.0
+
--- /dev/null
+From 3ba5405100206de3d417ba0ed56bafda4e7c10f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 14:31:41 +0200
+Subject: gfs2: Add proper lockspace locking
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 6ab26555c9ffef96c56ca16356e55ac5ab61ec93 ]
+
+GFS2 has been calling functions like dlm_lock() even after the lockspace
+that these functions operate on has been released with
+dlm_release_lockspace(). It has always assumed that those functions
+would return -EINVAL in that case, but that was never guaranteed, and it
+certainly is no longer the case since commit 4db41bf4f04f ("dlm: remove
+ls_local_handle from struct dlm_ls").
+
+To fix that, add proper lockspace locking.
+
+Fixes: 3e11e5304150 ("GFS2: ignore unlock failures after withdraw")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/file.c | 23 +++++++++++++++--------
+ fs/gfs2/glock.c | 5 ++---
+ fs/gfs2/incore.h | 2 ++
+ fs/gfs2/lock_dlm.c | 46 +++++++++++++++++++++++++++++++++++++---------
+ 4 files changed, 56 insertions(+), 20 deletions(-)
+
+diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
+index 72d95185a39f6..bc67fa058c845 100644
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -1442,6 +1442,7 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
+ struct gfs2_inode *ip = GFS2_I(file->f_mapping->host);
+ struct gfs2_sbd *sdp = GFS2_SB(file->f_mapping->host);
+ struct lm_lockstruct *ls = &sdp->sd_lockstruct;
++ int ret;
+
+ if (!(fl->c.flc_flags & FL_POSIX))
+ return -ENOLCK;
+@@ -1450,14 +1451,20 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
+ locks_lock_file_wait(file, fl);
+ return -EIO;
+ }
+- if (cmd == F_CANCELLK)
+- return dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl);
+- else if (IS_GETLK(cmd))
+- return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
+- else if (lock_is_unlock(fl))
+- return dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl);
+- else
+- return dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl);
++ down_read(&ls->ls_sem);
++ ret = -ENODEV;
++ if (likely(ls->ls_dlm != NULL)) {
++ if (cmd == F_CANCELLK)
++ ret = dlm_posix_cancel(ls->ls_dlm, ip->i_no_addr, file, fl);
++ else if (IS_GETLK(cmd))
++ ret = dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
++ else if (lock_is_unlock(fl))
++ ret = dlm_posix_unlock(ls->ls_dlm, ip->i_no_addr, file, fl);
++ else
++ ret = dlm_posix_lock(ls->ls_dlm, ip->i_no_addr, file, cmd, fl);
++ }
++ up_read(&ls->ls_sem);
++ return ret;
+ }
+
+ static void __flock_holder_uninit(struct file *file, struct gfs2_holder *fl_gh)
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 54c011ff00ddc..a6535413a0b46 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -800,9 +800,8 @@ __acquires(&gl->gl_lockref.lock)
+ }
+ clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
+
+- if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED &&
+- target == LM_ST_UNLOCKED &&
+- test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
++ if (ret == -ENODEV && gl->gl_target == LM_ST_UNLOCKED &&
++ target == LM_ST_UNLOCKED) {
+ /*
+ * The lockspace has been released and the lock has
+ * been unlocked implicitly.
+diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
+index c390f208654c1..3fcb7ab198d47 100644
+--- a/fs/gfs2/incore.h
++++ b/fs/gfs2/incore.h
+@@ -657,6 +657,8 @@ struct lm_lockstruct {
+ struct completion ls_sync_wait; /* {control,mounted}_{lock,unlock} */
+ char *ls_lvb_bits;
+
++ struct rw_semaphore ls_sem;
++
+ spinlock_t ls_recover_spin; /* protects following fields */
+ unsigned long ls_recover_flags; /* DFL_ */
+ uint32_t ls_recover_mount; /* gen in first recover_done cb */
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index 5daaeaaaf18dd..6db37c20587d1 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -329,8 +329,13 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
+ */
+
+ again:
+- error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname,
+- GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast);
++ down_read(&ls->ls_sem);
++ error = -ENODEV;
++ if (likely(ls->ls_dlm != NULL)) {
++ error = dlm_lock(ls->ls_dlm, req, &gl->gl_lksb, lkf, strname,
++ GDLM_STRNAME_BYTES - 1, 0, gdlm_ast, gl, gdlm_bast);
++ }
++ up_read(&ls->ls_sem);
+ if (error == -EBUSY) {
+ msleep(20);
+ goto again;
+@@ -379,8 +384,13 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ flags |= DLM_LKF_VALBLK;
+
+ again:
+- error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags,
+- NULL, gl);
++ down_read(&ls->ls_sem);
++ error = -ENODEV;
++ if (likely(ls->ls_dlm != NULL)) {
++ error = dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, flags,
++ NULL, gl);
++ }
++ up_read(&ls->ls_sem);
+ if (error == -EBUSY) {
+ msleep(20);
+ goto again;
+@@ -396,7 +406,12 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ static void gdlm_cancel(struct gfs2_glock *gl)
+ {
+ struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
+- dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
++
++ down_read(&ls->ls_sem);
++ if (likely(ls->ls_dlm != NULL)) {
++ dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
++ }
++ up_read(&ls->ls_sem);
+ }
+
+ /*
+@@ -577,7 +592,11 @@ static int sync_unlock(struct gfs2_sbd *sdp, struct dlm_lksb *lksb, char *name)
+ struct lm_lockstruct *ls = &sdp->sd_lockstruct;
+ int error;
+
+- error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls);
++ down_read(&ls->ls_sem);
++ error = -ENODEV;
++ if (likely(ls->ls_dlm != NULL))
++ error = dlm_unlock(ls->ls_dlm, lksb->sb_lkid, 0, lksb, ls);
++ up_read(&ls->ls_sem);
+ if (error) {
+ fs_err(sdp, "%s lkid %x error %d\n",
+ name, lksb->sb_lkid, error);
+@@ -604,9 +623,14 @@ static int sync_lock(struct gfs2_sbd *sdp, int mode, uint32_t flags,
+ memset(strname, 0, GDLM_STRNAME_BYTES);
+ snprintf(strname, GDLM_STRNAME_BYTES, "%8x%16x", LM_TYPE_NONDISK, num);
+
+- error = dlm_lock(ls->ls_dlm, mode, lksb, flags,
+- strname, GDLM_STRNAME_BYTES - 1,
+- 0, sync_wait_cb, ls, NULL);
++ down_read(&ls->ls_sem);
++ error = -ENODEV;
++ if (likely(ls->ls_dlm != NULL)) {
++ error = dlm_lock(ls->ls_dlm, mode, lksb, flags,
++ strname, GDLM_STRNAME_BYTES - 1,
++ 0, sync_wait_cb, ls, NULL);
++ }
++ up_read(&ls->ls_sem);
+ if (error) {
+ fs_err(sdp, "%s lkid %x flags %x mode %d error %d\n",
+ name, lksb->sb_lkid, flags, mode, error);
+@@ -1333,6 +1357,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
+ */
+
+ INIT_DELAYED_WORK(&sdp->sd_control_work, gfs2_control_func);
++ ls->ls_dlm = NULL;
+ spin_lock_init(&ls->ls_recover_spin);
+ ls->ls_recover_flags = 0;
+ ls->ls_recover_mount = 0;
+@@ -1367,6 +1392,7 @@ static int gdlm_mount(struct gfs2_sbd *sdp, const char *table)
+ * create/join lockspace
+ */
+
++ init_rwsem(&ls->ls_sem);
+ error = dlm_new_lockspace(fsname, cluster, flags, GDLM_LVB_SIZE,
+ &gdlm_lockspace_ops, sdp, &ops_result,
+ &ls->ls_dlm);
+@@ -1446,10 +1472,12 @@ static void gdlm_unmount(struct gfs2_sbd *sdp)
+
+ /* mounted_lock and control_lock will be purged in dlm recovery */
+ release:
++ down_write(&ls->ls_sem);
+ if (ls->ls_dlm) {
+ dlm_release_lockspace(ls->ls_dlm, 2);
+ ls->ls_dlm = NULL;
+ }
++ up_write(&ls->ls_sem);
+
+ free_recover_size(ls);
+ }
+--
+2.51.0
+
--- /dev/null
+From 206c0ba2ab3f59d082c9340da062f1d995999ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 19:13:32 +0200
+Subject: gfs2: do_xmote cleanup
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 2309a01351e56446f43c89e200d643647d47e739 ]
+
+Check for asynchronous completion and clear the GLF_PENDING_REPLY flag
+earlier in do_xmote(). This will make future changes more readable.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Stable-dep-of: 6ab26555c9ff ("gfs2: Add proper lockspace locking")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 68e943e13dd53..54c011ff00ddc 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -794,6 +794,12 @@ __acquires(&gl->gl_lockref.lock)
+ ret = ls->ls_ops->lm_lock(gl, target, lck_flags);
+ spin_lock(&gl->gl_lockref.lock);
+
++ if (!ret) {
++ /* The operation will be completed asynchronously. */
++ return;
++ }
++ clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
++
+ if (ret == -EINVAL && gl->gl_target == LM_ST_UNLOCKED &&
+ target == LM_ST_UNLOCKED &&
+ test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+@@ -801,14 +807,10 @@ __acquires(&gl->gl_lockref.lock)
+ * The lockspace has been released and the lock has
+ * been unlocked implicitly.
+ */
+- } else if (ret) {
++ } else {
+ fs_err(sdp, "lm_lock ret %d\n", ret);
+ target = gl->gl_state | LM_OUT_ERROR;
+- } else {
+- /* The operation will be completed asynchronously. */
+- return;
+ }
+- clear_bit(GLF_PENDING_REPLY, &gl->gl_flags);
+ }
+
+ /* Complete the operation now. */
+--
+2.51.0
+
--- /dev/null
+From 4df2c6c474a6d6237adcc0978c67f80a594a9481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 23:57:24 +0200
+Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
+
+Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
+flag a second time after it has already been cleared. Fix that.
+
+Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index b6fd1cb17de7b..edb105f9da059 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -805,8 +805,6 @@ __acquires(&gl->gl_lockref.lock)
+ clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
+ return;
+- } else {
+- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 18908e11c677b06a01c30da6cd7c5bf3d1e176b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 22:31:59 +0200
+Subject: gfs2: Fix LM_FLAG_TRY* logic in add_to_queue
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 0c23e24164d83086e75581b0cf930f4e161636d6 ]
+
+The logic in add_to_queue() for determining whether a LM_FLAG_TRY or
+LM_FLAG_TRY_1CB holder should be queued does not make any sense: we are
+interested in wether or not the new operation will block behind an
+existing or future holder in the queue, but the current code checks for
+ongoing locking or ->go_inval() operations, which has little to do with
+that.
+
+Replace that code with something more sensible, remove the incorrect
+add_to_queue() function annotations, remove the similarly misguided
+do_error(gl, 0) call in do_xmote(), and add a missing comment to the
+same call in do_promote().
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 47 ++++++++++++++++++++++++-----------------------
+ 1 file changed, 24 insertions(+), 23 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 45dd73bb884fd..5edf125b39fe3 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -502,7 +502,7 @@ static bool do_promote(struct gfs2_glock *gl)
+ */
+ if (list_is_first(&gh->gh_list, &gl->gl_holders))
+ return false;
+- do_error(gl, 0);
++ do_error(gl, 0); /* Fail queued try locks */
+ break;
+ }
+ set_bit(HIF_HOLDER, &gh->gh_iflags);
+@@ -713,7 +713,6 @@ __acquires(&gl->gl_lockref.lock)
+ if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
+ &gl->gl_flags))
+ return;
+- do_error(gl, 0); /* Fail queued try locks */
+ }
+ if (!glops->go_inval && !glops->go_sync)
+ goto skip_inval;
+@@ -1454,6 +1453,24 @@ void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...)
+ va_end(args);
+ }
+
++static bool gfs2_should_queue_trylock(struct gfs2_glock *gl,
++ struct gfs2_holder *gh)
++{
++ struct gfs2_holder *current_gh, *gh2;
++
++ current_gh = find_first_holder(gl);
++ if (current_gh && !may_grant(gl, current_gh, gh))
++ return false;
++
++ list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
++ if (test_bit(HIF_HOLDER, &gh2->gh_iflags))
++ continue;
++ if (!(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
++ return false;
++ }
++ return true;
++}
++
+ static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
+ {
+ if (!(gh->gh_flags & GL_NOPID))
+@@ -1472,27 +1489,20 @@ static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
+ */
+
+ static inline void add_to_queue(struct gfs2_holder *gh)
+-__releases(&gl->gl_lockref.lock)
+-__acquires(&gl->gl_lockref.lock)
+ {
+ struct gfs2_glock *gl = gh->gh_gl;
+ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+ struct gfs2_holder *gh2;
+- int try_futile = 0;
+
+ GLOCK_BUG_ON(gl, gh->gh_owner_pid == NULL);
+ if (test_and_set_bit(HIF_WAIT, &gh->gh_iflags))
+ GLOCK_BUG_ON(gl, true);
+
+- if (gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) {
+- if (test_bit(GLF_LOCK, &gl->gl_flags)) {
+- struct gfs2_holder *current_gh;
+-
+- current_gh = find_first_holder(gl);
+- try_futile = !may_grant(gl, current_gh, gh);
+- }
+- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags))
+- goto fail;
++ if ((gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) &&
++ !gfs2_should_queue_trylock(gl, gh)) {
++ gh->gh_error = GLR_TRYFAILED;
++ gfs2_holder_wake(gh);
++ return;
+ }
+
+ list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
+@@ -1504,15 +1514,6 @@ __acquires(&gl->gl_lockref.lock)
+ continue;
+ goto trap_recursive;
+ }
+- list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
+- if (try_futile &&
+- !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) {
+-fail:
+- gh->gh_error = GLR_TRYFAILED;
+- gfs2_holder_wake(gh);
+- return;
+- }
+- }
+ trace_gfs2_glock_queue(gh, 1);
+ gfs2_glstats_inc(gl, GFS2_LKS_QCOUNT);
+ gfs2_sbstats_inc(gl, GFS2_LKS_QCOUNT);
+--
+2.51.0
+
--- /dev/null
+From bb8887438e21fc8b06ecfb899945c95a3ec2d5d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:21:33 +0200
+Subject: gfs2: Further sanitize lock_dlm.c
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit fd70ab7155c4b92a9747d42c02791a0793ab9c66 ]
+
+The gl_req field and GLF_BLOCKING flag are only relevant to gdlm_lock(),
+its callback gdlm_ast(), and their helpers, so set and clear them inside
+lock_dlm.c.
+
+Also, the LM_FLAG_ANY flag is relevant to gdlm_lock(), but do_xmote()
+doesn't pass that flag down to gdlm_lock() as it should. Fix that by
+passing down all the flags.
+
+In addition, document the effect of the LM_FLAG_ANY flag on locks held
+in EX mode locally.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 6 ------
+ fs/gfs2/glock.h | 4 ++++
+ fs/gfs2/lock_dlm.c | 26 ++++++++++++++++++--------
+ 3 files changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 3d5cf9c24d78b..45dd73bb884fd 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -715,12 +715,6 @@ __acquires(&gl->gl_lockref.lock)
+ return;
+ do_error(gl, 0); /* Fail queued try locks */
+ }
+- gl->gl_req = target;
+- set_bit(GLF_BLOCKING, &gl->gl_flags);
+- if ((gl->gl_req == LM_ST_UNLOCKED) ||
+- (gl->gl_state == LM_ST_EXCLUSIVE) ||
+- (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB)))
+- clear_bit(GLF_BLOCKING, &gl->gl_flags);
+ if (!glops->go_inval && !glops->go_sync)
+ goto skip_inval;
+
+diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
+index 9339a3bff6eeb..d041b922b45e3 100644
+--- a/fs/gfs2/glock.h
++++ b/fs/gfs2/glock.h
+@@ -68,6 +68,10 @@ enum {
+ * also be granted in SHARED. The preferred state is whichever is compatible
+ * with other granted locks, or the specified state if no other locks exist.
+ *
++ * In addition, when a lock is already held in EX mode locally, a SHARED or
++ * DEFERRED mode request with the LM_FLAG_ANY flag set will be granted.
++ * (The LM_FLAG_ANY flag is only use for SHARED mode requests currently.)
++ *
+ * LM_FLAG_NODE_SCOPE
+ * This holder agrees to share the lock within this node. In other words,
+ * the glock is held in EX mode according to DLM, but local holders on the
+diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
+index cee5d199d2d87..5daaeaaaf18dd 100644
+--- a/fs/gfs2/lock_dlm.c
++++ b/fs/gfs2/lock_dlm.c
+@@ -58,6 +58,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
+ /**
+ * gfs2_update_reply_times - Update locking statistics
+ * @gl: The glock to update
++ * @blocking: The operation may have been blocking
+ *
+ * This assumes that gl->gl_dstamp has been set earlier.
+ *
+@@ -72,12 +73,12 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
+ * TRY_1CB flags are set are classified as non-blocking. All
+ * other DLM requests are counted as (potentially) blocking.
+ */
+-static inline void gfs2_update_reply_times(struct gfs2_glock *gl)
++static inline void gfs2_update_reply_times(struct gfs2_glock *gl,
++ bool blocking)
+ {
+ struct gfs2_pcpu_lkstats *lks;
+ const unsigned gltype = gl->gl_name.ln_type;
+- unsigned index = test_bit(GLF_BLOCKING, &gl->gl_flags) ?
+- GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
++ unsigned index = blocking ? GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
+ s64 rtt;
+
+ preempt_disable();
+@@ -119,14 +120,18 @@ static inline void gfs2_update_request_times(struct gfs2_glock *gl)
+ static void gdlm_ast(void *arg)
+ {
+ struct gfs2_glock *gl = arg;
++ bool blocking;
+ unsigned ret;
+
++ blocking = test_bit(GLF_BLOCKING, &gl->gl_flags);
++ gfs2_update_reply_times(gl, blocking);
++ clear_bit(GLF_BLOCKING, &gl->gl_flags);
++
+ /* If the glock is dead, we only react to a dlm_unlock() reply. */
+ if (__lockref_is_dead(&gl->gl_lockref) &&
+ gl->gl_lksb.sb_status != -DLM_EUNLOCK)
+ return;
+
+- gfs2_update_reply_times(gl);
+ BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
+
+ if ((gl->gl_lksb.sb_flags & DLM_SBF_VALNOTVALID) && gl->gl_lksb.sb_lvbptr)
+@@ -241,7 +246,7 @@ static bool down_conversion(int cur, int req)
+ }
+
+ static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
+- const int cur, const int req)
++ const int req, bool blocking)
+ {
+ u32 lkf = 0;
+
+@@ -274,7 +279,7 @@ static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
+ * "upward" lock conversions or else DLM will reject the
+ * request as invalid.
+ */
+- if (!down_conversion(cur, req))
++ if (blocking)
+ lkf |= DLM_LKF_QUECVT;
+ }
+
+@@ -294,14 +299,20 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
+ unsigned int flags)
+ {
+ struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
++ bool blocking;
+ int cur, req;
+ u32 lkf;
+ char strname[GDLM_STRNAME_BYTES] = "";
+ int error;
+
++ gl->gl_req = req_state;
+ cur = make_mode(gl->gl_name.ln_sbd, gl->gl_state);
+ req = make_mode(gl->gl_name.ln_sbd, req_state);
+- lkf = make_flags(gl, flags, cur, req);
++ blocking = !down_conversion(cur, req) &&
++ !(flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB));
++ lkf = make_flags(gl, flags, req, blocking);
++ if (blocking)
++ set_bit(GLF_BLOCKING, &gl->gl_flags);
+ gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
+ if (test_bit(GLF_INITIAL, &gl->gl_flags)) {
+@@ -341,7 +352,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
+ return;
+ }
+
+- clear_bit(GLF_BLOCKING, &gl->gl_flags);
+ gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
+ gfs2_update_request_times(gl);
+--
+2.51.0
+
--- /dev/null
+From 105fe0baead79bb6f28e3070a932312792ad467f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 23:26:12 +0200
+Subject: gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit bddb53b776fb7ce81dfba7c24884d9f2c0c68e50 ]
+
+Get rid of the GLF_INVALIDATE_IN_PROGRESS flag: it was originally used
+to indicate to add_to_queue() that the ->go_sync() and ->go_invalid()
+operations were in progress, but as we have established in commit "gfs2:
+Fix LM_FLAG_TRY* logic in add_to_queue", add_to_queue() has no need to
+know.
+
+Commit d99724c3c36a describes a race in which GLF_INVALIDATE_IN_PROGRESS
+is used to serialize two processes which are both in do_xmote() at the
+same time. That analysis is wrong: the serialization happens via the
+GLF_LOCK flag, which ensures that at most one glock operation can be
+active at any time.
+
+Fixes: d99724c3c36a ("gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 16 +---------------
+ fs/gfs2/incore.h | 1 -
+ fs/gfs2/trace_gfs2.h | 1 -
+ 3 files changed, 1 insertion(+), 17 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 93aae10d78f30..68e943e13dd53 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -703,17 +703,6 @@ __acquires(&gl->gl_lockref.lock)
+ lck_flags &= (LM_FLAG_TRY | LM_FLAG_TRY_1CB | LM_FLAG_NOEXP);
+ GLOCK_BUG_ON(gl, gl->gl_state == target);
+ GLOCK_BUG_ON(gl, gl->gl_state == gl->gl_target);
+- if ((target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) &&
+- glops->go_inval) {
+- /*
+- * If another process is already doing the invalidate, let that
+- * finish first. The glock state machine will get back to this
+- * holder again later.
+- */
+- if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
+- &gl->gl_flags))
+- return;
+- }
+ if (!glops->go_inval || !glops->go_sync)
+ goto skip_inval;
+
+@@ -732,7 +721,7 @@ __acquires(&gl->gl_lockref.lock)
+ goto skip_inval;
+ }
+
+- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
++ if (target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) {
+ /*
+ * The call to go_sync should have cleared out the ail list.
+ * If there are still items, we have a problem. We ought to
+@@ -747,7 +736,6 @@ __acquires(&gl->gl_lockref.lock)
+ gfs2_dump_glock(NULL, gl, true);
+ }
+ glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA);
+- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+ }
+ spin_lock(&gl->gl_lockref.lock);
+
+@@ -2313,8 +2301,6 @@ static const char *gflags2str(char *buf, const struct gfs2_glock *gl)
+ *p++ = 'y';
+ if (test_bit(GLF_LFLUSH, gflags))
+ *p++ = 'f';
+- if (test_bit(GLF_INVALIDATE_IN_PROGRESS, gflags))
+- *p++ = 'i';
+ if (test_bit(GLF_PENDING_REPLY, gflags))
+ *p++ = 'R';
+ if (test_bit(GLF_HAVE_REPLY, gflags))
+diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
+index d4ad82f47eeea..c390f208654c1 100644
+--- a/fs/gfs2/incore.h
++++ b/fs/gfs2/incore.h
+@@ -319,7 +319,6 @@ enum {
+ GLF_DEMOTE_IN_PROGRESS = 5,
+ GLF_DIRTY = 6,
+ GLF_LFLUSH = 7,
+- GLF_INVALIDATE_IN_PROGRESS = 8,
+ GLF_HAVE_REPLY = 9,
+ GLF_INITIAL = 10,
+ GLF_HAVE_FROZEN_REPLY = 11,
+diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
+index 26036ffc3f338..1c2507a273180 100644
+--- a/fs/gfs2/trace_gfs2.h
++++ b/fs/gfs2/trace_gfs2.h
+@@ -52,7 +52,6 @@
+ {(1UL << GLF_DEMOTE_IN_PROGRESS), "p" }, \
+ {(1UL << GLF_DIRTY), "y" }, \
+ {(1UL << GLF_LFLUSH), "f" }, \
+- {(1UL << GLF_INVALIDATE_IN_PROGRESS), "i" }, \
+ {(1UL << GLF_PENDING_REPLY), "R" }, \
+ {(1UL << GLF_HAVE_REPLY), "r" }, \
+ {(1UL << GLF_INITIAL), "a" }, \
+--
+2.51.0
+
--- /dev/null
+From 9a78f0eaa031cdc44a88a0a6511c06567b7ce03a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 23:18:45 +0200
+Subject: gfs2: Remove duplicate check in do_xmote
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 9b54770b68ae793a3a8d378be4cda2bb7be6c8cc ]
+
+In do_xmote(), remove the duplicate check for the ->go_sync and
+->go_inval glock operations. They are either both defined, or none of
+them are.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 5edf125b39fe3..93aae10d78f30 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -714,25 +714,24 @@ __acquires(&gl->gl_lockref.lock)
+ &gl->gl_flags))
+ return;
+ }
+- if (!glops->go_inval && !glops->go_sync)
++ if (!glops->go_inval || !glops->go_sync)
+ goto skip_inval;
+
+ spin_unlock(&gl->gl_lockref.lock);
+- if (glops->go_sync) {
+- ret = glops->go_sync(gl);
+- /* If we had a problem syncing (due to io errors or whatever,
+- * we should not invalidate the metadata or tell dlm to
+- * release the glock to other nodes.
+- */
+- if (ret) {
+- if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
+- fs_err(sdp, "Error %d syncing glock\n", ret);
+- gfs2_dump_glock(NULL, gl, true);
+- }
+- spin_lock(&gl->gl_lockref.lock);
+- goto skip_inval;
++ ret = glops->go_sync(gl);
++ /* If we had a problem syncing (due to io errors or whatever,
++ * we should not invalidate the metadata or tell dlm to
++ * release the glock to other nodes.
++ */
++ if (ret) {
++ if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
++ fs_err(sdp, "Error %d syncing glock\n", ret);
++ gfs2_dump_glock(NULL, gl, true);
+ }
++ spin_lock(&gl->gl_lockref.lock);
++ goto skip_inval;
+ }
++
+ if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
+ /*
+ * The call to go_sync should have cleared out the ail list.
+--
+2.51.0
+
--- /dev/null
+From eba69c0ce0af3470300bdcf6e7a8a57ae96e060c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:36:38 +0100
+Subject: gfs2: Remove space before newline
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit aa94ad9ab230d08741e6630a20fd1296b52c1009 ]
+
+There is an extraneous space before a newline in a fs_err message.
+Remove it
+
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index edb105f9da059..3d5cf9c24d78b 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -733,7 +733,7 @@ __acquires(&gl->gl_lockref.lock)
+ */
+ if (ret) {
+ if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
+- fs_err(sdp, "Error %d syncing glock \n", ret);
++ fs_err(sdp, "Error %d syncing glock\n", ret);
+ gfs2_dump_glock(NULL, gl, true);
+ }
+ spin_lock(&gl->gl_lockref.lock);
+--
+2.51.0
+
--- /dev/null
+From f3ace52de88566529e304adce0d528d12533f676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:00:01 +0200
+Subject: gpio: TODO: remove the task for converting to the new line setters
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6ec4b94e8e959b4201ca0bfc43fa50dc946d10cb ]
+
+The task is complete, but this was not reflected in the TODO file.
+
+Fixes: d9d87d90cc0b10cd ("treewide: rename GPIO set callbacks back to their original names")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/417af7e5a110c527eb759289bd5d2fd6885f4e01.1754917104.git.geert+renesas@glider.be
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/TODO | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/drivers/gpio/TODO b/drivers/gpio/TODO
+index 7a09a4f58551b..b797499e627ee 100644
+--- a/drivers/gpio/TODO
++++ b/drivers/gpio/TODO
+@@ -176,18 +176,6 @@ cannot be converted yet, but watch this space!
+
+ -------------------------------------------------------------------------------
+
+-Convert all GPIO chips to using the new, value returning line setters
+-
+-struct gpio_chip's set() and set_multiple() callbacks are now deprecated. They
+-return void and thus do not allow drivers to indicate failure to set the line
+-value back to the caller.
+-
+-We've now added new variants - set_rv() and set_multiple_rv() that return an
+-integer. Let's convert all GPIO drivers treewide to use the new callbacks,
+-remove the old ones and finally rename the new ones back to the old names.
+-
+--------------------------------------------------------------------------------
+-
+ Remove legacy sysfs features
+
+ We have two parallel per-chip class devices and per-exported-line attribute
+--
+2.51.0
+
--- /dev/null
+From 854deab64be97b77df698e73aae0d1a5fc01e0f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:13:16 +0800
+Subject: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
+
+From: Kang Chen <k.chen@smail.nju.edu.cn>
+
+[ Upstream commit bea3e1d4467bcf292c8e54f080353d556d355e26 ]
+
+BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
+Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290
+
+CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0xca/0x5f0 mm/kasan/report.c:482
+ kasan_report+0xca/0x100 mm/kasan/report.c:595
+ hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
+ hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738
+ vfs_listxattr+0xbe/0x140 fs/xattr.c:493
+ listxattr+0xee/0x190 fs/xattr.c:924
+ filename_listxattr fs/xattr.c:958 [inline]
+ path_listxattrat+0x143/0x360 fs/xattr.c:988
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7fe0e9fae16d
+Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
+RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000
+RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000
+ </TASK>
+
+Allocated by task 14290:
+ kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
+ kasan_save_track+0x14/0x30 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
+ __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4333 [inline]
+ __kmalloc_noprof+0x219/0x540 mm/slub.c:4345
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21
+ hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697
+ vfs_listxattr+0xbe/0x140 fs/xattr.c:493
+ listxattr+0xee/0x190 fs/xattr.c:924
+ filename_listxattr fs/xattr.c:958 [inline]
+ path_listxattrat+0x143/0x360 fs/xattr.c:988
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+When hfsplus_uni2asc is called from hfsplus_listxattr,
+it actually passes in a struct hfsplus_attr_unistr*.
+The size of the corresponding structure is different from that of hfsplus_unistr,
+so the previous fix (94458781aee6) is insufficient.
+The pointer on the unicode buffer is still going beyond the allocated memory.
+
+This patch introduces two warpper functions hfsplus_uni2asc_xattr_str and
+hfsplus_uni2asc_str to process two unicode buffers,
+struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively.
+When ustrlen value is bigger than the allocated memory size,
+the ustrlen value is limited to an safe size.
+
+Fixes: 94458781aee6 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()")
+Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/20250909031316.1647094-1-k.chen@smail.nju.edu.cn
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/dir.c | 2 +-
+ fs/hfsplus/hfsplus_fs.h | 8 ++++++--
+ fs/hfsplus/unicode.c | 24 +++++++++++++++++++-----
+ fs/hfsplus/xattr.c | 6 +++---
+ 4 files changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index 876bbb80fb4dc..1b3e27a0d5e03 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -204,7 +204,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
+ fd.entrylength);
+ type = be16_to_cpu(entry.type);
+ len = NLS_MAX_CHARSET_SIZE * HFSPLUS_MAX_STRLEN;
+- err = hfsplus_uni2asc(sb, &fd.key->cat.name, strbuf, &len);
++ err = hfsplus_uni2asc_str(sb, &fd.key->cat.name, strbuf, &len);
+ if (err)
+ goto out;
+ if (type == HFSPLUS_FOLDER) {
+diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
+index 96a5c24813dd6..2311e4be4e865 100644
+--- a/fs/hfsplus/hfsplus_fs.h
++++ b/fs/hfsplus/hfsplus_fs.h
+@@ -521,8 +521,12 @@ int hfsplus_strcasecmp(const struct hfsplus_unistr *s1,
+ const struct hfsplus_unistr *s2);
+ int hfsplus_strcmp(const struct hfsplus_unistr *s1,
+ const struct hfsplus_unistr *s2);
+-int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
+- char *astr, int *len_p);
++int hfsplus_uni2asc_str(struct super_block *sb,
++ const struct hfsplus_unistr *ustr, char *astr,
++ int *len_p);
++int hfsplus_uni2asc_xattr_str(struct super_block *sb,
++ const struct hfsplus_attr_unistr *ustr,
++ char *astr, int *len_p);
+ int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
+ int max_unistr_len, const char *astr, int len);
+ int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str);
+diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
+index 36b6cf2a3abba..862ba27f1628a 100644
+--- a/fs/hfsplus/unicode.c
++++ b/fs/hfsplus/unicode.c
+@@ -119,9 +119,8 @@ static u16 *hfsplus_compose_lookup(u16 *p, u16 cc)
+ return NULL;
+ }
+
+-int hfsplus_uni2asc(struct super_block *sb,
+- const struct hfsplus_unistr *ustr,
+- char *astr, int *len_p)
++static int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
++ int max_len, char *astr, int *len_p)
+ {
+ const hfsplus_unichr *ip;
+ struct nls_table *nls = HFSPLUS_SB(sb)->nls;
+@@ -134,8 +133,8 @@ int hfsplus_uni2asc(struct super_block *sb,
+ ip = ustr->unicode;
+
+ ustrlen = be16_to_cpu(ustr->length);
+- if (ustrlen > HFSPLUS_MAX_STRLEN) {
+- ustrlen = HFSPLUS_MAX_STRLEN;
++ if (ustrlen > max_len) {
++ ustrlen = max_len;
+ pr_err("invalid length %u has been corrected to %d\n",
+ be16_to_cpu(ustr->length), ustrlen);
+ }
+@@ -256,6 +255,21 @@ int hfsplus_uni2asc(struct super_block *sb,
+ return res;
+ }
+
++inline int hfsplus_uni2asc_str(struct super_block *sb,
++ const struct hfsplus_unistr *ustr, char *astr,
++ int *len_p)
++{
++ return hfsplus_uni2asc(sb, ustr, HFSPLUS_MAX_STRLEN, astr, len_p);
++}
++
++inline int hfsplus_uni2asc_xattr_str(struct super_block *sb,
++ const struct hfsplus_attr_unistr *ustr,
++ char *astr, int *len_p)
++{
++ return hfsplus_uni2asc(sb, (const struct hfsplus_unistr *)ustr,
++ HFSPLUS_ATTR_MAX_STRLEN, astr, len_p);
++}
++
+ /*
+ * Convert one or more ASCII characters into a single unicode character.
+ * Returns the number of ASCII characters corresponding to the unicode char.
+diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
+index 18dc3d254d218..c951fa9835aa1 100644
+--- a/fs/hfsplus/xattr.c
++++ b/fs/hfsplus/xattr.c
+@@ -735,9 +735,9 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
+ goto end_listxattr;
+
+ xattr_name_len = NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN;
+- if (hfsplus_uni2asc(inode->i_sb,
+- (const struct hfsplus_unistr *)&fd.key->attr.key_name,
+- strbuf, &xattr_name_len)) {
++ if (hfsplus_uni2asc_xattr_str(inode->i_sb,
++ &fd.key->attr.key_name, strbuf,
++ &xattr_name_len)) {
+ pr_err("unicode conversion failed\n");
+ res = -EIO;
+ goto end_listxattr;
+--
+2.51.0
+
--- /dev/null
+From 4c65e5a16907bf64f9c93d36460d6d09fb3d40fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 18:58:51 +0200
+Subject: HID: hidraw: tighten ioctl command parsing
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]
+
+The handling for variable-length ioctl commands in hidraw_ioctl() is
+rather complex and the check for the data direction is incomplete.
+
+Simplify this code by factoring out the various ioctls grouped by dir
+and size, and using a switch() statement with the size masked out, to
+ensure the rest of the command is correctly matched.
+
+Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hidraw.c | 224 ++++++++++++++++++++----------------
+ include/uapi/linux/hidraw.h | 2 +
+ 2 files changed, 124 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index c887f48756f4b..bbd6f23bce789 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
+ return 0;
+ }
+
+-static long hidraw_ioctl(struct file *file, unsigned int cmd,
+- unsigned long arg)
++static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *arg)
+ {
+- struct inode *inode = file_inode(file);
+- unsigned int minor = iminor(inode);
+- long ret = 0;
+- struct hidraw *dev;
+- struct hidraw_list *list = file->private_data;
+- void __user *user_arg = (void __user*) arg;
+-
+- down_read(&minors_rwsem);
+- dev = hidraw_table[minor];
+- if (!dev || !dev->exist || hidraw_is_revoked(list)) {
+- ret = -ENODEV;
+- goto out;
+- }
++ struct hid_device *hid = dev->hid;
+
+ switch (cmd) {
+ case HIDIOCGRDESCSIZE:
+- if (put_user(dev->hid->rsize, (int __user *)arg))
+- ret = -EFAULT;
++ if (put_user(hid->rsize, (int __user *)arg))
++ return -EFAULT;
+ break;
+
+ case HIDIOCGRDESC:
+@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
+ __u32 len;
+
+ if (get_user(len, (int __user *)arg))
+- ret = -EFAULT;
+- else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+- ret = -EINVAL;
+- else if (copy_to_user(user_arg + offsetof(
+- struct hidraw_report_descriptor,
+- value[0]),
+- dev->hid->rdesc,
+- min(dev->hid->rsize, len)))
+- ret = -EFAULT;
++ return -EFAULT;
++
++ if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
++ return -EINVAL;
++
++ if (copy_to_user(arg + offsetof(
++ struct hidraw_report_descriptor,
++ value[0]),
++ hid->rdesc,
++ min(hid->rsize, len)))
++ return -EFAULT;
++
+ break;
+ }
+ case HIDIOCGRAWINFO:
+ {
+ struct hidraw_devinfo dinfo;
+
+- dinfo.bustype = dev->hid->bus;
+- dinfo.vendor = dev->hid->vendor;
+- dinfo.product = dev->hid->product;
+- if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
+- ret = -EFAULT;
++ dinfo.bustype = hid->bus;
++ dinfo.vendor = hid->vendor;
++ dinfo.product = hid->product;
++ if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
++ return -EFAULT;
+ break;
+ }
+ case HIDIOCREVOKE:
+ {
+- if (user_arg)
+- ret = -EINVAL;
+- else
+- ret = hidraw_revoke(list);
+- break;
++ struct hidraw_list *list = file->private_data;
++
++ if (arg)
++ return -EINVAL;
++
++ return hidraw_revoke(list);
+ }
+ default:
+- {
+- struct hid_device *hid = dev->hid;
+- if (_IOC_TYPE(cmd) != 'H') {
+- ret = -EINVAL;
+- break;
+- }
++ /*
++ * None of the above ioctls can return -EAGAIN, so
++ * use it as a marker that we need to check variable
++ * length ioctls.
++ */
++ return -EAGAIN;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
+- break;
+- }
++ return 0;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
+- break;
+- }
++static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ int len = _IOC_SIZE(cmd);
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCSFEATURE(0):
++ return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCGFEATURE(0):
++ return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
++ case HIDIOCSINPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCGINPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
++ case HIDIOCSOUTPUT(0):
++ return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ case HIDIOCGOUTPUT(0):
++ return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
+- int len = _IOC_SIZE(cmd);
+- ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
+- break;
+- }
++ return -EINVAL;
++}
+
+- /* Begin Read-only ioctls. */
+- if (_IOC_DIR(cmd) != _IOC_READ) {
+- ret = -EINVAL;
+- break;
+- }
++static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
++ void __user *user_arg)
++{
++ struct hid_device *hid = dev->hid;
++ int len = _IOC_SIZE(cmd);
++ int field_len;
++
++ switch (cmd & ~IOCSIZE_MASK) {
++ case HIDIOCGRAWNAME(0):
++ field_len = strlen(hid->name) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->name, len) ? -EFAULT : len;
++ case HIDIOCGRAWPHYS(0):
++ field_len = strlen(hid->phys) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->phys, len) ? -EFAULT : len;
++ case HIDIOCGRAWUNIQ(0):
++ field_len = strlen(hid->uniq) + 1;
++ if (len > field_len)
++ len = field_len;
++ return copy_to_user(user_arg, hid->uniq, len) ? -EFAULT : len;
++ }
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
+- int len = strlen(hid->name) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->name, len) ?
+- -EFAULT : len;
+- break;
+- }
++ return -EINVAL;
++}
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
+- int len = strlen(hid->phys) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->phys, len) ?
+- -EFAULT : len;
+- break;
+- }
++static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ struct inode *inode = file_inode(file);
++ unsigned int minor = iminor(inode);
++ struct hidraw *dev;
++ struct hidraw_list *list = file->private_data;
++ void __user *user_arg = (void __user *)arg;
++ int ret;
+
+- if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
+- int len = strlen(hid->uniq) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- ret = copy_to_user(user_arg, hid->uniq, len) ?
+- -EFAULT : len;
+- break;
+- }
+- }
++ down_read(&minors_rwsem);
++ dev = hidraw_table[minor];
++ if (!dev || !dev->exist || hidraw_is_revoked(list)) {
++ ret = -ENODEV;
++ goto out;
++ }
++
++ if (_IOC_TYPE(cmd) != 'H') {
++ ret = -EINVAL;
++ goto out;
++ }
+
++ if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
+ ret = -ENOTTY;
++ goto out;
+ }
++
++ ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
++ if (ret != -EAGAIN)
++ goto out;
++
++ switch (_IOC_DIR(cmd)) {
++ case (_IOC_READ | _IOC_WRITE):
++ ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ case _IOC_READ:
++ ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
++ break;
++ default:
++ /* Any other IOC_DIR is wrong */
++ ret = -EINVAL;
++ }
++
+ out:
+ up_read(&minors_rwsem);
+ return ret;
+diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
+index d5ee269864e07..ebd701b3c18d9 100644
+--- a/include/uapi/linux/hidraw.h
++++ b/include/uapi/linux/hidraw.h
+@@ -48,6 +48,8 @@ struct hidraw_devinfo {
+ #define HIDIOCGOUTPUT(len) _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
+ #define HIDIOCREVOKE _IOW('H', 0x0D, int) /* Revoke device access */
+
++#define HIDIOCTL_LAST _IOC_NR(HIDIOCREVOKE)
++
+ #define HIDRAW_FIRST_MINOR 0
+ #define HIDRAW_MAX_DEVICES 64
+ /* number of reports to buffer */
+--
+2.51.0
+
--- /dev/null
+From ec9eda42010ce0f68f919da911e375eed80294b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:57:31 +0300
+Subject: HID: i2c-hid: Fix test in i2c_hid_core_register_panel_follower()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 5c76c794bf29399394ebacaa5af8436b8bed0d46 ]
+
+Bitwise AND was intended instead of OR. With the current code the
+condition is always true.
+
+Fixes: cbdd16b818ee ("HID: i2c-hid: Make elan touch controllers power on after panel is enabled")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Pin-yen Lin <treapking@chromium.org>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/aK8Au3CgZSTvfEJ6@stanley.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 99ce6386176c6..30ebde1273be3 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -1189,7 +1189,7 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
+ struct device *dev = &ihid->client->dev;
+ int ret;
+
+- if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
++ if (ihid->hid->initial_quirks & HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
+ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs;
+ else
+ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs;
+--
+2.51.0
+
--- /dev/null
+From 04ade47af7b516c319c1225e5a43c52ebe80a274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 19:49:34 +0800
+Subject: HID: i2c-hid: Make elan touch controllers power on after panel is
+ enabled
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit cbdd16b818eef876dd2de9d503fe7397a0666cbe ]
+
+Introduce a new HID quirk to indicate that this device has to be enabled
+after the panel's backlight is enabled, and update the driver data for
+the elan devices to enable this quirk. This cannot be a I2C HID quirk
+because the kernel needs to acknowledge this before powering up the
+device and read the VID/PID. When this quirk is enabled, register
+.panel_enabled()/.panel_disabling() instead for the panel follower.
+
+Also rename the *panel_prepare* functions into *panel_follower* because
+they could be called in other situations now.
+
+Fixes: bd3cba00dcc63 ("HID: i2c-hid: elan: Add support for Elan eKTH6915 i2c-hid touchscreens")
+Fixes: d06651bebf99e ("HID: i2c-hid: elan: Add elan-ekth6a12nay timing")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Acked-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250818115015.2909525-2-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 46 ++++++++++++++++-----------
+ drivers/hid/i2c-hid/i2c-hid-of-elan.c | 11 ++++++-
+ include/linux/hid.h | 2 ++
+ 3 files changed, 40 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index d3912e3f2f13a..99ce6386176c6 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -112,9 +112,9 @@ struct i2c_hid {
+
+ struct i2chid_ops *ops;
+ struct drm_panel_follower panel_follower;
+- struct work_struct panel_follower_prepare_work;
++ struct work_struct panel_follower_work;
+ bool is_panel_follower;
+- bool prepare_work_finished;
++ bool panel_follower_work_finished;
+ };
+
+ static const struct i2c_hid_quirks {
+@@ -1110,10 +1110,10 @@ static int i2c_hid_core_probe_panel_follower(struct i2c_hid *ihid)
+ return ret;
+ }
+
+-static void ihid_core_panel_prepare_work(struct work_struct *work)
++static void ihid_core_panel_follower_work(struct work_struct *work)
+ {
+ struct i2c_hid *ihid = container_of(work, struct i2c_hid,
+- panel_follower_prepare_work);
++ panel_follower_work);
+ struct hid_device *hid = ihid->hid;
+ int ret;
+
+@@ -1130,7 +1130,7 @@ static void ihid_core_panel_prepare_work(struct work_struct *work)
+ if (ret)
+ dev_warn(&ihid->client->dev, "Power on failed: %d\n", ret);
+ else
+- WRITE_ONCE(ihid->prepare_work_finished, true);
++ WRITE_ONCE(ihid->panel_follower_work_finished, true);
+
+ /*
+ * The work APIs provide a number of memory ordering guarantees
+@@ -1139,12 +1139,12 @@ static void ihid_core_panel_prepare_work(struct work_struct *work)
+ * guarantee that a write that happened in the work is visible after
+ * cancel_work_sync(). We'll add a write memory barrier here to match
+ * with i2c_hid_core_panel_unpreparing() to ensure that our write to
+- * prepare_work_finished is visible there.
++ * panel_follower_work_finished is visible there.
+ */
+ smp_wmb();
+ }
+
+-static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower)
++static int i2c_hid_core_panel_follower_resume(struct drm_panel_follower *follower)
+ {
+ struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower);
+
+@@ -1152,29 +1152,36 @@ static int i2c_hid_core_panel_prepared(struct drm_panel_follower *follower)
+ * Powering on a touchscreen can be a slow process. Queue the work to
+ * the system workqueue so we don't block the panel's power up.
+ */
+- WRITE_ONCE(ihid->prepare_work_finished, false);
+- schedule_work(&ihid->panel_follower_prepare_work);
++ WRITE_ONCE(ihid->panel_follower_work_finished, false);
++ schedule_work(&ihid->panel_follower_work);
+
+ return 0;
+ }
+
+-static int i2c_hid_core_panel_unpreparing(struct drm_panel_follower *follower)
++static int i2c_hid_core_panel_follower_suspend(struct drm_panel_follower *follower)
+ {
+ struct i2c_hid *ihid = container_of(follower, struct i2c_hid, panel_follower);
+
+- cancel_work_sync(&ihid->panel_follower_prepare_work);
++ cancel_work_sync(&ihid->panel_follower_work);
+
+- /* Match with ihid_core_panel_prepare_work() */
++ /* Match with ihid_core_panel_follower_work() */
+ smp_rmb();
+- if (!READ_ONCE(ihid->prepare_work_finished))
++ if (!READ_ONCE(ihid->panel_follower_work_finished))
+ return 0;
+
+ return i2c_hid_core_suspend(ihid, true);
+ }
+
+-static const struct drm_panel_follower_funcs i2c_hid_core_panel_follower_funcs = {
+- .panel_prepared = i2c_hid_core_panel_prepared,
+- .panel_unpreparing = i2c_hid_core_panel_unpreparing,
++static const struct drm_panel_follower_funcs
++ i2c_hid_core_panel_follower_prepare_funcs = {
++ .panel_prepared = i2c_hid_core_panel_follower_resume,
++ .panel_unpreparing = i2c_hid_core_panel_follower_suspend,
++};
++
++static const struct drm_panel_follower_funcs
++ i2c_hid_core_panel_follower_enable_funcs = {
++ .panel_enabled = i2c_hid_core_panel_follower_resume,
++ .panel_disabling = i2c_hid_core_panel_follower_suspend,
+ };
+
+ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
+@@ -1182,7 +1189,10 @@ static int i2c_hid_core_register_panel_follower(struct i2c_hid *ihid)
+ struct device *dev = &ihid->client->dev;
+ int ret;
+
+- ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_funcs;
++ if (ihid->hid->initial_quirks | HID_QUIRK_POWER_ON_AFTER_BACKLIGHT)
++ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_enable_funcs;
++ else
++ ihid->panel_follower.funcs = &i2c_hid_core_panel_follower_prepare_funcs;
+
+ /*
+ * If we're not in control of our own power up/power down then we can't
+@@ -1237,7 +1247,7 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+ init_waitqueue_head(&ihid->wait);
+ mutex_init(&ihid->cmd_lock);
+ mutex_init(&ihid->reset_lock);
+- INIT_WORK(&ihid->panel_follower_prepare_work, ihid_core_panel_prepare_work);
++ INIT_WORK(&ihid->panel_follower_work, ihid_core_panel_follower_work);
+
+ /* we need to allocate the command buffer without knowing the maximum
+ * size of the reports. Let's use HID_MIN_BUFFER_SIZE, then we do the
+diff --git a/drivers/hid/i2c-hid/i2c-hid-of-elan.c b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+index 3fcff6daa0d3a..0215f217f6d86 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-of-elan.c
++++ b/drivers/hid/i2c-hid/i2c-hid-of-elan.c
+@@ -8,6 +8,7 @@
+ #include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/gpio/consumer.h>
++#include <linux/hid.h>
+ #include <linux/i2c.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -23,6 +24,7 @@ struct elan_i2c_hid_chip_data {
+ unsigned int post_power_delay_ms;
+ u16 hid_descriptor_address;
+ const char *main_supply_name;
++ bool power_after_backlight;
+ };
+
+ struct i2c_hid_of_elan {
+@@ -97,6 +99,7 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client)
+ {
+ struct i2c_hid_of_elan *ihid_elan;
+ int ret;
++ u32 quirks = 0;
+
+ ihid_elan = devm_kzalloc(&client->dev, sizeof(*ihid_elan), GFP_KERNEL);
+ if (!ihid_elan)
+@@ -131,8 +134,12 @@ static int i2c_hid_of_elan_probe(struct i2c_client *client)
+ }
+ }
+
++ if (ihid_elan->chip_data->power_after_backlight)
++ quirks = HID_QUIRK_POWER_ON_AFTER_BACKLIGHT;
++
+ ret = i2c_hid_core_probe(client, &ihid_elan->ops,
+- ihid_elan->chip_data->hid_descriptor_address, 0);
++ ihid_elan->chip_data->hid_descriptor_address,
++ quirks);
+ if (ret)
+ goto err_deassert_reset;
+
+@@ -150,6 +157,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6915_chip_data = {
+ .post_gpio_reset_on_delay_ms = 300,
+ .hid_descriptor_address = 0x0001,
+ .main_supply_name = "vcc33",
++ .power_after_backlight = true,
+ };
+
+ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
+@@ -157,6 +165,7 @@ static const struct elan_i2c_hid_chip_data elan_ekth6a12nay_chip_data = {
+ .post_gpio_reset_on_delay_ms = 300,
+ .hid_descriptor_address = 0x0001,
+ .main_supply_name = "vcc33",
++ .power_after_backlight = true,
+ };
+
+ static const struct elan_i2c_hid_chip_data ilitek_ili9882t_chip_data = {
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index 2cc4f1e4ea963..c32425b5d0119 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -364,6 +364,7 @@ struct hid_item {
+ * | @HID_QUIRK_HAVE_SPECIAL_DRIVER:
+ * | @HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE:
+ * | @HID_QUIRK_IGNORE_SPECIAL_DRIVER
++ * | @HID_QUIRK_POWER_ON_AFTER_BACKLIGHT
+ * | @HID_QUIRK_FULLSPEED_INTERVAL:
+ * | @HID_QUIRK_NO_INIT_REPORTS:
+ * | @HID_QUIRK_NO_IGNORE:
+@@ -391,6 +392,7 @@ struct hid_item {
+ #define HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE BIT(20)
+ #define HID_QUIRK_NOINVERT BIT(21)
+ #define HID_QUIRK_IGNORE_SPECIAL_DRIVER BIT(22)
++#define HID_QUIRK_POWER_ON_AFTER_BACKLIGHT BIT(23)
+ #define HID_QUIRK_FULLSPEED_INTERVAL BIT(28)
+ #define HID_QUIRK_NO_INIT_REPORTS BIT(29)
+ #define HID_QUIRK_NO_IGNORE BIT(30)
+--
+2.51.0
+
--- /dev/null
+From 735126cbea533089008f0196b7a484aa0e29a7d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:27:35 +0200
+Subject: HID: steelseries: Fix STEELSERIES_SRWS1 handling in
+ steelseries_remove()
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit 2910913ef87dd9b9ce39e844c7295e1896b3b039 ]
+
+srws1_remove label can be only reached only if LEDS subsystem is enabled. To
+avoid putting horryfing ifdef second time around the label, just perform
+the cleanup and exit immediately directly.
+
+Fixes: a84eeacbf9325 ("HID: steelseries: refactor probe() and remove()")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202509090334.76D4qGtW-lkp@intel.com/
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-steelseries.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
+index 8af98d67959e0..f98435631aa18 100644
+--- a/drivers/hid/hid-steelseries.c
++++ b/drivers/hid/hid-steelseries.c
+@@ -582,7 +582,7 @@ static void steelseries_remove(struct hid_device *hdev)
+ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+- goto srws1_remove;
++ hid_hw_stop(hdev);
+ #endif
+ return;
+ }
+@@ -596,7 +596,6 @@ static void steelseries_remove(struct hid_device *hdev)
+ cancel_delayed_work_sync(&sd->battery_work);
+
+ hid_hw_close(hdev);
+-srws1_remove:
+ hid_hw_stop(hdev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ec948b1fb3e262c43cbe022f6818d878428d1b8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 20:26:43 +0900
+Subject: HID: steelseries: refactor probe() and remove()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+[ Upstream commit a84eeacbf9325fd7f604b80f246aaba157730cd5 ]
+
+steelseries_srws1_probe() still does not use devm_kzalloc() and
+devm_led_classdev_register(), so there is a lot of code to safely manage
+heap, which reduces readability and may cause memory leaks due to minor
+patch mistakes in the future.
+
+Therefore, it should be changed to use devm_kzalloc() and
+devm_led_classdev_register() to easily and safely manage heap.
+
+Also, the current steelseries driver mainly checks sd->quriks to determine
+which product a specific HID device is, which is not the correct way.
+
+remove(), unlike probe(), does not receive struct hid_device_id as an
+argument, so it must check hdev unconditionally to know which product
+it is.
+
+However, since struct steelseries_device and struct steelseries_srws1_data
+have different structures, if SRWS1 is removed in remove(), converts
+hdev->dev, which is initialized to struct steelseries_srws1_data,
+to struct steelseries_device and uses it. This causes various
+memory-related bugs as completely unexpected values exist in member
+variables of the structure.
+
+Therefore, in order to modify probe() and remove() to work properly,
+Arctis 1, 9 should be added to HID_USB_DEVICE and some functions should be
+modified to check hdev->product when determining HID device product.
+
+Fixes: a0c76896c3fb ("HID: steelseries: Add support for Arctis 1 XBox")
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 +
+ drivers/hid/hid-quirks.c | 2 +
+ drivers/hid/hid-steelseries.c | 109 ++++++++++++----------------------
+ 3 files changed, 43 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 149798754570d..ded5348d190c5 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1296,6 +1296,8 @@
+
+ #define USB_VENDOR_ID_STEELSERIES 0x1038
+ #define USB_DEVICE_ID_STEELSERIES_SRWS1 0x1410
++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_1 0x12b6
++#define USB_DEVICE_ID_STEELSERIES_ARCTIS_9 0x12c2
+
+ #define USB_VENDOR_ID_SUN 0x0430
+ #define USB_DEVICE_ID_RARITAN_KVM_DONGLE 0xcdab
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index f619ed10535d7..ffd034566e2e1 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -695,6 +695,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #endif
+ #if IS_ENABLED(CONFIG_HID_STEELSERIES)
+ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_SRWS1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_SUNPLUS)
+ { HID_USB_DEVICE(USB_VENDOR_ID_SUNPLUS, USB_DEVICE_ID_SUNPLUS_WDESKTOP) },
+diff --git a/drivers/hid/hid-steelseries.c b/drivers/hid/hid-steelseries.c
+index d4bd7848b8c66..8af98d67959e0 100644
+--- a/drivers/hid/hid-steelseries.c
++++ b/drivers/hid/hid-steelseries.c
+@@ -249,11 +249,11 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ {
+ int ret, i;
+ struct led_classdev *led;
++ struct steelseries_srws1_data *drv_data;
+ size_t name_sz;
+ char *name;
+
+- struct steelseries_srws1_data *drv_data = kzalloc(sizeof(*drv_data), GFP_KERNEL);
+-
++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL);
+ if (drv_data == NULL) {
+ hid_err(hdev, "can't alloc SRW-S1 memory\n");
+ return -ENOMEM;
+@@ -264,18 +264,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ ret = hid_parse(hdev);
+ if (ret) {
+ hid_err(hdev, "parse failed\n");
+- goto err_free;
++ goto err;
+ }
+
+ if (!hid_validate_values(hdev, HID_OUTPUT_REPORT, 0, 0, 16)) {
+ ret = -ENODEV;
+- goto err_free;
++ goto err;
+ }
+
+ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+ if (ret) {
+ hid_err(hdev, "hw start failed\n");
+- goto err_free;
++ goto err;
+ }
+
+ /* register led subsystem */
+@@ -288,10 +288,10 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ name_sz = strlen(hdev->uniq) + 16;
+
+ /* 'ALL', for setting all LEDs simultaneously */
+- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ if (!led) {
+ hid_err(hdev, "can't allocate memory for LED ALL\n");
+- goto err_led;
++ goto out;
+ }
+
+ name = (void *)(&led[1]);
+@@ -303,16 +303,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ led->brightness_set = steelseries_srws1_led_all_set_brightness;
+
+ drv_data->led[SRWS1_NUMBER_LEDS] = led;
+- ret = led_classdev_register(&hdev->dev, led);
+- if (ret)
+- goto err_led;
++ ret = devm_led_classdev_register(&hdev->dev, led);
++ if (ret) {
++ hid_err(hdev, "failed to register LED %d. Aborting.\n", SRWS1_NUMBER_LEDS);
++ goto out; /* let the driver continue without LEDs */
++ }
+
+ /* Each individual LED */
+ for (i = 0; i < SRWS1_NUMBER_LEDS; i++) {
+- led = kzalloc(sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
++ led = devm_kzalloc(&hdev->dev, sizeof(struct led_classdev)+name_sz, GFP_KERNEL);
+ if (!led) {
+ hid_err(hdev, "can't allocate memory for LED %d\n", i);
+- goto err_led;
++ break;
+ }
+
+ name = (void *)(&led[1]);
+@@ -324,53 +326,18 @@ static int steelseries_srws1_probe(struct hid_device *hdev,
+ led->brightness_set = steelseries_srws1_led_set_brightness;
+
+ drv_data->led[i] = led;
+- ret = led_classdev_register(&hdev->dev, led);
++ ret = devm_led_classdev_register(&hdev->dev, led);
+
+ if (ret) {
+ hid_err(hdev, "failed to register LED %d. Aborting.\n", i);
+-err_led:
+- /* Deregister all LEDs (if any) */
+- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
+- led = drv_data->led[i];
+- drv_data->led[i] = NULL;
+- if (!led)
+- continue;
+- led_classdev_unregister(led);
+- kfree(led);
+- }
+- goto out; /* but let the driver continue without LEDs */
++ break; /* but let the driver continue without LEDs */
+ }
+ }
+ out:
+ return 0;
+-err_free:
+- kfree(drv_data);
++err:
+ return ret;
+ }
+-
+-static void steelseries_srws1_remove(struct hid_device *hdev)
+-{
+- int i;
+- struct led_classdev *led;
+-
+- struct steelseries_srws1_data *drv_data = hid_get_drvdata(hdev);
+-
+- if (drv_data) {
+- /* Deregister LEDs (if any) */
+- for (i = 0; i < SRWS1_NUMBER_LEDS + 1; i++) {
+- led = drv_data->led[i];
+- drv_data->led[i] = NULL;
+- if (!led)
+- continue;
+- led_classdev_unregister(led);
+- kfree(led);
+- }
+-
+- }
+-
+- hid_hw_stop(hdev);
+- kfree(drv_data);
+-}
+ #endif
+
+ #define STEELSERIES_HEADSET_BATTERY_TIMEOUT_MS 3000
+@@ -405,13 +372,12 @@ static int steelseries_headset_request_battery(struct hid_device *hdev,
+
+ static void steelseries_headset_fetch_battery(struct hid_device *hdev)
+ {
+- struct steelseries_device *sd = hid_get_drvdata(hdev);
+ int ret = 0;
+
+- if (sd->quirks & STEELSERIES_ARCTIS_1)
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1)
+ ret = steelseries_headset_request_battery(hdev,
+ arctis_1_battery_request, sizeof(arctis_1_battery_request));
+- else if (sd->quirks & STEELSERIES_ARCTIS_9)
++ else if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9)
+ ret = steelseries_headset_request_battery(hdev,
+ arctis_9_battery_request, sizeof(arctis_9_battery_request));
+
+@@ -567,14 +533,7 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+ struct steelseries_device *sd;
+ int ret;
+
+- sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
+- if (!sd)
+- return -ENOMEM;
+- hid_set_drvdata(hdev, sd);
+- sd->hdev = hdev;
+- sd->quirks = id->driver_data;
+-
+- if (sd->quirks & STEELSERIES_SRWS1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+ return steelseries_srws1_probe(hdev, id);
+@@ -583,6 +542,13 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+ #endif
+ }
+
++ sd = devm_kzalloc(&hdev->dev, sizeof(*sd), GFP_KERNEL);
++ if (!sd)
++ return -ENOMEM;
++ hid_set_drvdata(hdev, sd);
++ sd->hdev = hdev;
++ sd->quirks = id->driver_data;
++
+ ret = hid_parse(hdev);
+ if (ret)
+ return ret;
+@@ -610,17 +576,19 @@ static int steelseries_probe(struct hid_device *hdev, const struct hid_device_id
+
+ static void steelseries_remove(struct hid_device *hdev)
+ {
+- struct steelseries_device *sd = hid_get_drvdata(hdev);
++ struct steelseries_device *sd;
+ unsigned long flags;
+
+- if (sd->quirks & STEELSERIES_SRWS1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1) {
+ #if IS_BUILTIN(CONFIG_LEDS_CLASS) || \
+ (IS_MODULE(CONFIG_LEDS_CLASS) && IS_MODULE(CONFIG_HID_STEELSERIES))
+- steelseries_srws1_remove(hdev);
++ goto srws1_remove;
+ #endif
+ return;
+ }
+
++ sd = hid_get_drvdata(hdev);
++
+ spin_lock_irqsave(&sd->lock, flags);
+ sd->removed = true;
+ spin_unlock_irqrestore(&sd->lock, flags);
+@@ -628,6 +596,7 @@ static void steelseries_remove(struct hid_device *hdev)
+ cancel_delayed_work_sync(&sd->battery_work);
+
+ hid_hw_close(hdev);
++srws1_remove:
+ hid_hw_stop(hdev);
+ }
+
+@@ -667,10 +636,10 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
+ unsigned long flags;
+
+ /* Not a headset */
+- if (sd->quirks & STEELSERIES_SRWS1)
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_SRWS1)
+ return 0;
+
+- if (sd->quirks & STEELSERIES_ARCTIS_1) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_1) {
+ hid_dbg(sd->hdev,
+ "Parsing raw event for Arctis 1 headset (%*ph)\n", size, read_buf);
+ if (size < ARCTIS_1_BATTERY_RESPONSE_LEN ||
+@@ -688,7 +657,7 @@ static int steelseries_headset_raw_event(struct hid_device *hdev,
+ }
+ }
+
+- if (sd->quirks & STEELSERIES_ARCTIS_9) {
++ if (hdev->product == USB_DEVICE_ID_STEELSERIES_ARCTIS_9) {
+ hid_dbg(sd->hdev,
+ "Parsing raw event for Arctis 9 headset (%*ph)\n", size, read_buf);
+ if (size < ARCTIS_9_BATTERY_RESPONSE_LEN) {
+@@ -757,11 +726,11 @@ static const struct hid_device_id steelseries_devices[] = {
+ .driver_data = STEELSERIES_SRWS1 },
+
+ { /* SteelSeries Arctis 1 Wireless for XBox */
+- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12b6),
+- .driver_data = STEELSERIES_ARCTIS_1 },
++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_1),
++ .driver_data = STEELSERIES_ARCTIS_1 },
+
+ { /* SteelSeries Arctis 9 Wireless for XBox */
+- HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, 0x12c2),
++ HID_USB_DEVICE(USB_VENDOR_ID_STEELSERIES, USB_DEVICE_ID_STEELSERIES_ARCTIS_9),
+ .driver_data = STEELSERIES_ARCTIS_9 },
+
+ { }
+--
+2.51.0
+
--- /dev/null
+From 073fc78eebc9afb31a734e2db256e086b8a3c26f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:02:54 +0530
+Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ]
+
+hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate
+operations. As per the original design in commit 40549ba8f8e0 ("hugetlb:
+use new vma_lock for pmd sharing synchronization"), if the trylock fails
+or the VMA has no lock, it should skip that VMA. Any remaining mapped
+pages are handled by remove_inode_hugepages() which is called after
+hugetlb_vmdelete_list() and uses proper lock ordering to guarantee
+unmapping success.
+
+Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs
+without shareable locks, the code proceeds to call unmap_hugepage_range().
+This causes assertion failures in huge_pmd_unshare() →
+hugetlb_vma_assert_locked() because no lock is actually held:
+
+ WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted
+ Call Trace:
+ hugetlb_vma_assert_locked+0x1dd/0x250
+ huge_pmd_unshare+0x2c8/0x540
+ __unmap_hugepage_range+0x6e3/0x1aa0
+ unmap_hugepage_range+0x32e/0x410
+ hugetlb_vmdelete_list+0x189/0x1f0
+
+Fix by using goto to ensure locks acquired by trylock are always released,
+even when skipping VMAs without shareable locks.
+
+Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com
+Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization")
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Oscar Salvador <osalvador@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hugetlbfs/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index be4be99304bc0..dbeef80811a32 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -490,6 +490,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ if (!hugetlb_vma_trylock_write(vma))
+ continue;
+
++ /*
++ * Skip VMAs without shareable locks. Per the design in commit
++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages()
++ * called after this function with proper locking.
++ */
++ if (!__vma_shareable_lock(vma))
++ goto skip;
++
+ v_start = vma_offset_start(vma, start);
+ v_end = vma_offset_end(vma, end);
+
+@@ -500,6 +508,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ * vmas. Therefore, lock is not held when calling
+ * unmap_hugepage_range for private vmas.
+ */
++skip:
+ hugetlb_vma_unlock_write(vma);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 7e320e078c7396baef0f9ff1255da3206c2ff636 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 22:31:48 +0200
+Subject: hwmon: (asus-ec-sensors) Narrow lock for X870E-CREATOR WIFI
+
+From: Eugene Shalygin <eugene.shalygin@gmail.com>
+
+[ Upstream commit 3aa72cf03924d04c8d20f8b319df8f73550dd26c ]
+
+Use mutex from the SIO device rather than the global lock.
+
+Signed-off-by: Eugene Shalygin <eugene.shalygin@gmail.com>
+
+Fixes: 3e538b52157b ("hwmon: (asus-ec-sensors) add ProArt X870E-CREATOR WIFI")
+Link: https://lore.kernel.org/r/20250805203157.18446-1-eugene.shalygin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 4ac554731e98a..f43efb80aabf3 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -396,7 +396,7 @@ static const struct ec_board_info board_info_pro_art_x870E_creator_wifi = {
+ .sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
+ SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
+ SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
+- .mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
++ .mutex_path = ASUS_HW_ACCESS_MUTEX_SB_PCI0_SBRG_SIO1_MUT0,
+ .family = family_amd_800_series,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 5398a24e6c21212e0cdcfa764c819e899058b7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:48:58 +0200
+Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
+ different subsystems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
+
+Distinct between fan speed setting request coming for hwmon and
+thermal subsystems.
+
+There are fields 'last_hwmon_state' and 'last_thermal_state' in the
+structure 'mlxreg_fan_pwm', which respectively store the cooling state
+set by the 'hwmon' and 'thermal' subsystem.
+The purpose is to make arbitration of fan speed setting. For example, if
+fan speed required to be not lower than some limit, such setting is to
+be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
+not set fan below this limit.
+
+Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
+cooling state to never be set to a lower value.
+
+Eliminate update of 'last_thermal_state', when request is coming from
+'hwmon' subsystem.
+
+Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index c25a54d5b39ad..0ba9195c9d713 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -113,8 +113,8 @@ struct mlxreg_fan {
+ int divider;
+ };
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state);
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal);
+
+ static int
+ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ * last thermal state.
+ */
+ if (pwm->last_hwmon_state >= pwm->last_thermal_state)
+- return mlxreg_fan_set_cur_state(pwm->cdev,
+- pwm->last_hwmon_state);
++ return _mlxreg_fan_set_cur_state(pwm->cdev,
++ pwm->last_hwmon_state,
++ false);
+ return 0;
+ }
+ return regmap_write(fan->regmap, pwm->reg, val);
+@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state)
+-
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal)
+ {
+ struct mlxreg_fan_pwm *pwm = cdev->devdata;
+ struct mlxreg_fan *fan = pwm->fan;
+@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return -EINVAL;
+
+ /* Save thermal state. */
+- pwm->last_thermal_state = state;
++ if (thermal)
++ pwm->last_thermal_state = state;
+
+ state = max_t(unsigned long, state, pwm->last_hwmon_state);
+ err = regmap_write(fan->regmap, pwm->reg,
+@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state)
++
++{
++ return _mlxreg_fan_set_cur_state(cdev, state, true);
++}
++
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+ .get_max_state = mlxreg_fan_get_max_state,
+ .get_cur_state = mlxreg_fan_get_cur_state,
+--
+2.51.0
+
--- /dev/null
+From f4311ac6a8e74d342fce44525dda0060a8fa1f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index d8fd8a3544828..9e408144a10c1 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -231,6 +231,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ if (IS_ERR(ks_sa_rng->regmap_cfg))
+ return dev_err_probe(dev, -EINVAL, "syscon_node_to_regmap failed\n");
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 5b3200f08992279357a550e82b72de846dd9235f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 17:28:00 +0200
+Subject: hwrng: nomadik - add ARM_AMBA dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
+
+Compile-testing this driver is only possible when the AMBA bus driver is
+available in the kernel:
+
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
+nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
+nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
+x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
+
+The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
+specified for the COMPILE_TEST case.
+
+Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index c858278434475..7826fd7c4603f 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG
+ config HW_RANDOM_NOMADIK
+ tristate "ST-Ericsson Nomadik Random Number Generator support"
+ depends on ARCH_NOMADIK || COMPILE_TEST
++ depends on ARM_AMBA
+ default HW_RANDOM
+ help
+ This driver provides kernel-side support for the Random Number
+--
+2.51.0
+
--- /dev/null
+From d20bc4ece93d218d1e0434eeffd7bfffbb4ecfca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index b4bfdd2dd35e4..e37210d6c5f26 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -314,6 +314,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 87a71f315fc751e4c9fd48765a579457479bcc89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:10 +0900
+Subject: i2c: designware: Fix clock issue when PM is disabled
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
+
+When the driver is removed, the clocks are first enabled by
+calling pm_runtime_get_sync(), and then disabled with
+pm_runtime_put_sync().
+
+If CONFIG_PM=y, clocks for this controller are disabled when it's in
+the idle state. So the clocks are properly disabled when the driver
+exits.
+
+Othewise, the clocks are always enabled and the PM functions have
+no effect. Therefore, the driver exits without disabling the clocks.
+
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 18
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+
+To ensure that the clocks can be disabled correctly even without
+CONFIG_PM=y, should add the following fixes:
+
+- Replace with pm_runtime_put_noidle(), which only decrements the runtime
+ PM usage count.
+- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index a35e4c64a1d46..b4bfdd2dd35e4 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -331,9 +331,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
+ i2c_dw_disable(dev);
+
+ pm_runtime_dont_use_autosuspend(device);
+- pm_runtime_put_sync(device);
++ pm_runtime_put_noidle(device);
+ dw_i2c_plat_pm_cleanup(dev);
+
++ i2c_dw_prepare_clk(dev, false);
++
+ i2c_dw_remove_lock_support(dev);
+
+ reset_control_assert(dev->rst);
+--
+2.51.0
+
--- /dev/null
+From e830f34d565482f67b70354715bff30fad745ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index ab456c3717db1..dee40704825cb 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From a7fa1f68263018c26e169ed67f0562d1da8ad810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:28 +0800
+Subject: i2c: spacemit: check SDA instead of SCL after bus reset
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit db7720ef50e0103be70a3887bc66e9c909933ad9 ]
+
+After calling spacemit_i2c_conditionally_reset_bus(),
+the controller should ensure that the SDA line is release
+before proceeding.
+
+Previously, the driver checked the SCL line instead,
+which does not guarantee that the bus is truly idle.
+
+This patch changes the check to verify SDA. This ensures
+proper bus recovery and avoids potential communication errors
+after a conditional reset.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 9bf9f01aa68bd..848dfaf634f63 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -172,9 +172,9 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ spacemit_i2c_reset(i2c);
+ usleep_range(10, 20);
+
+- /* check scl status again */
++ /* check sda again here */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+- if (!(status & SPACEMIT_BMR_SCL))
++ if (!(status & SPACEMIT_BMR_SDA))
+ dev_warn_ratelimited(i2c->dev, "unit reset failed\n");
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d8a25af6715965ff2ac1e3c9646c48e75d297a97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:27 +0800
+Subject: i2c: spacemit: disable SDA glitch fix to avoid restart delay
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ]
+
+The K1 I2C controller has an SDA glitch fix that introduces a small
+delay on restart signals. While this feature can suppress glitches
+on SDA when SCL = 0, it also delays the restart signal, which may
+cause unexpected behavior in some transfers.
+
+The glitch itself does not affect normal I2C operation, because
+the I2C specification allows SDA to change while SCL is low.
+
+To ensure correct transmission for every message, we disable the
+SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during
+initialization.
+
+This guarantees that restarts are issued promptly without
+unintended delays.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 84f132d0504dc..9bf9f01aa68bd 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -14,6 +14,7 @@
+ #define SPACEMIT_ICR 0x0 /* Control register */
+ #define SPACEMIT_ISR 0x4 /* Status register */
+ #define SPACEMIT_IDBR 0xc /* Data buffer register */
++#define SPACEMIT_IRCR 0x18 /* Reset cycle counter */
+ #define SPACEMIT_IBMR 0x1c /* Bus monitor register */
+
+ /* SPACEMIT_ICR register fields */
+@@ -76,6 +77,8 @@
+ SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \
+ SPACEMIT_SR_ALD)
+
++#define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
++
+ /* SPACEMIT_IBMR register fields */
+ #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
+ #define SPACEMIT_BMR_SCL BIT(1) /* SCL line level */
+@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
+ val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE;
+
+ writel(val, i2c->base + SPACEMIT_ICR);
++
++ /*
++ * The glitch fix in the K1 I2C controller introduces a delay
++ * on restart signals, so we disable the fix here.
++ */
++ val = readl(i2c->base + SPACEMIT_IRCR);
++ val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
++ writel(val, i2c->base + SPACEMIT_IRCR);
+ }
+
+ static inline void
+--
+2.51.0
+
--- /dev/null
+From c22edce1f8346674f17b2d146a722e076578b490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:25 +0800
+Subject: i2c: spacemit: ensure bus release check runs when wait_bus_idle()
+ fails
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 41d6f90ef5dc2841bdd09817c63a3d6188473b9b ]
+
+spacemit_i2c_wait_bus_idle() only returns 0 on success or a negative
+error code on failure.
+
+Since 'ret' can never be positive, the final 'else' branch was
+unreachable, and spacemit_i2c_check_bus_release() was never called.
+
+This commit guarantees we attempt to release the bus whenever waiting for
+an idle bus fails.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index b68a21fff0b56..ee08811f4087c 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -476,12 +476,13 @@ static int spacemit_i2c_xfer(struct i2c_adapter *adapt, struct i2c_msg *msgs, in
+ spacemit_i2c_enable(i2c);
+
+ ret = spacemit_i2c_wait_bus_idle(i2c);
+- if (!ret)
++ if (!ret) {
+ ret = spacemit_i2c_xfer_msg(i2c);
+- else if (ret < 0)
+- dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
+- else
++ if (ret < 0)
++ dev_dbg(i2c->dev, "i2c transfer error: %d\n", ret);
++ } else {
+ spacemit_i2c_check_bus_release(i2c);
++ }
+
+ spacemit_i2c_disable(i2c);
+
+--
+2.51.0
+
--- /dev/null
+From 2b19bc4ed9a85ee7198ddf0d6d1d024db00d569b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:29 +0800
+Subject: i2c: spacemit: ensure SDA is released after bus reset
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 0de61943244dec418d396633a587adca1c350b55 ]
+
+After performing a conditional bus reset, the controller must ensure
+that the SDA line is actually released.
+
+Previously, the reset routine only performed a single check,
+which could leave the bus in a locked state in some situations.
+
+This patch introduces a loop that toggles the reset cycle and issues
+a reset request up to SPACEMIT_BUS_RESET_CLK_CNT_MAX times, checking
+SDA after each attempt. If SDA is released before the maximum count,
+the function returns early. Otherwise, a warning is emitted.
+
+This change improves bus recovery reliability.
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index 848dfaf634f63..6b918770e612e 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2024-2025 Troy Mitchell <troymitchell988@gmail.com>
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/i2c.h>
+ #include <linux/iopoll.h>
+@@ -26,7 +27,8 @@
+ #define SPACEMIT_CR_MODE_FAST BIT(8) /* bus mode (master operation) */
+ /* Bit 9 is reserved */
+ #define SPACEMIT_CR_UR BIT(10) /* unit reset */
+-/* Bits 11-12 are reserved */
++#define SPACEMIT_CR_RSTREQ BIT(11) /* i2c bus reset request */
++/* Bit 12 is reserved */
+ #define SPACEMIT_CR_SCLE BIT(13) /* master clock enable */
+ #define SPACEMIT_CR_IUE BIT(14) /* unit enable */
+ /* Bits 15-17 are reserved */
+@@ -78,6 +80,8 @@
+ SPACEMIT_SR_ALD)
+
+ #define SPACEMIT_RCR_SDA_GLITCH_NOFIX BIT(7) /* bypass the SDA glitch fix */
++/* the cycles of SCL during bus reset */
++#define SPACEMIT_RCR_FIELD_RST_CYC GENMASK(3, 0)
+
+ /* SPACEMIT_IBMR register fields */
+ #define SPACEMIT_BMR_SDA BIT(0) /* SDA line level */
+@@ -91,6 +95,8 @@
+
+ #define SPACEMIT_SR_ERR (SPACEMIT_SR_BED | SPACEMIT_SR_RXOV | SPACEMIT_SR_ALD)
+
++#define SPACEMIT_BUS_RESET_CLK_CNT_MAX 9
++
+ enum spacemit_i2c_state {
+ SPACEMIT_STATE_IDLE,
+ SPACEMIT_STATE_START,
+@@ -163,6 +169,7 @@ static int spacemit_i2c_handle_err(struct spacemit_i2c_dev *i2c)
+ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ {
+ u32 status;
++ u8 clk_cnt;
+
+ /* if bus is locked, reset unit. 0: locked */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+@@ -172,6 +179,18 @@ static void spacemit_i2c_conditionally_reset_bus(struct spacemit_i2c_dev *i2c)
+ spacemit_i2c_reset(i2c);
+ usleep_range(10, 20);
+
++ for (clk_cnt = 0; clk_cnt < SPACEMIT_BUS_RESET_CLK_CNT_MAX; clk_cnt++) {
++ status = readl(i2c->base + SPACEMIT_IBMR);
++ if (status & SPACEMIT_BMR_SDA)
++ return;
++
++ /* There's nothing left to save here, we are about to exit */
++ writel(FIELD_PREP(SPACEMIT_RCR_FIELD_RST_CYC, 1),
++ i2c->base + SPACEMIT_IRCR);
++ writel(SPACEMIT_CR_RSTREQ, i2c->base + SPACEMIT_ICR);
++ usleep_range(20, 30);
++ }
++
+ /* check sda again here */
+ status = readl(i2c->base + SPACEMIT_IBMR);
+ if (!(status & SPACEMIT_BMR_SDA))
+--
+2.51.0
+
--- /dev/null
+From aa42421b22922a7340603c9d8ed702816188e5ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:02:26 +0800
+Subject: i2c: spacemit: remove stop function to avoid bus error
+
+From: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+
+[ Upstream commit 445522fe7aad6131b2747ae8c76f77266054cd84 ]
+
+Previously, STOP handling was split into two separate steps:
+ 1) clear TB/STOP/START/ACK bits
+ 2) issue STOP by calling spacemit_i2c_stop()
+
+This left a small window where the control register was updated
+twice, which can confuse the controller. While this race has not
+been observed with interrupt-driven transfers, it reliably causes
+bus errors in PIO mode.
+
+Inline the STOP sequence into the IRQ handler and ensure that
+control register bits are updated atomically in a single writel().
+
+Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
+Signed-off-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-k1.c | 26 +++++++-------------------
+ 1 file changed, 7 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
+index ee08811f4087c..84f132d0504dc 100644
+--- a/drivers/i2c/busses/i2c-k1.c
++++ b/drivers/i2c/busses/i2c-k1.c
+@@ -267,19 +267,6 @@ static void spacemit_i2c_start(struct spacemit_i2c_dev *i2c)
+ writel(val, i2c->base + SPACEMIT_ICR);
+ }
+
+-static void spacemit_i2c_stop(struct spacemit_i2c_dev *i2c)
+-{
+- u32 val;
+-
+- val = readl(i2c->base + SPACEMIT_ICR);
+- val |= SPACEMIT_CR_STOP | SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
+-
+- if (i2c->read)
+- val |= SPACEMIT_CR_ACKNAK;
+-
+- writel(val, i2c->base + SPACEMIT_ICR);
+-}
+-
+ static int spacemit_i2c_xfer_msg(struct spacemit_i2c_dev *i2c)
+ {
+ unsigned long time_left;
+@@ -412,7 +399,6 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
+
+ val = readl(i2c->base + SPACEMIT_ICR);
+ val &= ~(SPACEMIT_CR_TB | SPACEMIT_CR_ACKNAK | SPACEMIT_CR_STOP | SPACEMIT_CR_START);
+- writel(val, i2c->base + SPACEMIT_ICR);
+
+ switch (i2c->state) {
+ case SPACEMIT_STATE_START:
+@@ -429,14 +415,16 @@ static irqreturn_t spacemit_i2c_irq_handler(int irq, void *devid)
+ }
+
+ if (i2c->state != SPACEMIT_STATE_IDLE) {
++ val |= SPACEMIT_CR_TB | SPACEMIT_CR_ALDIE;
++
+ if (spacemit_i2c_is_last_msg(i2c)) {
+ /* trigger next byte with stop */
+- spacemit_i2c_stop(i2c);
+- } else {
+- /* trigger next byte */
+- val |= SPACEMIT_CR_ALDIE | SPACEMIT_CR_TB;
+- writel(val, i2c->base + SPACEMIT_ICR);
++ val |= SPACEMIT_CR_STOP;
++
++ if (i2c->read)
++ val |= SPACEMIT_CR_ACKNAK;
+ }
++ writel(val, i2c->base + SPACEMIT_ICR);
+ }
+
+ err_out:
+--
+2.51.0
+
--- /dev/null
+From 2acd6d8f84f4d7f1ac2186b398bbde7273af539a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 22:18:33 +0200
+Subject: i3c: fix big-endian FIFO transfers
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ]
+
+Short MMIO transfers that are not a multiple of four bytes in size need
+a special case for the final bytes, however the existing implementation
+is not endian-safe and introduces an incorrect byteswap on big-endian
+kernels.
+
+This usually does not cause problems because most systems are
+little-endian and most transfers are multiple of four bytes long, but
+still needs to be fixed to avoid the extra byteswap.
+
+Change the special case for both i3c_writel_fifo() and i3c_readl_fifo()
+to use non-byteswapping writesl() and readsl() with a single element
+instead of the byteswapping writel()/readl() that are meant for individual
+MMIO registers. As data is copied between a FIFO and a memory buffer,
+the writesl()/readsl() loops are typically based on __raw_readl()/
+__raw_writel(), resulting in the order of bytes in the FIFO to match
+the order in the buffer, regardless of the CPU endianess.
+
+The earlier versions in the dw-i3c and i3c-master-cdns had a correct
+implementation, but the generic version that was recently added broke it.
+
+Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()")
+Cc: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Jorge Marques <jorge.marques@analog.com>
+Link: https://lore.kernel.org/r/20250924201837.3691486-1-arnd@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/internals.h | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
+index 0d857cc68cc5d..79ceaa5f5afd6 100644
+--- a/drivers/i3c/internals.h
++++ b/drivers/i3c/internals.h
+@@ -38,7 +38,11 @@ static inline void i3c_writel_fifo(void __iomem *addr, const void *buf,
+ u32 tmp = 0;
+
+ memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3);
+- writel(tmp, addr);
++ /*
++ * writesl() instead of writel() to keep FIFO
++ * byteorder on big-endian targets
++ */
++ writesl(addr, &tmp, 1);
+ }
+ }
+
+@@ -55,7 +59,11 @@ static inline void i3c_readl_fifo(const void __iomem *addr, void *buf,
+ if (nbytes & 3) {
+ u32 tmp;
+
+- tmp = readl(addr);
++ /*
++ * readsl() instead of readl() to keep FIFO
++ * byteorder on big-endian targets
++ */
++ readsl(addr, &tmp, 1);
+ memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From dc52c429da3625fac729c2cdd980dca458d3e821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 8e7b4ab919e3d..9641e66a4e5f2 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ded243482a7e82068a1e75161d3cbd9e90ac2333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:08 +0800
+Subject: i3c: master: svc: Use manual response for IBI events
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
+
+Driver wants to nack the IBI request when the target is not in the
+known address list. In below code, svc_i3c_master_nack_ibi() will
+cause undefined behavior when using AUTOIBI with auto response rule,
+because hw always auto ack the IBI request.
+
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ svc_i3c_master_nack_ibi(master);
+ ...
+ break;
+
+AutoIBI has another issue that the controller doesn't quit AutoIBI state
+after IBIWON polling timeout when there is a SDA glitch(high->low->high).
+1. SDA high->low: raising an interrupt to execute IBI ISR
+2. SDA low->high
+3. Driver writes an AutoIBI request
+4. AutoIBI process does not start because SDA is not low
+5. IBIWON polling times out
+6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
+
+Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 701ae165b25b7..8e7b4ab919e3d 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ */
+ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
+- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
+- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
+- SVC_I3C_MCTRL_IBIRESP_AUTO,
++ /*
++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
++ * instend of using AUTO_IBI.
++ *
++ * Using AutoIBI request may cause controller to remain in AutoIBI state when
++ * there is a glitch on SDA line (high->low->high).
++ * 1. SDA high->low, raising an interrupt to execute IBI isr.
++ * 2. SDA low->high.
++ * 3. IBI isr writes an AutoIBI request.
++ * 4. The controller will not start AutoIBI process because SDA is not low.
++ * 5. IBIWON polling times out.
++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
++ */
++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
++ SVC_I3C_MCTRL_TYPE_I3C |
++ SVC_I3C_MCTRL_IBIRESP_MANUAL |
++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
+ master->regs + SVC_I3C_MCTRL);
+
+ /* Wait for IBIWON, should take approximately 100us */
+@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
+ svc_i3c_master_nack_ibi(master);
+- else
++ } else {
++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
++ svc_i3c_master_ack_ibi(master, true);
++ else
++ svc_i3c_master_ack_ibi(master, false);
+ svc_i3c_master_handle_ibi(master, dev);
++ }
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
+ if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
+--
+2.51.0
+
--- /dev/null
+From 9a9e61194fb13c062772e16336eefe44ca7d0cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 53571e6b3162c..66df5bed6a562 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From d3b548fa3cbe12f87a8dd67264f1e8f4b437fe78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 11:02:10 -0700
+Subject: idpf: fix mismatched free function for dma_alloc_coherent
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]
+
+The mailbox receive path allocates coherent DMA memory with
+dma_alloc_coherent(), but frees it with dmam_free_coherent().
+This is incorrect since dmam_free_coherent() is only valid for
+buffers allocated with dmam_alloc_coherent().
+
+Fix the mismatch by using dma_free_coherent() instead of
+dmam_free_coherent
+
+Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Link: https://patch.msgid.link/20250925180212.415093-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index 6330d4a0ae075..c1f34381333d1 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -702,9 +702,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
+ /* If post failed clear the only buffer we supplied */
+ if (post_err) {
+ if (dma_mem)
+- dmam_free_coherent(&adapter->pdev->dev,
+- dma_mem->size, dma_mem->va,
+- dma_mem->pa);
++ dma_free_coherent(&adapter->pdev->dev,
++ dma_mem->size, dma_mem->va,
++ dma_mem->pa);
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 47e26ff0c9eabfbe1f7e10e4197c308220e5d2b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:54:56 +0200
+Subject: idpf: fix Rx descriptor ready check barrier in splitq
+
+From: Alexander Lobakin <aleksander.lobakin@intel.com>
+
+[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]
+
+No idea what the current barrier position was meant for. At that point,
+nothing is read from the descriptor, only the pointer to the actual one
+is fetched.
+The correct barrier usage here is after the generation check, so that
+only the first qword is read if the descriptor is not yet ready and we
+need to stop polling. Debatable on coherent DMA as the Rx descriptor
+size is <= cacheline size, but anyway, the current barrier position
+only makes the codegen worse.
+
+Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Tested-by: Ramu R <ramu.r@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index eaad52a83b04c..50f90ed3107ec 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -3187,18 +3187,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
+ /* get the Rx desc from Rx queue based on 'next_to_clean' */
+ rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
+
+- /* This memory barrier is needed to keep us from reading
+- * any other fields out of the rx_desc
+- */
+- dma_rmb();
+-
+ /* if the descriptor isn't done, no work yet to do */
+ gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
+ VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
+-
+ if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
+ break;
+
++ dma_rmb();
++
+ rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
+ rx_desc->rxdid_ucast);
+ if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
+--
+2.51.0
+
--- /dev/null
+From c4220fc792655466bffb2ebd5dcfb5958c1c473e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:20 +0200
+Subject: iio: consumers: Fix handling of negative channel scale in
+ iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
+
+There is an issue with the handling of negative channel scales
+in iio_convert_raw_to_processed_unlocked() when the channel-scale
+is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
+
+Things work for channel-scale values > -1.0 and < 0.0 because of
+the use of signed values in:
+
+ *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
+
+Things will break however for scale values < -1.0. Lets for example say
+that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
+
+The result should then be 2 * 10 * -1.5 = -30.
+
+channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
+now lets see what gets stored in processed:
+
+1. *processed = raw64 * scale_val * scale;
+2. *processed += raw64 * scale_val2 * scale / 1000000LL;
+
+1. Sets processed to 2 * -1 * 10 = -20
+2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
+
+And the end result is processed = -20 + 10 = -10, which is not correct.
+
+Fix this by always using the abs value of both scale_val and scale_val2
+and if either is negative multiply the end-result by -1.
+
+Note there seems to be an unwritten rule about negative
+IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
+
+i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx
+ii. values <= -1.0 are written as val=-xxx val2=xxx
+
+But iio_format_value() will also correctly display a third option:
+
+iii. values <= -1.0 written as val=-xxx val2=-xxx
+
+Since iio_format_value() uses abs(val) when val2 < 0.
+
+This fix also makes iio_convert_raw_to_processed() properly handle
+channel-scales using this third option.
+
+Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
+Cc: Matteo Martelli <matteomartelli3@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index c174ebb7d5e6d..d36a80a7b8a93 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -11,6 +11,7 @@
+ #include <linux/mutex.h>
+ #include <linux/property.h>
+ #include <linux/slab.h>
++#include <linux/units.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/iio-opaque.h>
+@@ -604,7 +605,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ {
+ int scale_type, scale_val, scale_val2;
+ int offset_type, offset_val, offset_val2;
+- s64 raw64 = raw;
++ s64 denominator, raw64 = raw;
+
+ offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
+ IIO_CHAN_INFO_OFFSET);
+@@ -648,20 +649,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ *processed = raw64 * scale_val * scale;
+ break;
+ case IIO_VAL_INT_PLUS_MICRO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000LL);
+- break;
+ case IIO_VAL_INT_PLUS_NANO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000000LL);
++ switch (scale_type) {
++ case IIO_VAL_INT_PLUS_MICRO:
++ denominator = MICRO;
++ break;
++ case IIO_VAL_INT_PLUS_NANO:
++ denominator = NANO;
++ break;
++ }
++ *processed = raw64 * scale * abs(scale_val);
++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
++ if (scale_val < 0 || scale_val2 < 0)
++ *processed *= -1;
+ break;
+ case IIO_VAL_FRACTIONAL:
+ *processed = div_s64(raw64 * (s64)scale_val * scale,
+--
+2.51.0
+
--- /dev/null
+From 383d7d6ee2c09eab4a193f113f74bbadecbfcb15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index d36a80a7b8a93..642beb4b3360d 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -640,7 +640,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ccca6de71ff5170107cdaf20470afa3fd1e71efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:30:51 +0000
+Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
+
+We need to check socket netns before considering them in ping_get_port().
+Otherwise, one malicious netns could 'consume' all ports.
+
+Add corresponding check in ping_lookup().
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 031df4c19fcc5..d2c3480df8f77 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
+
+ int ping_get_port(struct sock *sk, unsigned short ident)
+ {
++ struct net *net = sock_net(sk);
+ struct inet_sock *isk, *isk2;
+ struct hlist_head *hlist;
+ struct sock *sk2 = NULL;
+@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ for (i = 0; i < (1L << 16); i++, result++) {
+ if (!result)
+ result++; /* avoid zero */
+- hlist = ping_hashslot(&ping_table, sock_net(sk),
+- result);
++ hlist = ping_hashslot(&ping_table, net, result);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ if (isk2->inet_num == result)
+@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ if (i >= (1L << 16))
+ goto fail;
+ } else {
+- hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
++ hlist = ping_hashslot(&ping_table, net, ident);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ /* BUG? Why is this reuse and not reuseaddr? ping.c
+@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ pr_debug("was not hashed\n");
+ sk_add_node_rcu(sk, hlist);
+ sock_set_flag(sk, SOCK_RCU_FREE);
+- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++ sock_prot_inuse_add(net, sk->sk_prot, 1);
+ }
+ spin_unlock(&ping_table.lock);
+ return 0;
+@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ }
+
+ sk_for_each_rcu(sk, hslot) {
++ if (!net_eq(sock_net(sk), net))
++ continue;
+ isk = inet_sk(sk);
+
+ pr_debug("iterate\n");
+--
+2.51.0
+
--- /dev/null
+From dbceb988426885b8f8f65fd0b46a9771c4db05eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:11:05 +0200
+Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
+
+INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
+init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
+prevent asking the user about this feature when configuring a kernel
+without initramfs support.
+
+Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index ecddb94db8dc0..e5d6d798994ae 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1504,6 +1504,7 @@ config BOOT_CONFIG_EMBED_FILE
+
+ config INITRAMFS_PRESERVE_MTIME
+ bool "Preserve cpio archive mtimes in initramfs"
++ depends on BLK_DEV_INITRD
+ default y
+ help
+ Each entry in an initramfs cpio archive carries an mtime value. When
+--
+2.51.0
+
--- /dev/null
+From f4d2072bec18c2f2774d897a2ce5f513fe86b34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:16:28 +0200
+Subject: iommu/selftest: prevent use of uninitialized variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alessandro Zanni <alessandro.zanni87@gmail.com>
+
+[ Upstream commit 1d235d8494259b588bc3b7d29bc73ce34bf885bc ]
+
+Fix to avoid the usage of the `res` variable uninitialized in the
+following macro expansions.
+
+It solves the following warning:
+In function ‘iommufd_viommu_vdevice_alloc’,
+ inlined from ‘wrapper_iommufd_viommu_vdevice_alloc’ at iommufd.c:2889:1:
+../kselftest_harness.h:760:12: warning: ‘ret’ may be used uninitialized [-Wmaybe-uninitialized]
+ 760 | if (!(__exp _t __seen)) { \
+ | ^
+../kselftest_harness.h:513:9: note: in expansion of macro ‘__EXPECT’
+ 513 | __EXPECT(expected, #expected, seen, #seen, ==, 1)
+ | ^~~~~~~~
+iommufd_utils.h:1057:9: note: in expansion of macro ‘ASSERT_EQ’
+ 1057 | ASSERT_EQ(0, _test_cmd_trigger_vevents(self->fd, dev_id, nvevents))
+ | ^~~~~~~~~
+iommufd.c:2924:17: note: in expansion of macro ‘test_cmd_trigger_vevents’
+ 2924 | test_cmd_trigger_vevents(dev_id, 3);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~
+
+The issue can be reproduced, building the tests, with the command: make -C
+tools/testing/selftests TARGETS=iommu
+
+Link: https://patch.msgid.link/r/20250924171629.50266-1-alessandro.zanni87@gmail.com
+Fixes: 97717a1f283f ("iommufd/selftest: Add IOMMU_VEVENTQ_ALLOC test coverage")
+Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/iommu/iommufd_utils.h | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h
+index 3c3e08b8c90eb..772ca1db6e597 100644
+--- a/tools/testing/selftests/iommu/iommufd_utils.h
++++ b/tools/testing/selftests/iommu/iommufd_utils.h
+@@ -1042,15 +1042,13 @@ static int _test_cmd_trigger_vevents(int fd, __u32 dev_id, __u32 nvevents)
+ .dev_id = dev_id,
+ },
+ };
+- int ret;
+
+ while (nvevents--) {
+- ret = ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
+- &trigger_vevent_cmd);
+- if (ret < 0)
++ if (!ioctl(fd, _IOMMU_TEST_CMD(IOMMU_TEST_OP_TRIGGER_VEVENT),
++ &trigger_vevent_cmd))
+ return -1;
+ }
+- return ret;
++ return 0;
+ }
+
+ #define test_cmd_trigger_vevents(dev_id, nvevents) \
+--
+2.51.0
+
--- /dev/null
+From 2ec2c1bfa79ba489e3637eefec15a176710df917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:59 +0800
+Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic
+
+From: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+
+[ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ]
+
+In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR
+maybe uninitialized or zero in that case and may cause oops like:
+
+ Oops: general protection fault, probably for non-canonical address
+ 0xf00087d3f000f000: 0000 [#1] SMP NOPTI
+ CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014
+ RIP: 0010:pgtable_walk_level+0x98/0x150
+ RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206
+ RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e
+ RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000
+ RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002
+ R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000
+ R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98
+ FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ pgtable_walk_level+0x88/0x150
+ domain_translation_struct_show.isra.0+0x2d9/0x300
+ dev_domain_translation_struct_show+0x20/0x40
+ seq_read_iter+0x12d/0x490
+...
+
+Avoid walking the page table if TT is not 00b or 01b.
+
+Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table")
+Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index affbf4a1558de..5aa7f46a420b5 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m,
+ }
+ pgd &= VTD_PAGE_MASK;
+ } else { /* legacy mode */
+- pgd = context->lo & VTD_PAGE_MASK;
+- agaw = context->hi & 7;
++ u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2;
++
++ /*
++ * According to Translation Type(TT),
++ * get the page table pointer(SSPTPTR).
++ */
++ switch (tt) {
++ case CONTEXT_TT_MULTI_LEVEL:
++ case CONTEXT_TT_DEV_IOTLB:
++ pgd = context->lo & VTD_PAGE_MASK;
++ agaw = context->hi & 7;
++ break;
++ default:
++ goto iommu_unlock;
++ }
+ }
+
+ seq_printf(m, "Device %04x:%02x:%02x.%x ",
+--
+2.51.0
+
--- /dev/null
+From 27770bc4f267074c6e5db9f59d7ea8a9defdb711 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 10:41:30 +0800
+Subject: iommu/vt-d: Disallow dirty tracking if incoherent page walk
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57f55048e564dedd8a4546d018e29d6bbfff0a7e ]
+
+Dirty page tracking relies on the IOMMU atomically updating the dirty bit
+in the paging-structure entry. For this operation to succeed, the paging-
+structure memory must be coherent between the IOMMU and the CPU. In
+another word, if the iommu page walk is incoherent, dirty page tracking
+doesn't work.
+
+The Intel VT-d specification, Section 3.10 "Snoop Behavior" states:
+
+"Remapping hardware encountering the need to atomically update A/EA/D bits
+ in a paging-structure entry that is not snooped will result in a non-
+ recoverable fault."
+
+To prevent an IOMMU from being incorrectly configured for dirty page
+tracking when it is operating in an incoherent mode, mark SSADS as
+supported only when both ecap_slads and ecap_smpwc are supported.
+
+Fixes: f35f22cc760e ("iommu/vt-d: Access/Dirty bit support for SS domains")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20250924083447.123224-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index d09b928716592..2c261c069001c 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -541,7 +541,8 @@ enum {
+ #define pasid_supported(iommu) (sm_supported(iommu) && \
+ ecap_pasid((iommu)->ecap))
+ #define ssads_supported(iommu) (sm_supported(iommu) && \
+- ecap_slads((iommu)->ecap))
++ ecap_slads((iommu)->ecap) && \
++ ecap_smpwc(iommu->ecap))
+ #define nested_supported(iommu) (sm_supported(iommu) && \
+ ecap_nest((iommu)->ecap))
+
+--
+2.51.0
+
--- /dev/null
+From ccb291e1426a650baabb2993683749602f171527 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:47:30 +0800
+Subject: iommufd: Register iommufd mock devices with fwspec
+
+From: Guixin Liu <kanie@linux.alibaba.com>
+
+[ Upstream commit 2a918911ed3d0841923525ed0fe707762ee78844 ]
+
+Since the bus ops were retired the iommu subsystem changed to using fwspec
+to match the iommu driver to the iommu device. If a device has a NULL
+fwspec then it is matched to the first iommu driver with a NULL fwspec,
+effectively disabling support for systems with more than one non-fwspec
+iommu driver.
+
+Thus, if the iommufd selfest are run in an x86 system that registers a
+non-fwspec iommu driver they fail to bind their mock devices to the mock
+iommu driver.
+
+Fix this by allocating a software fwnode for mock iommu driver's
+iommu_device, and set it to the device which mock iommu driver created.
+
+This is done by adding a new helper iommu_mock_device_add() which abuses
+the internals of the fwspec system to establish a fwspec before the device
+is added and is careful not to leak it. A matching dummy fwspec is
+automatically added to the mock iommu driver.
+
+Test by "make -C toosl/testing/selftests TARGETS=iommu run_tests":
+PASSED: 229 / 229 tests passed.
+
+In addition, this issue is also can be found on amd platform, and
+also tested on a amd machine.
+
+Link: https://patch.msgid.link/r/20250925054730.3877-1-kanie@linux.alibaba.com
+Fixes: 17de3f5fdd35 ("iommu: Retire bus ops")
+Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu-priv.h | 2 ++
+ drivers/iommu/iommu.c | 26 ++++++++++++++++++++++++++
+ drivers/iommu/iommufd/selftest.c | 2 +-
+ 3 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu-priv.h b/drivers/iommu/iommu-priv.h
+index e236b932e7668..c95394cd03a77 100644
+--- a/drivers/iommu/iommu-priv.h
++++ b/drivers/iommu/iommu-priv.h
+@@ -37,6 +37,8 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
+ const struct bus_type *bus,
+ struct notifier_block *nb);
+
++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu);
++
+ struct iommu_attach_handle *iommu_attach_handle_get(struct iommu_group *group,
+ ioasid_t pasid,
+ unsigned int type);
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 060ebe330ee16..59244c744eabd 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -304,6 +304,7 @@ void iommu_device_unregister_bus(struct iommu_device *iommu,
+ struct notifier_block *nb)
+ {
+ bus_unregister_notifier(bus, nb);
++ fwnode_remove_software_node(iommu->fwnode);
+ iommu_device_unregister(iommu);
+ }
+ EXPORT_SYMBOL_GPL(iommu_device_unregister_bus);
+@@ -326,6 +327,12 @@ int iommu_device_register_bus(struct iommu_device *iommu,
+ if (err)
+ return err;
+
++ iommu->fwnode = fwnode_create_software_node(NULL, NULL);
++ if (IS_ERR(iommu->fwnode)) {
++ bus_unregister_notifier(bus, nb);
++ return PTR_ERR(iommu->fwnode);
++ }
++
+ spin_lock(&iommu_device_lock);
+ list_add_tail(&iommu->list, &iommu_device_list);
+ spin_unlock(&iommu_device_lock);
+@@ -335,9 +342,28 @@ int iommu_device_register_bus(struct iommu_device *iommu,
+ iommu_device_unregister_bus(iommu, bus, nb);
+ return err;
+ }
++ WRITE_ONCE(iommu->ready, true);
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(iommu_device_register_bus);
++
++int iommu_mock_device_add(struct device *dev, struct iommu_device *iommu)
++{
++ int rc;
++
++ mutex_lock(&iommu_probe_device_lock);
++ rc = iommu_fwspec_init(dev, iommu->fwnode);
++ mutex_unlock(&iommu_probe_device_lock);
++
++ if (rc)
++ return rc;
++
++ rc = device_add(dev);
++ if (rc)
++ iommu_fwspec_free(dev);
++ return rc;
++}
++EXPORT_SYMBOL_GPL(iommu_mock_device_add);
+ #endif
+
+ static struct dev_iommu *dev_iommu_get(struct device *dev)
+diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
+index 61686603c7693..de178827a078a 100644
+--- a/drivers/iommu/iommufd/selftest.c
++++ b/drivers/iommu/iommufd/selftest.c
+@@ -1126,7 +1126,7 @@ static struct mock_dev *mock_dev_create(unsigned long dev_flags)
+ goto err_put;
+ }
+
+- rc = device_add(&mdev->dev);
++ rc = iommu_mock_device_add(&mdev->dev, &mock_iommu.iommu_dev);
+ if (rc)
+ goto err_put;
+ return mdev;
+--
+2.51.0
+
--- /dev/null
+From 4ee1e2f0b508f603f0fc235c8b6e37da04fa5a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:23 +0000
+Subject: ipv4: start using dst_dev_rcu()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8 ]
+
+Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.
+
+Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
+ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-9-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/icmp.c | 6 +++---
+ net/ipv4/ip_fragment.c | 6 ++++--
+ net/ipv4/ipmr.c | 6 +++---
+ net/ipv4/route.c | 4 ++--
+ 4 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index c48c572f024da..1be0d91620a38 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -318,17 +318,17 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+ return true;
+
+ /* No rate limit on loopback */
+- dev = dst_dev(dst);
++ rcu_read_lock();
++ dev = dst_dev_rcu(dst);
+ if (dev && (dev->flags & IFF_LOOPBACK))
+ goto out;
+
+- rcu_read_lock();
+ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr,
+ l3mdev_master_ifindex_rcu(dev));
+ rc = inet_peer_xrlim_allow(peer,
+ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
+- rcu_read_unlock();
+ out:
++ rcu_read_unlock();
+ if (!rc)
+ __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST);
+ else
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index b2584cce90ae1..f7012479713ba 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -476,14 +476,16 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ /* Process an incoming IP datagram fragment. */
+ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
+ {
+- struct net_device *dev = skb->dev ? : skb_dst_dev(skb);
+- int vif = l3mdev_master_ifindex_rcu(dev);
++ struct net_device *dev;
+ struct ipq *qp;
++ int vif;
+
+ __IP_INC_STATS(net, IPSTATS_MIB_REASMREQDS);
+
+ /* Lookup (or create) queue header */
+ rcu_read_lock();
++ dev = skb->dev ? : skb_dst_dev_rcu(skb);
++ vif = l3mdev_master_ifindex_rcu(dev);
+ qp = ip_find(net, ip_hdr(skb), user, vif);
+ if (qp) {
+ int ret, refs = 0;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index e86a8a862c411..8c568fbddb5fb 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1904,7 +1904,7 @@ static int ipmr_prepare_xmit(struct net *net, struct mr_table *mrt,
+ return -1;
+ }
+
+- encap += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len;
++ encap += LL_RESERVED_SPACE(dst_dev_rcu(&rt->dst)) + rt->dst.header_len;
+
+ if (skb_cow(skb, encap)) {
+ ip_rt_put(rt);
+@@ -1957,7 +1957,7 @@ static void ipmr_queue_fwd_xmit(struct net *net, struct mr_table *mrt,
+ * result in receiving multiple packets.
+ */
+ NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
+- net, NULL, skb, skb->dev, rt->dst.dev,
++ net, NULL, skb, skb->dev, dst_dev_rcu(&rt->dst),
+ ipmr_forward_finish);
+ return;
+
+@@ -2301,7 +2301,7 @@ int ip_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+
+ guard(rcu)();
+
+- dev = rt->dst.dev;
++ dev = dst_dev_rcu(&rt->dst);
+
+ if (IPCB(skb)->flags & IPSKB_FORWARDED)
+ goto mc_output;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 97b96275a775d..5582ccd673eeb 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -413,11 +413,11 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
+ const void *daddr)
+ {
+ const struct rtable *rt = container_of(dst, struct rtable, dst);
+- struct net_device *dev = dst_dev(dst);
++ struct net_device *dev;
+ struct neighbour *n;
+
+ rcu_read_lock();
+-
++ dev = dst_dev_rcu(dst);
+ if (likely(rt->rt_gw_family == AF_INET)) {
+ n = ip_neigh_gw4(dev, rt->rt_gw4);
+ } else if (rt->rt_gw_family == AF_INET6) {
+--
+2.51.0
+
--- /dev/null
+From 1b415225d411a6a9cc37ff07d169e62cae58f100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:40:51 +0800
+Subject: ipv6: mcast: Add ip6_mc_find_idev() helper
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 60c481d4caa569001c708d4e9622d19650b6bedc ]
+
+Extract the same code logic from __ipv6_sock_mc_join() and
+ip6_mc_find_dev(), also add new helper ip6_mc_find_idev() to
+reduce redundancy and enhance readability.
+
+No functional changes intended.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
+Link: https://patch.msgid.link/20250822064051.2991480-1-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b775ecf1655c ("ipv6: start using dst_dev_rcu()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/mcast.c | 67 ++++++++++++++++++++++--------------------------
+ 1 file changed, 31 insertions(+), 36 deletions(-)
+
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 36ca27496b3c0..55c49dc14b1bd 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -169,6 +169,29 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
+ return iv > 0 ? iv : 1;
+ }
+
++static struct net_device *ip6_mc_find_dev(struct net *net,
++ const struct in6_addr *group,
++ int ifindex)
++{
++ struct net_device *dev = NULL;
++ struct rt6_info *rt;
++
++ if (ifindex == 0) {
++ rcu_read_lock();
++ rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
++ if (rt) {
++ dev = dst_dev(&rt->dst);
++ dev_hold(dev);
++ ip6_rt_put(rt);
++ }
++ rcu_read_unlock();
++ } else {
++ dev = dev_get_by_index(net, ifindex);
++ }
++
++ return dev;
++}
++
+ /*
+ * socket join on multicast group
+ */
+@@ -191,28 +214,13 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
+ }
+
+ mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
+-
+ if (!mc_lst)
+ return -ENOMEM;
+
+ mc_lst->next = NULL;
+ mc_lst->addr = *addr;
+
+- if (ifindex == 0) {
+- struct rt6_info *rt;
+-
+- rcu_read_lock();
+- rt = rt6_lookup(net, addr, NULL, 0, NULL, 0);
+- if (rt) {
+- dev = dst_dev(&rt->dst);
+- dev_hold(dev);
+- ip6_rt_put(rt);
+- }
+- rcu_read_unlock();
+- } else {
+- dev = dev_get_by_index(net, ifindex);
+- }
+-
++ dev = ip6_mc_find_dev(net, addr, ifindex);
+ if (!dev) {
+ sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
+ return -ENODEV;
+@@ -302,27 +310,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
+ }
+ EXPORT_SYMBOL(ipv6_sock_mc_drop);
+
+-static struct inet6_dev *ip6_mc_find_dev(struct net *net,
+- const struct in6_addr *group,
+- int ifindex)
++static struct inet6_dev *ip6_mc_find_idev(struct net *net,
++ const struct in6_addr *group,
++ int ifindex)
+ {
+- struct net_device *dev = NULL;
++ struct net_device *dev;
+ struct inet6_dev *idev;
+
+- if (ifindex == 0) {
+- struct rt6_info *rt;
+-
+- rcu_read_lock();
+- rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
+- if (rt) {
+- dev = dst_dev(&rt->dst);
+- dev_hold(dev);
+- ip6_rt_put(rt);
+- }
+- rcu_read_unlock();
+- } else {
+- dev = dev_get_by_index(net, ifindex);
+- }
++ dev = ip6_mc_find_dev(net, group, ifindex);
+ if (!dev)
+ return NULL;
+
+@@ -374,7 +369,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
+ if (!ipv6_addr_is_multicast(group))
+ return -EINVAL;
+
+- idev = ip6_mc_find_dev(net, group, pgsr->gsr_interface);
++ idev = ip6_mc_find_idev(net, group, pgsr->gsr_interface);
+ if (!idev)
+ return -ENODEV;
+
+@@ -509,7 +504,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
+ gsf->gf_fmode != MCAST_EXCLUDE)
+ return -EINVAL;
+
+- idev = ip6_mc_find_dev(net, group, gsf->gf_interface);
++ idev = ip6_mc_find_idev(net, group, gsf->gf_interface);
+ if (!idev)
+ return -ENODEV;
+
+--
+2.51.0
+
--- /dev/null
+From d171a64f4d37398d120555942dfaa5101768d252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 16:58:07 +0000
+Subject: ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 2fab94bcf313480336b0a41eb45a24ffd5087490 ]
+
+Blamed commit added a critical false sharing on a single
+atomic_long_t under DOS, like receiving UDP packets
+to closed ports.
+
+Per netns ICMP6_MIB_RATELIMITHOST tracking uses per-cpu
+storage and is enough, we do not need per-device and slow tracking.
+
+Fixes: d0941130c9351 ("icmp: Add counters for rate limits")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Jamie Bainbridge <jamie.bainbridge@gmail.com>
+Cc: Abhishek Rawal <rawal.abhishek92@gmail.com>
+Link: https://patch.msgid.link/20250905165813.1470708-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/icmp.c | 3 +--
+ net/ipv6/proc.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 95cdd4cacb004..56c974cf75d15 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -230,8 +230,7 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+ }
+ rcu_read_unlock();
+ if (!res)
+- __ICMP6_INC_STATS(net, ip6_dst_idev(dst),
+- ICMP6_MIB_RATELIMITHOST);
++ __ICMP6_INC_STATS(net, NULL, ICMP6_MIB_RATELIMITHOST);
+ else
+ icmp_global_consume(net);
+ dst_release(dst);
+diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
+index 1a20d088bb13c..eb268b0700258 100644
+--- a/net/ipv6/proc.c
++++ b/net/ipv6/proc.c
+@@ -94,6 +94,7 @@ static const struct snmp_mib snmp6_icmp6_list[] = {
+ SNMP_MIB_ITEM("Icmp6OutMsgs", ICMP6_MIB_OUTMSGS),
+ SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS),
+ SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS),
++/* ICMP6_MIB_RATELIMITHOST needs to be last, see snmp6_dev_seq_show(). */
+ SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST),
+ };
+
+@@ -242,8 +243,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
+ snmp6_ipstats_list,
+ ARRAY_SIZE(snmp6_ipstats_list),
+ offsetof(struct ipstats_mib, syncp));
++
++ /* Per idev icmp stats do not have ICMP6_MIB_RATELIMITHOST */
+ snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
+- snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list));
++ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list) - 1);
++
+ snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 5915bcfb87ed1375951f6a971dea224b96edd8de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 16:58:06 +0000
+Subject: ipv6: snmp: do not use SNMP_MIB_SENTINEL anymore
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ceac1fb2290d230eb83aff3761058c559440de13 ]
+
+Use ARRAY_SIZE(), so that we know the limit at compile time.
+
+Following patch needs this preliminary change.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20250905165813.1470708-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 2fab94bcf313 ("ipv6: snmp: do not track per idev ICMP6_MIB_RATELIMITHOST")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip.h | 24 ++++++++++++++++++++++++
+ net/ipv6/proc.c | 43 ++++++++++++++++++++++++-------------------
+ 2 files changed, 48 insertions(+), 19 deletions(-)
+
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 6dbd2bf8fa9c9..a1624e8db1abd 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -338,6 +338,19 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o
+ } \
+ }
+
++#define snmp_get_cpu_field64_batch_cnt(buff64, stats_list, cnt, \
++ mib_statistic, offset) \
++{ \
++ int i, c; \
++ for_each_possible_cpu(c) { \
++ for (i = 0; i < cnt; i++) \
++ buff64[i] += snmp_get_cpu_field64( \
++ mib_statistic, \
++ c, stats_list[i].entry, \
++ offset); \
++ } \
++}
++
+ #define snmp_get_cpu_field_batch(buff, stats_list, mib_statistic) \
+ { \
+ int i, c; \
+@@ -349,6 +362,17 @@ static inline u64 snmp_fold_field64(void __percpu *mib, int offt, size_t syncp_o
+ } \
+ }
+
++#define snmp_get_cpu_field_batch_cnt(buff, stats_list, cnt, mib_statistic) \
++{ \
++ int i, c; \
++ for_each_possible_cpu(c) { \
++ for (i = 0; i < cnt; i++) \
++ buff[i] += snmp_get_cpu_field( \
++ mib_statistic, \
++ c, stats_list[i].entry); \
++ } \
++}
++
+ static inline void inet_get_local_port_range(const struct net *net, int *low, int *high)
+ {
+ u32 range = READ_ONCE(net->ipv4.ip_local_ports.range);
+diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
+index 752327b10dde7..1a20d088bb13c 100644
+--- a/net/ipv6/proc.c
++++ b/net/ipv6/proc.c
+@@ -85,7 +85,6 @@ static const struct snmp_mib snmp6_ipstats_list[] = {
+ SNMP_MIB_ITEM("Ip6InECT0Pkts", IPSTATS_MIB_ECT0PKTS),
+ SNMP_MIB_ITEM("Ip6InCEPkts", IPSTATS_MIB_CEPKTS),
+ SNMP_MIB_ITEM("Ip6OutTransmits", IPSTATS_MIB_OUTPKTS),
+- SNMP_MIB_SENTINEL
+ };
+
+ static const struct snmp_mib snmp6_icmp6_list[] = {
+@@ -96,7 +95,6 @@ static const struct snmp_mib snmp6_icmp6_list[] = {
+ SNMP_MIB_ITEM("Icmp6OutErrors", ICMP6_MIB_OUTERRORS),
+ SNMP_MIB_ITEM("Icmp6InCsumErrors", ICMP6_MIB_CSUMERRORS),
+ SNMP_MIB_ITEM("Icmp6OutRateLimitHost", ICMP6_MIB_RATELIMITHOST),
+- SNMP_MIB_SENTINEL
+ };
+
+ /* RFC 4293 v6 ICMPMsgStatsTable; named items for RFC 2466 compatibility */
+@@ -129,7 +127,6 @@ static const struct snmp_mib snmp6_udp6_list[] = {
+ SNMP_MIB_ITEM("Udp6InCsumErrors", UDP_MIB_CSUMERRORS),
+ SNMP_MIB_ITEM("Udp6IgnoredMulti", UDP_MIB_IGNOREDMULTI),
+ SNMP_MIB_ITEM("Udp6MemErrors", UDP_MIB_MEMERRORS),
+- SNMP_MIB_SENTINEL
+ };
+
+ static const struct snmp_mib snmp6_udplite6_list[] = {
+@@ -141,7 +138,6 @@ static const struct snmp_mib snmp6_udplite6_list[] = {
+ SNMP_MIB_ITEM("UdpLite6SndbufErrors", UDP_MIB_SNDBUFERRORS),
+ SNMP_MIB_ITEM("UdpLite6InCsumErrors", UDP_MIB_CSUMERRORS),
+ SNMP_MIB_ITEM("UdpLite6MemErrors", UDP_MIB_MEMERRORS),
+- SNMP_MIB_SENTINEL
+ };
+
+ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
+@@ -182,35 +178,37 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
+ */
+ static void snmp6_seq_show_item(struct seq_file *seq, void __percpu *pcpumib,
+ atomic_long_t *smib,
+- const struct snmp_mib *itemlist)
++ const struct snmp_mib *itemlist,
++ int cnt)
+ {
+ unsigned long buff[SNMP_MIB_MAX];
+ int i;
+
+ if (pcpumib) {
+- memset(buff, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
++ memset(buff, 0, sizeof(unsigned long) * cnt);
+
+- snmp_get_cpu_field_batch(buff, itemlist, pcpumib);
+- for (i = 0; itemlist[i].name; i++)
++ snmp_get_cpu_field_batch_cnt(buff, itemlist, cnt, pcpumib);
++ for (i = 0; i < cnt; i++)
+ seq_printf(seq, "%-32s\t%lu\n",
+ itemlist[i].name, buff[i]);
+ } else {
+- for (i = 0; itemlist[i].name; i++)
++ for (i = 0; i < cnt; i++)
+ seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name,
+ atomic_long_read(smib + itemlist[i].entry));
+ }
+ }
+
+ static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
+- const struct snmp_mib *itemlist, size_t syncpoff)
++ const struct snmp_mib *itemlist,
++ int cnt, size_t syncpoff)
+ {
+ u64 buff64[SNMP_MIB_MAX];
+ int i;
+
+- memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
++ memset(buff64, 0, sizeof(u64) * cnt);
+
+- snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
+- for (i = 0; itemlist[i].name; i++)
++ snmp_get_cpu_field64_batch_cnt(buff64, itemlist, cnt, mib, syncpoff);
++ for (i = 0; i < cnt; i++)
+ seq_printf(seq, "%-32s\t%llu\n", itemlist[i].name, buff64[i]);
+ }
+
+@@ -219,14 +217,19 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
+ struct net *net = (struct net *)seq->private;
+
+ snmp6_seq_show_item64(seq, net->mib.ipv6_statistics,
+- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
++ snmp6_ipstats_list,
++ ARRAY_SIZE(snmp6_ipstats_list),
++ offsetof(struct ipstats_mib, syncp));
+ snmp6_seq_show_item(seq, net->mib.icmpv6_statistics,
+- NULL, snmp6_icmp6_list);
++ NULL, snmp6_icmp6_list,
++ ARRAY_SIZE(snmp6_icmp6_list));
+ snmp6_seq_show_icmpv6msg(seq, net->mib.icmpv6msg_statistics->mibs);
+ snmp6_seq_show_item(seq, net->mib.udp_stats_in6,
+- NULL, snmp6_udp6_list);
++ NULL, snmp6_udp6_list,
++ ARRAY_SIZE(snmp6_udp6_list));
+ snmp6_seq_show_item(seq, net->mib.udplite_stats_in6,
+- NULL, snmp6_udplite6_list);
++ NULL, snmp6_udplite6_list,
++ ARRAY_SIZE(snmp6_udplite6_list));
+ return 0;
+ }
+
+@@ -236,9 +239,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
+
+ seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
+ snmp6_seq_show_item64(seq, idev->stats.ipv6,
+- snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
++ snmp6_ipstats_list,
++ ARRAY_SIZE(snmp6_ipstats_list),
++ offsetof(struct ipstats_mib, syncp));
+ snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
+- snmp6_icmp6_list);
++ snmp6_icmp6_list, ARRAY_SIZE(snmp6_icmp6_list));
+ snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 7e75f210fa98a98750298a00a13828d57cfbf9ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:17 +0000
+Subject: ipv6: start using dst_dev_rcu()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b775ecf1655cedbc465fd6699ab18a2bc4e7a352 ]
+
+Refactor icmpv6_xrlim_allow() and ip6_dst_hoplimit()
+so that we acquire rcu_read_lock() a bit longer
+to be able to use dst_dev_rcu() instead of dst_dev().
+
+__ip6_rt_update_pmtu() and rt6_do_redirect can directly
+use dst_dev_rcu() in sections already holding rcu_read_lock().
+
+Small changes to use dst_dev_net_rcu() in
+ip6_default_advmss(), ipv6_sock_ac_join(),
+ip6_mc_find_dev() and ndisc_send_skb().
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/anycast.c | 2 +-
+ net/ipv6/icmp.c | 6 +++---
+ net/ipv6/mcast.c | 2 +-
+ net/ipv6/ndisc.c | 2 +-
+ net/ipv6/output_core.c | 8 +++++---
+ net/ipv6/route.c | 7 +++----
+ 6 files changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
+index f8a8e46286b8e..52599584422bf 100644
+--- a/net/ipv6/anycast.c
++++ b/net/ipv6/anycast.c
+@@ -104,7 +104,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
+ rcu_read_lock();
+ rt = rt6_lookup(net, addr, NULL, 0, NULL, 0);
+ if (rt) {
+- dev = dst_dev(&rt->dst);
++ dev = dst_dev_rcu(&rt->dst);
+ netdev_hold(dev, &dev_tracker, GFP_ATOMIC);
+ ip6_rt_put(rt);
+ } else if (ishost) {
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index 44550957fd4e3..95cdd4cacb004 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -209,7 +209,8 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+ * this lookup should be more aggressive (not longer than timeout).
+ */
+ dst = ip6_route_output(net, sk, fl6);
+- dev = dst_dev(dst);
++ rcu_read_lock();
++ dev = dst_dev_rcu(dst);
+ if (dst->error) {
+ IP6_INC_STATS(net, ip6_dst_idev(dst),
+ IPSTATS_MIB_OUTNOROUTES);
+@@ -224,11 +225,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+ if (rt->rt6i_dst.plen < 128)
+ tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
+
+- rcu_read_lock();
+ peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr);
+ res = inet_peer_xrlim_allow(peer, tmo);
+- rcu_read_unlock();
+ }
++ rcu_read_unlock();
+ if (!res)
+ __ICMP6_INC_STATS(net, ip6_dst_idev(dst),
+ ICMP6_MIB_RATELIMITHOST);
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 55c49dc14b1bd..016b572e7d6f0 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -180,7 +180,7 @@ static struct net_device *ip6_mc_find_dev(struct net *net,
+ rcu_read_lock();
+ rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
+ if (rt) {
+- dev = dst_dev(&rt->dst);
++ dev = dst_dev_rcu(&rt->dst);
+ dev_hold(dev);
+ ip6_rt_put(rt);
+ }
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 7d5abb3158ec9..d6bb1e2f6192e 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -505,7 +505,7 @@ void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
+
+ ip6_nd_hdr(skb, saddr, daddr, READ_ONCE(inet6_sk(sk)->hop_limit), skb->len);
+
+- dev = dst_dev(dst);
++ dev = dst_dev_rcu(dst);
+ idev = __in6_dev_get(dev);
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
+
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index d21fe27fe21e3..1c9b283a4132d 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -104,18 +104,20 @@ EXPORT_SYMBOL(ip6_find_1stfragopt);
+ int ip6_dst_hoplimit(struct dst_entry *dst)
+ {
+ int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
++
++ rcu_read_lock();
+ if (hoplimit == 0) {
+- struct net_device *dev = dst_dev(dst);
++ struct net_device *dev = dst_dev_rcu(dst);
+ struct inet6_dev *idev;
+
+- rcu_read_lock();
+ idev = __in6_dev_get(dev);
+ if (idev)
+ hoplimit = READ_ONCE(idev->cnf.hop_limit);
+ else
+ hoplimit = READ_ONCE(dev_net(dev)->ipv6.devconf_all->hop_limit);
+- rcu_read_unlock();
+ }
++ rcu_read_unlock();
++
+ return hoplimit;
+ }
+ EXPORT_SYMBOL(ip6_dst_hoplimit);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 3299cfa12e21c..3371f16b7a3e6 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2943,7 +2943,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
+
+ if (res.f6i->nh) {
+ struct fib6_nh_match_arg arg = {
+- .dev = dst_dev(dst),
++ .dev = dst_dev_rcu(dst),
+ .gw = &rt6->rt6i_gateway,
+ };
+
+@@ -3238,7 +3238,6 @@ EXPORT_SYMBOL_GPL(ip6_sk_redirect);
+
+ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
+ {
+- struct net_device *dev = dst_dev(dst);
+ unsigned int mtu = dst_mtu(dst);
+ struct net *net;
+
+@@ -3246,7 +3245,7 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
+
+ rcu_read_lock();
+
+- net = dev_net_rcu(dev);
++ net = dst_dev_net_rcu(dst);
+ if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
+ mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
+
+@@ -4301,7 +4300,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
+
+ if (res.f6i->nh) {
+ struct fib6_nh_match_arg arg = {
+- .dev = dst_dev(dst),
++ .dev = dst_dev_rcu(dst),
+ .gw = &rt->rt6i_gateway,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 5e4485bbdc7ee7884a7b5a7a3b191400f7267df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:19 +0000
+Subject: ipv6: use RCU in ip6_output()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 11709573cc4e48dc34c80fc7ab9ce5b159e29695 ]
+
+Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent
+possible UAF.
+
+We can remove rcu_read_lock()/rcu_read_unlock() pairs
+from ip6_finish_output2().
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_output.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index e234640433d6b..9d64c13bab5ea 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -60,7 +60,7 @@
+ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+- struct net_device *dev = dst_dev(dst);
++ struct net_device *dev = dst_dev_rcu(dst);
+ struct inet6_dev *idev = ip6_dst_idev(dst);
+ unsigned int hh_len = LL_RESERVED_SPACE(dev);
+ const struct in6_addr *daddr, *nexthop;
+@@ -70,15 +70,12 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+
+ /* Be paranoid, rather than too clever. */
+ if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) {
+- /* Make sure idev stays alive */
+- rcu_read_lock();
++ /* idev stays alive because we hold rcu_read_lock(). */
+ skb = skb_expand_head(skb, hh_len);
+ if (!skb) {
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+- rcu_read_unlock();
+ return -ENOMEM;
+ }
+- rcu_read_unlock();
+ }
+
+ hdr = ipv6_hdr(skb);
+@@ -123,7 +120,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+
+ IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
+
+- rcu_read_lock();
+ nexthop = rt6_nexthop(dst_rt6_info(dst), daddr);
+ neigh = __ipv6_neigh_lookup_noref(dev, nexthop);
+
+@@ -131,7 +127,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+ if (unlikely(!neigh))
+ neigh = __neigh_create(&nd_tbl, nexthop, dev, false);
+ if (IS_ERR(neigh)) {
+- rcu_read_unlock();
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTNOROUTES);
+ kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_CREATEFAIL);
+ return -EINVAL;
+@@ -139,7 +134,6 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
+ }
+ sock_confirm_neigh(skb, neigh);
+ ret = neigh_output(neigh, skb, false);
+- rcu_read_unlock();
+ return ret;
+ }
+
+@@ -233,22 +227,29 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
+ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+- struct net_device *dev = dst_dev(dst), *indev = skb->dev;
+- struct inet6_dev *idev = ip6_dst_idev(dst);
++ struct net_device *dev, *indev = skb->dev;
++ struct inet6_dev *idev;
++ int ret;
+
+ skb->protocol = htons(ETH_P_IPV6);
++ rcu_read_lock();
++ dev = dst_dev_rcu(dst);
++ idev = ip6_dst_idev(dst);
+ skb->dev = dev;
+
+ if (unlikely(!idev || READ_ONCE(idev->cnf.disable_ipv6))) {
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
++ rcu_read_unlock();
+ kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
+ return 0;
+ }
+
+- return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
+- net, sk, skb, indev, dev,
+- ip6_finish_output,
+- !(IP6CB(skb)->flags & IP6SKB_REROUTED));
++ ret = NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
++ net, sk, skb, indev, dev,
++ ip6_finish_output,
++ !(IP6CB(skb)->flags & IP6SKB_REROUTED));
++ rcu_read_unlock();
++ return ret;
+ }
+ EXPORT_SYMBOL(ip6_output);
+
+--
+2.51.0
+
--- /dev/null
+From e9030d1809a6422f05b394363043a207a4be26a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:18 +0000
+Subject: ipv6: use RCU in ip6_xmit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9085e56501d93af9f2d7bd16f7fcfacdde47b99c ]
+
+Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent
+possible UAF.
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_output.c | 35 +++++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 1e1410237b6ef..e234640433d6b 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -268,35 +268,36 @@ bool ip6_autoflowlabel(struct net *net, const struct sock *sk)
+ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
+ __u32 mark, struct ipv6_txoptions *opt, int tclass, u32 priority)
+ {
+- struct net *net = sock_net(sk);
+ const struct ipv6_pinfo *np = inet6_sk(sk);
+ struct in6_addr *first_hop = &fl6->daddr;
+ struct dst_entry *dst = skb_dst(skb);
+- struct net_device *dev = dst_dev(dst);
+ struct inet6_dev *idev = ip6_dst_idev(dst);
+ struct hop_jumbo_hdr *hop_jumbo;
+ int hoplen = sizeof(*hop_jumbo);
++ struct net *net = sock_net(sk);
+ unsigned int head_room;
++ struct net_device *dev;
+ struct ipv6hdr *hdr;
+ u8 proto = fl6->flowi6_proto;
+ int seg_len = skb->len;
+- int hlimit = -1;
++ int ret, hlimit = -1;
+ u32 mtu;
+
++ rcu_read_lock();
++
++ dev = dst_dev_rcu(dst);
+ head_room = sizeof(struct ipv6hdr) + hoplen + LL_RESERVED_SPACE(dev);
+ if (opt)
+ head_room += opt->opt_nflen + opt->opt_flen;
+
+ if (unlikely(head_room > skb_headroom(skb))) {
+- /* Make sure idev stays alive */
+- rcu_read_lock();
++ /* idev stays alive while we hold rcu_read_lock(). */
+ skb = skb_expand_head(skb, head_room);
+ if (!skb) {
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
+- rcu_read_unlock();
+- return -ENOBUFS;
++ ret = -ENOBUFS;
++ goto unlock;
+ }
+- rcu_read_unlock();
+ }
+
+ if (opt) {
+@@ -358,17 +359,21 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
+ * skb to its handler for processing
+ */
+ skb = l3mdev_ip6_out((struct sock *)sk, skb);
+- if (unlikely(!skb))
+- return 0;
++ if (unlikely(!skb)) {
++ ret = 0;
++ goto unlock;
++ }
+
+ /* hooks should never assume socket lock is held.
+ * we promote our socket to non const
+ */
+- return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
+- net, (struct sock *)sk, skb, NULL, dev,
+- dst_output);
++ ret = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
++ net, (struct sock *)sk, skb, NULL, dev,
++ dst_output);
++ goto unlock;
+ }
+
++ ret = -EMSGSIZE;
+ skb->dev = dev;
+ /* ipv6_local_error() does not require socket lock,
+ * we promote our socket to non const
+@@ -377,7 +382,9 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
+
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_FRAGFAILS);
+ kfree_skb(skb);
+- return -EMSGSIZE;
++unlock:
++ rcu_read_unlock();
++ return ret;
+ }
+ EXPORT_SYMBOL(ip6_xmit);
+
+--
+2.51.0
+
--- /dev/null
+From 5314fd05084527a5353df7c69f24ad50564eaf22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index d8a284999544b..206c6700e2006 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From 8c08dbc73f59570ab8f53b305c9a0462a61d0b95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 21:46:54 +0800
+Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
+
+From: Zhang Tengfei <zhtfdev@gmail.com>
+
+[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
+
+KCSAN reported a data-race on the `ipvs->enable` flag, which is
+written in the control path and read concurrently from many other
+contexts.
+
+Following a suggestion by Julian, this patch fixes the race by
+converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
+This lightweight approach ensures atomic access and acts as a
+compiler barrier, preventing unsafe optimizations where the flag
+is checked in loops (e.g., in ip_vs_est.c).
+
+Additionally, the `enable` checks in the fast-path hooks
+(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
+removed. These are unnecessary since commit 857ca89711de
+("ipvs: register hooks only with services"). The `enable=0`
+condition they check for can only occur in two rare and non-fatal
+scenarios: 1) after hooks are registered but before the flag is set,
+and 2) after hooks are unregistered on cleanup_net. In the worst
+case, a single packet might be mishandled (e.g., dropped), which
+does not lead to a system crash or data corruption. Adding a check
+in the performance-critical fast-path to handle this harmless
+condition is not a worthwhile trade-off.
+
+Fixes: 857ca89711de ("ipvs: register hooks only with services")
+Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
+Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
+ net/netfilter/ipvs/ip_vs_ctl.c | 6 +++---
+ net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++--------
+ 4 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 965f3c8e5089d..37ebb0cb62b8b 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
+ * conntrack cleanup for the net.
+ */
+ smp_rmb();
+- if (ipvs->enable)
++ if (READ_ONCE(ipvs->enable))
+ ip_vs_conn_drop_conntrack(cp);
+ }
+
+@@ -1439,7 +1439,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
+ cond_resched_rcu();
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ break;
+ }
+ rcu_read_unlock();
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index c7a8a08b73089..5ea7ab8bf4dcc 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
+ if (unlikely(!skb_dst(skb)))
+ return NF_ACCEPT;
+
+- if (!ipvs->enable)
+- return NF_ACCEPT;
+-
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (af == AF_INET6) {
+@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
+ return NF_ACCEPT;
+ }
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
+ int r;
+
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ if (state->pf == NFPROTO_IPV4) {
+@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
+ return -ENOMEM;
+
+ /* Hold the beast until a service is registered */
+- ipvs->enable = 0;
++ WRITE_ONCE(ipvs->enable, 0);
+ ipvs->net = net;
+ /* Counters used for creating unique names */
+ ipvs->gen = atomic_read(&ipvs_netns_cnt);
+@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
+ ipvs = net_ipvs(net);
+ ip_vs_unregister_hooks(ipvs, AF_INET);
+ ip_vs_unregister_hooks(ipvs, AF_INET6);
+- ipvs->enable = 0; /* Disable packet reception */
++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */
+ smp_wmb();
+ ip_vs_sync_net_cleanup(ipvs);
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 6a6fc44785337..4c8fa22be88ad 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
+ struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock;
+ if (!kd)
+ continue;
+@@ -1483,9 +1483,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+
+ *svc_p = svc;
+
+- if (!ipvs->enable) {
++ if (!READ_ONCE(ipvs->enable)) {
+ /* Now there is a service - full throttle */
+- ipvs->enable = 1;
++ WRITE_ONCE(ipvs->enable, 1);
+
+ /* Start estimation for first time */
+ ip_vs_est_reload_start(ipvs);
+diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
+index 15049b8267327..93a925f1ed9b8 100644
+--- a/net/netfilter/ipvs/ip_vs_est.c
++++ b/net/netfilter/ipvs/ip_vs_est.c
+@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
+ void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
+ {
+ /* Ignore reloads before first service is added */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ return;
+ ip_vs_est_stopped_recalc(ipvs);
+ /* Bump the kthread configuration genid */
+@@ -306,7 +306,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ int i;
+
+ if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
+- ipvs->enable && ipvs->est_max_threads)
++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
+ return -EINVAL;
+
+ mutex_lock(&ipvs->est_mutex);
+@@ -343,7 +343,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ }
+
+ /* Start kthread tasks only when services are present */
+- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
+ ret = ip_vs_est_kthread_start(ipvs, kd);
+ if (ret < 0)
+ goto out;
+@@ -486,7 +486,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
+ struct ip_vs_estimator *est = &stats->est;
+ int ret;
+
+- if (!ipvs->est_max_threads && ipvs->enable)
++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
+ ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
+
+ est->ktid = -1;
+@@ -663,7 +663,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ /* Wait for cpufreq frequency transition */
+ wait_event_idle_timeout(wq, kthread_should_stop(),
+ HZ / 50);
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ }
+
+@@ -681,7 +681,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ rcu_read_unlock();
+ local_bh_enable();
+
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ cond_resched();
+
+@@ -757,7 +757,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ mutex_lock(&ipvs->est_mutex);
+ for (id = 1; id < ipvs->est_kt_count; id++) {
+ /* netns clean up started, abort */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock2;
+ kd = ipvs->est_kt_arr[id];
+ if (!kd)
+@@ -787,7 +787,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ id = ipvs->est_kt_count;
+
+ next_kt:
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto unlock;
+ id--;
+ if (id < 0)
+--
+2.51.0
+
--- /dev/null
+From 1195c2328d4ee735861c48cb7e2fb30703b88587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:27:45 +0200
+Subject: irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit a186120c780e21e4cfd186a925e34f718e30de88 ]
+
+Code in gicv5_its_irq_domain_alloc() has two issues:
+
+ - it checks the wrong return value/variable when calling gicv5_alloc_lpi()
+
+ - The cleanup code does not take previous loop iterations into account
+
+Fix both issues at once by adding the right gicv5_alloc_lpi() variable
+check and by reworking the function cleanup code to take into account
+current and previous iterations.
+
+[ lpieralisi: Reworded commit message ]
+
+Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
+Link: https://lore.kernel.org/all/20250908082745.113718-4-lpieralisi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v5-its.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
+index 4701ef62b8b27..2fb58d76f5214 100644
+--- a/drivers/irqchip/irq-gic-v5-its.c
++++ b/drivers/irqchip/irq-gic-v5-its.c
+@@ -949,15 +949,18 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
+ device_id = its_dev->device_id;
+
+ for (i = 0; i < nr_irqs; i++) {
+- lpi = gicv5_alloc_lpi();
++ ret = gicv5_alloc_lpi();
+ if (ret < 0) {
+ pr_debug("Failed to find free LPI!\n");
+- goto out_eventid;
++ goto out_free_irqs;
+ }
++ lpi = ret;
+
+ ret = irq_domain_alloc_irqs_parent(domain, virq + i, 1, &lpi);
+- if (ret)
+- goto out_free_lpi;
++ if (ret) {
++ gicv5_free_lpi(lpi);
++ goto out_free_irqs;
++ }
+
+ /*
+ * Store eventid and deviceid into the hwirq for later use.
+@@ -977,8 +980,13 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
+
+ return 0;
+
+-out_free_lpi:
+- gicv5_free_lpi(lpi);
++out_free_irqs:
++ while (--i >= 0) {
++ irqd = irq_domain_get_irq_data(domain, virq + i);
++ gicv5_free_lpi(irqd->parent_data->hwirq);
++ irq_domain_reset_irq_data(irqd);
++ irq_domain_free_irqs_parent(domain, virq + i, 1);
++ }
+ out_eventid:
+ gicv5_its_free_eventid(its_dev, event_id_base, nr_irqs);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 60ecadda130b396a541e04ed76a65693ffe966ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:27:44 +0200
+Subject: irqchip/gic-v5: Fix loop in gicv5_its_create_itt_two_level() cleanup
+ path
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit bfcd1fdaae92faa8cae880eb4c3aaaa60c54bf0d ]
+
+The "i" variable in gicv5_its_create_itt_two_level() needs to be signed
+otherwise it can cause a forever loop in the function's cleanup path.
+
+[ lpieralisi: Reworded commit message ]
+
+Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
+Link: https://lore.kernel.org/all/20250908082745.113718-3-lpieralisi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v5-its.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
+index 9290ac741949c..4701ef62b8b27 100644
+--- a/drivers/irqchip/irq-gic-v5-its.c
++++ b/drivers/irqchip/irq-gic-v5-its.c
+@@ -191,9 +191,9 @@ static int gicv5_its_create_itt_two_level(struct gicv5_its_chip_data *its,
+ unsigned int num_events)
+ {
+ unsigned int l1_bits, l2_bits, span, events_per_l2_table;
+- unsigned int i, complete_tables, final_span, num_ents;
++ unsigned int complete_tables, final_span, num_ents;
+ __le64 *itt_l1, *itt_l2, **l2ptrs;
+- int ret;
++ int i, ret;
+ u64 val;
+
+ ret = gicv5_its_l2sz_to_l2_bits(itt_l2sz);
+--
+2.51.0
+
--- /dev/null
+From 0fac4f9520e07c38c0a2f80e6d74a2337e4a6027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 07:28:33 +0800
+Subject: irqchip/sg2042-msi: Fix broken affinity setting
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit 9d8c41816bac518b4824f83b346ae30a1be83f68 ]
+
+When using NVME on SG2044, the NVME drvier always complains about "I/O tag
+XXX (XXX) QID XX timeout, completion polled", which is caused by the broken
+affinity setting mechanism of the sg2042-msi driver.
+
+The PLIC driver can only the set the affinity when enabled, but the
+sg2042-msi driver invokes the affinity setter in disabled state, which
+causes the change to be lost.
+
+Cure this by implementing the irq_startup()/shutdown() callbacks, which
+allow to startup (enabled) the underlying PLIC first.
+
+Fixes: e96b93a97c90 ("irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller")
+Reported-by: Han Gao <rabenda.cn@gmail.com>
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Link: https://lore.kernel.org/all/20250813232835.43458-4-inochiama@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sg2042-msi.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sg2042-msi.c b/drivers/irqchip/irq-sg2042-msi.c
+index bcfddc51bc6a1..2fd4d94f9bd76 100644
+--- a/drivers/irqchip/irq-sg2042-msi.c
++++ b/drivers/irqchip/irq-sg2042-msi.c
+@@ -85,6 +85,8 @@ static void sg2042_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
+
+ static const struct irq_chip sg2042_msi_middle_irq_chip = {
+ .name = "SG2042 MSI",
++ .irq_startup = irq_chip_startup_parent,
++ .irq_shutdown = irq_chip_shutdown_parent,
+ .irq_ack = sg2042_msi_irq_ack,
+ .irq_mask = irq_chip_mask_parent,
+ .irq_unmask = irq_chip_unmask_parent,
+@@ -114,6 +116,8 @@ static void sg2044_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
+
+ static struct irq_chip sg2044_msi_middle_irq_chip = {
+ .name = "SG2044 MSI",
++ .irq_startup = irq_chip_startup_parent,
++ .irq_shutdown = irq_chip_shutdown_parent,
+ .irq_ack = sg2044_msi_irq_ack,
+ .irq_mask = irq_chip_mask_parent,
+ .irq_unmask = irq_chip_unmask_parent,
+@@ -185,8 +189,10 @@ static const struct irq_domain_ops sg204x_msi_middle_domain_ops = {
+ .select = msi_lib_irq_domain_select,
+ };
+
+-#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
+- MSI_FLAG_USE_DEF_CHIP_OPS)
++#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
++ MSI_FLAG_USE_DEF_CHIP_OPS | \
++ MSI_FLAG_PCI_MSI_MASK_PARENT | \
++ MSI_FLAG_PCI_MSI_STARTUP_PARENT)
+
+ #define SG2042_MSI_FLAGS_SUPPORTED MSI_GENERIC_FLAGS_MASK
+
+@@ -200,10 +206,12 @@ static const struct msi_parent_ops sg2042_msi_parent_ops = {
+ .init_dev_msi_info = msi_lib_init_dev_msi_info,
+ };
+
+-#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
+- MSI_FLAG_USE_DEF_CHIP_OPS)
++#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS | \
++ MSI_FLAG_USE_DEF_CHIP_OPS | \
++ MSI_FLAG_PCI_MSI_MASK_PARENT | \
++ MSI_FLAG_PCI_MSI_STARTUP_PARENT)
+
+-#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \
++#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK | \
+ MSI_FLAG_PCI_MSIX)
+
+ static const struct msi_parent_ops sg2044_msi_parent_ops = {
+--
+2.51.0
+
--- /dev/null
+From 64db51cb165339c15e0f41548761fa83d78407f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 15:26:39 -0500
+Subject: kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
+
+From: Kienan Stewart <kstewart@efficios.com>
+
+[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ]
+
+In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b
+("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
+artifacts required for building out-of-tree kernel modules had
+$(objtree) prepended to them to prepare for building in other
+directories.
+
+When building external modules for powerpc,
+arch/powerpc/lib/crtsavres.o is required for certain
+configurations. This artifact is missing the prepended $(objtree).
+
+Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=")
+Acked-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nicolas Schier <n.schier@avm.de>
+Tested-by: Nicolas Schier <n.schier@avm.de>
+Signed-off-by: Kienan Stewart <kstewart@efficios.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 9753fb87217c3..a58b1029592ce 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
+ # There is a corresponding test in arch/powerpc/lib/Makefile
+ KBUILD_LDFLAGS_MODULE += --save-restore-funcs
+ else
+-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
++KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o
+ endif
+
+ ifdef CONFIG_CPU_LITTLE_ENDIAN
+--
+2.51.0
+
--- /dev/null
+From 7612e9e865bccabd71f673f21c9ced85b69d5089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 21:15:50 +0000
+Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing
+
+From: Fan Wu <wufan@kernel.org>
+
+[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
+
+Fix the X.509 Basic Constraints CA flag parsing to correctly handle
+the ASN.1 DER encoded structure. The parser was incorrectly treating
+the length field as the boolean value.
+
+Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
+According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
+
+Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
+
+The basicConstraints extension with CA:TRUE is encoded as:
+
+ SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
+ ^-- v[2] ^-- v[3] ^-- v[4]
+
+The parser was checking v[3] (the length field, always 0x01) instead
+of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
+
+Also handle the case where the extension is an empty SEQUENCE (30 00),
+which is valid for CA:FALSE when the default value is omitted as
+required by DER encoding rules (X.690 section 11.5).
+
+Per ITU-T X.690-0207:
+- Section 11.5: Default values must be omitted in DER
+- Section 11.1: DER requires TRUE to be encoded as 0xFF
+
+Link: https://datatracker.ietf.org/doc/html/rfc5280
+Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
+Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
+Signed-off-by: Fan Wu <wufan@kernel.org>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index 2ffe4ae90bea0..8df3fa60a44f8 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -610,11 +610,14 @@ int x509_process_extension(void *context, size_t hdrlen,
+ /*
+ * Get hold of the basicConstraints
+ * v[1] is the encoding size
+- * (Expect 0x2 or greater, making it 1 or more bytes)
++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or
++ * 0x03 or greater for non-empty SEQUENCE)
+ * v[2] is the encoding type
+ * (Expect an ASN1_BOOL for the CA)
+- * v[3] is the contents of the ASN1_BOOL
+- * (Expect 1 if the CA is TRUE)
++ * v[3] is the length of the ASN1_BOOL
++ * (Expect 1 for a single byte boolean)
++ * v[4] is the contents of the ASN1_BOOL
++ * (Expect 0xFF if the CA is TRUE)
+ * vlen should match the entire extension size
+ */
+ if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+@@ -623,8 +626,13 @@ int x509_process_extension(void *context, size_t hdrlen,
+ return -EBADMSG;
+ if (v[1] != vlen - 2)
+ return -EBADMSG;
+- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
++ if (v[1] == 0)
++ return 0;
++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
+ ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
++ else
++ return -EBADMSG;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8310df23bb067b2e4799c7c06e69bbc0cf832824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:13:02 +0200
+Subject: kselftest/arm64/gcs: Correctly check return value when disabling GCS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ]
+
+The return value was not assigned to 'ret', so the check afterwards
+does not do anything.
+
+Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c
+index 54f9c888249d7..100d2a983155f 100644
+--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c
++++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c
+@@ -410,7 +410,7 @@ int main(void)
+ }
+
+ /* One last test: disable GCS, we can do this one time */
+- my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
++ ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
+ if (ret != 0)
+ ksft_print_msg("Failed to disable GCS: %d\n", ret);
+
+--
+2.51.0
+
--- /dev/null
+From 8f56a8e3a51c6c44961f07ac0778cefc231dca81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:51:22 +0800
+Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
+
+There is a register to clamp the flash current per LED channel when
+safety timer is disabled. It needs to be updated according to the
+maximum torch LED current setting to ensure the torch current won't
+be clamped unexpectedly.
+
+Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
+index 89cf5120f5d55..db7c2c743adc7 100644
+--- a/drivers/leds/flash/leds-qcom-flash.c
++++ b/drivers/leds/flash/leds-qcom-flash.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #include <linux/bitfield.h>
+@@ -114,36 +114,39 @@ enum {
+ REG_THERM_THRSH1,
+ REG_THERM_THRSH2,
+ REG_THERM_THRSH3,
++ REG_TORCH_CLAMP,
+ REG_MAX_COUNT,
+ };
+
+ static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x08, 0, 7), /* status1 */
+- REG_FIELD(0x09, 0, 7), /* status2 */
+- REG_FIELD(0x0a, 0, 7), /* status3 */
+- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */
+- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x47, 0, 5), /* iresolution */
+- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */
+- REG_FIELD(0x4c, 0, 2), /* chan_en */
+- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */
+- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7),
++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2),
++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2),
++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6),
+ };
+
+ static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x06, 0, 7), /* status1 */
+- REG_FIELD(0x07, 0, 6), /* status2 */
+- REG_FIELD(0x09, 0, 7), /* status3 */
+- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */
+- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x49, 0, 3), /* iresolution */
+- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */
+- REG_FIELD(0x4e, 0, 3), /* chan_en */
+- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */
++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6),
++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3),
++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6),
+ };
+
+ struct qcom_flash_data {
+@@ -156,6 +159,7 @@ struct qcom_flash_data {
+ u8 max_channels;
+ u8 chan_en_bits;
+ u8 revision;
++ u8 torch_clamp;
+ };
+
+ struct qcom_flash_led {
+@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
+ u32 current_ua, timeout_us;
+ u32 channels[4];
+ int i, rc, count;
++ u8 torch_clamp;
+
+ count = fwnode_property_count_u32(node, "led-sources");
+ if (count <= 0) {
+@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
+ current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
+ led->max_torch_current_ma = current_ua / UA_PER_MA;
+
++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
++ if (torch_clamp != 0)
++ torch_clamp--;
++
++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
++
+ if (fwnode_property_present(node, "flash-max-microamp")) {
+ flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
+
+@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
+ flash_data->leds_count++;
+ }
+
+- return 0;
+-
++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
+ release:
+ while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
+ v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]);
+--
+2.51.0
+
--- /dev/null
+From a407667e7f018f4eb2342c2c2bed613c6f8f5d59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:47:12 +0200
+Subject: leds: leds-lp55xx: Use correct address for memory programming
+
+From: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+
+[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]
+
+Memory programming doesn't work for devices without page support.
+For example, LP5562 has 3 engines but doesn't support pages,
+the start address is changed depending on engine number.
+According to datasheet [1], the PROG MEM register addresses for each
+engine are as follows:
+
+ Engine 1: 0x10
+ Engine 2: 0x30
+ Engine 3: 0x50
+
+However, the current implementation incorrectly calculates the address
+of PROG MEM register using the engine index starting from 1:
+
+ prog_mem_base = 0x10
+ LP55xx_BYTES_PER_PAGE = 0x20
+
+ Engine 1: 0x10 + 0x20 * 1 = 0x30
+ Engine 2: 0x10 + 0x20 * 2 = 0x50
+ Engine 3: 0x10 + 0x20 * 3 = 0x70
+
+This results in writing to the wrong engine memory, causing pattern
+programming to fail.
+
+To correct it, the engine index should be decreased:
+ Engine 1: 0x10 + 0x20 * 0 = 0x10
+ Engine 2: 0x10 + 0x20 * 1 = 0x30
+ Engine 3: 0x10 + 0x20 * 2 = 0x50
+
+1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf
+
+Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
+Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
+Link: https://lore.kernel.org/r/20250820-lp5562-prog-mem-address-v1-1-8569647fa71d@anton-paar.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp55xx-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
+index e71456a56ab8d..fd447eb7eb15e 100644
+--- a/drivers/leds/leds-lp55xx-common.c
++++ b/drivers/leds/leds-lp55xx-common.c
+@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
+ * For LED chip that support page, PAGE is already set in load_engine.
+ */
+ if (!cfg->pages_per_engine)
+- start_addr += LP55xx_BYTES_PER_PAGE * idx;
++ start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
+
+ for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
+ /* Write to the next page each 32 bytes (if supported) */
+--
+2.51.0
+
--- /dev/null
+From 7ef018b2c891694f2aa0f3f1d81328ff3fc69798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 07:56:45 +0000
+Subject: leds: max77705: Function return instead of variable assignment
+
+From: Len Bao <len.bao@gmx.us>
+
+[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ]
+
+Coverity noticed that assigning value -EINVAL to 'ret' in the if
+statement is useless because 'ret' is overwritten a few lines later.
+However, after inspect the code, this warning reveals that we need to
+return -EINVAL instead of the variable assignment. So, fix it.
+
+Coverity-id: 1646104
+Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
+Signed-off-by: Len Bao <len.bao@gmx.us>
+Link: https://lore.kernel.org/r/20250727075649.34496-1-len.bao@gmx.us
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-max77705.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
+index 933cb4f19be9b..b7403b3fcf5e7 100644
+--- a/drivers/leds/leds-max77705.c
++++ b/drivers/leds/leds-max77705.c
+@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
+
+ ret = fwnode_property_read_u32(np, "reg", ®);
+ if (ret || reg >= MAX77705_LED_NUM_LEDS)
+- ret = -EINVAL;
++ return -EINVAL;
+
+ info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL);
+ if (!info)
+--
+2.51.0
+
--- /dev/null
+From b2f628a50688cacc40ca5361f510d5cdfe3ab338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 22:51:19 +0100
+Subject: libbpf: Export bpf_object__prepare symbol
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ]
+
+Add missing LIBBPF_API macro for bpf_object__prepare function to enable
+its export. libbpf.map had bpf_object__prepare already listed.
+
+Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load")
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250819215119.37795-1-mykyta.yatsenko5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
+index 455a957cb702c..2b86e21190d37 100644
+--- a/tools/lib/bpf/libbpf.h
++++ b/tools/lib/bpf/libbpf.h
+@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
+ * @return 0, on success; negative error code, otherwise, error code is
+ * stored in errno
+ */
+-int bpf_object__prepare(struct bpf_object *obj);
++LIBBPF_API int bpf_object__prepare(struct bpf_object *obj);
+
+ /**
+ * @brief **bpf_object__load()** loads BPF object into kernel.
+--
+2.51.0
+
--- /dev/null
+From 0f519272424ac06f98acd83d0a2053daad7647ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 15:17:51 +0800
+Subject: libbpf: Fix error when st-prefix_ops and ops from differ btf
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]
+
+When a module registers a struct_ops, the struct_ops type and its
+corresponding map_value type ("bpf_struct_ops_") may reside in different
+btf objects, here are four possible case:
+
++--------+---------------+-------------+---------------------------------+
+| |bpf_struct_ops_| xxx_ops | |
++--------+---------------+-------------+---------------------------------+
+| case 0 | btf_vmlinux | btf_vmlinux | be used and reg only in vmlinux |
++--------+---------------+-------------+---------------------------------+
+| case 1 | btf_vmlinux | mod_btf | INVALID |
++--------+---------------+-------------+---------------------------------+
+| case 2 | mod_btf | btf_vmlinux | reg in mod but be used both in |
+| | | | vmlinux and mod. |
++--------+---------------+-------------+---------------------------------+
+| case 3 | mod_btf | mod_btf | be used and reg only in mod |
++--------+---------------+-------------+---------------------------------+
+
+Currently we figure out the mod_btf by searching with the struct_ops type,
+which makes it impossible to figure out the mod_btf when the struct_ops
+type is in btf_vmlinux while it's corresponding map_value type is in
+mod_btf (case 2).
+
+The fix is to use the corresponding map_value type ("bpf_struct_ops_")
+as the lookup anchor instead of the struct_ops type to figure out the
+`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
+the kern_type_id via btf__find_by_name_kind() with the `btf` we just
+obtained from find_ksym_btf_id().
+
+With this change the lookup obtains the correct btf and mod_btf for case 2,
+preserves correct behavior for other valid cases, and still fails as
+expected for the invalid scenario (case 1).
+
+Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/bpf/20250926071751.108293-1-alibuda@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index fe4fc5438678c..8f9261279b921 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1013,35 +1013,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ const struct btf_member *kern_data_member;
+ struct btf *btf = NULL;
+ __s32 kern_vtype_id, kern_type_id;
+- char tname[256];
++ char tname[192], stname[256];
+ __u32 i;
+
+ snprintf(tname, sizeof(tname), "%.*s",
+ (int)bpf_core_essential_name_len(tname_raw), tname_raw);
+
+- kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
+- &btf, mod_btf);
+- if (kern_type_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
+- tname);
+- return kern_type_id;
+- }
+- kern_type = btf__type_by_id(btf, kern_type_id);
++ snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
+
+- /* Find the corresponding "map_value" type that will be used
+- * in map_update(BPF_MAP_TYPE_STRUCT_OPS). For example,
+- * find "struct bpf_struct_ops_tcp_congestion_ops" from the
+- * btf_vmlinux.
++ /* Look for the corresponding "map_value" type that will be used
++ * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
++ * and the mod_btf.
++ * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
+ */
+- kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
+- tname, BTF_KIND_STRUCT);
++ kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
+ if (kern_vtype_id < 0) {
+- pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
+- STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
+ return kern_vtype_id;
+ }
+ kern_vtype = btf__type_by_id(btf, kern_vtype_id);
+
++ kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
++ if (kern_type_id < 0) {
++ pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
++ return kern_type_id;
++ }
++ kern_type = btf__type_by_id(btf, kern_type_id);
++
+ /* Find "struct tcp_congestion_ops" from
+ * struct bpf_struct_ops_tcp_congestion_ops {
+ * [ ... ]
+@@ -1054,8 +1052,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
+ break;
+ }
+ if (i == btf_vlen(kern_vtype)) {
+- pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
+- tname, STRUCT_OPS_VALUE_PREFIX, tname);
++ pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
++ tname, stname);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From cca29f54ecd0cc0a8f2ddd8ecc2f9206ce770784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 8f5a81b672e1b..fe4fc5438678c 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From 9c9fb3e18ef6b085dc65e4471d12dbbf8f00349f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 15:28:00 -0700
+Subject: lsm: CONFIG_LSM can depend on CONFIG_SECURITY
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]
+
+When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
+not need to be visible and settable since builtin_lsm_order is defined in
+security.o, which is only built when CONFIG_SECURITY=y.
+
+So make CONFIG_LSM depend on CONFIG_SECURITY.
+
+Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[PM: subj tweak]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/Kconfig b/security/Kconfig
+index 4816fc74f81eb..285f284dfcac4 100644
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -269,6 +269,7 @@ endchoice
+
+ config LSM
+ string "Ordered list of enabled LSMs"
++ depends on SECURITY
+ default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
+ default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
+ default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
+--
+2.51.0
+
--- /dev/null
+From c2d3b88201c1406171eadff96e22f02b2680907c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 15:50:58 +0200
+Subject: media: i2c: vd55g1: Fix duster register address
+
+From: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
+
+[ Upstream commit ba4b8886c22a3e8c3f41c6dd373b177d7d41bcf8 ]
+
+The duster register needs to be disabled on test patterns. While the
+code is correctly doing so, the register address contained a typo, thus
+not disabling the duster correctly. Fix the typo.
+
+Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor")
+
+Signed-off-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/vd55g1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c
+index 7c39183dd44bf..4a62d35006829 100644
+--- a/drivers/media/i2c/vd55g1.c
++++ b/drivers/media/i2c/vd55g1.c
+@@ -66,7 +66,7 @@
+ #define VD55G1_REG_READOUT_CTRL CCI_REG8(0x052e)
+ #define VD55G1_READOUT_CTRL_BIN_MODE_NORMAL 0
+ #define VD55G1_READOUT_CTRL_BIN_MODE_DIGITAL_X2 1
+-#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ea)
++#define VD55G1_REG_DUSTER_CTRL CCI_REG8(0x03ae)
+ #define VD55G1_DUSTER_ENABLE BIT(0)
+ #define VD55G1_DUSTER_DISABLE 0
+ #define VD55G1_DUSTER_DYN_ENABLE BIT(1)
+--
+2.51.0
+
--- /dev/null
+From 27f052a0b71b50a23d183eb6543eb3f1f67f8861 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index b7ca39f63dba8..6dfc912168510 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From 2c4f94e06f81e23435c68eeaa1dcc10f3d824808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 11:31:56 +0200
+Subject: media: st-delta: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
+
+Building with a reduced stack warning limit shows that delta_mjpeg_decode()
+copies a giant structure to the stack each time but only uses three of
+its members:
+
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Open-code the passing of the structure members that are actually used here.
+
+Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+index 0533d4a083d24..a078f1107300e 100644
+--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
+ return 0;
+ }
+
+-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
+ {
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+
+ memset(params, 0, sizeof(*params));
+
+- params->picture_start_addr_p = (u32)(au->paddr);
+- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
++ params->picture_start_addr_p = pstart;
++ params->picture_end_addr_p = pend;
+
+ /*
+ * !WARNING!
+@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+ int ret;
+- struct delta_au au = *pau;
++ void *au_vaddr = pau->vaddr;
++ dma_addr_t au_dma = pau->paddr;
++ size_t au_size = pau->size;
+ unsigned int data_offset = 0;
+ struct mjpeg_header *header = &ctx->header_struct;
+
+ if (!ctx->header) {
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ goto err;
+ }
+
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ ctx->header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+ goto err;
+ }
+
+- au.paddr += data_offset;
+- au.vaddr += data_offset;
++ au_dma += data_offset;
++ au_vaddr += data_offset;
+
+- ret = delta_mjpeg_ipc_decode(pctx, &au);
++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
+ if (ret)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From b389dcb61cf0332bd97079f9691f90d6da235da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:20:37 +0800
+Subject: media: staging/ipu7: cleanup the MMU correctly in IPU7 driver release
+
+From: Bingbu Cao <bingbu.cao@intel.com>
+
+[ Upstream commit 01a80b6649e69e4889b8521de022d3ee4bc5cb6f ]
+
+IPU7 ISYS and PSYS auxiliary devices are released after
+ipu7_bus_del_devices(), so driver can not reference the MMU devices
+from ISYS and PSYS auxiliary devices, so move the MMUs cleanup before
+releasing the auxiliary devices.
+
+Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
+Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
+[Sakari Ailus: Drop extra newline.]
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/ipu7/ipu7.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
+index aef931d235108..ee6b63717ed36 100644
+--- a/drivers/staging/media/ipu7/ipu7.c
++++ b/drivers/staging/media/ipu7/ipu7.c
+@@ -2644,6 +2644,9 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
+ if (!IS_ERR_OR_NULL(isp->fw_code_region))
+ vfree(isp->fw_code_region);
+
++ ipu7_mmu_cleanup(isp->isys->mmu);
++ ipu7_mmu_cleanup(isp->psys->mmu);
++
+ ipu7_bus_del_devices(pdev);
+
+ pm_runtime_forbid(&pdev->dev);
+@@ -2652,9 +2655,6 @@ static void ipu7_pci_remove(struct pci_dev *pdev)
+ ipu_buttress_exit(isp);
+
+ release_firmware(isp->cpd_fw);
+-
+- ipu7_mmu_cleanup(isp->psys->mmu);
+- ipu7_mmu_cleanup(isp->isys->mmu);
+ }
+
+ static void ipu7_pci_reset_prepare(struct pci_dev *pdev)
+--
+2.51.0
+
--- /dev/null
+From 4b30ac40b81687fe34b7894182dfa2407b19130b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:20:35 +0800
+Subject: media: staging/ipu7: convert to use pci_alloc_irq_vectors() API
+
+From: Bingbu Cao <bingbu.cao@intel.com>
+
+[ Upstream commit 283f7638c26c0f36e4ef5e147884e241b24fbebd ]
+
+pci_enable_msi() is a deprecated API, thus switch to use modern
+pci_alloc_irq_vectors().
+
+Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
+Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/ipu7/ipu7.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
+index 1b4f01db13ca2..a8e8b0e231989 100644
+--- a/drivers/staging/media/ipu7/ipu7.c
++++ b/drivers/staging/media/ipu7/ipu7.c
+@@ -2248,20 +2248,13 @@ void ipu7_dump_fw_error_log(const struct ipu7_bus_device *adev)
+ }
+ EXPORT_SYMBOL_NS_GPL(ipu7_dump_fw_error_log, "INTEL_IPU7");
+
+-static int ipu7_pci_config_setup(struct pci_dev *dev)
++static void ipu7_pci_config_setup(struct pci_dev *dev)
+ {
+ u16 pci_command;
+- int ret;
+
+ pci_read_config_word(dev, PCI_COMMAND, &pci_command);
+ pci_command |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER;
+ pci_write_config_word(dev, PCI_COMMAND, pci_command);
+-
+- ret = pci_enable_msi(dev);
+- if (ret)
+- dev_err(&dev->dev, "Failed to enable msi (%d)\n", ret);
+-
+- return ret;
+ }
+
+ static int ipu7_map_fw_code_region(struct ipu7_bus_device *sys,
+@@ -2510,13 +2503,15 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ dma_set_max_seg_size(dev, UINT_MAX);
+
+- ret = ipu7_pci_config_setup(pdev);
+- if (ret)
+- return ret;
++ ipu7_pci_config_setup(pdev);
++
++ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
++ if (ret < 0)
++ return dev_err_probe(dev, ret, "Failed to alloc irq vector\n");
+
+ ret = ipu_buttress_init(isp);
+ if (ret)
+- return ret;
++ goto pci_irq_free;
+
+ dev_info(dev, "firmware cpd file: %s\n", isp->cpd_fw_name);
+
+@@ -2632,6 +2627,8 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ release_firmware(isp->cpd_fw);
+ buttress_exit:
+ ipu_buttress_exit(isp);
++pci_irq_free:
++ pci_free_irq_vectors(pdev);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9e832ff533f77836decc14274976371087a0bd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:20:36 +0800
+Subject: media: staging/ipu7: Don't set name for IPU7 PCI device
+
+From: Bingbu Cao <bingbu.cao@intel.com>
+
+[ Upstream commit 8abb489f9aa181882ece7c24712ad39cbb9dab81 ]
+
+Driver better not dev_set_name() to change the PCI device
+name, so remove it.
+
+Fixes: b7fe4c0019b1 ("media: staging/ipu7: add Intel IPU7 PCI device driver")
+Signed-off-by: Bingbu Cao <bingbu.cao@intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/ipu7/ipu7.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/staging/media/ipu7/ipu7.c b/drivers/staging/media/ipu7/ipu7.c
+index a8e8b0e231989..aef931d235108 100644
+--- a/drivers/staging/media/ipu7/ipu7.c
++++ b/drivers/staging/media/ipu7/ipu7.c
+@@ -2428,7 +2428,6 @@ static int ipu7_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (!isp)
+ return -ENOMEM;
+
+- dev_set_name(dev, "intel-ipu7");
+ isp->pdev = pdev;
+ INIT_LIST_HEAD(&isp->devices);
+
+--
+2.51.0
+
--- /dev/null
+From cb04579c5bc172da542deb91285064836ccda8a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:30:15 +0300
+Subject: media: zoran: Remove zoran_fh structure
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
+
+The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
+mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
+but the structure stayed by mistake. It is now used in a single
+location, assigned from a void pointer and then recast to a void
+pointer, without being every accessed. Drop it.
+
+Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/zoran/zoran.h | 6 ------
+ drivers/media/pci/zoran/zoran_driver.c | 3 +--
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
+index 1cd990468d3de..d05e222b39215 100644
+--- a/drivers/media/pci/zoran/zoran.h
++++ b/drivers/media/pci/zoran/zoran.h
+@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
+
+ struct zoran;
+
+-/* zoran_fh contains per-open() settings */
+-struct zoran_fh {
+- struct v4l2_fh fh;
+- struct zoran *zr;
+-};
+-
+ struct card_info {
+ enum card_type type;
+ char name[32];
+diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
+index f42f596d3e629..ec7fc1da4cc02 100644
+--- a/drivers/media/pci/zoran/zoran_driver.c
++++ b/drivers/media/pci/zoran/zoran_driver.c
+@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
+ struct v4l2_format *fmt)
+ {
+ struct zoran *zr = video_drvdata(file);
+- struct zoran_fh *fh = __fh;
+ int i;
+ int res = 0;
+
+ if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
+- return zoran_s_fmt_vid_out(file, fh, fmt);
++ return zoran_s_fmt_vid_out(file, __fh, fmt);
+
+ for (i = 0; i < NUM_FORMATS; i++)
+ if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
+--
+2.51.0
+
--- /dev/null
+From 896bcf8502523eee9f6f7224e76aad9f0ce44d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 20:06:46 +0300
+Subject: mfd: max77705: max77705_charger: move active discharge setting to mfd
+ parent
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit c24928ac69be2390cdf456d126b464af079c57ef ]
+
+Active discharge setting is a part of MFD top level i2c device, hence
+cannot be controlled by charger. Writing to MAX77705_PMIC_REG_MAINCTRL1
+register from charger driver is a mistake.
+
+Move active discharge setting to MFD parent driver.
+
+Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Acked-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/max77705.c | 3 +++
+ drivers/power/supply/max77705_charger.c | 3 ---
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
+index 6b263bacb8c28..ff07d0e0d5f8e 100644
+--- a/drivers/mfd/max77705.c
++++ b/drivers/mfd/max77705.c
+@@ -108,6 +108,9 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
+ if (pmic_rev != MAX77705_PASS3)
+ return dev_err_probe(dev, -ENODEV, "Rev.0x%x is not tested\n", pmic_rev);
+
++ /* Active Discharge Enable */
++ regmap_update_bits(max77705->regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
++
+ ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
+ i2c->irq,
+ IRQF_ONESHOT | IRQF_SHARED, 0,
+diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
+index 329b430d0e506..3b75c82b9b9ea 100644
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -487,9 +487,6 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+ regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
+ MAX77705_WDTEN_MASK, 0);
+
+- /* Active Discharge Enable */
+- regmap_update_bits(regmap, MAX77705_PMIC_REG_MAINCTRL1, 1, 1);
+-
+ /* VBYPSET=5.0V */
+ regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
+
+--
+2.51.0
+
--- /dev/null
+From d596aaba3590aad148bb014a8751b96a4c1448dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 21:23:07 +0300
+Subject: mfd: max77705: Setup the core driver as an interrupt controller
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit 605c9820e44de2da7d67acf66484136561da63a2 ]
+
+Current implementation describes only MFD's own topsys interrupts.
+However, max77705 has a register which indicates interrupt source, i.e.
+it acts as an interrupt controller. There's 4 interrupt sources in
+max77705: topsys, charger, fuelgauge, usb type-c manager.
+
+Setup max77705 MFD parent as an interrupt controller. Delete topsys
+interrupts because currently unused.
+
+Remove shared interrupt flag, because we're are an interrupt controller
+now, and subdevices should request interrupts from us.
+
+Fixes: c8d50f029748 ("mfd: Add new driver for MAX77705 PMIC")
+
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Link: https://lore.kernel.org/r/20250909-max77705-fix_interrupt_handling-v3-1-233c5a1a20b5@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/max77705.c | 35 ++++++++++++++---------------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/max77705.c b/drivers/mfd/max77705.c
+index ff07d0e0d5f8e..e1a9bfd658560 100644
+--- a/drivers/mfd/max77705.c
++++ b/drivers/mfd/max77705.c
+@@ -61,21 +61,21 @@ static const struct regmap_config max77705_regmap_config = {
+ .max_register = MAX77705_PMIC_REG_USBC_RESET,
+ };
+
+-static const struct regmap_irq max77705_topsys_irqs[] = {
+- { .mask = MAX77705_SYSTEM_IRQ_BSTEN_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_SYSUVLO_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_SYSOVLO_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_TSHDN_INT, },
+- { .mask = MAX77705_SYSTEM_IRQ_TM_INT, },
++static const struct regmap_irq max77705_irqs[] = {
++ { .mask = MAX77705_SRC_IRQ_CHG, },
++ { .mask = MAX77705_SRC_IRQ_TOP, },
++ { .mask = MAX77705_SRC_IRQ_FG, },
++ { .mask = MAX77705_SRC_IRQ_USBC, },
+ };
+
+-static const struct regmap_irq_chip max77705_topsys_irq_chip = {
+- .name = "max77705-topsys",
+- .status_base = MAX77705_PMIC_REG_SYSTEM_INT,
+- .mask_base = MAX77705_PMIC_REG_SYSTEM_INT_MASK,
++static const struct regmap_irq_chip max77705_irq_chip = {
++ .name = "max77705",
++ .status_base = MAX77705_PMIC_REG_INTSRC,
++ .ack_base = MAX77705_PMIC_REG_INTSRC,
++ .mask_base = MAX77705_PMIC_REG_INTSRC_MASK,
+ .num_regs = 1,
+- .irqs = max77705_topsys_irqs,
+- .num_irqs = ARRAY_SIZE(max77705_topsys_irqs),
++ .irqs = max77705_irqs,
++ .num_irqs = ARRAY_SIZE(max77705_irqs),
+ };
+
+ static int max77705_i2c_probe(struct i2c_client *i2c)
+@@ -113,19 +113,12 @@ static int max77705_i2c_probe(struct i2c_client *i2c)
+
+ ret = devm_regmap_add_irq_chip(dev, max77705->regmap,
+ i2c->irq,
+- IRQF_ONESHOT | IRQF_SHARED, 0,
+- &max77705_topsys_irq_chip,
++ IRQF_ONESHOT, 0,
++ &max77705_irq_chip,
+ &irq_data);
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
+
+- /* Unmask interrupts from all blocks in interrupt source register */
+- ret = regmap_update_bits(max77705->regmap,
+- MAX77705_PMIC_REG_INTSRC_MASK,
+- MAX77705_SRC_IRQ_ALL, (unsigned int)~MAX77705_SRC_IRQ_ALL);
+- if (ret < 0)
+- return dev_err_probe(dev, ret, "Could not unmask interrupts in INTSRC\n");
+-
+ domain = regmap_irq_get_domain(irq_data);
+
+ ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
+--
+2.51.0
+
--- /dev/null
+From 168ad90b0b861e1c97775f3918a7964a5390a221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From dfcdda3a18c0a25db09e68ed171c612104d9694b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 20:03:35 +0300
+Subject: misc: pci_endpoint_test: Fix array underflow in
+ pci_endpoint_test_ioctl()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1ad82f9db13d85667366044acdfb02009d576c5a ]
+
+Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
+added NO_BAR (-1) to the pci_barno enum which, in practical terms,
+changes the enum from an unsigned int to a signed int. If the user
+passes a negative number in pci_endpoint_test_ioctl() then it results in
+an array underflow in pci_endpoint_test_bar().
+
+Fixes: eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/aIzzZ4vc6ZrmM9rI@suswa
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pci_endpoint_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index 1c156a3f845e1..f935175d8bf55 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -937,7 +937,7 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
+ switch (cmd) {
+ case PCITEST_BAR:
+ bar = arg;
+- if (bar > BAR_5)
++ if (bar <= NO_BAR || bar > BAR_5)
+ goto ret;
+ if (is_am654_pci_dev(pdev) && bar == BAR_0)
+ goto ret;
+--
+2.51.0
+
--- /dev/null
+From 429dbb2e04e94b5c1b89ce6d9309520dd0de9ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 14:23:14 +0800
+Subject: mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit e1c4350327b39c9cad27b6c5779b3754384f26c8 ]
+
+The comparison function cmp_loc_by_count() used for sorting stack trace
+locations in debugfs currently returns -1 if a->count > b->count and 1
+otherwise. This breaks the antisymmetry property required by sort(),
+because when two counts are equal, both cmp(a, b) and cmp(b, a) return
+1.
+
+This can lead to undefined or incorrect ordering results. Fix it by
+updating the comparison logic to explicitly handle the case when counts
+are equal, and use cmp_int() to ensure the comparison function adheres
+to the required mathematical properties of antisymmetry.
+
+Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces")
+Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/slub.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index d257141896c95..264fc76455d73 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -7731,10 +7731,7 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data)
+ struct location *loc1 = (struct location *)a;
+ struct location *loc2 = (struct location *)b;
+
+- if (loc1->count > loc2->count)
+- return -1;
+- else
+- return 1;
++ return cmp_int(loc2->count, loc1->count);
+ }
+
+ static void *slab_debugfs_start(struct seq_file *seq, loff_t *ppos)
+--
+2.51.0
+
--- /dev/null
+From 032ada895dae155952252d2b67efe54d77e2fb22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:06:05 +0200
+Subject: mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
+
+From: Bean Huo <beanhuo@micron.com>
+
+[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]
+
+Rename the inner 'frm' variable to 'resp_frm' in the write path of
+mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.
+
+The function declares 'frm' at function scope pointing to the request
+frame, but then redeclares another 'frm' variable inside the write
+block pointing to the response frame. This shadowing makes the code
+confusing and error-prone.
+
+Using 'resp_frm' for the response frame makes the distinction clear
+and improves code readability.
+
+Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 9cc47bf94804b..dd6cffc0df729 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2936,15 +2936,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
+ return -ENOMEM;
+
+ if (write) {
+- struct rpmb_frame *frm = (struct rpmb_frame *)resp;
++ struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
+
+ /* Send write request frame(s) */
+ set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
+ 1 | MMC_CMD23_ARG_REL_WR, req, req_len);
+
+ /* Send result request frame */
+- memset(frm, 0, sizeof(*frm));
+- frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
++ memset(resp_frm, 0, sizeof(*resp_frm));
++ resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
+ set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
+ resp_len);
+
+--
+2.51.0
+
--- /dev/null
+From d2ff8a2336be63db213127372668b1d3efad56e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:33:16 +0300
+Subject: mmc: select REGMAP_MMIO with MMC_LOONGSON2
+
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+
+[ Upstream commit 67da3f16e5f97a864a0beb4f9758d09e1890a76e ]
+
+COMPILE_TEST with MMC_LOONGSON2 failed to link due to
+undeclared dependency:
+
+ERROR: modpost: "__devm_regmap_init_mmio_clk"
+[drivers/mmc/host/loongson2-mmc.ko] undefined!
+
+Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver")
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Suggested-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 7232de1c06887..5cc415ba4f550 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1115,6 +1115,7 @@ config MMC_LOONGSON2
+ tristate "Loongson-2K SD/SDIO/eMMC Host Interface support"
+ depends on LOONGARCH || COMPILE_TEST
+ depends on HAS_DMA
++ select REGMAP_MMIO
+ help
+ This selects support for the SD/SDIO/eMMC Host Controller on
+ Loongson-2K series CPUs.
+--
+2.51.0
+
--- /dev/null
+From e50a6ebf2d313dee86ab6768f981a15886d29367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:24 +0000
+Subject: mptcp: Call dst_release() in mptcp_active_enable().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 108a86c71c93ff28087994e6107bc99ebe336629 ]
+
+mptcp_active_enable() calls sk_dst_get(), which returns dst with its
+refcount bumped, but forgot dst_release().
+
+Let's add missing dst_release().
+
+Cc: stable@vger.kernel.org
+Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-7-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 893c49a78d9f ("mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/ctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
+index fed40dae5583a..c0e516872b4b5 100644
+--- a/net/mptcp/ctrl.c
++++ b/net/mptcp/ctrl.c
+@@ -505,6 +505,8 @@ void mptcp_active_enable(struct sock *sk)
+
+ if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))
+ atomic_set(&pernet->active_disable_times, 0);
++
++ dst_release(dst);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2ab9a9c91241d32bec41a7cba7c0466411f5ad60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:09 +0000
+Subject: mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 68889dfd547bd8eabc5a98b58475d7b901cf5129 ]
+
+When sk_alloc() allocates a socket, mem_cgroup_sk_alloc() sets
+sk->sk_memcg based on the current task.
+
+MPTCP subflow socket creation is triggered from userspace or
+an in-kernel worker.
+
+In the latter case, sk->sk_memcg is not what we want. So, we fix
+it up from the parent socket's sk->sk_memcg in mptcp_attach_cgroup().
+
+Although the code is placed under #ifdef CONFIG_MEMCG, it is buried
+under #ifdef CONFIG_SOCK_CGROUP_DATA.
+
+The two configs are orthogonal. If CONFIG_MEMCG is enabled without
+CONFIG_SOCK_CGROUP_DATA, the subflow's memory usage is not charged
+correctly.
+
+Let's move the code out of the wrong ifdef guard.
+
+Note that sk->sk_memcg is freed in sk_prot_free() and the parent
+sk holds the refcnt of memcg->css here, so we don't need to use
+css_tryget().
+
+Fixes: 3764b0c5651e3 ("mptcp: attach subflow socket to parent cgroup")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-2-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/memcontrol.h | 6 ++++++
+ mm/memcontrol.c | 13 +++++++++++++
+ net/mptcp/subflow.c | 11 +++--------
+ 3 files changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index 785173aa0739c..25921fbec6856 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -1604,6 +1604,7 @@ extern struct static_key_false memcg_sockets_enabled_key;
+ #define mem_cgroup_sockets_enabled static_branch_unlikely(&memcg_sockets_enabled_key)
+ void mem_cgroup_sk_alloc(struct sock *sk);
+ void mem_cgroup_sk_free(struct sock *sk);
++void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk);
+
+ #if BITS_PER_LONG < 64
+ static inline void mem_cgroup_set_socket_pressure(struct mem_cgroup *memcg)
+@@ -1661,6 +1662,11 @@ void reparent_shrinker_deferred(struct mem_cgroup *memcg);
+ #define mem_cgroup_sockets_enabled 0
+ static inline void mem_cgroup_sk_alloc(struct sock *sk) { };
+ static inline void mem_cgroup_sk_free(struct sock *sk) { };
++
++static inline void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk)
++{
++}
++
+ static inline bool mem_cgroup_under_socket_pressure(struct mem_cgroup *memcg)
+ {
+ return false;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 8dd7fbed5a942..46713b9ece063 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5024,6 +5024,19 @@ void mem_cgroup_sk_free(struct sock *sk)
+ css_put(&sk->sk_memcg->css);
+ }
+
++void mem_cgroup_sk_inherit(const struct sock *sk, struct sock *newsk)
++{
++ if (sk->sk_memcg == newsk->sk_memcg)
++ return;
++
++ mem_cgroup_sk_free(newsk);
++
++ if (sk->sk_memcg)
++ css_get(&sk->sk_memcg->css);
++
++ newsk->sk_memcg = sk->sk_memcg;
++}
++
+ /**
+ * mem_cgroup_charge_skmem - charge socket memory
+ * @memcg: memcg to charge
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index f31a3a79531a2..e8325890a3223 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -1721,19 +1721,14 @@ static void mptcp_attach_cgroup(struct sock *parent, struct sock *child)
+ /* only the additional subflows created by kworkers have to be modified */
+ if (cgroup_id(sock_cgroup_ptr(parent_skcd)) !=
+ cgroup_id(sock_cgroup_ptr(child_skcd))) {
+-#ifdef CONFIG_MEMCG
+- struct mem_cgroup *memcg = parent->sk_memcg;
+-
+- mem_cgroup_sk_free(child);
+- if (memcg && css_tryget(&memcg->css))
+- child->sk_memcg = memcg;
+-#endif /* CONFIG_MEMCG */
+-
+ cgroup_sk_free(child_skcd);
+ *child_skcd = *parent_skcd;
+ cgroup_sk_clone(child_skcd);
+ }
+ #endif /* CONFIG_SOCK_CGROUP_DATA */
++
++ if (mem_cgroup_sockets_enabled)
++ mem_cgroup_sk_inherit(parent, child);
+ }
+
+ static void mptcp_subflow_ops_override(struct sock *ssk)
+--
+2.51.0
+
--- /dev/null
+From 5141c48379e7203a433d5300b29025af3b194864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:25 +0000
+Subject: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 893c49a78d9f85e4b8081b908fb7c407d018106a ]
+
+mptcp_active_enable() is called from subflow_finish_connect(),
+which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
+under RCU.
+
+Using sk_dst_get(sk)->dev could trigger UAF.
+
+Let's use __sk_dst_get() and dst_dev_rcu().
+
+Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/ctrl.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
+index c0e516872b4b5..e8ffa62ec183f 100644
+--- a/net/mptcp/ctrl.c
++++ b/net/mptcp/ctrl.c
+@@ -501,12 +501,15 @@ void mptcp_active_enable(struct sock *sk)
+ struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk));
+
+ if (atomic_read(&pernet->active_disable_times)) {
+- struct dst_entry *dst = sk_dst_get(sk);
++ struct net_device *dev;
++ struct dst_entry *dst;
+
+- if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))
++ rcu_read_lock();
++ dst = __sk_dst_get(sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ if (dev && (dev->flags & IFF_LOOPBACK))
+ atomic_set(&pernet->active_disable_times, 0);
+-
+- dst_release(dst);
++ rcu_read_unlock();
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 24caca85637c6d46a1ab0047919eaeb0b089f310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:07:27 +0300
+Subject: mtd: rawnand: atmel: Fix error handling path in
+ atmel_nand_controller_add_nands
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
+
+In case of a jump to the err label due to atmel_nand_create() or
+atmel_nand_controller_add_nand() failure, the reference to nand_np
+need to be released
+
+Use for_each_child_of_node_scoped() to fix the issue.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index db94d14a3807f..49e00458eebeb 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
+
+ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+ {
+- struct device_node *np, *nand_np;
++ struct device_node *np;
+ struct device *dev = nc->dev;
+ int ret, reg_cells;
+ u32 val;
+@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ reg_cells += val;
+
+- for_each_child_of_node(np, nand_np) {
++ for_each_child_of_node_scoped(np, nand_np) {
+ struct atmel_nand *nand;
+
+ nand = atmel_nand_create(nc, nand_np, reg_cells);
+--
+2.51.0
+
--- /dev/null
+From 68ed2102e5f4590c65a4c299d96aecdd754cbadc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:22:43 +0000
+Subject: nbd: restrict sockets to TCP and UDP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
+
+Recently, syzbot started to abuse NBD with all kinds of sockets.
+
+Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
+made sure the socket supported a shutdown() method.
+
+Explicitely accept TCP and UNIX stream sockets.
+
+Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
+Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Richard W.M. Jones <rjones@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Yu Kuai <yukuai1@huaweicloud.com>
+Cc: linux-block@vger.kernel.org
+Cc: nbd@other.debian.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 6463d0e8d0cef..87b0b78249da3 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (!sock)
+ return NULL;
+
++ if (!sk_is_tcp(sock->sk) &&
++ !sk_is_stream_unix(sock->sk)) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
++ *err = -EINVAL;
++ sockfd_put(sock);
++ return NULL;
++ }
++
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 92645982a7d9b34632e357ed2ac4f3a33aff8865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index 6bbf6e5584e54..1996d2e4e3e2c 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -964,15 +964,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From 67854d8be06cbb29db1e97d2d92410f208bd1bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:16 +0000
+Subject: net: dst: introduce dst->dev_rcu
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit caedcc5b6df1b2e2b5f39079e3369c1d4d5c5f50 ]
+
+Followup of commit 88fe14253e18 ("net: dst: add four helpers
+to annotate data-races around dst->dev").
+
+We want to gradually add explicit RCU protection to dst->dev,
+including lockdep support.
+
+Add an union to alias dst->dev_rcu and dst->dev.
+
+Add dst_dev_net_rcu() helper.
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/dst.h | 16 +++++++++++-----
+ net/core/dst.c | 2 +-
+ net/ipv4/route.c | 4 ++--
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/include/net/dst.h b/include/net/dst.h
+index bab01363bb975..f8aa1239b4db6 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -24,7 +24,10 @@
+ struct sk_buff;
+
+ struct dst_entry {
+- struct net_device *dev;
++ union {
++ struct net_device *dev;
++ struct net_device __rcu *dev_rcu;
++ };
+ struct dst_ops *ops;
+ unsigned long _metrics;
+ unsigned long expires;
+@@ -570,9 +573,12 @@ static inline struct net_device *dst_dev(const struct dst_entry *dst)
+
+ static inline struct net_device *dst_dev_rcu(const struct dst_entry *dst)
+ {
+- /* In the future, use rcu_dereference(dst->dev) */
+- WARN_ON_ONCE(!rcu_read_lock_held());
+- return READ_ONCE(dst->dev);
++ return rcu_dereference(dst->dev_rcu);
++}
++
++static inline struct net *dst_dev_net_rcu(const struct dst_entry *dst)
++{
++ return dev_net_rcu(dst_dev_rcu(dst));
+ }
+
+ static inline struct net_device *skb_dst_dev(const struct sk_buff *skb)
+@@ -592,7 +598,7 @@ static inline struct net *skb_dst_dev_net(const struct sk_buff *skb)
+
+ static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb)
+ {
+- return dev_net_rcu(skb_dst_dev(skb));
++ return dev_net_rcu(skb_dst_dev_rcu(skb));
+ }
+
+ struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie);
+diff --git a/net/core/dst.c b/net/core/dst.c
+index e2de8b68c41d3..e9d35f49c9e78 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -150,7 +150,7 @@ void dst_dev_put(struct dst_entry *dst)
+ dst->ops->ifdown(dst, dev);
+ WRITE_ONCE(dst->input, dst_discard);
+ WRITE_ONCE(dst->output, dst_discard_out);
+- WRITE_ONCE(dst->dev, blackhole_netdev);
++ rcu_assign_pointer(dst->dev_rcu, blackhole_netdev);
+ netdev_ref_replace(dev, blackhole_netdev, &dst->dev_tracker,
+ GFP_ATOMIC);
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index baa43e5966b19..97b96275a775d 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1026,7 +1026,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ return;
+
+ rcu_read_lock();
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+ if (mtu < net->ipv4.ip_rt_min_pmtu) {
+ lock = true;
+ mtu = min(old_mtu, net->ipv4.ip_rt_min_pmtu);
+@@ -1326,7 +1326,7 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
+ struct net *net;
+
+ rcu_read_lock();
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+ advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
+ net->ipv4.ip_rt_min_advmss);
+ rcu_read_unlock();
+--
+2.51.0
+
--- /dev/null
+From 7f8834df58f24299bb9e62c4e90d09568439317e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index a81d3a7a3bb9a..fe3479b84a1f3 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -865,7 +865,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From 6a68ae06c9869e28eabd9f35858061b7004cc218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:27:55 +0800
+Subject: net: enetc: Fix probing error message typo for the ENETCv4 PF driver
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit c35cf24a69b00b7f54f2f19838f2b82d54480b0f ]
+
+Blamed commit wrongly indicates VF error in case of PF probing error.
+
+Fixes: 99100d0d9922 ("net: enetc: add preliminary support for i.MX95 ENETC PF")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250924082755.1984798-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc4_pf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+index b3dc1afeefd1d..a5c1f1cef3b0c 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc4_pf.c
+@@ -1030,7 +1030,7 @@ static int enetc4_pf_probe(struct pci_dev *pdev,
+ err = enetc_get_driver_data(si);
+ if (err)
+ return dev_err_probe(dev, err,
+- "Could not get VF driver data\n");
++ "Could not get PF driver data\n");
+
+ err = enetc4_pf_struct_init(si);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From 9c83b1cbaf3d2e3fe265f8859b616b6b2763b8c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:39:53 +0800
+Subject: net: enetc: initialize SW PIR and CIR based HW PIR and CIR values
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 2aff4420efc2910e905ee5b000e04e87422aebc4 ]
+
+Software can only initialize the PIR and CIR of the command BD ring after
+a FLR, and these two registers can only be set to 0. But the reset values
+of these two registers are 0, so software does not need to update them.
+If there is no a FLR and PIR and CIR are not 0, resetting them to 0 or
+other values by software will cause the command BD ring to work
+abnormally. This is because of an internal context in the ring prefetch
+logic that will retain the state from the first incarnation of the ring
+and continue prefetching from the stale location when the ring is
+reinitialized. The internal context can only be reset by the FLR.
+
+In addition, there is a logic error in the implementation, next_to_clean
+indicates the software CIR and next_to_use indicates the software PIR.
+But the current driver uses next_to_clean to set PIR and use next_to_use
+to set CIR. This does not cause a problem in actual use, because the
+current command BD ring is only initialized after FLR, and the initial
+values of next_to_use and next_to_clean are both 0.
+
+Therefore, this patch removes the initialization of PIR and CIR. Instead,
+next_to_use and next_to_clean are initialized by reading the values of
+PIR and CIR.
+
+Fixes: 4701073c3deb ("net: enetc: add initial netc-lib driver to support NTMP")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Link: https://patch.msgid.link/20250926013954.2003456-1-wei.fang@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/ntmp.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/ntmp.c b/drivers/net/ethernet/freescale/enetc/ntmp.c
+index ba32c1bbd9e18..0c1d343253bfb 100644
+--- a/drivers/net/ethernet/freescale/enetc/ntmp.c
++++ b/drivers/net/ethernet/freescale/enetc/ntmp.c
+@@ -52,24 +52,19 @@ int ntmp_init_cbdr(struct netc_cbdr *cbdr, struct device *dev,
+ cbdr->addr_base_align = PTR_ALIGN(cbdr->addr_base,
+ NTMP_BASE_ADDR_ALIGN);
+
+- cbdr->next_to_clean = 0;
+- cbdr->next_to_use = 0;
+ spin_lock_init(&cbdr->ring_lock);
+
++ cbdr->next_to_use = netc_read(cbdr->regs.pir);
++ cbdr->next_to_clean = netc_read(cbdr->regs.cir);
++
+ /* Step 1: Configure the base address of the Control BD Ring */
+ netc_write(cbdr->regs.bar0, lower_32_bits(cbdr->dma_base_align));
+ netc_write(cbdr->regs.bar1, upper_32_bits(cbdr->dma_base_align));
+
+- /* Step 2: Configure the producer index register */
+- netc_write(cbdr->regs.pir, cbdr->next_to_clean);
+-
+- /* Step 3: Configure the consumer index register */
+- netc_write(cbdr->regs.cir, cbdr->next_to_use);
+-
+- /* Step4: Configure the number of BDs of the Control BD Ring */
++ /* Step 2: Configure the number of BDs of the Control BD Ring */
+ netc_write(cbdr->regs.lenr, cbdr->bd_num);
+
+- /* Step 5: Enable the Control BD Ring */
++ /* Step 3: Enable the Control BD Ring */
+ netc_write(cbdr->regs.mr, NETC_CBDR_MR_EN);
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 3955c8a38753c7d000dde49b5b7052eb3d6a0c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:19:24 -0700
+Subject: net: ethtool: tsconfig: set command must provide a reply
+
+From: Vadim Fedorenko <vadfed@meta.com>
+
+[ Upstream commit e8ab231782e92bc26e5eb605263525636a2f7ae7 ]
+
+Timestamping configuration through ethtool has inconsistent behavior of
+skipping the reply for set command if configuration was not changed. Fix
+it be providing reply in any case.
+
+Fixes: 6e9e2eed4f39d ("net: ethtool: Add support for tsconfig command to get/set hwtstamp config")
+Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20250922231924.2769571-1-vadfed@meta.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/tsconfig.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/net/ethtool/tsconfig.c b/net/ethtool/tsconfig.c
+index 2be356bdfe873..169b413b31fc5 100644
+--- a/net/ethtool/tsconfig.c
++++ b/net/ethtool/tsconfig.c
+@@ -423,13 +423,11 @@ static int ethnl_set_tsconfig(struct ethnl_req_info *req_base,
+ return ret;
+ }
+
+- if (hwprov_mod || config_mod) {
+- ret = tsconfig_send_reply(dev, info);
+- if (ret && ret != -EOPNOTSUPP) {
+- NL_SET_ERR_MSG(info->extack,
+- "error while reading the new configuration set");
+- return ret;
+- }
++ ret = tsconfig_send_reply(dev, info);
++ if (ret && ret != -EOPNOTSUPP) {
++ NL_SET_ERR_MSG(info->extack,
++ "error while reading the new configuration set");
++ return ret;
+ }
+
+ /* tsconfig has no notification */
+--
+2.51.0
+
--- /dev/null
+From 61c9b7da6d3448e38fe9301d8129d3cca5b85f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:25 +0200
+Subject: net: macb: move ring size computation to functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 92d4256fafd8d0a14d3aaa10452ac771bf9b597c ]
+
+The tx/rx ring size calculation is somewhat complex and partially hidden
+behind a macro. Move that out of the {RX,TX}_RING_BYTES() macros and
+macb_{alloc,free}_consistent() functions into neat separate functions.
+
+In macb_free_consistent(), we drop the size variable and directly call
+the size helpers in the arguments list. In macb_alloc_consistent(), we
+keep the size variable that is used by netdev_dbg() calls.
+
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-3-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 78d901897b3c ("net: macb: single dma_alloc_coherent() for DMA descriptors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 27 ++++++++++++++----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 3e634049dadf1..73840808ea801 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -51,14 +51,10 @@ struct sifive_fu540_macb_mgmt {
+ #define DEFAULT_RX_RING_SIZE 512 /* must be power of 2 */
+ #define MIN_RX_RING_SIZE 64
+ #define MAX_RX_RING_SIZE 8192
+-#define RX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \
+- * (bp)->rx_ring_size)
+
+ #define DEFAULT_TX_RING_SIZE 512 /* must be power of 2 */
+ #define MIN_TX_RING_SIZE 64
+ #define MAX_TX_RING_SIZE 4096
+-#define TX_RING_BYTES(bp) (macb_dma_desc_get_size(bp) \
+- * (bp)->tx_ring_size)
+
+ /* level of occupied TX descriptors under which we wake up TX process */
+ #define MACB_TX_WAKEUP_THRESH(bp) (3 * (bp)->tx_ring_size / 4)
+@@ -2470,11 +2466,20 @@ static void macb_free_rx_buffers(struct macb *bp)
+ }
+ }
+
++static unsigned int macb_tx_ring_size_per_queue(struct macb *bp)
++{
++ return macb_dma_desc_get_size(bp) * bp->tx_ring_size + bp->tx_bd_rd_prefetch;
++}
++
++static unsigned int macb_rx_ring_size_per_queue(struct macb *bp)
++{
++ return macb_dma_desc_get_size(bp) * bp->rx_ring_size + bp->rx_bd_rd_prefetch;
++}
++
+ static void macb_free_consistent(struct macb *bp)
+ {
+ struct macb_queue *queue;
+ unsigned int q;
+- int size;
+
+ if (bp->rx_ring_tieoff) {
+ dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp),
+@@ -2488,14 +2493,14 @@ static void macb_free_consistent(struct macb *bp)
+ kfree(queue->tx_skb);
+ queue->tx_skb = NULL;
+ if (queue->tx_ring) {
+- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
+- dma_free_coherent(&bp->pdev->dev, size,
++ dma_free_coherent(&bp->pdev->dev,
++ macb_tx_ring_size_per_queue(bp),
+ queue->tx_ring, queue->tx_ring_dma);
+ queue->tx_ring = NULL;
+ }
+ if (queue->rx_ring) {
+- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+- dma_free_coherent(&bp->pdev->dev, size,
++ dma_free_coherent(&bp->pdev->dev,
++ macb_rx_ring_size_per_queue(bp),
+ queue->rx_ring, queue->rx_ring_dma);
+ queue->rx_ring = NULL;
+ }
+@@ -2546,7 +2551,7 @@ static int macb_alloc_consistent(struct macb *bp)
+ int size;
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+- size = TX_RING_BYTES(bp) + bp->tx_bd_rd_prefetch;
++ size = macb_tx_ring_size_per_queue(bp);
+ queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+ &queue->tx_ring_dma,
+ GFP_KERNEL);
+@@ -2564,7 +2569,7 @@ static int macb_alloc_consistent(struct macb *bp)
+ if (!queue->tx_skb)
+ goto out_err;
+
+- size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
++ size = macb_rx_ring_size_per_queue(bp);
+ queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+ &queue->rx_ring_dma,
+ GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 3a4a8598e47711026268db66bfcba6426f340ae0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:24 +0200
+Subject: net: macb: remove illusion about TBQPH/RBQPH being per-queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit fca3dc859b200ca4dcdd2124beaf3bb2ab80b0f7 ]
+
+The MACB driver acts as if TBQPH/RBQPH are configurable on a per queue
+basis; this is a lie. A single register configures the upper 32 bits of
+each DMA descriptor buffers for all queues.
+
+Concrete actions:
+
+ - Drop GEM_TBQPH/GEM_RBQPH macros which have a queue index argument.
+ Only use MACB_TBQPH/MACB_RBQPH constants.
+
+ - Drop struct macb_queue->TBQPH/RBQPH fields.
+
+ - In macb_init_buffers(): do a single write to TBQPH and RBQPH for all
+ queues instead of a write per queue.
+
+ - In macb_tx_error_task(): drop the write to TBQPH.
+
+ - In macb_alloc_consistent(): if allocations give different upper
+ 32-bits, fail. Previously, it would have lead to silent memory
+ corruption as queues would have used the upper 32 bits of the alloc
+ from queue 0 and their own low 32 bits.
+
+ - In macb_suspend(): if we use the tie off descriptor for suspend, do
+ the write once for all queues instead of once per queue.
+
+Fixes: fff8019a08b6 ("net: macb: Add 64 bit addressing support for GEM")
+Fixes: ae1f2a56d273 ("net: macb: Added support for many RX queues")
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-2-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb.h | 4 --
+ drivers/net/ethernet/cadence/macb_main.c | 57 ++++++++++--------------
+ 2 files changed, 24 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
+index c9a5c8beb2fa8..a7e845fee4b3a 100644
+--- a/drivers/net/ethernet/cadence/macb.h
++++ b/drivers/net/ethernet/cadence/macb.h
+@@ -213,10 +213,8 @@
+
+ #define GEM_ISR(hw_q) (0x0400 + ((hw_q) << 2))
+ #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2))
+-#define GEM_TBQPH(hw_q) (0x04C8)
+ #define GEM_RBQP(hw_q) (0x0480 + ((hw_q) << 2))
+ #define GEM_RBQS(hw_q) (0x04A0 + ((hw_q) << 2))
+-#define GEM_RBQPH(hw_q) (0x04D4)
+ #define GEM_IER(hw_q) (0x0600 + ((hw_q) << 2))
+ #define GEM_IDR(hw_q) (0x0620 + ((hw_q) << 2))
+ #define GEM_IMR(hw_q) (0x0640 + ((hw_q) << 2))
+@@ -1214,10 +1212,8 @@ struct macb_queue {
+ unsigned int IDR;
+ unsigned int IMR;
+ unsigned int TBQP;
+- unsigned int TBQPH;
+ unsigned int RBQS;
+ unsigned int RBQP;
+- unsigned int RBQPH;
+
+ /* Lock to protect tx_head and tx_tail */
+ spinlock_t tx_ptr_lock;
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index c769b7dbd3baf..3e634049dadf1 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -495,19 +495,19 @@ static void macb_init_buffers(struct macb *bp)
+ struct macb_queue *queue;
+ unsigned int q;
+
+- for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+- queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma));
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
+- queue_writel(queue, RBQPH,
+- upper_32_bits(queue->rx_ring_dma));
++ /* Single register for all queues' high 32 bits. */
++ if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
++ macb_writel(bp, RBQPH,
++ upper_32_bits(bp->queues[0].rx_ring_dma));
++ macb_writel(bp, TBQPH,
++ upper_32_bits(bp->queues[0].tx_ring_dma));
++ }
+ #endif
++
++ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
++ queue_writel(queue, RBQP, lower_32_bits(queue->rx_ring_dma));
+ queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
+-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
+- queue_writel(queue, TBQPH,
+- upper_32_bits(queue->tx_ring_dma));
+-#endif
+ }
+ }
+
+@@ -1166,10 +1166,6 @@ static void macb_tx_error_task(struct work_struct *work)
+
+ /* Reinitialize the TX desc queue */
+ queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
+-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- if (bp->hw_dma_cap & HW_DMA_CAP_64B)
+- queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
+-#endif
+ /* Make TX ring reflect state of hardware */
+ queue->tx_head = 0;
+ queue->tx_tail = 0;
+@@ -2546,6 +2542,7 @@ static int macb_alloc_consistent(struct macb *bp)
+ {
+ struct macb_queue *queue;
+ unsigned int q;
++ u32 upper;
+ int size;
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+@@ -2553,7 +2550,9 @@ static int macb_alloc_consistent(struct macb *bp)
+ queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+ &queue->tx_ring_dma,
+ GFP_KERNEL);
+- if (!queue->tx_ring)
++ upper = upper_32_bits(queue->tx_ring_dma);
++ if (!queue->tx_ring ||
++ upper != upper_32_bits(bp->queues[0].tx_ring_dma))
+ goto out_err;
+ netdev_dbg(bp->dev,
+ "Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n",
+@@ -2567,8 +2566,11 @@ static int macb_alloc_consistent(struct macb *bp)
+
+ size = RX_RING_BYTES(bp) + bp->rx_bd_rd_prefetch;
+ queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+- &queue->rx_ring_dma, GFP_KERNEL);
+- if (!queue->rx_ring)
++ &queue->rx_ring_dma,
++ GFP_KERNEL);
++ upper = upper_32_bits(queue->rx_ring_dma);
++ if (!queue->rx_ring ||
++ upper != upper_32_bits(bp->queues[0].rx_ring_dma))
+ goto out_err;
+ netdev_dbg(bp->dev,
+ "Allocated RX ring of %d bytes at %08lx (mapped %p)\n",
+@@ -4309,12 +4311,6 @@ static int macb_init(struct platform_device *pdev)
+ queue->TBQP = GEM_TBQP(hw_q - 1);
+ queue->RBQP = GEM_RBQP(hw_q - 1);
+ queue->RBQS = GEM_RBQS(hw_q - 1);
+-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+- queue->TBQPH = GEM_TBQPH(hw_q - 1);
+- queue->RBQPH = GEM_RBQPH(hw_q - 1);
+- }
+-#endif
+ } else {
+ /* queue0 uses legacy registers */
+ queue->ISR = MACB_ISR;
+@@ -4323,12 +4319,6 @@ static int macb_init(struct platform_device *pdev)
+ queue->IMR = MACB_IMR;
+ queue->TBQP = MACB_TBQP;
+ queue->RBQP = MACB_RBQP;
+-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- if (bp->hw_dma_cap & HW_DMA_CAP_64B) {
+- queue->TBQPH = MACB_TBQPH;
+- queue->RBQPH = MACB_RBQPH;
+- }
+-#endif
+ }
+
+ /* get irq: here we use the linux queue index, not the hardware
+@@ -5452,6 +5442,11 @@ static int __maybe_unused macb_suspend(struct device *dev)
+ */
+ tmp = macb_readl(bp, NCR);
+ macb_writel(bp, NCR, tmp & ~(MACB_BIT(TE) | MACB_BIT(RE)));
++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
++ if (!(bp->caps & MACB_CAPS_QUEUE_DISABLE))
++ macb_writel(bp, RBQPH,
++ upper_32_bits(bp->rx_ring_tieoff_dma));
++#endif
+ for (q = 0, queue = bp->queues; q < bp->num_queues;
+ ++q, ++queue) {
+ /* Disable RX queues */
+@@ -5461,10 +5456,6 @@ static int __maybe_unused macb_suspend(struct device *dev)
+ /* Tie off RX queues */
+ queue_writel(queue, RBQP,
+ lower_32_bits(bp->rx_ring_tieoff_dma));
+-#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+- queue_writel(queue, RBQPH,
+- upper_32_bits(bp->rx_ring_tieoff_dma));
+-#endif
+ }
+ /* Disable all interrupts */
+ queue_writel(queue, IDR, -1);
+--
+2.51.0
+
--- /dev/null
+From b916dc5557d57c9bb9ea81f0a89104c160beb6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:26 +0200
+Subject: net: macb: single dma_alloc_coherent() for DMA descriptors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 78d901897b3cae06b38f54e48a2378cf9da21175 ]
+
+Move from 2*NUM_QUEUES dma_alloc_coherent() for DMA descriptor rings to
+2 calls overall.
+
+Issue is with how all queues share the same register for configuring the
+upper 32-bits of Tx/Rx descriptor rings. Taking Tx, notice how TBQPH
+does *not* depend on the queue index:
+
+ #define GEM_TBQP(hw_q) (0x0440 + ((hw_q) << 2))
+ #define GEM_TBQPH(hw_q) (0x04C8)
+
+ queue_writel(queue, TBQP, lower_32_bits(queue->tx_ring_dma));
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+ if (bp->hw_dma_cap & HW_DMA_CAP_64B)
+ queue_writel(queue, TBQPH, upper_32_bits(queue->tx_ring_dma));
+ #endif
+
+To maximise our chances of getting valid DMA addresses, we do a single
+dma_alloc_coherent() across queues. This improves the odds because
+alloc_pages() guarantees natural alignment. Other codepaths (IOMMU or
+dev/arch dma_map_ops) don't give high enough guarantees
+(even page-aligned isn't enough).
+
+Two consideration:
+
+ - dma_alloc_coherent() gives us page alignment. Here we remove this
+ constraint meaning each queue's ring won't be page-aligned anymore.
+
+ - This can save some tiny amounts of memory. Fewer allocations means
+ (1) less overhead (constant cost per alloc) and (2) less wasted bytes
+ due to alignment constraints.
+
+ Example for (2): 4 queues, default ring size (512), 64-bit DMA
+ descriptors, 16K pages:
+ - Before: 8 allocs of 8K, each rounded to 16K => 64K wasted.
+ - After: 2 allocs of 32K => 0K wasted.
+
+Fixes: 02c958dd3446 ("net/macb: add TX multiqueue support for gem")
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Tested-by: Nicolas Ferre <nicolas.ferre@microchip.com> # on sam9x75
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-4-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 80 ++++++++++++------------
+ 1 file changed, 41 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 73840808ea801..fc082a7a5a313 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2478,32 +2478,30 @@ static unsigned int macb_rx_ring_size_per_queue(struct macb *bp)
+
+ static void macb_free_consistent(struct macb *bp)
+ {
++ struct device *dev = &bp->pdev->dev;
+ struct macb_queue *queue;
+ unsigned int q;
++ size_t size;
+
+ if (bp->rx_ring_tieoff) {
+- dma_free_coherent(&bp->pdev->dev, macb_dma_desc_get_size(bp),
++ dma_free_coherent(dev, macb_dma_desc_get_size(bp),
+ bp->rx_ring_tieoff, bp->rx_ring_tieoff_dma);
+ bp->rx_ring_tieoff = NULL;
+ }
+
+ bp->macbgem_ops.mog_free_rx_buffers(bp);
+
++ size = bp->num_queues * macb_tx_ring_size_per_queue(bp);
++ dma_free_coherent(dev, size, bp->queues[0].tx_ring, bp->queues[0].tx_ring_dma);
++
++ size = bp->num_queues * macb_rx_ring_size_per_queue(bp);
++ dma_free_coherent(dev, size, bp->queues[0].rx_ring, bp->queues[0].rx_ring_dma);
++
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+ kfree(queue->tx_skb);
+ queue->tx_skb = NULL;
+- if (queue->tx_ring) {
+- dma_free_coherent(&bp->pdev->dev,
+- macb_tx_ring_size_per_queue(bp),
+- queue->tx_ring, queue->tx_ring_dma);
+- queue->tx_ring = NULL;
+- }
+- if (queue->rx_ring) {
+- dma_free_coherent(&bp->pdev->dev,
+- macb_rx_ring_size_per_queue(bp),
+- queue->rx_ring, queue->rx_ring_dma);
+- queue->rx_ring = NULL;
+- }
++ queue->tx_ring = NULL;
++ queue->rx_ring = NULL;
+ }
+ }
+
+@@ -2545,41 +2543,45 @@ static int macb_alloc_rx_buffers(struct macb *bp)
+
+ static int macb_alloc_consistent(struct macb *bp)
+ {
++ struct device *dev = &bp->pdev->dev;
++ dma_addr_t tx_dma, rx_dma;
+ struct macb_queue *queue;
+ unsigned int q;
+- u32 upper;
+- int size;
++ void *tx, *rx;
++ size_t size;
++
++ /*
++ * Upper 32-bits of Tx/Rx DMA descriptor for each queues much match!
++ * We cannot enforce this guarantee, the best we can do is do a single
++ * allocation and hope it will land into alloc_pages() that guarantees
++ * natural alignment of physical addresses.
++ */
++
++ size = bp->num_queues * macb_tx_ring_size_per_queue(bp);
++ tx = dma_alloc_coherent(dev, size, &tx_dma, GFP_KERNEL);
++ if (!tx || upper_32_bits(tx_dma) != upper_32_bits(tx_dma + size - 1))
++ goto out_err;
++ netdev_dbg(bp->dev, "Allocated %zu bytes for %u TX rings at %08lx (mapped %p)\n",
++ size, bp->num_queues, (unsigned long)tx_dma, tx);
++
++ size = bp->num_queues * macb_rx_ring_size_per_queue(bp);
++ rx = dma_alloc_coherent(dev, size, &rx_dma, GFP_KERNEL);
++ if (!rx || upper_32_bits(rx_dma) != upper_32_bits(rx_dma + size - 1))
++ goto out_err;
++ netdev_dbg(bp->dev, "Allocated %zu bytes for %u RX rings at %08lx (mapped %p)\n",
++ size, bp->num_queues, (unsigned long)rx_dma, rx);
+
+ for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
+- size = macb_tx_ring_size_per_queue(bp);
+- queue->tx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+- &queue->tx_ring_dma,
+- GFP_KERNEL);
+- upper = upper_32_bits(queue->tx_ring_dma);
+- if (!queue->tx_ring ||
+- upper != upper_32_bits(bp->queues[0].tx_ring_dma))
+- goto out_err;
+- netdev_dbg(bp->dev,
+- "Allocated TX ring for queue %u of %d bytes at %08lx (mapped %p)\n",
+- q, size, (unsigned long)queue->tx_ring_dma,
+- queue->tx_ring);
++ queue->tx_ring = tx + macb_tx_ring_size_per_queue(bp) * q;
++ queue->tx_ring_dma = tx_dma + macb_tx_ring_size_per_queue(bp) * q;
++
++ queue->rx_ring = rx + macb_rx_ring_size_per_queue(bp) * q;
++ queue->rx_ring_dma = rx_dma + macb_rx_ring_size_per_queue(bp) * q;
+
+ size = bp->tx_ring_size * sizeof(struct macb_tx_skb);
+ queue->tx_skb = kmalloc(size, GFP_KERNEL);
+ if (!queue->tx_skb)
+ goto out_err;
+-
+- size = macb_rx_ring_size_per_queue(bp);
+- queue->rx_ring = dma_alloc_coherent(&bp->pdev->dev, size,
+- &queue->rx_ring_dma,
+- GFP_KERNEL);
+- upper = upper_32_bits(queue->rx_ring_dma);
+- if (!queue->rx_ring ||
+- upper != upper_32_bits(bp->queues[0].rx_ring_dma))
+- goto out_err;
+- netdev_dbg(bp->dev,
+- "Allocated RX ring of %d bytes at %08lx (mapped %p)\n",
+- size, (unsigned long)queue->rx_ring_dma, queue->rx_ring);
+ }
+ if (bp->macbgem_ops.mog_alloc_rx_buffers(bp))
+ goto out_err;
+--
+2.51.0
+
--- /dev/null
+From 9bd0fcadc4546ec5cd232f28f6069ce6def494f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:09 +0300
+Subject: net/mlx5: fw reset, add reset timeout work
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
+
+Add sync reset timeout to stop poll_sync_reset in case there was no
+reset done or abort event within timeout. Otherwise poll sync reset will
+just continue and in case of fw fatal error no health reporting will be
+done.
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 22995131824a0..89e399606877b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
+ struct work_struct reset_reload_work;
+ struct work_struct reset_now_work;
+ struct work_struct reset_abort_work;
++ struct delayed_work reset_timeout_work;
+ unsigned long reset_flags;
+ u8 reset_method;
+ struct timer_list timer;
+@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
+ return -EALREADY;
+ }
+
++ if (current_work() != &fw_reset->reset_timeout_work.work)
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ mlx5_stop_sync_reset_poll(dev);
+ if (poll_health)
+ mlx5_start_health_poll(dev);
+@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+ }
+ mlx5_stop_health_poll(dev, true);
+ mlx5_start_sync_reset_poll(dev);
++
++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
++ &fw_reset->reset_flags))
++ schedule_delayed_work(&fw_reset->reset_timeout_work,
++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
+ return 0;
+ }
+
+@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
+ }
+ }
+
++static void mlx5_sync_reset_timeout_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_fw_reset *fw_reset =
++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
++ struct mlx5_core_dev *dev = fw_reset->dev;
++
++ if (mlx5_sync_reset_clear_reset_requested(dev, true))
++ return;
++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
++}
++
+ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
+ cancel_work_sync(&fw_reset->reset_reload_work);
+ cancel_work_sync(&fw_reset->reset_now_work);
+ cancel_work_sync(&fw_reset->reset_abort_work);
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ }
+
+ static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
+@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
+ INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
+ INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
++ mlx5_sync_reset_timeout_work);
+
+ init_completion(&fw_reset->done);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 89eb26b97f6900e73d8c796889b4050f785c8778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:08 +0300
+Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
+ teardown
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
+
+The reclaim_pages_cmd() function sends a command to the firmware to
+reclaim pages if the command interface is active.
+
+A race condition can occur if the command interface goes down (e.g., due
+to a PCI error) while the mlx5_cmd_do() call is in flight. In this
+case, mlx5_cmd_do() will return an error. The original code would
+propagate this error immediately, bypassing the software-based page
+reclamation logic that is supposed to run when the command interface is
+down.
+
+Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
+that command interface is down. If this is the case, fall through to
+the software reclamation path. If the command failed for any another
+reason, or finished successfully, return as before.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 9bc9bd83c2324..cd68c4b2c0bf9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
++ int err;
+
+- if (!mlx5_cmd_is_down(dev))
+- return mlx5_cmd_do(dev, in, in_size, out, out_size);
++ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
++ if (err != -ENXIO)
++ return err;
+
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+--
+2.51.0
+
--- /dev/null
+From 46126896fea290f2eebaac5586fd8e603e15ad04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:07 +0300
+Subject: net/mlx5: Stop polling for command response if interface goes down
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
+
+Stop polling on firmware response to command in polling mode if the
+command interface got down. This situation can occur, for example, if a
+firmware fatal error is detected during polling.
+
+This change halts the polling process when the command interface goes
+down, preventing unnecessary waits.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index e395ef5f356eb..722282cebce9a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+ return;
+ }
+ cond_resched();
++ if (mlx5_cmd_is_down(dev)) {
++ ent->ret = -ENXIO;
++ return;
++ }
+ } while (time_before(jiffies, poll_end));
+
+ ent->ret = -ETIMEDOUT;
+@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 178c7f5e8e6880dcb15cd70f710bbf350a09c7bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 15:44:29 +0200
+Subject: net: phy: as21xxx: better handle PHY HW reset on soft-reboot
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit b4d5cd20507b252c746fa6971d82ac96f3b3e5b7 ]
+
+On soft-reboot, with a reset GPIO defined for an Aeonsemi PHY, the
+special match_phy_device fails to correctly identify that the PHY
+needs to load the firmware again.
+
+This is caused by the fact that PHY ID is read BEFORE the PHY reset
+GPIO (if present) is asserted, so we can be in the scenario where the
+phydev have the previous PHY ID (with the PHY firmware loaded) but
+after reset the generic AS21xxx PHY is present in the PHY ID registers.
+
+To better handle this, skip reading the PHY ID register only for the PHY
+that are not AS21xxx (by matching for the Aeonsemi Vendor) and always
+read the PHY ID for the other case to handle both firmware already
+loaded or an HW reset.
+
+Fixes: 830877d89edc ("net: phy: Add support for Aeonsemi AS21xxx PHYs")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Link: https://patch.msgid.link/20250823134431.4854-2-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/as21xxx.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/as21xxx.c b/drivers/net/phy/as21xxx.c
+index 92697f43087dc..0052773606562 100644
+--- a/drivers/net/phy/as21xxx.c
++++ b/drivers/net/phy/as21xxx.c
+@@ -884,11 +884,12 @@ static int as21xxx_match_phy_device(struct phy_device *phydev,
+ u32 phy_id;
+ int ret;
+
+- /* Skip PHY that are not AS21xxx or already have firmware loaded */
+- if (phydev->c45_ids.device_ids[MDIO_MMD_PCS] != PHY_ID_AS21XXX)
++ /* Skip PHY that are not AS21xxx */
++ if (!phy_id_compare_vendor(phydev->c45_ids.device_ids[MDIO_MMD_PCS],
++ PHY_VENDOR_AEONSEMI))
+ return genphy_match_phy_device(phydev, phydrv);
+
+- /* Read PHY ID to handle firmware just loaded */
++ /* Read PHY ID to handle firmware loaded or HW reset */
+ ret = phy_read_mmd(phydev, MDIO_MMD_PCS, MII_PHYSID1);
+ if (ret < 0)
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 84685097936fcff585767d280a37ea3a06ac19ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 15:44:28 +0200
+Subject: net: phy: introduce phy_id_compare_vendor() PHY ID helper
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit 1abe21ef1adf0c5b6dbb5878c2fa4573df8d29fc ]
+
+Introduce phy_id_compare_vendor() PHY ID helper to compare a PHY ID with
+the PHY ID Vendor using the generic PHY ID Vendor mask.
+
+While at it also rework the PHY_ID_MATCH macro and move the mask to
+dedicated define so that PHY driver can make use of the mask if needed.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250823134431.4854-1-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: b4d5cd20507b ("net: phy: as21xxx: better handle PHY HW reset on soft-reboot")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/phy.h | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index bb45787d86848..04553419adc3f 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -1273,9 +1273,13 @@ struct phy_driver {
+ #define to_phy_driver(d) container_of_const(to_mdio_common_driver(d), \
+ struct phy_driver, mdiodrv)
+
+-#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 0)
+-#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 4)
+-#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = GENMASK(31, 10)
++#define PHY_ID_MATCH_EXTACT_MASK GENMASK(31, 0)
++#define PHY_ID_MATCH_MODEL_MASK GENMASK(31, 4)
++#define PHY_ID_MATCH_VENDOR_MASK GENMASK(31, 10)
++
++#define PHY_ID_MATCH_EXACT(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_EXTACT_MASK
++#define PHY_ID_MATCH_MODEL(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_MODEL_MASK
++#define PHY_ID_MATCH_VENDOR(id) .phy_id = (id), .phy_id_mask = PHY_ID_MATCH_VENDOR_MASK
+
+ /**
+ * phy_id_compare - compare @id1 with @id2 taking account of @mask
+@@ -1291,6 +1295,19 @@ static inline bool phy_id_compare(u32 id1, u32 id2, u32 mask)
+ return !((id1 ^ id2) & mask);
+ }
+
++/**
++ * phy_id_compare_vendor - compare @id with @vendor mask
++ * @id: PHY ID
++ * @vendor_mask: PHY Vendor mask
++ *
++ * Return: true if the bits from @id match @vendor using the
++ * generic PHY Vendor mask.
++ */
++static inline bool phy_id_compare_vendor(u32 id, u32 vendor_mask)
++{
++ return phy_id_compare(id, vendor_mask, PHY_ID_MATCH_VENDOR_MASK);
++}
++
+ /**
+ * phydev_id_compare - compare @id with the PHY's Clause 22 ID
+ * @phydev: the PHY device
+--
+2.51.0
+
--- /dev/null
+From a5f8f69796c0add9cff9a9bae42ed74be7bdf365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index ddff6f19ff98e..92add3daadbb1 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From de37fcccaea2abc58e36f82e0f321b15495785d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:20 +0000
+Subject: net: use dst_dev_rcu() in sk_setup_caps()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 99a2ace61b211b0be861b07fbaa062fca4b58879 ]
+
+Use RCU to protect accesses to dst->dev from sk_setup_caps()
+and sk_dst_gso_max_size().
+
+Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(),
+and ip_dst_mtu_maybe_forward().
+
+ip4_dst_hoplimit() can use dst_dev_net_rcu().
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-6-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip.h | 6 ++++--
+ include/net/ip6_route.h | 2 +-
+ include/net/route.h | 2 +-
+ net/core/sock.c | 16 ++++++++++------
+ 4 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/ip.h b/include/net/ip.h
+index befcba575129a..6dbd2bf8fa9c9 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -467,12 +467,14 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+ bool forwarding)
+ {
+ const struct rtable *rt = dst_rtable(dst);
++ const struct net_device *dev;
+ unsigned int mtu, res;
+ struct net *net;
+
+ rcu_read_lock();
+
+- net = dev_net_rcu(dst_dev(dst));
++ dev = dst_dev_rcu(dst);
++ net = dev_net_rcu(dev);
+ if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||
+ ip_mtu_locked(dst) ||
+ !forwarding) {
+@@ -486,7 +488,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+ if (mtu)
+ goto out;
+
+- mtu = READ_ONCE(dst_dev(dst)->mtu);
++ mtu = READ_ONCE(dev->mtu);
+
+ if (unlikely(ip_mtu_locked(dst))) {
+ if (rt->rt_uses_gateway && mtu > 576)
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 9255f21818ee7..59f48ca3abdf5 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -337,7 +337,7 @@ static inline unsigned int ip6_dst_mtu_maybe_forward(const struct dst_entry *dst
+
+ mtu = IPV6_MIN_MTU;
+ rcu_read_lock();
+- idev = __in6_dev_get(dst_dev(dst));
++ idev = __in6_dev_get(dst_dev_rcu(dst));
+ if (idev)
+ mtu = READ_ONCE(idev->cnf.mtu6);
+ rcu_read_unlock();
+diff --git a/include/net/route.h b/include/net/route.h
+index 7ea840daa775b..c916bbe25a774 100644
+--- a/include/net/route.h
++++ b/include/net/route.h
+@@ -390,7 +390,7 @@ static inline int ip4_dst_hoplimit(const struct dst_entry *dst)
+ const struct net *net;
+
+ rcu_read_lock();
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+ hoplimit = READ_ONCE(net->ipv4.sysctl_ip_default_ttl);
+ rcu_read_unlock();
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 158bddd23134c..e21348ead7e76 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2584,7 +2584,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ }
+ EXPORT_SYMBOL_GPL(sk_clone_lock);
+
+-static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
++static u32 sk_dst_gso_max_size(struct sock *sk, const struct net_device *dev)
+ {
+ bool is_ipv6 = false;
+ u32 max_size;
+@@ -2594,8 +2594,8 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
+ !ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr));
+ #endif
+ /* pairs with the WRITE_ONCE() in netif_set_gso(_ipv4)_max_size() */
+- max_size = is_ipv6 ? READ_ONCE(dst_dev(dst)->gso_max_size) :
+- READ_ONCE(dst_dev(dst)->gso_ipv4_max_size);
++ max_size = is_ipv6 ? READ_ONCE(dev->gso_max_size) :
++ READ_ONCE(dev->gso_ipv4_max_size);
+ if (max_size > GSO_LEGACY_MAX_SIZE && !sk_is_tcp(sk))
+ max_size = GSO_LEGACY_MAX_SIZE;
+
+@@ -2604,9 +2604,12 @@ static u32 sk_dst_gso_max_size(struct sock *sk, struct dst_entry *dst)
+
+ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
+ {
++ const struct net_device *dev;
+ u32 max_segs = 1;
+
+- sk->sk_route_caps = dst_dev(dst)->features;
++ rcu_read_lock();
++ dev = dst_dev_rcu(dst);
++ sk->sk_route_caps = dev->features;
+ if (sk_is_tcp(sk)) {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+
+@@ -2622,13 +2625,14 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
+ sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
+ } else {
+ sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
+- sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dst);
++ sk->sk_gso_max_size = sk_dst_gso_max_size(sk, dev);
+ /* pairs with the WRITE_ONCE() in netif_set_gso_max_segs() */
+- max_segs = max_t(u32, READ_ONCE(dst_dev(dst)->gso_max_segs), 1);
++ max_segs = max_t(u32, READ_ONCE(dev->gso_max_segs), 1);
+ }
+ }
+ sk->sk_gso_max_segs = max_segs;
+ sk_dst_set(sk, dst);
++ rcu_read_unlock();
+ }
+ EXPORT_SYMBOL_GPL(sk_setup_caps);
+
+--
+2.51.0
+
--- /dev/null
+From 9180da0a9c2683b194506bdd7f8dbbfed424f5d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 5251524b96afa..5e4453e9ef8e7 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -63,7 +63,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From a121376ca6ffe07c802e2defd9209c900f75f5cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 07:27:09 +0000
+Subject: netfilter: nf_conntrack: do not skip entries in
+ /proc/net/nf_conntrack
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c5ba345b2d358b07cc4f07253ba1ada73e77d586 ]
+
+ct_seq_show() has an opportunistic garbage collector :
+
+if (nf_ct_should_gc(ct)) {
+ nf_ct_kill(ct);
+ goto release;
+}
+
+So if one nf_conn is killed there, next time ct_get_next() runs,
+we skip the following item in the bucket, even if it should have
+been displayed if gc did not take place.
+
+We can decrement st->skip_elems to tell ct_get_next() one of the items
+was removed from the chain.
+
+Fixes: 58e207e4983d ("netfilter: evict stale entries when user reads /proc/net/nf_conntrack")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_standalone.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 1f14ef0436c65..708b79380f047 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -317,6 +317,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
+ smp_acquire__after_ctrl_dep();
+
+ if (nf_ct_should_gc(ct)) {
++ struct ct_iter_state *st = s->private;
++
++ st->skip_elems--;
+ nf_ct_kill(ct);
+ goto release;
+ }
+--
+2.51.0
+
--- /dev/null
+From 392fb615821862db3710c094117a9b23f5e9c7a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:40:43 +0200
+Subject: netfilter: nfnetlink: reset nlh pointer during batch replay
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 09efbac953f6f076a07735f9ba885148d4796235 ]
+
+During a batch replay, the nlh pointer is not reset until the parsing of
+the commands. Since commit bf2ac490d28c ("netfilter: nfnetlink: Handle
+ACK flags for batch messages") that is problematic as the condition to
+add an ACK for batch begin will evaluate to true even if NLM_F_ACK
+wasn't used for batch begin message.
+
+If there is an error during the command processing, netlink is sending
+an ACK despite that. This misleads userspace tools which think that the
+return code was 0. Reset the nlh pointer to the original one when a
+replay is triggered.
+
+Fixes: bf2ac490d28c ("netfilter: nfnetlink: Handle ACK flags for batch messages")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nfnetlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index e598a2a252b0a..811d02b4c4f7c 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -376,6 +376,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ const struct nfnetlink_subsystem *ss;
+ const struct nfnl_callback *nc;
+ struct netlink_ext_ack extack;
++ struct nlmsghdr *onlh = nlh;
+ LIST_HEAD(err_list);
+ u32 status;
+ int err;
+@@ -386,6 +387,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ status = 0;
+ replay_abort:
+ skb = netlink_skb_clone(oskb, GFP_KERNEL);
++ nlh = onlh;
+ if (!skb)
+ return netlink_ack(oskb, nlh, -ENOMEM, NULL);
+
+--
+2.51.0
+
--- /dev/null
+From 3a8f5d92e83c393ebf65eddb276e2077e46286b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index a36215195923c..16c828dd5c1a3 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1788,7 +1788,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From 7f818935051c3eefc1f3fb7cf4f2fb21d0700365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 10:36:26 -0400
+Subject: nfs/localio: avoid issuing misaligned IO using O_DIRECT
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 25ba2b84c38f624151a3ba36e56d41c39b9223ad ]
+
+Add nfsd_file_dio_alignment and use it to avoid issuing misaligned IO
+using O_DIRECT. Any misaligned DIO falls back to using buffered IO.
+
+Because misaligned DIO is now handled safely, remove the nfs modparam
+'localio_O_DIRECT_semantics' that was added to require users opt-in to
+the requirement that all O_DIRECT be properly DIO-aligned.
+
+Also, introduce nfs_iov_iter_aligned_bvec() which is a variant of
+iov_iter_aligned_bvec() that also verifies the offset associated with
+an iov_iter is DIO-aligned. NOTE: in a parallel effort,
+iov_iter_aligned_bvec() is being removed along with
+iov_iter_is_aligned().
+
+Lastly, add pr_info_ratelimited if underlying filesystem returns
+-EINVAL because it was made to try O_DIRECT for IO that is not
+DIO-aligned (shouldn't happen, so its best to be louder if it does).
+
+Fixes: 3feec68563d ("nfs/localio: add direct IO enablement with sync and async IO support")
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/localio.c | 65 ++++++++++++++++++++++++++++++++------
+ fs/nfsd/localio.c | 11 +++++++
+ include/linux/nfslocalio.h | 2 ++
+ 3 files changed, 68 insertions(+), 10 deletions(-)
+
+diff --git a/fs/nfs/localio.c b/fs/nfs/localio.c
+index 97abf62f109d2..31ce210f032ac 100644
+--- a/fs/nfs/localio.c
++++ b/fs/nfs/localio.c
+@@ -49,11 +49,6 @@ struct nfs_local_fsync_ctx {
+ static bool localio_enabled __read_mostly = true;
+ module_param(localio_enabled, bool, 0644);
+
+-static bool localio_O_DIRECT_semantics __read_mostly = false;
+-module_param(localio_O_DIRECT_semantics, bool, 0644);
+-MODULE_PARM_DESC(localio_O_DIRECT_semantics,
+- "LOCALIO will use O_DIRECT semantics to filesystem.");
+-
+ static inline bool nfs_client_is_local(const struct nfs_client *clp)
+ {
+ return !!rcu_access_pointer(clp->cl_uuid.net);
+@@ -321,12 +316,9 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr,
+ return NULL;
+ }
+
+- if (localio_O_DIRECT_semantics &&
+- test_bit(NFS_IOHDR_ODIRECT, &hdr->flags)) {
+- iocb->kiocb.ki_filp = file;
++ init_sync_kiocb(&iocb->kiocb, file);
++ if (test_bit(NFS_IOHDR_ODIRECT, &hdr->flags))
+ iocb->kiocb.ki_flags = IOCB_DIRECT;
+- } else
+- init_sync_kiocb(&iocb->kiocb, file);
+
+ iocb->kiocb.ki_pos = hdr->args.offset;
+ iocb->hdr = hdr;
+@@ -336,6 +328,30 @@ nfs_local_iocb_alloc(struct nfs_pgio_header *hdr,
+ return iocb;
+ }
+
++static bool nfs_iov_iter_aligned_bvec(const struct iov_iter *i,
++ loff_t offset, unsigned int addr_mask, unsigned int len_mask)
++{
++ const struct bio_vec *bvec = i->bvec;
++ size_t skip = i->iov_offset;
++ size_t size = i->count;
++
++ if ((offset | size) & len_mask)
++ return false;
++ do {
++ size_t len = bvec->bv_len;
++
++ if (len > size)
++ len = size;
++ if ((unsigned long)(bvec->bv_offset + skip) & addr_mask)
++ return false;
++ bvec++;
++ size -= len;
++ skip = 0;
++ } while (size);
++
++ return true;
++}
++
+ static void
+ nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir)
+ {
+@@ -345,6 +361,25 @@ nfs_local_iter_init(struct iov_iter *i, struct nfs_local_kiocb *iocb, int dir)
+ hdr->args.count + hdr->args.pgbase);
+ if (hdr->args.pgbase != 0)
+ iov_iter_advance(i, hdr->args.pgbase);
++
++ if (iocb->kiocb.ki_flags & IOCB_DIRECT) {
++ u32 nf_dio_mem_align, nf_dio_offset_align, nf_dio_read_offset_align;
++ /* Verify the IO is DIO-aligned as required */
++ nfs_to->nfsd_file_dio_alignment(iocb->localio, &nf_dio_mem_align,
++ &nf_dio_offset_align,
++ &nf_dio_read_offset_align);
++ if (dir == READ)
++ nf_dio_offset_align = nf_dio_read_offset_align;
++
++ if (nf_dio_mem_align && nf_dio_offset_align &&
++ nfs_iov_iter_aligned_bvec(i, hdr->args.offset,
++ nf_dio_mem_align - 1,
++ nf_dio_offset_align - 1))
++ return; /* is DIO-aligned */
++
++ /* Fallback to using buffered for this misaligned IO */
++ iocb->kiocb.ki_flags &= ~IOCB_DIRECT;
++ }
+ }
+
+ static void
+@@ -405,6 +440,11 @@ nfs_local_read_done(struct nfs_local_kiocb *iocb, long status)
+ struct nfs_pgio_header *hdr = iocb->hdr;
+ struct file *filp = iocb->kiocb.ki_filp;
+
++ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) {
++ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */
++ pr_info_ratelimited("nfs: Unexpected direct I/O read alignment failure\n");
++ }
++
+ nfs_local_pgio_done(hdr, status);
+
+ /*
+@@ -597,6 +637,11 @@ nfs_local_write_done(struct nfs_local_kiocb *iocb, long status)
+
+ dprintk("%s: wrote %ld bytes.\n", __func__, status > 0 ? status : 0);
+
++ if ((iocb->kiocb.ki_flags & IOCB_DIRECT) && status == -EINVAL) {
++ /* Underlying FS will return -EINVAL if misaligned DIO is attempted. */
++ pr_info_ratelimited("nfs: Unexpected direct I/O write alignment failure\n");
++ }
++
+ /* Handle short writes as if they are ENOSPC */
+ if (status > 0 && status < hdr->args.count) {
+ hdr->mds_offset += status;
+diff --git a/fs/nfsd/localio.c b/fs/nfsd/localio.c
+index cb237f1b902a7..9e0a37cd29d8a 100644
+--- a/fs/nfsd/localio.c
++++ b/fs/nfsd/localio.c
+@@ -117,6 +117,16 @@ nfsd_open_local_fh(struct net *net, struct auth_domain *dom,
+ return localio;
+ }
+
++static void nfsd_file_dio_alignment(struct nfsd_file *nf,
++ u32 *nf_dio_mem_align,
++ u32 *nf_dio_offset_align,
++ u32 *nf_dio_read_offset_align)
++{
++ *nf_dio_mem_align = nf->nf_dio_mem_align;
++ *nf_dio_offset_align = nf->nf_dio_offset_align;
++ *nf_dio_read_offset_align = nf->nf_dio_read_offset_align;
++}
++
+ static const struct nfsd_localio_operations nfsd_localio_ops = {
+ .nfsd_net_try_get = nfsd_net_try_get,
+ .nfsd_net_put = nfsd_net_put,
+@@ -124,6 +134,7 @@ static const struct nfsd_localio_operations nfsd_localio_ops = {
+ .nfsd_file_put_local = nfsd_file_put_local,
+ .nfsd_file_get_local = nfsd_file_get_local,
+ .nfsd_file_file = nfsd_file_file,
++ .nfsd_file_dio_alignment = nfsd_file_dio_alignment,
+ };
+
+ void nfsd_localio_ops_init(void)
+diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h
+index 5c7c92659e736..7ca2715edccca 100644
+--- a/include/linux/nfslocalio.h
++++ b/include/linux/nfslocalio.h
+@@ -65,6 +65,8 @@ struct nfsd_localio_operations {
+ struct net *(*nfsd_file_put_local)(struct nfsd_file __rcu **);
+ struct nfsd_file *(*nfsd_file_get_local)(struct nfsd_file *);
+ struct file *(*nfsd_file_file)(struct nfsd_file *);
++ void (*nfsd_file_dio_alignment)(struct nfsd_file *,
++ u32 *, u32 *, u32 *);
+ } ____cacheline_aligned;
+
+ extern void nfsd_localio_ops_init(void);
+--
+2.51.0
+
--- /dev/null
+From 97660d35c741de050eea6a3c17814fcca1de62ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:56:41 -0400
+Subject: NFSD: filecache: add STATX_DIOALIGN and STATX_DIO_READ_ALIGN support
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit d11f6cd1bb4a416b4515702d020a7480ac667f0f ]
+
+Use STATX_DIOALIGN and STATX_DIO_READ_ALIGN to get DIO alignment
+attributes from the underlying filesystem and store them in the
+associated nfsd_file. This is done when the nfsd_file is first
+opened for each regular file.
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Acked-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Stable-dep-of: 25ba2b84c38f ("nfs/localio: avoid issuing misaligned IO using O_DIRECT")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/filecache.c | 34 ++++++++++++++++++++++++++++++++++
+ fs/nfsd/filecache.h | 4 ++++
+ fs/nfsd/trace.h | 27 +++++++++++++++++++++++++++
+ fs/nfsd/vfs.h | 4 ++++
+ include/trace/misc/fs.h | 22 ++++++++++++++++++++++
+ 5 files changed, 91 insertions(+)
+
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index 732abf6b92a56..7ca1dedf4e04a 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -231,6 +231,9 @@ nfsd_file_alloc(struct net *net, struct inode *inode, unsigned char need,
+ refcount_set(&nf->nf_ref, 1);
+ nf->nf_may = need;
+ nf->nf_mark = NULL;
++ nf->nf_dio_mem_align = 0;
++ nf->nf_dio_offset_align = 0;
++ nf->nf_dio_read_offset_align = 0;
+ return nf;
+ }
+
+@@ -1069,6 +1072,35 @@ nfsd_file_is_cached(struct inode *inode)
+ return ret;
+ }
+
++static __be32
++nfsd_file_get_dio_attrs(const struct svc_fh *fhp, struct nfsd_file *nf)
++{
++ struct inode *inode = file_inode(nf->nf_file);
++ struct kstat stat;
++ __be32 status;
++
++ /* Currently only need to get DIO alignment info for regular files */
++ if (!S_ISREG(inode->i_mode))
++ return nfs_ok;
++
++ status = fh_getattr(fhp, &stat);
++ if (status != nfs_ok)
++ return status;
++
++ trace_nfsd_file_get_dio_attrs(inode, &stat);
++
++ if (stat.result_mask & STATX_DIOALIGN) {
++ nf->nf_dio_mem_align = stat.dio_mem_align;
++ nf->nf_dio_offset_align = stat.dio_offset_align;
++ }
++ if (stat.result_mask & STATX_DIO_READ_ALIGN)
++ nf->nf_dio_read_offset_align = stat.dio_read_offset_align;
++ else
++ nf->nf_dio_read_offset_align = nf->nf_dio_offset_align;
++
++ return nfs_ok;
++}
++
+ static __be32
+ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net,
+ struct svc_cred *cred,
+@@ -1187,6 +1219,8 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct net *net,
+ }
+ status = nfserrno(ret);
+ trace_nfsd_file_open(nf, status);
++ if (status == nfs_ok)
++ status = nfsd_file_get_dio_attrs(fhp, nf);
+ }
+ } else
+ status = nfserr_jukebox;
+diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h
+index 722b26c71e454..237a05c74211b 100644
+--- a/fs/nfsd/filecache.h
++++ b/fs/nfsd/filecache.h
+@@ -54,6 +54,10 @@ struct nfsd_file {
+ struct list_head nf_gc;
+ struct rcu_head nf_rcu;
+ ktime_t nf_birthtime;
++
++ u32 nf_dio_mem_align;
++ u32 nf_dio_offset_align;
++ u32 nf_dio_read_offset_align;
+ };
+
+ int nfsd_file_cache_init(void);
+diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h
+index a664fdf1161e9..6e2c8e2aab10a 100644
+--- a/fs/nfsd/trace.h
++++ b/fs/nfsd/trace.h
+@@ -1133,6 +1133,33 @@ TRACE_EVENT(nfsd_file_alloc,
+ )
+ );
+
++TRACE_EVENT(nfsd_file_get_dio_attrs,
++ TP_PROTO(
++ const struct inode *inode,
++ const struct kstat *stat
++ ),
++ TP_ARGS(inode, stat),
++ TP_STRUCT__entry(
++ __field(const void *, inode)
++ __field(unsigned long, mask)
++ __field(u32, mem_align)
++ __field(u32, offset_align)
++ __field(u32, read_offset_align)
++ ),
++ TP_fast_assign(
++ __entry->inode = inode;
++ __entry->mask = stat->result_mask;
++ __entry->mem_align = stat->dio_mem_align;
++ __entry->offset_align = stat->dio_offset_align;
++ __entry->read_offset_align = stat->dio_read_offset_align;
++ ),
++ TP_printk("inode=%p flags=%s mem_align=%u offset_align=%u read_offset_align=%u",
++ __entry->inode, show_statx_mask(__entry->mask),
++ __entry->mem_align, __entry->offset_align,
++ __entry->read_offset_align
++ )
++);
++
+ TRACE_EVENT(nfsd_file_acquire,
+ TP_PROTO(
+ const struct svc_rqst *rqstp,
+diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h
+index eff04959606fe..fde3e0c11dbaf 100644
+--- a/fs/nfsd/vfs.h
++++ b/fs/nfsd/vfs.h
+@@ -185,6 +185,10 @@ static inline __be32 fh_getattr(const struct svc_fh *fh, struct kstat *stat)
+ u32 request_mask = STATX_BASIC_STATS;
+ struct path p = {.mnt = fh->fh_export->ex_path.mnt,
+ .dentry = fh->fh_dentry};
++ struct inode *inode = d_inode(p.dentry);
++
++ if (S_ISREG(inode->i_mode))
++ request_mask |= (STATX_DIOALIGN | STATX_DIO_READ_ALIGN);
+
+ if (fh->fh_maxsize == NFS4_FHSIZE)
+ request_mask |= (STATX_BTIME | STATX_CHANGE_COOKIE);
+diff --git a/include/trace/misc/fs.h b/include/trace/misc/fs.h
+index 0406ebe2a80a4..7ead1c61f0cb1 100644
+--- a/include/trace/misc/fs.h
++++ b/include/trace/misc/fs.h
+@@ -141,3 +141,25 @@
+ { ATTR_TIMES_SET, "TIMES_SET" }, \
+ { ATTR_TOUCH, "TOUCH"}, \
+ { ATTR_DELEG, "DELEG"})
++
++#define show_statx_mask(flags) \
++ __print_flags(flags, "|", \
++ { STATX_TYPE, "TYPE" }, \
++ { STATX_MODE, "MODE" }, \
++ { STATX_NLINK, "NLINK" }, \
++ { STATX_UID, "UID" }, \
++ { STATX_GID, "GID" }, \
++ { STATX_ATIME, "ATIME" }, \
++ { STATX_MTIME, "MTIME" }, \
++ { STATX_CTIME, "CTIME" }, \
++ { STATX_INO, "INO" }, \
++ { STATX_SIZE, "SIZE" }, \
++ { STATX_BLOCKS, "BLOCKS" }, \
++ { STATX_BASIC_STATS, "BASIC_STATS" }, \
++ { STATX_BTIME, "BTIME" }, \
++ { STATX_MNT_ID, "MNT_ID" }, \
++ { STATX_DIOALIGN, "DIOALIGN" }, \
++ { STATX_MNT_ID_UNIQUE, "MNT_ID_UNIQUE" }, \
++ { STATX_SUBVOL, "SUBVOL" }, \
++ { STATX_WRITE_ATOMIC, "WRITE_ATOMIC" }, \
++ { STATX_DIO_READ_ALIGN, "DIO_READ_ALIGN" })
+--
+2.51.0
+
--- /dev/null
+From 53069e4b08ee2b85c4260758b67796de82197f95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index ce61253efd45b..611e6283c194f 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9442,7 +9442,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 378d772671b798f789b6cd0711d5c02d695c903b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:07:32 +0800
+Subject: null_blk: Fix the description of the cache_size module argument
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
+
+When executing modinfo null_blk, there is an error in the description
+of module parameter mbps, and the output information of cache_size is
+incomplete.The output of modinfo before and after applying this patch
+is as follows:
+
+Before:
+[...]
+parm: cache_size:ulong
+[...]
+parm: mbps:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (uint)
+[...]
+
+After:
+[...]
+parm: cache_size:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (ulong)
+[...]
+parm: mbps:Limit maximum bandwidth (in MiB/s).
+ Default: 0 (no limit) (uint)
+[...]
+
+Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index 91642c9a3b293..f982027e8c858 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
+
+ static unsigned long g_cache_size;
+ module_param_named(cache_size, g_cache_size, ulong, 0444);
+-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+
+ static bool g_fua = true;
+ module_param_named(fua, g_fua, bool, 0444);
+--
+2.51.0
+
--- /dev/null
+From 98b23e7ccf3daac1bbeb3d295441723575699f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:21 +0530
+Subject: nvme-auth: update bi_directional flag
+
+From: Martin George <martinus.gpy@gmail.com>
+
+[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ]
+
+While setting chap->s2 to zero as part of secure channel
+concatenation, the host missed out to disable the bi_directional
+flag to indicate that controller authentication is not requested.
+Fix the same.
+
+Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
+Signed-off-by: Martin George <marting@netapp.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/auth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
+index 201fc8809a628..012fcfc79a73b 100644
+--- a/drivers/nvme/host/auth.c
++++ b/drivers/nvme/host/auth.c
+@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl,
+ } else {
+ memset(chap->c2, 0, chap->hash_len);
+ }
+- if (ctrl->opts->concat)
++ if (ctrl->opts->concat) {
+ chap->s2 = 0;
+- else
++ chap->bi_directional = false;
++ } else
+ chap->s2 = nvme_auth_get_seqnum();
+ data->seqnum = cpu_to_le32(chap->s2);
+ if (chap->host_key_len) {
+--
+2.51.0
+
--- /dev/null
+From 986eda82d56ff8c5673f1f79b76ba0cebf1a9de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:05:09 +0530
+Subject: nvme-tcp: send only permitted commands for secure concat
+
+From: Martin George <martinus.gpy@gmail.com>
+
+[ Upstream commit df4666a4908a6d883f628f93a3e6c80981332035 ]
+
+In addition to sending permitted commands such as connect/auth
+over the initial unencrypted admin connection as part of secure
+channel concatenation, the host also sends commands such as
+Property Get and Identify on the same. This is a spec violation
+leading to secure concat failures. Fix this by ensuring these
+additional commands are avoided on this connection.
+
+Fixes: 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation")
+Signed-off-by: Martin George <marting@netapp.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index c0fe8cfb7229e..1413788ca7d52 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -2250,6 +2250,9 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
+ if (error)
+ goto out_cleanup_tagset;
+
++ if (ctrl->opts->concat && !ctrl->tls_pskid)
++ return 0;
++
+ error = nvme_enable_ctrl(ctrl);
+ if (error)
+ goto out_stop_queue;
+--
+2.51.0
+
--- /dev/null
+From bba7f05c0b60df802bcac2dbbe208407ce3ef222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index a9b18c051f5bd..6725c34dd7c90 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From d8e4e3cfc4a3f7369d2ee2e08456e8e2a463eafa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:02 +0200
+Subject: nvmet-fcloop: call done callback even when remote port is gone
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ]
+
+When the target port is gone, it's not possible to access any of the
+request resources. The function should just silently drop the response.
+The comment is misleading in this regard.
+
+Though it's still necessary to call the driver via the ->done callback
+so the driver is able to release all resources.
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Closes: https://lore.kernel.org/all/CAHj4cs-OBA0WMt5f7R0dz+rR4HcEz19YLhnyGsj-MRV3jWDsPg@mail.gmail.com/
+Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 257b497d515a8..5dffcc5becae8 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport,
+ if (!targetport) {
+ /*
+ * The target port is gone. The target doesn't expect any
+- * response anymore and the ->done call is not valid
+- * because the resources have been freed by
+- * nvmet_fc_free_pending_reqs.
++ * response anymore and thus lsreq can't be accessed anymore.
+ *
+ * We end up here from delete association exchange:
+ * nvmet_fc_xmt_disconnect_assoc sends an async request.
++ *
++ * Return success because this is what LLDDs do; silently
++ * drop the response.
+ */
++ lsrsp->done(lsrsp);
+ kmem_cache_free(lsreq_cache, tls_req);
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8b244d871dac82621ce7c8402b50a78001c2eef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 0f045e45fa0c3..439742cec3c26 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1011,6 +1011,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From b35f0619ef2c385321bb618bece85d342bbe2264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 14:12:36 +0800
+Subject: octeontx2-pf: fix bitmap leak
+
+From: Bo Sun <bo@mboxify.com>
+
+[ Upstream commit 92e9f4faffca70c82126e59552f6e8ff8f95cc65 ]
+
+The bitmap allocated with bitmap_zalloc() in otx2_probe() was not
+released in otx2_remove(). Unbinding and rebinding the driver therefore
+triggers a kmemleak warning:
+
+ unreferenced object (size 8):
+ backtrace:
+ bitmap_zalloc
+ otx2_probe
+
+Call bitmap_free() in the remove path to fix the leak.
+
+Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
+Signed-off-by: Bo Sun <bo@mboxify.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index 5027fae0aa77a..e808995703cfd 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -3542,6 +3542,7 @@ static void otx2_remove(struct pci_dev *pdev)
+ otx2_disable_mbox_intr(pf);
+ otx2_pfaf_mbox_destroy(pf);
+ pci_free_irq_vectors(pf->pdev);
++ bitmap_free(pf->af_xdp_zc_qidx);
+ pci_set_drvdata(pdev, NULL);
+ free_netdev(netdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From 22aad95f2116c1b4a927751872ab901fbeaabaa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 14:12:35 +0800
+Subject: octeontx2-vf: fix bitmap leak
+
+From: Bo Sun <bo@mboxify.com>
+
+[ Upstream commit cd9ea7da41a449ff1950230a35990155457b9879 ]
+
+The bitmap allocated with bitmap_zalloc() in otx2vf_probe() was not
+released in otx2vf_remove(). Unbinding and rebinding the driver therefore
+triggers a kmemleak warning:
+
+ unreferenced object (size 8):
+ backtrace:
+ bitmap_zalloc
+ otx2vf_probe
+
+Call bitmap_free() in the remove path to fix the leak.
+
+Fixes: efabce290151 ("octeontx2-pf: AF_XDP zero copy receive support")
+Signed-off-by: Bo Sun <bo@mboxify.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+index 7ebb6e656884a..25381f079b97d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+@@ -854,6 +854,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
+ qmem_free(vf->dev, vf->dync_lmt);
+ otx2vf_vfaf_mbox_destroy(vf);
+ pci_free_irq_vectors(vf->pdev);
++ bitmap_free(vf->af_xdp_zc_qidx);
+ pci_set_drvdata(pdev, NULL);
+ free_netdev(netdev);
+ }
+--
+2.51.0
+
--- /dev/null
+From a0a69474497dd62a72162e1018ed038d91736230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 19:29:10 +0800
+Subject: once: fix race by moving DO_ONCE to separate section
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
+
+The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
+DO_ONCE's ___done variable to .data.once section, which conflicts with
+DO_ONCE_LITE() that also uses the same section.
+
+This creates a race condition when clear_warn_once is used:
+
+Thread 1 (DO_ONCE) Thread 2 (DO_ONCE)
+__do_once_start
+ read ___done (false)
+ acquire once_lock
+execute func
+__do_once_done
+ write ___done (true) __do_once_start
+ release once_lock // Thread 3 clear_warn_once reset ___done
+ read ___done (false)
+ acquire once_lock
+ execute func
+schedule once_work __do_once_done
+once_deferred: OK write ___done (true)
+static_branch_disable release once_lock
+ schedule once_work
+ once_deferred:
+ BUG_ON(!static_key_enabled)
+
+DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
+macros. Keep its ___done flag in the .data..once section and allow resetting
+by clear_warn_once, as originally intended.
+
+In contrast, DO_ONCE() is used for functions like get_random_once() and
+relies on its ___done flag for internal synchronization. We should not reset
+DO_ONCE() by clear_warn_once.
+
+Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
+shielding it from clear_warn_once.
+
+Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 1 +
+ include/linux/once.h | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index ae2d2359b79e9..8efbe8c4874ee 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -361,6 +361,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
+ __start_once = .; \
+ *(.data..once) \
+ __end_once = .; \
++ *(.data..do_once) \
+ STRUCT_ALIGN(); \
+ *(__tracepoints) \
+ /* implement dynamic printk debug */ \
+diff --git a/include/linux/once.h b/include/linux/once.h
+index 30346fcdc7995..449a0e34ad5ad 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ unsigned long ___flags; \
+@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE_SLEEPABLE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ ___ret = __do_once_sleepable_start(&___done); \
+--
+2.51.0
+
--- /dev/null
+From 51ef3d222597cd718daf6ccd425aabe6b97da60a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 14:46:42 -0700
+Subject: PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]
+
+pci_acpi_preserve_config() leaks memory by returning early without freeing
+the ACPI object on success. Fix that by always freeing the obj, which is
+not needed by the caller.
+
+Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250825214642.142135-1-nirmoyd@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-acpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index ddb25960ea47d..9369377725fa0 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
+
+ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ {
++ bool ret = false;
++
+ if (ACPI_HANDLE(&host_bridge->dev)) {
+ union acpi_object *obj;
+
+@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
+ 1, DSM_PCI_PRESERVE_BOOT_CONFIG,
+ NULL, ACPI_TYPE_INTEGER);
+ if (obj && obj->integer.value == 0)
+- return true;
++ ret = true;
+ ACPI_FREE(obj);
+ }
+
+- return false;
++ return ret;
+ }
+
+ /* _HPX PCI Setting Record (Type 0); same as _HPP */
+--
+2.51.0
+
--- /dev/null
+From e177c711e70dc09121d93d3d5c1a8a564b82ffb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 16:34:45 +0300
+Subject: PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in
+ pci_epf_write_msi_msg()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 57a75fa9d56e310e883e4377205690e88c05781b ]
+
+The pci_epc_get() function returns error pointers. It never returns NULL.
+Update the check to match.
+
+Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/aIzCdV8jyBeql-Oa@stanley.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/pci-ep-msi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
+index 9ca89cbfec15d..1b58357b905fa 100644
+--- a/drivers/pci/endpoint/pci-ep-msi.c
++++ b/drivers/pci/endpoint/pci-ep-msi.c
+@@ -24,7 +24,7 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
+ struct pci_epf *epf;
+
+ epc = pci_epc_get(dev_name(msi_desc_to_dev(desc)));
+- if (!epc)
++ if (IS_ERR(epc))
+ return;
+
+ epf = list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list);
+--
+2.51.0
+
--- /dev/null
+From 095407991fb2a9cd9d4435c6ae485a5dd117fa7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 18:19:42 +0200
+Subject: PCI: endpoint: pci-epf-test: Fix doorbell test support
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit f272210b28d050df56ec7dfaecb9fa3bebca6419 ]
+
+The doorbell feature temporarily overrides the inbound translation to point
+to the address stored in epf_test->db_bar.phys_addr, i.e., it calls
+set_bar() twice without ever calling clear_bar(), as calling clear_bar()
+would clear the BAR's PCI address assigned by the host.
+
+Thus, when disabling the doorbell, restore the inbound translation to point
+to the memory allocated for the BAR.
+
+Without this, running the PCI endpoint kselftest doorbell test case more
+than once would fail.
+
+Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250908161942.534799-2-cassel@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index e091193bd8a8a..2a85d3eda92f0 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -772,12 +772,24 @@ static void pci_epf_test_disable_doorbell(struct pci_epf_test *epf_test,
+ u32 status = le32_to_cpu(reg->status);
+ struct pci_epf *epf = epf_test->epf;
+ struct pci_epc *epc = epf->epc;
++ int ret;
+
+ if (bar < BAR_0)
+ goto set_status_err;
+
+ pci_epf_test_doorbell_cleanup(epf_test);
+- pci_epc_clear_bar(epc, epf->func_no, epf->vfunc_no, &epf_test->db_bar);
++
++ /*
++ * The doorbell feature temporarily overrides the inbound translation
++ * to point to the address stored in epf_test->db_bar.phys_addr, i.e.,
++ * it calls set_bar() twice without ever calling clear_bar(), as
++ * calling clear_bar() would clear the BAR's PCI address assigned by
++ * the host. Thus, when disabling the doorbell, restore the inbound
++ * translation to point to the memory allocated for the BAR.
++ */
++ ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, &epf->bar[bar]);
++ if (ret)
++ goto set_status_err;
+
+ status |= STATUS_DOORBELL_DISABLE_SUCCESS;
+ reg->status = cpu_to_le32(status);
+--
+2.51.0
+
--- /dev/null
+From 7b731956a833951f1fec3513556612027041f6c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 17:26:40 +0300
+Subject: PCI: Fix pdev_resources_assignable() disparity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit ff77c5219747d6b78e8b0ffc4c43d3dd8173d1b2 ]
+
+pdev_sort_resources() uses pdev_resources_assignable() helper to decide if
+device's resources cannot be assigned, so it ignores class 0
+(PCI_CLASS_NOT_DEFINED) devices. pbus_size_mem(), on the other hand, does
+not do the same check. This could lead into a situation where a resource
+ends up on realloc_head list but is not on the head list, which in turn
+prevents emptying the resource from the realloc_head list in
+__assign_resources_sorted().
+
+A non-empty realloc_head is unacceptable because it triggers an internal
+sanity check as shown in this log with a device that has class 0
+(PCI_CLASS_NOT_DEFINED):
+
+ pci 0001:01:00.0: [144d:a5a5] type 00 class 0x000000 PCIe Endpoint
+ pci 0001:01:00.0: BAR 0 [mem 0x00000000-0x000fffff 64bit]
+ pci 0001:01:00.0: ROM [mem 0x00000000-0x0000ffff pref]
+ pcieport 0001:00:00.0: bridge window [mem 0x00100000-0x001fffff] to [bus 01-ff] add_size 100000 add_align 100000
+ pcieport 0001:00:00.0: bridge window [mem 0x40000000-0x401fffff]: assigned
+ ------------[ cut here ]------------
+ kernel BUG at drivers/pci/setup-bus.c:2532!
+ Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
+ ...
+ Call trace:
+ pci_assign_unassigned_bus_resources+0x110/0x114 (P)
+ pci_rescan_bus+0x28/0x48
+
+Use pdev_resources_assignable() also within pbus_size_mem() to skip
+processing of non-assignable resources which removes the disparity in
+between what resources pdev_sort_resources() and pbus_size_mem() consider.
+As non-assignable resources are no longer processed, they are not added to
+the realloc_head list, thus the sanity check no longer triggers.
+
+This disparity problem is very old but only now became apparent after
+2499f5348431 ("PCI: Rework optional resource handling") that made the ROM
+resources optional when calculating bridge window sizes which required
+adding the resource to the realloc_head list. Previously, bridge windows
+were just sized larger than necessary.
+
+Fixes: 2499f5348431 ("PCI: Rework optional resource handling")
+Reported-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Closes: https://lore.kernel.org/all/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org/
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v6.15+
+Link: https://patch.msgid.link/20250822123359.16305-3-ilpo.jarvinen@linux.intel.com
+Stable-dep-of: 8278c6914306 ("PCI: Preserve bridge window resource type flags")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/setup-bus.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 7853ac6999e2c..c992707a8ebd6 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -1190,6 +1190,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
+ resource_size_t r_size;
+
+ if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) ||
++ !pdev_resources_assignable(dev) ||
+ ((r->flags & mask) != type &&
+ (r->flags & mask) != type2 &&
+ (r->flags & mask) != type3))
+--
+2.51.0
+
--- /dev/null
+From 43242e2c68e7490295b909230c316d30132581db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 14:14:34 -0700
+Subject: PCI: j721e: Fix incorrect error message in probe()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]
+
+The probe() function prints "pm_runtime_get_sync failed" when
+j721e_pcie_ctrl_init() returns an error. This is misleading since
+the failure is not from pm_runtime, but from the controller init
+routine. Update the error message to correctly reflect the source.
+
+No functional changes.
+
+Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Link: https://patch.msgid.link/20250905211436.3048282-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 6c93f39d02888..5e445a7bda332 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -549,7 +549,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+
+ ret = j721e_pcie_ctrl_init(pcie);
+ if (ret < 0) {
+- dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
++ dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
+ goto err_get_sync;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 38e29c2de0b1135e82a38c0be8033d158395c374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 07:28:32 +0800
+Subject: PCI/MSI: Add startup/shutdown for per device domains
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit 54f45a30c0d0153d2be091ba2d683ab6db6d1d5b ]
+
+As the RISC-V PLIC cannot apply affinity settings without invoking
+irq_enable(), it will make the interrupt unavailble when used as an
+underlying interrupt chip for the MSI controller.
+
+Implement the irq_startup() and irq_shutdown() callbacks for the PCI MSI
+and MSI-X templates.
+
+For chips that specify MSI_FLAG_PCI_MSI_STARTUP_PARENT, the parent startup
+and shutdown functions are invoked. That allows the interrupt on the parent
+chip to be enabled if the interrupt has not been enabled during
+allocation. This is necessary for MSI controllers which use PLIC as
+underlying parent interrupt chip.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox
+Reviewed-by: Chen Wang <unicorn_wang@outlook.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://lore.kernel.org/all/20250813232835.43458-3-inochiama@gmail.com
+Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/irqdomain.c | 52 +++++++++++++++++++++++++++++++++++++
+ include/linux/msi.h | 2 ++
+ 2 files changed, 54 insertions(+)
+
+diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c
+index 0938ef7ebabf2..e0a800f918e81 100644
+--- a/drivers/pci/msi/irqdomain.c
++++ b/drivers/pci/msi/irqdomain.c
+@@ -148,6 +148,23 @@ static void pci_device_domain_set_desc(msi_alloc_info_t *arg, struct msi_desc *d
+ arg->hwirq = desc->msi_index;
+ }
+
++static void cond_shutdown_parent(struct irq_data *data)
++{
++ struct msi_domain_info *info = data->domain->host_data;
++
++ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
++ irq_chip_shutdown_parent(data);
++}
++
++static unsigned int cond_startup_parent(struct irq_data *data)
++{
++ struct msi_domain_info *info = data->domain->host_data;
++
++ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
++ return irq_chip_startup_parent(data);
++ return 0;
++}
++
+ static __always_inline void cond_mask_parent(struct irq_data *data)
+ {
+ struct msi_domain_info *info = data->domain->host_data;
+@@ -164,6 +181,23 @@ static __always_inline void cond_unmask_parent(struct irq_data *data)
+ irq_chip_unmask_parent(data);
+ }
+
++static void pci_irq_shutdown_msi(struct irq_data *data)
++{
++ struct msi_desc *desc = irq_data_get_msi_desc(data);
++
++ pci_msi_mask(desc, BIT(data->irq - desc->irq));
++ cond_shutdown_parent(data);
++}
++
++static unsigned int pci_irq_startup_msi(struct irq_data *data)
++{
++ struct msi_desc *desc = irq_data_get_msi_desc(data);
++ unsigned int ret = cond_startup_parent(data);
++
++ pci_msi_unmask(desc, BIT(data->irq - desc->irq));
++ return ret;
++}
++
+ static void pci_irq_mask_msi(struct irq_data *data)
+ {
+ struct msi_desc *desc = irq_data_get_msi_desc(data);
+@@ -194,6 +228,8 @@ static void pci_irq_unmask_msi(struct irq_data *data)
+ static const struct msi_domain_template pci_msi_template = {
+ .chip = {
+ .name = "PCI-MSI",
++ .irq_startup = pci_irq_startup_msi,
++ .irq_shutdown = pci_irq_shutdown_msi,
+ .irq_mask = pci_irq_mask_msi,
+ .irq_unmask = pci_irq_unmask_msi,
+ .irq_write_msi_msg = pci_msi_domain_write_msg,
+@@ -210,6 +246,20 @@ static const struct msi_domain_template pci_msi_template = {
+ },
+ };
+
++static void pci_irq_shutdown_msix(struct irq_data *data)
++{
++ pci_msix_mask(irq_data_get_msi_desc(data));
++ cond_shutdown_parent(data);
++}
++
++static unsigned int pci_irq_startup_msix(struct irq_data *data)
++{
++ unsigned int ret = cond_startup_parent(data);
++
++ pci_msix_unmask(irq_data_get_msi_desc(data));
++ return ret;
++}
++
+ static void pci_irq_mask_msix(struct irq_data *data)
+ {
+ pci_msix_mask(irq_data_get_msi_desc(data));
+@@ -234,6 +284,8 @@ EXPORT_SYMBOL_GPL(pci_msix_prepare_desc);
+ static const struct msi_domain_template pci_msix_template = {
+ .chip = {
+ .name = "PCI-MSIX",
++ .irq_startup = pci_irq_startup_msix,
++ .irq_shutdown = pci_irq_shutdown_msix,
+ .irq_mask = pci_irq_mask_msix,
+ .irq_unmask = pci_irq_unmask_msix,
+ .irq_write_msi_msg = pci_msi_domain_write_msg,
+diff --git a/include/linux/msi.h b/include/linux/msi.h
+index e5e86a8529fb6..3111ba95fbde4 100644
+--- a/include/linux/msi.h
++++ b/include/linux/msi.h
+@@ -568,6 +568,8 @@ enum {
+ MSI_FLAG_PARENT_PM_DEV = (1 << 8),
+ /* Support for parent mask/unmask */
+ MSI_FLAG_PCI_MSI_MASK_PARENT = (1 << 9),
++ /* Support for parent startup/shutdown */
++ MSI_FLAG_PCI_MSI_STARTUP_PARENT = (1 << 10),
+
+ /* Mask for the generic functionality */
+ MSI_GENERIC_FLAGS_MASK = GENMASK(15, 0),
+--
+2.51.0
+
--- /dev/null
+From e3efaf339ff73175d5e1d5a314993b0c244b02fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 07:09:42 +0800
+Subject: PCI/MSI: Check MSI_FLAG_PCI_MSI_MASK_PARENT in
+ cond_[startup|shutdown]_parent()
+
+From: Inochi Amaoto <inochiama@gmail.com>
+
+[ Upstream commit 727e914bbfbbda9e6efa5cb1abe4e96a949d576f ]
+
+For MSI controllers which only support MSI_FLAG_PCI_MSI_MASK_PARENT, the
+newly added callback irq_startup() and irq_shutdown() for
+pci_msi[x]_template will not unmask or mask the interrupt when startup()
+resp. shutdown() is invoked. This prevents the interrupt from being
+enabled resp. disabled.
+
+Invoke irq_[un]mask_parent() in cond_[startup|shutdown]_parent(), when the
+interrupt has the MSI_FLAG_PCI_MSI_MASK_PARENT flag set.
+
+Fixes: 54f45a30c0d0 ("PCI/MSI: Add startup/shutdown for per device domains")
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Reported-by: Wei Fang <wei.fang@nxp.com>
+Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Wei Fang <wei.fang@nxp.com>
+Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox/SG2042
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://lore.kernel.org/all/20250827230943.17829-1-inochiama@gmail.com
+Closes: https://lore.kernel.org/regressions/aK4O7Hl8NCVEMznB@monster/
+Closes: https://lore.kernel.org/regressions/20250826220959.GA4119563@ax162/
+Closes: https://lore.kernel.org/all/20250827093911.1218640-1-wei.fang@nxp.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi/irqdomain.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/msi/irqdomain.c b/drivers/pci/msi/irqdomain.c
+index e0a800f918e81..b11b7f63f0d6f 100644
+--- a/drivers/pci/msi/irqdomain.c
++++ b/drivers/pci/msi/irqdomain.c
+@@ -154,6 +154,8 @@ static void cond_shutdown_parent(struct irq_data *data)
+
+ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
+ irq_chip_shutdown_parent(data);
++ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT))
++ irq_chip_mask_parent(data);
+ }
+
+ static unsigned int cond_startup_parent(struct irq_data *data)
+@@ -162,6 +164,9 @@ static unsigned int cond_startup_parent(struct irq_data *data)
+
+ if (unlikely(info->flags & MSI_FLAG_PCI_MSI_STARTUP_PARENT))
+ return irq_chip_startup_parent(data);
++ else if (unlikely(info->flags & MSI_FLAG_PCI_MSI_MASK_PARENT))
++ irq_chip_unmask_parent(data);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b871817e3ba3e462dbc10491a2786cd3fb9dc064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:10:59 +0300
+Subject: PCI: Preserve bridge window resource type flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 8278c6914306f35f32d73bdf2a918950919a0051 ]
+
+When a bridge window is found unused or fails to assign, the flags of the
+associated resource are cleared. Clearing flags is problematic as it also
+removes the type information of the resource which is needed later.
+
+Thus, always preserve the bridge window type flags and use IORESOURCE_UNSET
+and IORESOURCE_DISABLED to indicate the status of the bridge window. Also,
+when initializing resources, make sure all valid bridge windows do get
+their type flags set.
+
+Change various places that relied on resource flags being cleared to check
+for IORESOURCE_UNSET and IORESOURCE_DISABLED to allow bridge window
+resource to retain their type flags. Add pdev_resource_assignable() and
+pdev_resource_should_fit() helpers to filter out disabled bridge windows
+during resource fitting; the latter combines more common checks into the
+helper.
+
+When reading the bridge windows from the registers, instead of leaving the
+resource flags cleared for bridge windows that are not enabled, always
+set up the flags and set IORESOURCE_UNSET | IORESOURCE_DISABLED as needed.
+
+When resource fitting or assignment fails for a bridge window resource, or
+the bridge window is not needed, mark the resource with IORESOURCE_UNSET or
+IORESOURCE_DISABLED, respectively.
+
+Use dummy zero resource in resource_show() for backwards compatibility as
+lspci will otherwise misrepresent disabled bridge windows.
+
+This change fixes an issue which highlights the importance of keeping the
+resource type flags intact:
+
+ At the end of __assign_resources_sorted(), reset_resource() is called,
+ previously clearing the flags. Later, pci_prepare_next_assign_round()
+ attempted to release bridge resources using
+ pci_bus_release_bridge_resources() that calls into
+ pci_bridge_release_resources() that assumes type flags are still present.
+ As type flags were cleared, IORESOURCE_MEM_64 was not set leading to
+ resources under an incorrect bridge window to be released (idx = 1
+ instead of idx = 2). While the assignments performed later covered this
+ problem so that the wrongly released resources got assigned in the end,
+ it was still causing extra release+assign pairs.
+
+There are other reasons why the resource flags should be retained in
+upcoming changes too.
+
+Removing the flag reset for non-bridge window resource is left as future
+work, in part because it has a much higher regression potential due to
+pci_enable_resources() that will start to work also for those resources
+then and due to what endpoint drivers might assume about resources.
+
+Despite the Fixes tag, backporting this (at least any time soon) is highly
+discouraged. The issue fixed is borderline cosmetic as the later
+assignments normally cover the problem entirely. Also there might be
+non-obvious dependencies.
+
+Fixes: 5b28541552ef ("PCI: Restrict 64-bit prefetchable bridge windows to 64-bit resources")
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250829131113.36754-11-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/bus.c | 3 ++
+ drivers/pci/pci-sysfs.c | 7 ++++
+ drivers/pci/probe.c | 25 +++++++++---
+ drivers/pci/setup-bus.c | 89 +++++++++++++++++++++++++++--------------
+ drivers/pci/setup-res.c | 3 ++
+ 5 files changed, 90 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index b77fd30bbfd9d..58b5388423ee3 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -204,6 +204,9 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
+ if (!r)
+ continue;
+
++ if (r->flags & (IORESOURCE_UNSET|IORESOURCE_DISABLED))
++ continue;
++
+ /* type_mask must match */
+ if ((res->flags ^ r->flags) & type_mask)
+ continue;
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 5eea14c1f7f5f..162a5241c7f70 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -177,6 +177,13 @@ static ssize_t resource_show(struct device *dev, struct device_attribute *attr,
+
+ for (i = 0; i < max; i++) {
+ struct resource *res = &pci_dev->resource[i];
++ struct resource zerores = {};
++
++ /* For backwards compatibility */
++ if (i >= PCI_BRIDGE_RESOURCES && i <= PCI_BRIDGE_RESOURCE_END &&
++ res->flags & (IORESOURCE_UNSET | IORESOURCE_DISABLED))
++ res = &zerores;
++
+ pci_resource_to_user(pci_dev, i, res, &start, &end);
+ len += sysfs_emit_at(buf, len, "0x%016llx 0x%016llx 0x%016llx\n",
+ (unsigned long long)start,
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index f41128f91ca76..f31d27c7708a6 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -419,13 +419,17 @@ static void pci_read_bridge_io(struct pci_dev *dev, struct resource *res,
+ limit |= ((unsigned long) io_limit_hi << 16);
+ }
+
++ res->flags = (io_base_lo & PCI_IO_RANGE_TYPE_MASK) | IORESOURCE_IO;
++
+ if (base <= limit) {
+- res->flags = (io_base_lo & PCI_IO_RANGE_TYPE_MASK) | IORESOURCE_IO;
+ region.start = base;
+ region.end = limit + io_granularity - 1;
+ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ if (log)
+ pci_info(dev, " bridge window %pR\n", res);
++ } else {
++ resource_set_range(res, 0, 0);
++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED;
+ }
+ }
+
+@@ -440,13 +444,18 @@ static void pci_read_bridge_mmio(struct pci_dev *dev, struct resource *res,
+ pci_read_config_word(dev, PCI_MEMORY_LIMIT, &mem_limit_lo);
+ base = ((unsigned long) mem_base_lo & PCI_MEMORY_RANGE_MASK) << 16;
+ limit = ((unsigned long) mem_limit_lo & PCI_MEMORY_RANGE_MASK) << 16;
++
++ res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
++
+ if (base <= limit) {
+- res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
+ region.start = base;
+ region.end = limit + 0xfffff;
+ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ if (log)
+ pci_info(dev, " bridge window %pR\n", res);
++ } else {
++ resource_set_range(res, 0, 0);
++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED;
+ }
+ }
+
+@@ -489,16 +498,20 @@ static void pci_read_bridge_mmio_pref(struct pci_dev *dev, struct resource *res,
+ return;
+ }
+
++ res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) | IORESOURCE_MEM |
++ IORESOURCE_PREFETCH;
++ if (res->flags & PCI_PREF_RANGE_TYPE_64)
++ res->flags |= IORESOURCE_MEM_64;
++
+ if (base <= limit) {
+- res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) |
+- IORESOURCE_MEM | IORESOURCE_PREFETCH;
+- if (res->flags & PCI_PREF_RANGE_TYPE_64)
+- res->flags |= IORESOURCE_MEM_64;
+ region.start = base;
+ region.end = limit + 0xfffff;
+ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ if (log)
+ pci_info(dev, " bridge window %pR\n", res);
++ } else {
++ resource_set_range(res, 0, 0);
++ res->flags |= IORESOURCE_UNSET | IORESOURCE_DISABLED;
+ }
+ }
+
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 203c8ebef7029..8078ee30e675f 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -154,6 +154,31 @@ static bool pdev_resources_assignable(struct pci_dev *dev)
+ return true;
+ }
+
++static bool pdev_resource_assignable(struct pci_dev *dev, struct resource *res)
++{
++ int idx = pci_resource_num(dev, res);
++
++ if (!res->flags)
++ return false;
++
++ if (idx >= PCI_BRIDGE_RESOURCES && idx <= PCI_BRIDGE_RESOURCE_END &&
++ res->flags & IORESOURCE_DISABLED)
++ return false;
++
++ return true;
++}
++
++static bool pdev_resource_should_fit(struct pci_dev *dev, struct resource *res)
++{
++ if (res->parent)
++ return false;
++
++ if (res->flags & IORESOURCE_PCI_FIXED)
++ return false;
++
++ return pdev_resource_assignable(dev, res);
++}
++
+ /* Sort resources by alignment */
+ static void pdev_sort_resources(struct pci_dev *dev, struct list_head *head)
+ {
+@@ -169,10 +194,7 @@ static void pdev_sort_resources(struct pci_dev *dev, struct list_head *head)
+ resource_size_t r_align;
+ struct list_head *n;
+
+- if (r->flags & IORESOURCE_PCI_FIXED)
+- continue;
+-
+- if (!(r->flags) || r->parent)
++ if (!pdev_resource_should_fit(dev, r))
+ continue;
+
+ r_align = pci_resource_alignment(dev, r);
+@@ -221,8 +243,15 @@ bool pci_resource_is_optional(const struct pci_dev *dev, int resno)
+ return false;
+ }
+
+-static inline void reset_resource(struct resource *res)
++static inline void reset_resource(struct pci_dev *dev, struct resource *res)
+ {
++ int idx = pci_resource_num(dev, res);
++
++ if (idx >= PCI_BRIDGE_RESOURCES && idx <= PCI_BRIDGE_RESOURCE_END) {
++ res->flags |= IORESOURCE_UNSET;
++ return;
++ }
++
+ res->start = 0;
+ res->end = 0;
+ res->flags = 0;
+@@ -568,7 +597,7 @@ static void __assign_resources_sorted(struct list_head *head,
+ 0 /* don't care */);
+ }
+
+- reset_resource(res);
++ reset_resource(dev, res);
+ }
+
+ free_list(head);
+@@ -997,8 +1026,11 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
+
+ if (r->parent || !(r->flags & IORESOURCE_IO))
+ continue;
+- r_size = resource_size(r);
+
++ if (!pdev_resource_assignable(dev, r))
++ continue;
++
++ r_size = resource_size(r);
+ if (r_size < SZ_1K)
+ /* Might be re-aligned for ISA */
+ size += r_size;
+@@ -1017,6 +1049,9 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
+ size0 = calculate_iosize(size, min_size, size1, 0, 0,
+ resource_size(b_res), min_align);
+
++ if (size0)
++ b_res->flags &= ~IORESOURCE_DISABLED;
++
+ size1 = size0;
+ if (realloc_head && (add_size > 0 || children_add_size > 0)) {
+ size1 = calculate_iosize(size, min_size, size1, add_size,
+@@ -1028,13 +1063,14 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
+ if (bus->self && (b_res->start || b_res->end))
+ pci_info(bus->self, "disabling bridge window %pR to %pR (unused)\n",
+ b_res, &bus->busn_res);
+- b_res->flags = 0;
++ b_res->flags |= IORESOURCE_DISABLED;
+ return;
+ }
+
+ resource_set_range(b_res, min_align, size0);
+ b_res->flags |= IORESOURCE_STARTALIGN;
+ if (bus->self && size1 > size0 && realloc_head) {
++ b_res->flags &= ~IORESOURCE_DISABLED;
+ add_to_list(realloc_head, bus->self, b_res, size1-size0,
+ min_align);
+ pci_info(bus->self, "bridge window %pR to %pR add_size %llx\n",
+@@ -1180,11 +1216,13 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
+ const char *r_name = pci_resource_name(dev, i);
+ resource_size_t r_size;
+
+- if (r->parent || (r->flags & IORESOURCE_PCI_FIXED) ||
+- !pdev_resources_assignable(dev) ||
+- ((r->flags & mask) != type &&
+- (r->flags & mask) != type2 &&
+- (r->flags & mask) != type3))
++ if (!pdev_resources_assignable(dev) ||
++ !pdev_resource_should_fit(dev, r))
++ continue;
++
++ if ((r->flags & mask) != type &&
++ (r->flags & mask) != type2 &&
++ (r->flags & mask) != type3)
+ continue;
+ r_size = resource_size(r);
+
+@@ -1235,6 +1273,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
+ min_align = max(min_align, win_align);
+ size0 = calculate_memsize(size, min_size, 0, 0, resource_size(b_res), min_align);
+
++ if (size0)
++ b_res->flags &= ~IORESOURCE_DISABLED;
++
+ if (bus->self && size0 &&
+ !pbus_upstream_space_available(bus, mask | IORESOURCE_PREFETCH, type,
+ size0, min_align)) {
+@@ -1267,13 +1308,14 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
+ if (bus->self && (b_res->start || b_res->end))
+ pci_info(bus->self, "disabling bridge window %pR to %pR (unused)\n",
+ b_res, &bus->busn_res);
+- b_res->flags = 0;
++ b_res->flags |= IORESOURCE_DISABLED;
+ return 0;
+ }
+
+ resource_set_range(b_res, min_align, size0);
+ b_res->flags |= IORESOURCE_STARTALIGN;
+ if (bus->self && size1 > size0 && realloc_head) {
++ b_res->flags &= ~IORESOURCE_DISABLED;
+ add_to_list(realloc_head, bus->self, b_res, size1-size0, add_align);
+ pci_info(bus->self, "bridge window %pR to %pR add_size %llx add_align %llx\n",
+ b_res, &bus->busn_res,
+@@ -1705,7 +1747,6 @@ static void pci_bridge_release_resources(struct pci_bus *bus,
+ {
+ struct pci_dev *dev = bus->self;
+ struct resource *r;
+- unsigned int old_flags;
+ struct resource *b_res;
+ int idx, ret;
+
+@@ -1742,17 +1783,15 @@ static void pci_bridge_release_resources(struct pci_bus *bus,
+ /* If there are children, release them all */
+ release_child_resources(r);
+
+- type = old_flags = r->flags & PCI_RES_TYPE_MASK;
+ ret = pci_release_resource(dev, PCI_BRIDGE_RESOURCES + idx);
+ if (ret)
+ return;
+
++ type = r->flags & PCI_RES_TYPE_MASK;
+ /* Avoiding touch the one without PREF */
+ if (type & IORESOURCE_PREFETCH)
+ type = IORESOURCE_PREFETCH;
+ __pci_setup_bridge(bus, type);
+- /* For next child res under same bridge */
+- r->flags = old_flags;
+ }
+
+ enum release_type {
+@@ -2230,21 +2269,9 @@ static void pci_prepare_next_assign_round(struct list_head *fail_head,
+ }
+
+ /* Restore size and flags */
+- list_for_each_entry(fail_res, fail_head, list) {
+- struct resource *res = fail_res->res;
+- struct pci_dev *dev = fail_res->dev;
+- int idx = pci_resource_num(dev, res);
+-
++ list_for_each_entry(fail_res, fail_head, list)
+ restore_dev_resource(fail_res);
+
+- if (!pci_is_bridge(dev))
+- continue;
+-
+- if (idx >= PCI_BRIDGE_RESOURCES &&
+- idx <= PCI_BRIDGE_RESOURCE_END)
+- res->flags = 0;
+- }
+-
+ free_list(fail_head);
+ }
+
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index 0468c058b5987..c5ef8ef54d3ce 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -359,6 +359,9 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
+
+ res->flags &= ~IORESOURCE_UNSET;
+ res->flags &= ~IORESOURCE_STARTALIGN;
++ if (resno >= PCI_BRIDGE_RESOURCES && resno <= PCI_BRIDGE_RESOURCE_END)
++ res->flags &= ~IORESOURCE_DISABLED;
++
+ pci_info(dev, "%s %pR: assigned\n", res_name, res);
+ if (resno < PCI_BRIDGE_RESOURCES)
+ pci_update_resource(dev, resno);
+--
+2.51.0
+
--- /dev/null
+From 3de6f4762747d006cbbb89125636bac42e05a84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 17:56:25 +0200
+Subject: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit ab81f2f79c683c94bac622aafafbe8232e547159 ]
+
+When devm_add_action_or_reset() fails, it calls the passed cleanup
+function. Hence the caller must not repeat that cleanup.
+
+Replace the "goto err_regulator_free" by the actual freeing, as there
+will never be a need again for a second user of this label.
+
+Fixes: 75996c92f4de309f ("PCI/pwrctrl: Add pwrctrl driver for PCI slots")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # V4H Sparrow Hawk
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://patch.msgid.link/7b1386e6162e70e6d631c87f6323d2ab971bc1c5.1755100324.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pwrctrl/slot.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/pwrctrl/slot.c b/drivers/pci/pwrctrl/slot.c
+index 6e138310b45b9..3320494b62d89 100644
+--- a/drivers/pci/pwrctrl/slot.c
++++ b/drivers/pci/pwrctrl/slot.c
+@@ -49,13 +49,14 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
+ ret = regulator_bulk_enable(slot->num_supplies, slot->supplies);
+ if (ret < 0) {
+ dev_err_probe(dev, ret, "Failed to enable slot regulators\n");
+- goto err_regulator_free;
++ regulator_bulk_free(slot->num_supplies, slot->supplies);
++ return ret;
+ }
+
+ ret = devm_add_action_or_reset(dev, devm_pci_pwrctrl_slot_power_off,
+ slot);
+ if (ret)
+- goto err_regulator_disable;
++ return ret;
+
+ clk = devm_clk_get_optional_enabled(dev, NULL);
+ if (IS_ERR(clk)) {
+@@ -70,13 +71,6 @@ static int pci_pwrctrl_slot_probe(struct platform_device *pdev)
+ return dev_err_probe(dev, ret, "Failed to register pwrctrl driver\n");
+
+ return 0;
+-
+-err_regulator_disable:
+- regulator_bulk_disable(slot->num_supplies, slot->supplies);
+-err_regulator_free:
+- regulator_bulk_free(slot->num_supplies, slot->supplies);
+-
+- return ret;
+ }
+
+ static const struct of_device_id pci_pwrctrl_slot_of_match[] = {
+--
+2.51.0
+
--- /dev/null
+From 536d608b339eda9affa78e78d5d244bc19d9a82a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 14:52:23 +0800
+Subject: PCI: qcom: Add equalization settings for 8.0 GT/s and 32.0 GT/s
+
+From: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
+
+[ Upstream commit 37bf0f4e39de9b53bc6f8d3702b021e2c6b5bae3 ]
+
+Add lane equalization setting for 8.0 GT/s and 32.0 GT/s to enhance link
+stability and avoid AER Correctable Errors reported on some platforms
+(eg. SA8775P).
+
+8.0 GT/s, 16.0 GT/s and 32.0 GT/s require the same equalization setting.
+This setting is programmed into a group of shadow registers, which can be
+switched to configure equalization for different speeds by writing 00b,
+01b and 10b to `RATE_SHADOW_SEL`.
+
+Hence, program equalization registers in a loop using link speed as index,
+so that equalization setting can be programmed for 8.0 GT/s, 16.0 GT/s
+and 32.0 GT/s.
+
+Fixes: 489f14be0e0a ("arm64: dts: qcom: sa8775p: Add pcie0 and pcie1 nodes")
+Co-developed-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
+Signed-off-by: Qiang Yu <qiang.yu@oss.qualcomm.com>
+Signed-off-by: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
+[mani: wrapped the warning to fit 100 columns, used post-increment for loop]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250904065225.1762793-2-ziyue.zhang@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.h | 1 -
+ drivers/pci/controller/dwc/pcie-qcom-common.c | 58 +++++++++++--------
+ drivers/pci/controller/dwc/pcie-qcom-common.h | 2 +-
+ drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 +-
+ drivers/pci/controller/dwc/pcie-qcom.c | 6 +-
+ 5 files changed, 41 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.h b/drivers/pci/controller/dwc/pcie-designware.h
+index 00f52d472dcdd..cc71a2d90cd48 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.h
++++ b/drivers/pci/controller/dwc/pcie-designware.h
+@@ -123,7 +123,6 @@
+ #define GEN3_RELATED_OFF_GEN3_EQ_DISABLE BIT(16)
+ #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_SHIFT 24
+ #define GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK GENMASK(25, 24)
+-#define GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT 0x1
+
+ #define GEN3_EQ_CONTROL_OFF 0x8A8
+ #define GEN3_EQ_CONTROL_OFF_FB_MODE GENMASK(3, 0)
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.c b/drivers/pci/controller/dwc/pcie-qcom-common.c
+index 3aad19b56da8f..0c6f4514f922f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-common.c
++++ b/drivers/pci/controller/dwc/pcie-qcom-common.c
+@@ -8,9 +8,11 @@
+ #include "pcie-designware.h"
+ #include "pcie-qcom-common.h"
+
+-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
++void qcom_pcie_common_set_equalization(struct dw_pcie *pci)
+ {
++ struct device *dev = pci->dev;
+ u32 reg;
++ u16 speed;
+
+ /*
+ * GEN3_RELATED_OFF register is repurposed to apply equalization
+@@ -19,32 +21,40 @@ void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci)
+ * determines the data rate for which these equalization settings are
+ * applied.
+ */
+- reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
+- reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
+- reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
+- reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
+- GEN3_RELATED_OFF_RATE_SHADOW_SEL_16_0GT);
+- dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
+
+- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
+- reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
+- GEN3_EQ_FMDC_N_EVALS |
+- GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
+- GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
+- reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
+- FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
+- FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
+- FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
+- dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
++ for (speed = PCIE_SPEED_8_0GT; speed <= pcie_link_speed[pci->max_link_speed]; speed++) {
++ if (speed > PCIE_SPEED_32_0GT) {
++ dev_warn(dev, "Skipped equalization settings for unsupported data rate\n");
++ break;
++ }
+
+- reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
+- reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
+- GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
+- GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
+- GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
+- dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
++ reg = dw_pcie_readl_dbi(pci, GEN3_RELATED_OFF);
++ reg &= ~GEN3_RELATED_OFF_GEN3_ZRXDC_NONCOMPL;
++ reg &= ~GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK;
++ reg |= FIELD_PREP(GEN3_RELATED_OFF_RATE_SHADOW_SEL_MASK,
++ speed - PCIE_SPEED_8_0GT);
++ dw_pcie_writel_dbi(pci, GEN3_RELATED_OFF, reg);
++
++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF);
++ reg &= ~(GEN3_EQ_FMDC_T_MIN_PHASE23 |
++ GEN3_EQ_FMDC_N_EVALS |
++ GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA |
++ GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA);
++ reg |= FIELD_PREP(GEN3_EQ_FMDC_T_MIN_PHASE23, 0x1) |
++ FIELD_PREP(GEN3_EQ_FMDC_N_EVALS, 0xd) |
++ FIELD_PREP(GEN3_EQ_FMDC_MAX_PRE_CUSROR_DELTA, 0x5) |
++ FIELD_PREP(GEN3_EQ_FMDC_MAX_POST_CUSROR_DELTA, 0x5);
++ dw_pcie_writel_dbi(pci, GEN3_EQ_FB_MODE_DIR_CHANGE_OFF, reg);
++
++ reg = dw_pcie_readl_dbi(pci, GEN3_EQ_CONTROL_OFF);
++ reg &= ~(GEN3_EQ_CONTROL_OFF_FB_MODE |
++ GEN3_EQ_CONTROL_OFF_PHASE23_EXIT_MODE |
++ GEN3_EQ_CONTROL_OFF_FOM_INC_INITIAL_EVAL |
++ GEN3_EQ_CONTROL_OFF_PSET_REQ_VEC);
++ dw_pcie_writel_dbi(pci, GEN3_EQ_CONTROL_OFF, reg);
++ }
+ }
+-EXPORT_SYMBOL_GPL(qcom_pcie_common_set_16gt_equalization);
++EXPORT_SYMBOL_GPL(qcom_pcie_common_set_equalization);
+
+ void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci)
+ {
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-common.h b/drivers/pci/controller/dwc/pcie-qcom-common.h
+index 7d88d29e47661..7f5ca2fd9a72f 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-common.h
++++ b/drivers/pci/controller/dwc/pcie-qcom-common.h
+@@ -8,7 +8,7 @@
+
+ struct dw_pcie;
+
+-void qcom_pcie_common_set_16gt_equalization(struct dw_pcie *pci);
++void qcom_pcie_common_set_equalization(struct dw_pcie *pci);
+ void qcom_pcie_common_set_16gt_lane_margining(struct dw_pcie *pci);
+
+ #endif
+diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c
+index bf7c6ac0f3e39..aaf060bf39d40 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c
++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c
+@@ -511,10 +511,10 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci)
+ goto err_disable_resources;
+ }
+
+- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+- qcom_pcie_common_set_16gt_equalization(pci);
++ qcom_pcie_common_set_equalization(pci);
++
++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
+ qcom_pcie_common_set_16gt_lane_margining(pci);
+- }
+
+ /*
+ * The physical address of the MMIO region which is exposed as the BAR
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index fbed7130d7475..a93740ae602f2 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -322,10 +322,10 @@ static int qcom_pcie_start_link(struct dw_pcie *pci)
+ {
+ struct qcom_pcie *pcie = to_qcom_pcie(pci);
+
+- if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT) {
+- qcom_pcie_common_set_16gt_equalization(pci);
++ qcom_pcie_common_set_equalization(pci);
++
++ if (pcie_link_speed[pci->max_link_speed] == PCIE_SPEED_16_0GT)
+ qcom_pcie_common_set_16gt_lane_margining(pci);
+- }
+
+ /* Enable Link Training state machine */
+ if (pcie->cfg->ops->ltssm_enable)
+--
+2.51.0
+
--- /dev/null
+From 3fc2ab9af40ee834182fae6144a4fd1ce2d50637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:32:55 +0530
+Subject: PCI: qcom: Restrict port parsing only to PCIe bridge child nodes
+
+From: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+
+[ Upstream commit 45df22935bdc6bbddf87f38a57ae7257244cf3cf ]
+
+The qcom_pcie_parse_ports() function currently iterates over all available
+child nodes of the PCIe controller's device tree node. This includes
+unrelated nodes such as OPP (Operating Performance Points) nodes, which do
+not contain the expected 'reset' and 'phy' properties. As a result, parsing
+fails and the driver falls back to the legacy method of parsing the
+controller node directly. However, this fallback also fails when properties
+are shifted to the Root Port node, leading to probe failure.
+
+Fix this by restricting the parsing logic to only consider child nodes with
+device_type = "pci", which is the expected and required property for PCIe
+bridge nodes as per the pci-bus-common.yaml dtschema.
+
+Fixes: a2fbecdbbb9d ("PCI: qcom: Add support for parsing the new Root Port binding")
+Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250826-pakala-v3-3-721627bd5bb0@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 294babe1816e4..fbed7130d7475 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1740,6 +1740,8 @@ static int qcom_pcie_parse_ports(struct qcom_pcie *pcie)
+ int ret = -ENOENT;
+
+ for_each_available_child_of_node_scoped(dev->of_node, of_port) {
++ if (!of_node_is_type(of_port, "pci"))
++ continue;
+ ret = qcom_pcie_parse_port(pcie, of_port);
+ if (ret)
+ goto err_port_del;
+--
+2.51.0
+
--- /dev/null
+From 4832cd2264b1bab60f0d074b036900d39bae1b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 15:45:58 +0200
+Subject: PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
+Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
+domain, after reset has been asserted by writing a matching reset bit into
+register SRCR, it is mandatory to wait 1ms.
+
+Because it is the controller driver which can determine whether or not the
+controller is in HSC domain based on its compatible string, add the missing
+delay in the controller driver.
+
+This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
+whether S4 is affected as well. This patch does apply the extra delay on
+R-Car S4 as well.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+[mani: added the missing r-b tag from Krzysztof]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Link: https://patch.msgid.link/20250919134644.208098-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 18055807a4f5f..d9a42fa51520a 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ return ret;
+ }
+
+- if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
++ if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
+ reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ /*
++ * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
++ * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
++ * indicates that for peripherals in HSC domain, after
++ * reset has been asserted by writing a matching reset bit
++ * into register SRCR, it is mandatory to wait 1ms.
++ */
++ fsleep(1000);
++ }
+
+ val = readl(rcar->base + PCIEMSR0);
+ if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
+--
+2.51.0
+
--- /dev/null
+From 6627fc2c55b47e1049b4ba3ca4e639f52c55c62f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 02:55:45 +0200
+Subject: PCI: rcar-gen4: Assure reset occurs before DBI access
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]
+
+Assure the reset is latched and the core is ready for DBI access. On R-Car
+V4H, the PCIe reset is asynchronous and does not take effect immediately,
+but needs a short time to complete. In case DBI access happens in that
+short time, that access generates an SError. Make sure that condition can
+never happen, read back the state of the reset, which should turn the
+asynchronous reset into a synchronous one, and wait a little over 1ms to
+add additional safety margin.
+
+Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250924005610.96484-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index d9a42fa51520a..9ac3f0f11adad 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
+ if (ret)
+ goto err_unprepare;
+
++ /*
++ * Assure the reset is latched and the core is ready for DBI access.
++ * On R-Car V4H, the PCIe reset is asynchronous and does not take
++ * effect immediately, but needs a short time to complete. In case
++ * DBI access happens in that short time, that access generates an
++ * SError. To make sure that condition can never happen, read back the
++ * state of the reset, which should turn the asynchronous reset into
++ * synchronous one, and wait a little over 1ms to add additional
++ * safety margin.
++ */
++ reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
++ fsleep(1000);
++
+ if (rcar->drvdata->additional_common_init)
+ rcar->drvdata->additional_common_init(rcar);
+
+--
+2.51.0
+
--- /dev/null
+From 5fbde2a082a2300db38e170175cad2147f41ccc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 01:58:40 +0200
+Subject: PCI: rcar-gen4: Fix inverted break condition in PHY initialization
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]
+
+R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
+Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
+figure indicates that register 0xf8 should be polled until bit 18 becomes
+set to 1.
+
+Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
+set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
+break condition is inverted and returns when register 0xf8, bit 18 is set
+to 0, which in most cases means immediately. In case
+CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
+readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
+afterward never read register 0xf8, bit 18 as 0, which leads to timeout
+and failure to start the PCIe controller.
+
+Fix this by inverting the poll condition to match the reference manual
+initialization sequence.
+
+Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250915235910.47768-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+index 9ac3f0f11adad..c16c4c2be4993 100644
+--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
++++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
+ val &= ~APP_HOLD_PHY_RST;
+ writel(val, rcar->base + PCIERSTCTRL1);
+
+- ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
++ ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
+ if (ret < 0)
+ return ret;
+
+--
+2.51.0
+
--- /dev/null
+From 8c4323ad821256c6f8d4b2878265168ab2568e79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 17:44:47 +0300
+Subject: PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit d3fee10e40a938331e2aae34348691136db31304 ]
+
+Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to
+msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because
+the object of type struct irq_domain_info passed to:
+
+msi_create_parent_irq_domain() ->
+ irq_domain_instantiate()() ->
+ __irq_domain_instantiate()
+
+has no reference to the parent IRQ domain. Using msi->domain->parent as an
+argument for generic_handle_domain_irq() leads to below error:
+
+ "Unable to handle kernel NULL pointer dereference at virtual address"
+
+This error was identified while switching the upcoming RZ/G3S PCIe host
+controller driver to msi_create_parent_irq_domain() (which was using a
+similar pattern to handle MSIs (see link section)), but it was not tested
+on hardware using the pcie-rcar-host controller driver due to lack of
+hardware.
+
+Fixes: dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Nam Cao <namcao@linutronix.de>
+Link: https://lore.kernel.org/all/20250704161410.3931884-6-claudiu.beznea.uj@bp.renesas.com
+Link: https://patch.msgid.link/20250809144447.3939284-1-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rcar-host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
+index fe288fd770c49..4780e0109e583 100644
+--- a/drivers/pci/controller/pcie-rcar-host.c
++++ b/drivers/pci/controller/pcie-rcar-host.c
+@@ -584,7 +584,7 @@ static irqreturn_t rcar_pcie_msi_irq(int irq, void *data)
+ unsigned int index = find_first_bit(®, 32);
+ int ret;
+
+- ret = generic_handle_domain_irq(msi->domain->parent, index);
++ ret = generic_handle_domain_irq(msi->domain, index);
+ if (ret) {
+ /* Unknown MSI, just clear it */
+ dev_dbg(dev, "unexpected MSI\n");
+--
+2.51.0
+
--- /dev/null
+From 1a9024d125e0bb4e0802ffdf658abcd5c8dd22e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 467ddc701adce..bb88767a37979 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1344,7 +1344,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 687d6315a9ba570d7bb598f4e339b356fad574a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 11:30:22 +0200
+Subject: PCI: tegra194: Fix duplicate PLL disable in
+ pex_ep_event_pex_rst_assert()
+
+From: Nagarjuna Kristam <nkristam@nvidia.com>
+
+[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
+
+During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
+called twice.
+
+pex_ep_event_pex_rst_assert() should do the opposite of
+pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
+tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
+tegra_pcie_bpmp_set_pll_state() call should instead be a call to
+tegra_pcie_bpmp_set_ctrl_state().
+
+With this, the uninitialization sequence also matches that of
+tegra_pcie_unconfig_controller().
+
+Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
+Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
+[cassel: improve commit log]
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 4f26086f25daf..0c0734aa14b68 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1722,9 +1722,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
+ ret);
+ }
+
+- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
+ if (ret)
+- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
+
+ pcie->ep_state = EP_STATE_DISABLED;
+ dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
+--
+2.51.0
+
--- /dev/null
+From a5c01cacc40950fb11cd299334cfbaf0542be443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:10:57 +0300
+Subject: PCI: Use pci_release_resource() instead of release_resource()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 3baeae36039afc233d4a42d6ff4aa7019892619f ]
+
+A few places in setup-bus.c call release_resource() directly and end up
+duplicating functionality from pci_release_resource() such as parent check,
+logging, and clearing the resource. Worse yet, the way the resource is
+cleared is inconsistent between different sites.
+
+Convert release_resource() calls into pci_release_resource() to remove code
+duplication. This will also make the resource start, end, and flags
+behavior consistent, i.e., start address is cleared, and only
+IORESOURCE_UNSET is asserted for the resource.
+
+While at it, eliminate the unnecessary initialization of idx variable in
+pci_bridge_release_resources().
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250829131113.36754-9-ilpo.jarvinen@linux.intel.com
+Stable-dep-of: 8278c6914306 ("PCI: Preserve bridge window resource type flags")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/setup-bus.c | 46 +++++++++++++----------------------------
+ drivers/pci/setup-res.c | 11 +++++++---
+ include/linux/pci.h | 2 +-
+ 3 files changed, 23 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index c992707a8ebd6..203c8ebef7029 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -431,8 +431,6 @@ static void __assign_resources_sorted(struct list_head *head,
+ struct pci_dev_resource *dev_res, *tmp_res, *dev_res2;
+ struct resource *res;
+ struct pci_dev *dev;
+- const char *res_name;
+- int idx;
+ unsigned long fail_type;
+ resource_size_t add_align, align;
+
+@@ -540,14 +538,7 @@ static void __assign_resources_sorted(struct list_head *head,
+ res = dev_res->res;
+ dev = dev_res->dev;
+
+- if (!res->parent)
+- continue;
+-
+- idx = pci_resource_num(dev, res);
+- res_name = pci_resource_name(dev, idx);
+- pci_dbg(dev, "%s %pR: releasing\n", res_name, res);
+-
+- release_resource(res);
++ pci_release_resource(dev, pci_resource_num(dev, res));
+ restore_dev_resource(dev_res);
+ }
+ /* Restore start/end/flags from saved list */
+@@ -1716,7 +1707,7 @@ static void pci_bridge_release_resources(struct pci_bus *bus,
+ struct resource *r;
+ unsigned int old_flags;
+ struct resource *b_res;
+- int idx = 1;
++ int idx, ret;
+
+ b_res = &dev->resource[PCI_BRIDGE_RESOURCES];
+
+@@ -1750,21 +1741,18 @@ static void pci_bridge_release_resources(struct pci_bus *bus,
+
+ /* If there are children, release them all */
+ release_child_resources(r);
+- if (!release_resource(r)) {
+- type = old_flags = r->flags & PCI_RES_TYPE_MASK;
+- pci_info(dev, "resource %d %pR released\n",
+- PCI_BRIDGE_RESOURCES + idx, r);
+- /* Keep the old size */
+- resource_set_range(r, 0, resource_size(r));
+- r->flags = 0;
+
+- /* Avoiding touch the one without PREF */
+- if (type & IORESOURCE_PREFETCH)
+- type = IORESOURCE_PREFETCH;
+- __pci_setup_bridge(bus, type);
+- /* For next child res under same bridge */
+- r->flags = old_flags;
+- }
++ type = old_flags = r->flags & PCI_RES_TYPE_MASK;
++ ret = pci_release_resource(dev, PCI_BRIDGE_RESOURCES + idx);
++ if (ret)
++ return;
++
++ /* Avoiding touch the one without PREF */
++ if (type & IORESOURCE_PREFETCH)
++ type = IORESOURCE_PREFETCH;
++ __pci_setup_bridge(bus, type);
++ /* For next child res under same bridge */
++ r->flags = old_flags;
+ }
+
+ enum release_type {
+@@ -2409,7 +2397,6 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type)
+ for (i = PCI_BRIDGE_RESOURCES; i < PCI_BRIDGE_RESOURCE_END;
+ i++) {
+ struct resource *res = &bridge->resource[i];
+- const char *res_name = pci_resource_name(bridge, i);
+
+ if ((res->flags ^ type) & PCI_RES_TYPE_MASK)
+ continue;
+@@ -2422,12 +2409,7 @@ int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type)
+ if (ret)
+ goto cleanup;
+
+- pci_info(bridge, "%s %pR: releasing\n", res_name, res);
+-
+- if (res->parent)
+- release_resource(res);
+- res->start = 0;
+- res->end = 0;
++ pci_release_resource(bridge, i);
+ break;
+ }
+ if (i == PCI_BRIDGE_RESOURCE_END)
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index d2b3ed51e8804..0468c058b5987 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -406,20 +406,25 @@ int pci_reassign_resource(struct pci_dev *dev, int resno,
+ return 0;
+ }
+
+-void pci_release_resource(struct pci_dev *dev, int resno)
++int pci_release_resource(struct pci_dev *dev, int resno)
+ {
+ struct resource *res = pci_resource_n(dev, resno);
+ const char *res_name = pci_resource_name(dev, resno);
++ int ret;
+
+ if (!res->parent)
+- return;
++ return 0;
+
+ pci_info(dev, "%s %pR: releasing\n", res_name, res);
+
+- release_resource(res);
++ ret = release_resource(res);
++ if (ret)
++ return ret;
+ res->end = resource_size(res) - 1;
+ res->start = 0;
+ res->flags |= IORESOURCE_UNSET;
++
++ return 0;
+ }
+ EXPORT_SYMBOL(pci_release_resource);
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 59876de13860d..275df40587672 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1417,7 +1417,7 @@ void pci_reset_secondary_bus(struct pci_dev *dev);
+ void pcibios_reset_secondary_bus(struct pci_dev *dev);
+ void pci_update_resource(struct pci_dev *dev, int resno);
+ int __must_check pci_assign_resource(struct pci_dev *dev, int i);
+-void pci_release_resource(struct pci_dev *dev, int resno);
++int pci_release_resource(struct pci_dev *dev, int resno);
+ static inline int pci_rebar_bytes_to_size(u64 bytes)
+ {
+ bytes = roundup_pow_of_two(bytes);
+--
+2.51.0
+
--- /dev/null
+From 4e98d67dbc93847a078108be8e3b95b3035d37f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 16:34:37 +0300
+Subject: PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit b26fc701a25195134ff0327709a0421767c4c7b2 ]
+
+There is a typo so we accidentally return positive EINVAL instead of
+negative -EINVAL. Add the missing '-' character.
+
+Fixes: 6aceb36f17ab ("PCI: xgene-msi: Restructure handler setup/teardown")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Link: https://patch.msgid.link/aIzCbVd93ivPinne@stanley.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-xgene-msi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
+index 0a37a3f1809c5..654639bccd10e 100644
+--- a/drivers/pci/controller/pci-xgene-msi.c
++++ b/drivers/pci/controller/pci-xgene-msi.c
+@@ -311,7 +311,7 @@ static int xgene_msi_handler_setup(struct platform_device *pdev)
+ msi_val = xgene_msi_int_read(xgene_msi, i);
+ if (msi_val) {
+ dev_err(&pdev->dev, "Failed to clear spurious IRQ\n");
+- return EINVAL;
++ return -EINVAL;
+ }
+
+ irq = platform_get_irq(pdev, i);
+--
+2.51.0
+
--- /dev/null
+From c5543721c706f2aa3cf48aae9b7bfada15391fb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 369e77ad5f13f..8f14cb324e018 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -97,7 +97,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From 5886e33129c90b25b5f6d1cced563a7154c6fdb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:30:27 +0800
+Subject: perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
+
+From: Dapeng Mi <dapeng1.mi@linux.intel.com>
+
+[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ]
+
+When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
+ access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.
+
+[ 55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
+[ 55.611280] Call Trace:
+[ 55.611282] <TASK>
+[ 55.611284] ? intel_pmu_config_acr+0x87/0x160
+[ 55.611289] intel_pmu_enable_acr+0x6d/0x80
+[ 55.611291] intel_pmu_enable_event+0xce/0x460
+[ 55.611293] x86_pmu_start+0x78/0xb0
+[ 55.611297] x86_pmu_enable+0x218/0x3a0
+[ 55.611300] ? x86_pmu_enable+0x121/0x3a0
+[ 55.611302] perf_pmu_enable+0x40/0x50
+[ 55.611307] ctx_resched+0x19d/0x220
+[ 55.611309] __perf_install_in_context+0x284/0x2f0
+[ 55.611311] ? __pfx_remote_function+0x10/0x10
+[ 55.611314] remote_function+0x52/0x70
+[ 55.611317] ? __pfx_remote_function+0x10/0x10
+[ 55.611319] generic_exec_single+0x84/0x150
+[ 55.611323] smp_call_function_single+0xc5/0x1a0
+[ 55.611326] ? __pfx_remote_function+0x10/0x10
+[ 55.611329] perf_install_in_context+0xd1/0x1e0
+[ 55.611331] ? __pfx___perf_install_in_context+0x10/0x10
+[ 55.611333] __do_sys_perf_event_open+0xa76/0x1040
+[ 55.611336] __x64_sys_perf_event_open+0x26/0x30
+[ 55.611337] x64_sys_call+0x1d8e/0x20c0
+[ 55.611339] do_syscall_64+0x4f/0x120
+[ 55.611343] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
+thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
+which requires to enable auto counter reload on GP counter 0.
+
+The root cause of causing this issue is the check for auto counter
+reload (ACR) counter mask from user space is incorrect in
+intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
+mask from user space could be set into hw.config1 and then written into
+CFG_B MSRs and trigger the MSR access warning.
+
+e.g., User may create a perf event with ACR counter mask (config2=0xcb),
+and there is only 1 event created, so "cpuc->n_events" is 1.
+
+The correct check condition should be "i + idx >= cpuc->n_events"
+instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
+the counter mask would traverse twice and an invalid "cpuc->assign[1]"
+bit (bit 0) is set into hw.config1 and cause MSR accessing error.
+
+Besides, also check if the ACR counter mask corresponding events are
+ACR events. If not, filter out these counter mask. If a event is not a
+ACR event, it could be scheduled to an HW counter which doesn't support
+ACR. It's invalid to add their counter index in ACR counter mask.
+
+Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
+user could set any invalid ACR counter mask and the warning message
+could mislead users.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/r/20250820023032.17128-3-dapeng1.mi@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index c2fb729c270ec..15da60cf69f20 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc)
+ if (event->group_leader != leader->group_leader)
+ break;
+ for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) {
+- if (WARN_ON_ONCE(i + idx > cpuc->n_events))
++ if (i + idx >= cpuc->n_events ||
++ !is_acr_event_group(cpuc->event_list[i + idx]))
+ return;
+ __set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1);
+ }
+--
+2.51.0
+
--- /dev/null
+From 533f06902f4227beb1800e9095a4ab6584c6089c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:30:26 +0800
+Subject: perf/x86/intel: Use early_initcall() to hook bts_init()
+
+From: Dapeng Mi <dapeng1.mi@linux.intel.com>
+
+[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ]
+
+After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS
+ initialization from PEBS initialization")' is introduced, x86_pmu.bts
+would initialized in bts_init() which is hooked by arch_initcall().
+
+Whereas init_hw_perf_events() is hooked by early_initcall(). Once the
+core PMU is initialized, nmi watchdog initialization is called
+immediately before bts_init() is called. It leads to the BTS buffer is
+not really initialized since bts_init() is not called and x86_pmu.bts is
+still false at that time. Worse, BTS buffer would never be initialized
+then unless all core PMU events are freed and reserve_ds_buffers()
+is called again.
+
+Thus aligning with init_hw_perf_events(), use early_initcall() to hook
+bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog
+initialization.
+
+Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")
+Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/r/20250820023032.17128-2-dapeng1.mi@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/bts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
+index 61da6b8a3d519..cbac54cb3a9ec 100644
+--- a/arch/x86/events/intel/bts.c
++++ b/arch/x86/events/intel/bts.c
+@@ -643,4 +643,4 @@ static __init int bts_init(void)
+
+ return perf_pmu_register(&bts_pmu, "intel_bts", -1);
+ }
+-arch_initcall(bts_init);
++early_initcall(bts_init);
+--
+2.51.0
+
--- /dev/null
+From 9afe56ecd3d25458188ef21c43939f8394d47fa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 07:23:22 +0000
+Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
+
+The boot firmware may disable the U3 port early during boot and leave it
+up to the controller or PHY driver to re-enable U3 when needed.
+
+The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
+something the Rockchip Naneng Combo PHY driver never does for RK3568.
+This may result in USB 3.0 ports being limited to only using USB 2.0 or
+in special cases not working at all on RK3568.
+
+Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
+when a PHY with PHY_TYPE_USB3 mode is used.
+
+Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+index ce91fb1d51671..17c6310f4b54b 100644
+--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+@@ -137,6 +137,8 @@ struct rockchip_combphy_grfcfg {
+ struct combphy_reg pipe_xpcs_phy_ready;
+ struct combphy_reg pipe_pcie1l0_sel;
+ struct combphy_reg pipe_pcie1l1_sel;
++ struct combphy_reg u3otg0_port_en;
++ struct combphy_reg u3otg1_port_en;
+ };
+
+ struct rockchip_combphy_cfg {
+@@ -594,6 +596,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
++ switch (priv->id) {
++ case 0:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
++ break;
++ case 1:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
++ break;
++ }
+ break;
+
+ case PHY_TYPE_SATA:
+@@ -737,6 +747,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
+ /* pipe-grf */
+ .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 },
+ .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 },
++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 },
++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 },
+ };
+
+ static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
+--
+2.51.0
+
--- /dev/null
+From 45d99aac90afc2a6c7ae2667bb761aea8bf10d7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 21:26:05 +0200
+Subject: pid: use ns_capable_noaudit() when determining net sysctl permissions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian Göttsche <cgzones@googlemail.com>
+
+[ Upstream commit b9cb7e59ac4ae68940347ebfc41e0436d32d3c6e ]
+
+The capability check should not be audited since it is only being used
+to determine the inode permissions. A failed check does not indicate a
+violation of security policy but, when an LSM is enabled, a denial audit
+message was being generated.
+
+The denial audit message can either lead to the capability being
+unnecessarily allowed in a security policy, or being silenced potentially
+masking a legitimate capability check at a later point in time.
+
+Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when
+determining net sysctl permissions")
+
+Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace")
+CC: Christian Brauner <brauner@kernel.org>
+CC: linux-security-module@vger.kernel.org
+CC: selinux@vger.kernel.org
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Acked-by: Serge Hallyn <serge@hallyn.com>
+Reviewed-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/pid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/pid.c b/kernel/pid.c
+index c45a28c16cd25..d94ce02505012 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head,
+ container_of(head->set, struct pid_namespace, set);
+ int mode = table->mode;
+
+- if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) ||
++ if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) ||
+ uid_eq(current_euid(), make_kuid(pidns->user_ns, 0)))
+ mode = (mode & S_IRWXU) >> 6;
+ else if (in_egroup_p(make_kgid(pidns->user_ns, 0)))
+--
+2.51.0
+
--- /dev/null
+From 55e54a6546b697d6c4b89df6f72a703b66db06f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:19:15 +0800
+Subject: pinctrl: eswin: Fix regulator error check and Kconfig dependency
+
+From: Yulin Lu <luyulin@eswincomputing.com>
+
+[ Upstream commit a6a2f50ab1721343ee2d5d2be888709aa886e3aa ]
+
+Smatch reported the following warning in eic7700_pinctrl_probe():
+
+ drivers/pinctrl/pinctrl-eic7700.c:638 eic7700_pinctrl_probe()
+ warn: passing zero to 'PTR_ERR'
+
+The root cause is that devm_regulator_get() may return NULL when
+CONFIG_REGULATOR is disabled. In such case, IS_ERR_OR_NULL() triggers
+PTR_ERR(NULL) which evaluates to 0, leading to passing a success code
+as an error.
+
+However, this driver cannot work without a regulator. To fix this:
+
+ - Change the check from IS_ERR_OR_NULL() to IS_ERR()
+ - Update Kconfig to explicitly select REGULATOR and
+ REGULATOR_FIXED_VOLTAGE, ensuring that the regulator framework is
+ always available.
+
+This resolves the Smatch warning and enforces the correct dependency.
+
+Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/linux-gpio/aKRGiZ-fai0bv0tG@stanley.mountain/
+Signed-off-by: Yulin Lu <luyulin@eswincomputing.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/Kconfig | 2 ++
+ drivers/pinctrl/pinctrl-eic7700.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
+index be1ca8e85754b..0402626c4b98b 100644
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -211,6 +211,8 @@ config PINCTRL_EIC7700
+ depends on ARCH_ESWIN || COMPILE_TEST
+ select PINMUX
+ select GENERIC_PINCONF
++ select REGULATOR
++ select REGULATOR_FIXED_VOLTAGE
+ help
+ This driver support for the pin controller in ESWIN's EIC7700 SoC,
+ which supports pin multiplexing, pin configuration,and rgmii voltage
+diff --git a/drivers/pinctrl/pinctrl-eic7700.c b/drivers/pinctrl/pinctrl-eic7700.c
+index 4874b55323439..ffcd0ec5c2dc6 100644
+--- a/drivers/pinctrl/pinctrl-eic7700.c
++++ b/drivers/pinctrl/pinctrl-eic7700.c
+@@ -634,7 +634,7 @@ static int eic7700_pinctrl_probe(struct platform_device *pdev)
+ return PTR_ERR(pc->base);
+
+ regulator = devm_regulator_get(dev, "vrgmii");
+- if (IS_ERR_OR_NULL(regulator)) {
++ if (IS_ERR(regulator)) {
+ return dev_err_probe(dev, PTR_ERR(regulator),
+ "failed to get vrgmii regulator\n");
+ }
+--
+2.51.0
+
--- /dev/null
+From 407d1fa7dbfb0c4f2d8ab82fd6df0da27725db16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 9171de657f978..a75762e4d2641 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From 5c21eb67a8ee1f348f4ca32929855bbc6ab1da02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 17:08:13 +0100
+Subject: pinctrl: renesas: rzg2l: Fix invalid unsigned return in
+ rzg3s_oen_read()
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]
+
+rzg3s_oen_read() returns a u32 value, but previously propagated a negative
+error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
+positive value due to unsigned conversion. This caused incorrect
+output-enable reporting for certain pins.
+
+Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
+as "output enabled" in the pinconf-pins debugfs file. With this fix, only
+P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
+hardware manual.
+
+Fix this by returning 0 when the OEN bit lookup fails, treating the pin
+as output-disabled by default.
+
+Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250709160819.306875-2-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index c52263c2a7b09..22bc5b8f65fde 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1124,7 +1124,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
+
+ bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
+ if (bit < 0)
+- return bit;
++ return 0;
+
+ return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
+ }
+--
+2.51.0
+
--- /dev/null
+From e6dcd02ab8b1826ac52ff7ca0718533e0e3e8a81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index 29d16c9c1bd19..3a742f74ecd1d 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From 03d92778f3502f21704349fc1749ba91aaf6fb3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:58:23 +0300
+Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
+ probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
+
+The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
+would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
+that the pointer is valid.
+
+Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
+index 22fe9e631f8aa..5730076846e1b 100644
+--- a/drivers/devfreq/mtk-cci-devfreq.c
++++ b/drivers/devfreq/mtk-cci-devfreq.c
+@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
+ out_free_resources:
+ if (regulator_is_enabled(drv->proc_reg))
+ regulator_disable(drv->proc_reg);
+- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
++ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
++ regulator_is_enabled(drv->sram_reg))
+ regulator_disable(drv->sram_reg);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 452edfd767a5acd169f0f17e5d0513a9ed62a2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 May 2025 15:38:08 +0200
+Subject: PM / devfreq: rockchip-dfi: double count on RK3588
+
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+
+[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]
+
+On RK3588 with LPDDR4X memory, the cycle count as returned by
+
+ perf stat -a -e rockchip_ddr/cycles/ sleep 1
+
+consistently reads half as much as what the actual DDR frequency is at.
+For a LPDDR4X module running at 2112MHz, I get more like 1056059916
+cycles per second, which is almost bang-on half what it should be. No,
+I'm not mixing up megatransfers and megahertz.
+
+Consulting the downstream driver, this appears to be because the RK3588
+hardware specifically (and RK3528 as well, for future reference) needs a
+multiplier of 2 to get to the correct frequency with everything but
+LPDDR5.
+
+The RK3588's actual memory bandwidth measurements in MB/s are correct
+however, as confirmed with stress-ng --stream. This makes me think the
+access counters are not affected in the same way. This tracks with the
+vendor kernel not multiplying the access counts either.
+
+Solve this by adding a new member to the dfi struct, which each SoC can
+set to whatever they want, but defaults to 1 if left unset by the SoC
+init functions. The event_get_count op can then use this multiplier if
+the cycle count is requested.
+
+The cycle multiplier is not used in rockchip_dfi_get_event because the
+vendor driver doesn't use it there either, and we don't do other actual
+bandwidth unit conversion stuff in there anyway.
+
+Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://lore.kernel.org/lkml/20250530-rk3588-dfi-improvements-v1-1-6e077c243a95@collabora.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
+index 0470d7c175f4f..54effb6351965 100644
+--- a/drivers/devfreq/event/rockchip-dfi.c
++++ b/drivers/devfreq/event/rockchip-dfi.c
+@@ -116,6 +116,7 @@ struct rockchip_dfi {
+ int buswidth[DMC_MAX_CHANNELS];
+ int ddrmon_stride;
+ bool ddrmon_ctrl_single;
++ unsigned int count_multiplier; /* number of data clocks per count */
+ };
+
+ static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
+@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
+
+ switch (event->attr.config) {
+ case PERF_EVENT_CYCLES:
+- count = total.c[0].clock_cycles;
++ count = total.c[0].clock_cycles * dfi->count_multiplier;
+ break;
+ case PERF_EVENT_READ_BYTES:
+ for (i = 0; i < dfi->max_channels; i++)
+@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
+ break;
+ }
+
++ if (!dfi->count_multiplier)
++ dfi->count_multiplier = 1;
++
+ ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
+ if (ret)
+ return ret;
+@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
+ dfi->max_channels = 4;
+
+ dfi->ddrmon_stride = 0x4000;
++ dfi->count_multiplier = 2;
+
+ return 0;
+ };
+--
+2.51.0
+
--- /dev/null
+From 46625e12d2f17daf6271892e5c583f340bcd207c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 2ea6e05e6ec90..c883b01ffbddc 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -724,8 +724,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From 18786673429d0b9080b084a993ca7a7bc19bc315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 20:32:59 +0800
+Subject: power: supply: cw2015: Fix a alignment coding style issue
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
+
+Fix the checkpatch warning:
+CHECK: Alignment should match open parenthesis
+
+Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index f63c3c4104515..382dff8805c62 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
+ if (!cw_bat->battery_workqueue)
+ return -ENOMEM;
+
+- devm_delayed_work_autocancel(&client->dev,
+- &cw_bat->battery_delay_work, cw_bat_work);
++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ queue_delayed_work(cw_bat->battery_workqueue,
+ &cw_bat->battery_delay_work, msecs_to_jiffies(10));
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 6e2379bd37e97dc4a382955e67af7236b521f78d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 20:06:47 +0300
+Subject: power: supply: max77705_charger: refactoring: rename charger to chg
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit d84510db8c1414b67167cdc452103c1f429588cc ]
+
+Rename struct max77705_charger_data variable to chg for consistency.
+
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max77705_charger.c | 80 ++++++++++++-------------
+ 1 file changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
+index 3b75c82b9b9ea..7855f890e0a9f 100644
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -42,9 +42,9 @@ static enum power_supply_property max77705_charger_props[] = {
+
+ static int max77705_chgin_irq(void *irq_drv_data)
+ {
+- struct max77705_charger_data *charger = irq_drv_data;
++ struct max77705_charger_data *chg = irq_drv_data;
+
+- queue_work(charger->wqueue, &charger->chgin_work);
++ queue_work(chg->wqueue, &chg->chgin_work);
+
+ return 0;
+ }
+@@ -109,19 +109,19 @@ static int max77705_get_online(struct regmap *regmap, int *val)
+ return 0;
+ }
+
+-static int max77705_check_battery(struct max77705_charger_data *charger, int *val)
++static int max77705_check_battery(struct max77705_charger_data *chg, int *val)
+ {
+ unsigned int reg_data;
+ unsigned int reg_data2;
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+
+ regmap_read(regmap, MAX77705_CHG_REG_INT_OK, ®_data);
+
+- dev_dbg(charger->dev, "CHG_INT_OK(0x%x)\n", reg_data);
++ dev_dbg(chg->dev, "CHG_INT_OK(0x%x)\n", reg_data);
+
+ regmap_read(regmap, MAX77705_CHG_REG_DETAILS_00, ®_data2);
+
+- dev_dbg(charger->dev, "CHG_DETAILS00(0x%x)\n", reg_data2);
++ dev_dbg(chg->dev, "CHG_DETAILS00(0x%x)\n", reg_data2);
+
+ if ((reg_data & MAX77705_BATP_OK) || !(reg_data2 & MAX77705_BATP_DTLS))
+ *val = true;
+@@ -131,9 +131,9 @@ static int max77705_check_battery(struct max77705_charger_data *charger, int *va
+ return 0;
+ }
+
+-static int max77705_get_charge_type(struct max77705_charger_data *charger, int *val)
++static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
+ {
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+ unsigned int reg_data;
+
+ regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+@@ -159,9 +159,9 @@ static int max77705_get_charge_type(struct max77705_charger_data *charger, int *
+ return 0;
+ }
+
+-static int max77705_get_status(struct max77705_charger_data *charger, int *val)
++static int max77705_get_status(struct max77705_charger_data *chg, int *val)
+ {
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+ unsigned int reg_data;
+
+ regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+@@ -234,10 +234,10 @@ static int max77705_get_vbus_state(struct regmap *regmap, int *value)
+ return 0;
+ }
+
+-static int max77705_get_battery_health(struct max77705_charger_data *charger,
++static int max77705_get_battery_health(struct max77705_charger_data *chg,
+ int *value)
+ {
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+ unsigned int bat_dtls;
+
+ regmap_read(regmap, MAX77705_CHG_REG_DETAILS_01, &bat_dtls);
+@@ -245,16 +245,16 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
+
+ switch (bat_dtls) {
+ case MAX77705_BATTERY_NOBAT:
+- dev_dbg(charger->dev, "%s: No battery and the charger is suspended\n",
++ dev_dbg(chg->dev, "%s: No battery and the chg is suspended\n",
+ __func__);
+ *value = POWER_SUPPLY_HEALTH_NO_BATTERY;
+ break;
+ case MAX77705_BATTERY_PREQUALIFICATION:
+- dev_dbg(charger->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n",
++ dev_dbg(chg->dev, "%s: battery is okay but its voltage is low(~VPQLB)\n",
+ __func__);
+ break;
+ case MAX77705_BATTERY_DEAD:
+- dev_dbg(charger->dev, "%s: battery dead\n", __func__);
++ dev_dbg(chg->dev, "%s: battery dead\n", __func__);
+ *value = POWER_SUPPLY_HEALTH_DEAD;
+ break;
+ case MAX77705_BATTERY_GOOD:
+@@ -262,11 +262,11 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
+ *value = POWER_SUPPLY_HEALTH_GOOD;
+ break;
+ case MAX77705_BATTERY_OVERVOLTAGE:
+- dev_dbg(charger->dev, "%s: battery ovp\n", __func__);
++ dev_dbg(chg->dev, "%s: battery ovp\n", __func__);
+ *value = POWER_SUPPLY_HEALTH_OVERVOLTAGE;
+ break;
+ default:
+- dev_dbg(charger->dev, "%s: battery unknown\n", __func__);
++ dev_dbg(chg->dev, "%s: battery unknown\n", __func__);
+ *value = POWER_SUPPLY_HEALTH_UNSPEC_FAILURE;
+ break;
+ }
+@@ -274,9 +274,9 @@ static int max77705_get_battery_health(struct max77705_charger_data *charger,
+ return 0;
+ }
+
+-static int max77705_get_health(struct max77705_charger_data *charger, int *val)
++static int max77705_get_health(struct max77705_charger_data *chg, int *val)
+ {
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+ int ret, is_online = 0;
+
+ ret = max77705_get_online(regmap, &is_online);
+@@ -287,15 +287,15 @@ static int max77705_get_health(struct max77705_charger_data *charger, int *val)
+ if (ret || (*val != POWER_SUPPLY_HEALTH_GOOD))
+ return ret;
+ }
+- return max77705_get_battery_health(charger, val);
++ return max77705_get_battery_health(chg, val);
+ }
+
+-static int max77705_get_input_current(struct max77705_charger_data *charger,
++static int max77705_get_input_current(struct max77705_charger_data *chg,
+ int *val)
+ {
+ unsigned int reg_data;
+ int get_current = 0;
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+
+ regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+
+@@ -313,11 +313,11 @@ static int max77705_get_input_current(struct max77705_charger_data *charger,
+ return 0;
+ }
+
+-static int max77705_get_charge_current(struct max77705_charger_data *charger,
++static int max77705_get_charge_current(struct max77705_charger_data *chg,
+ int *val)
+ {
+ unsigned int reg_data;
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+
+ regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data);
+ reg_data &= MAX77705_CHG_CC;
+@@ -327,12 +327,12 @@ static int max77705_get_charge_current(struct max77705_charger_data *charger,
+ return 0;
+ }
+
+-static int max77705_set_float_voltage(struct max77705_charger_data *charger,
++static int max77705_set_float_voltage(struct max77705_charger_data *chg,
+ int float_voltage)
+ {
+ int float_voltage_mv;
+ unsigned int reg_data = 0;
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+
+ float_voltage_mv = float_voltage / 1000;
+ reg_data = float_voltage_mv <= 4000 ? 0x0 :
+@@ -345,12 +345,12 @@ static int max77705_set_float_voltage(struct max77705_charger_data *charger,
+ (reg_data << MAX77705_CHG_CV_PRM_SHIFT));
+ }
+
+-static int max77705_get_float_voltage(struct max77705_charger_data *charger,
++static int max77705_get_float_voltage(struct max77705_charger_data *chg,
+ int *val)
+ {
+ unsigned int reg_data = 0;
+ int voltage_mv;
+- struct regmap *regmap = charger->regmap;
++ struct regmap *regmap = chg->regmap;
+
+ regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data);
+ reg_data &= MAX77705_CHG_PRM_MASK;
+@@ -365,28 +365,28 @@ static int max77705_chg_get_property(struct power_supply *psy,
+ enum power_supply_property psp,
+ union power_supply_propval *val)
+ {
+- struct max77705_charger_data *charger = power_supply_get_drvdata(psy);
+- struct regmap *regmap = charger->regmap;
++ struct max77705_charger_data *chg = power_supply_get_drvdata(psy);
++ struct regmap *regmap = chg->regmap;
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
+ return max77705_get_online(regmap, &val->intval);
+ case POWER_SUPPLY_PROP_PRESENT:
+- return max77705_check_battery(charger, &val->intval);
++ return max77705_check_battery(chg, &val->intval);
+ case POWER_SUPPLY_PROP_STATUS:
+- return max77705_get_status(charger, &val->intval);
++ return max77705_get_status(chg, &val->intval);
+ case POWER_SUPPLY_PROP_CHARGE_TYPE:
+- return max77705_get_charge_type(charger, &val->intval);
++ return max77705_get_charge_type(chg, &val->intval);
+ case POWER_SUPPLY_PROP_HEALTH:
+- return max77705_get_health(charger, &val->intval);
++ return max77705_get_health(chg, &val->intval);
+ case POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT:
+- return max77705_get_input_current(charger, &val->intval);
++ return max77705_get_input_current(chg, &val->intval);
+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT:
+- return max77705_get_charge_current(charger, &val->intval);
++ return max77705_get_charge_current(chg, &val->intval);
+ case POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE:
+- return max77705_get_float_voltage(charger, &val->intval);
++ return max77705_get_float_voltage(chg, &val->intval);
+ case POWER_SUPPLY_PROP_VOLTAGE_MAX_DESIGN:
+- val->intval = charger->bat_info->voltage_max_design_uv;
++ val->intval = chg->bat_info->voltage_max_design_uv;
+ break;
+ case POWER_SUPPLY_PROP_MODEL_NAME:
+ val->strval = max77705_charger_model;
+@@ -410,10 +410,10 @@ static const struct power_supply_desc max77705_charger_psy_desc = {
+
+ static void max77705_chgin_isr_work(struct work_struct *work)
+ {
+- struct max77705_charger_data *charger =
++ struct max77705_charger_data *chg =
+ container_of(work, struct max77705_charger_data, chgin_work);
+
+- power_supply_changed(charger->psy_chg);
++ power_supply_changed(chg->psy_chg);
+ }
+
+ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+--
+2.51.0
+
--- /dev/null
+From 00ccf0c4e51b313d48a669d957307c394f90a361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 20:06:51 +0300
+Subject: power: supply: max77705_charger: rework interrupts
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit 12a1185a06e3377af777e792ba7436862f8e528a ]
+
+Current implementation uses handle_post_irq to actually handle chgin
+irq. This is not how things are meant to work in regmap-irq.
+
+Remove handle_post_irq, and request a threaded interrupt for chgin.
+
+Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max77705_charger.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
+index 2d2201a6ba687..a8762bdd2c7c6 100644
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -40,13 +40,13 @@ static enum power_supply_property max77705_charger_props[] = {
+ POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT,
+ };
+
+-static int max77705_chgin_irq(void *irq_drv_data)
++static irqreturn_t max77705_chgin_irq(int irq, void *irq_drv_data)
+ {
+ struct max77705_charger_data *chg = irq_drv_data;
+
+ queue_work(chg->wqueue, &chg->chgin_work);
+
+- return 0;
++ return IRQ_HANDLED;
+ }
+
+ static const struct regmap_irq max77705_charger_irqs[] = {
+@@ -64,7 +64,6 @@ static struct regmap_irq_chip max77705_charger_irq_chip = {
+ .name = "max77705-charger",
+ .status_base = MAX77705_CHG_REG_INT,
+ .mask_base = MAX77705_CHG_REG_INT_MASK,
+- .handle_post_irq = max77705_chgin_irq,
+ .num_regs = 1,
+ .irqs = max77705_charger_irqs,
+ .num_irqs = ARRAY_SIZE(max77705_charger_irqs),
+@@ -493,12 +492,6 @@ static int max77705_charger_probe(struct i2c_client *i2c)
+ "cannot allocate regmap field\n");
+ }
+
+- ret = regmap_update_bits(chg->regmap,
+- MAX77705_CHG_REG_INT_MASK,
+- MAX77705_CHGIN_IM, 0);
+- if (ret)
+- return ret;
+-
+ pscfg.fwnode = dev_fwnode(dev);
+ pscfg.drv_data = chg;
+
+@@ -508,7 +501,7 @@ static int max77705_charger_probe(struct i2c_client *i2c)
+
+ max77705_charger_irq_chip.irq_drv_data = chg;
+ ret = devm_regmap_add_irq_chip(chg->dev, chg->regmap, i2c->irq,
+- IRQF_ONESHOT | IRQF_SHARED, 0,
++ IRQF_ONESHOT, 0,
+ &max77705_charger_irq_chip,
+ &irq_data);
+ if (ret)
+@@ -526,6 +519,15 @@ static int max77705_charger_probe(struct i2c_client *i2c)
+
+ max77705_charger_initialize(chg);
+
++ ret = devm_request_threaded_irq(dev, regmap_irq_get_virq(irq_data, MAX77705_CHGIN_I),
++ NULL, max77705_chgin_irq,
++ IRQF_TRIGGER_NONE,
++ "chgin-irq", chg);
++ if (ret) {
++ dev_err_probe(dev, ret, "Failed to Request chgin IRQ\n");
++ goto destroy_wq;
++ }
++
+ ret = max77705_charger_enable(chg);
+ if (ret) {
+ dev_err_probe(dev, ret, "failed to enable charge\n");
+--
+2.51.0
+
--- /dev/null
+From 2907a1c82744cb891eb51e79aedb449172f8b7d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 20:06:48 +0300
+Subject: power: supply: max77705_charger: use regfields for config registers
+
+From: Dzmitry Sankouski <dsankouski@gmail.com>
+
+[ Upstream commit ef1e734dbe257ce8bc42383b9977b5558f061288 ]
+
+Using regfields allows to cleanup masks and register offset definition,
+allowing to access register info by it's functional name.
+
+Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Stable-dep-of: 12a1185a06e3 ("power: supply: max77705_charger: rework interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max77705_charger.c | 105 +++++++++---------------
+ include/linux/power/max77705_charger.h | 102 ++++++++++++-----------
+ 2 files changed, 93 insertions(+), 114 deletions(-)
+
+diff --git a/drivers/power/supply/max77705_charger.c b/drivers/power/supply/max77705_charger.c
+index 7855f890e0a9f..2d2201a6ba687 100644
+--- a/drivers/power/supply/max77705_charger.c
++++ b/drivers/power/supply/max77705_charger.c
+@@ -74,8 +74,7 @@ static int max77705_charger_enable(struct max77705_charger_data *chg)
+ {
+ int rv;
+
+- rv = regmap_update_bits(chg->regmap, MAX77705_CHG_REG_CNFG_09,
+- MAX77705_CHG_EN_MASK, MAX77705_CHG_EN_MASK);
++ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], 1);
+ if (rv)
+ dev_err(chg->dev, "unable to enable the charger: %d\n", rv);
+
+@@ -87,10 +86,7 @@ static void max77705_charger_disable(void *data)
+ struct max77705_charger_data *chg = data;
+ int rv;
+
+- rv = regmap_update_bits(chg->regmap,
+- MAX77705_CHG_REG_CNFG_09,
+- MAX77705_CHG_EN_MASK,
+- MAX77705_CHG_DISABLE);
++ rv = regmap_field_write(chg->rfield[MAX77705_CHG_EN], MAX77705_CHG_DISABLE);
+ if (rv)
+ dev_err(chg->dev, "unable to disable the charger: %d\n", rv);
+ }
+@@ -134,10 +130,10 @@ static int max77705_check_battery(struct max77705_charger_data *chg, int *val)
+ static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
+ {
+ struct regmap *regmap = chg->regmap;
+- unsigned int reg_data;
++ unsigned int reg_data, chg_en;
+
+- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) {
++ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en);
++ if (!chg_en) {
+ *val = POWER_SUPPLY_CHARGE_TYPE_NONE;
+ return 0;
+ }
+@@ -162,10 +158,10 @@ static int max77705_get_charge_type(struct max77705_charger_data *chg, int *val)
+ static int max77705_get_status(struct max77705_charger_data *chg, int *val)
+ {
+ struct regmap *regmap = chg->regmap;
+- unsigned int reg_data;
++ unsigned int reg_data, chg_en;
+
+- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+- if (!MAX77705_CHARGER_CHG_CHARGING(reg_data)) {
++ regmap_field_read(chg->rfield[MAX77705_CHG_EN], &chg_en);
++ if (!chg_en) {
+ *val = POWER_SUPPLY_CHARGE_TYPE_NONE;
+ return 0;
+ }
+@@ -295,16 +291,11 @@ static int max77705_get_input_current(struct max77705_charger_data *chg,
+ {
+ unsigned int reg_data;
+ int get_current = 0;
+- struct regmap *regmap = chg->regmap;
+
+- regmap_read(regmap, MAX77705_CHG_REG_CNFG_09, ®_data);
+-
+- reg_data &= MAX77705_CHG_CHGIN_LIM_MASK;
++ regmap_field_read(chg->rfield[MAX77705_CHG_CHGIN_LIM], ®_data);
+
+ if (reg_data <= 3)
+ get_current = MAX77705_CURRENT_CHGIN_MIN;
+- else if (reg_data >= MAX77705_CHG_CHGIN_LIM_MASK)
+- get_current = MAX77705_CURRENT_CHGIN_MAX;
+ else
+ get_current = (reg_data + 1) * MAX77705_CURRENT_CHGIN_STEP;
+
+@@ -317,10 +308,8 @@ static int max77705_get_charge_current(struct max77705_charger_data *chg,
+ int *val)
+ {
+ unsigned int reg_data;
+- struct regmap *regmap = chg->regmap;
+
+- regmap_read(regmap, MAX77705_CHG_REG_CNFG_02, ®_data);
+- reg_data &= MAX77705_CHG_CC;
++ regmap_field_read(chg->rfield[MAX77705_CHG_CC_LIM], ®_data);
+
+ *val = reg_data <= 0x2 ? MAX77705_CURRENT_CHGIN_MIN : reg_data * MAX77705_CURRENT_CHG_STEP;
+
+@@ -332,7 +321,6 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg,
+ {
+ int float_voltage_mv;
+ unsigned int reg_data = 0;
+- struct regmap *regmap = chg->regmap;
+
+ float_voltage_mv = float_voltage / 1000;
+ reg_data = float_voltage_mv <= 4000 ? 0x0 :
+@@ -340,9 +328,7 @@ static int max77705_set_float_voltage(struct max77705_charger_data *chg,
+ (float_voltage_mv <= 4200) ? (float_voltage_mv - 4000) / 50 :
+ (((float_voltage_mv - 4200) / 10) + 0x04);
+
+- return regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_04,
+- MAX77705_CHG_CV_PRM_MASK,
+- (reg_data << MAX77705_CHG_CV_PRM_SHIFT));
++ return regmap_field_write(chg->rfield[MAX77705_CHG_CV_PRM], reg_data);
+ }
+
+ static int max77705_get_float_voltage(struct max77705_charger_data *chg,
+@@ -350,10 +336,8 @@ static int max77705_get_float_voltage(struct max77705_charger_data *chg,
+ {
+ unsigned int reg_data = 0;
+ int voltage_mv;
+- struct regmap *regmap = chg->regmap;
+
+- regmap_read(regmap, MAX77705_CHG_REG_CNFG_04, ®_data);
+- reg_data &= MAX77705_CHG_PRM_MASK;
++ regmap_field_read(chg->rfield[MAX77705_CHG_CV_PRM], ®_data);
+ voltage_mv = reg_data <= 0x04 ? reg_data * 50 + 4000 :
+ (reg_data - 4) * 10 + 4200;
+ *val = voltage_mv * 1000;
+@@ -418,7 +402,6 @@ static void max77705_chgin_isr_work(struct work_struct *work)
+
+ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+ {
+- u8 reg_data;
+ struct power_supply_battery_info *info;
+ struct regmap *regmap = chg->regmap;
+
+@@ -429,45 +412,31 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+
+ /* unlock charger setting protect */
+ /* slowest LX slope */
+- reg_data = MAX77705_CHGPROT_MASK | MAX77705_SLOWEST_LX_SLOPE;
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_06, reg_data,
+- reg_data);
++ regmap_field_write(chg->rfield[MAX77705_CHGPROT], MAX77705_CHGPROT_UNLOCKED);
++ regmap_field_write(chg->rfield[MAX77705_LX_SLOPE], MAX77705_SLOWEST_LX_SLOPE);
+
+ /* fast charge timer disable */
+ /* restart threshold disable */
+ /* pre-qual charge disable */
+- reg_data = (MAX77705_FCHGTIME_DISABLE << MAX77705_FCHGTIME_SHIFT) |
+- (MAX77705_CHG_RSTRT_DISABLE << MAX77705_CHG_RSTRT_SHIFT) |
+- (MAX77705_CHG_PQEN_DISABLE << MAX77705_PQEN_SHIFT);
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_01,
+- (MAX77705_FCHGTIME_MASK |
+- MAX77705_CHG_RSTRT_MASK |
+- MAX77705_PQEN_MASK),
+- reg_data);
+-
+- /* OTG off(UNO on), boost off */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
+- MAX77705_OTG_CTRL, 0);
++ regmap_field_write(chg->rfield[MAX77705_FCHGTIME], MAX77705_FCHGTIME_DISABLE);
++ regmap_field_write(chg->rfield[MAX77705_CHG_RSTRT], MAX77705_CHG_RSTRT_DISABLE);
++ regmap_field_write(chg->rfield[MAX77705_CHG_PQEN], MAX77705_CHG_PQEN_DISABLE);
++
++ regmap_field_write(chg->rfield[MAX77705_MODE],
++ MAX77705_CHG_MASK | MAX77705_BUCK_MASK);
+
+ /* charge current 450mA(default) */
+ /* otg current limit 900mA */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_02,
+- MAX77705_OTG_ILIM_MASK,
+- MAX77705_OTG_ILIM_900 << MAX77705_OTG_ILIM_SHIFT);
++ regmap_field_write(chg->rfield[MAX77705_OTG_ILIM], MAX77705_OTG_ILIM_900);
+
+ /* BAT to SYS OCP 4.80A */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_05,
+- MAX77705_REG_B2SOVRC_MASK,
+- MAX77705_B2SOVRC_4_8A << MAX77705_REG_B2SOVRC_SHIFT);
++ regmap_field_write(chg->rfield[MAX77705_REG_B2SOVRC], MAX77705_B2SOVRC_4_8A);
++
+ /* top off current 150mA */
+ /* top off timer 30min */
+- reg_data = (MAX77705_TO_ITH_150MA << MAX77705_TO_ITH_SHIFT) |
+- (MAX77705_TO_TIME_30M << MAX77705_TO_TIME_SHIFT) |
+- (MAX77705_SYS_TRACK_DISABLE << MAX77705_SYS_TRACK_DIS_SHIFT);
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_03,
+- (MAX77705_TO_ITH_MASK |
+- MAX77705_TO_TIME_MASK |
+- MAX77705_SYS_TRACK_DIS_MASK), reg_data);
++ regmap_field_write(chg->rfield[MAX77705_TO], MAX77705_TO_ITH_150MA);
++ regmap_field_write(chg->rfield[MAX77705_TO_TIME], MAX77705_TO_TIME_30M);
++ regmap_field_write(chg->rfield[MAX77705_SYS_TRACK], MAX77705_SYS_TRACK_DISABLE);
+
+ /* cv voltage 4.2V or 4.35V */
+ /* MINVSYS 3.6V(default) */
+@@ -478,25 +447,21 @@ static void max77705_charger_initialize(struct max77705_charger_data *chg)
+ max77705_set_float_voltage(chg, info->voltage_max_design_uv);
+ }
+
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12,
+- MAX77705_VCHGIN_REG_MASK, MAX77705_VCHGIN_4_5);
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12,
+- MAX77705_WCIN_REG_MASK, MAX77705_WCIN_4_5);
++ regmap_field_write(chg->rfield[MAX77705_VCHGIN], MAX77705_VCHGIN_4_5);
++ regmap_field_write(chg->rfield[MAX77705_WCIN], MAX77705_WCIN_4_5);
+
+ /* Watchdog timer */
+ regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_00,
+ MAX77705_WDTEN_MASK, 0);
+
+ /* VBYPSET=5.0V */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_11, MAX77705_VBYPSET_MASK, 0);
++ regmap_field_write(chg->rfield[MAX77705_VBYPSET], 0);
+
+ /* Switching Frequency : 1.5MHz */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_08, MAX77705_REG_FSW_MASK,
+- (MAX77705_CHG_FSW_1_5MHz << MAX77705_REG_FSW_SHIFT));
++ regmap_field_write(chg->rfield[MAX77705_REG_FSW], MAX77705_CHG_FSW_1_5MHz);
+
+ /* Auto skip mode */
+- regmap_update_bits(regmap, MAX77705_CHG_REG_CNFG_12, MAX77705_REG_DISKIP_MASK,
+- (MAX77705_AUTO_SKIP << MAX77705_REG_DISKIP_SHIFT));
++ regmap_field_write(chg->rfield[MAX77705_REG_DISKIP], MAX77705_AUTO_SKIP);
+ }
+
+ static int max77705_charger_probe(struct i2c_client *i2c)
+@@ -520,6 +485,14 @@ static int max77705_charger_probe(struct i2c_client *i2c)
+ if (IS_ERR(chg->regmap))
+ return PTR_ERR(chg->regmap);
+
++ for (int i = 0; i < MAX77705_N_REGMAP_FIELDS; i++) {
++ chg->rfield[i] = devm_regmap_field_alloc(dev, chg->regmap,
++ max77705_reg_field[i]);
++ if (IS_ERR(chg->rfield[i]))
++ return dev_err_probe(dev, PTR_ERR(chg->rfield[i]),
++ "cannot allocate regmap field\n");
++ }
++
+ ret = regmap_update_bits(chg->regmap,
+ MAX77705_CHG_REG_INT_MASK,
+ MAX77705_CHGIN_IM, 0);
+diff --git a/include/linux/power/max77705_charger.h b/include/linux/power/max77705_charger.h
+index fdec9af9c5418..a612795577b62 100644
+--- a/include/linux/power/max77705_charger.h
++++ b/include/linux/power/max77705_charger.h
+@@ -9,6 +9,8 @@
+ #ifndef __MAX77705_CHARGER_H
+ #define __MAX77705_CHARGER_H __FILE__
+
++#include <linux/regmap.h>
++
+ /* MAX77705_CHG_REG_CHG_INT */
+ #define MAX77705_BYP_I BIT(0)
+ #define MAX77705_INP_LIMIT_I BIT(1)
+@@ -63,7 +65,6 @@
+ #define MAX77705_BUCK_SHIFT 2
+ #define MAX77705_BOOST_SHIFT 3
+ #define MAX77705_WDTEN_SHIFT 4
+-#define MAX77705_MODE_MASK GENMASK(3, 0)
+ #define MAX77705_CHG_MASK BIT(MAX77705_CHG_SHIFT)
+ #define MAX77705_UNO_MASK BIT(MAX77705_UNO_SHIFT)
+ #define MAX77705_OTG_MASK BIT(MAX77705_OTG_SHIFT)
+@@ -74,34 +75,19 @@
+ #define MAX77705_OTG_CTRL (MAX77705_OTG_MASK | MAX77705_BOOST_MASK)
+
+ /* MAX77705_CHG_REG_CNFG_01 */
+-#define MAX77705_FCHGTIME_SHIFT 0
+-#define MAX77705_FCHGTIME_MASK GENMASK(2, 0)
+-#define MAX77705_CHG_RSTRT_SHIFT 4
+-#define MAX77705_CHG_RSTRT_MASK GENMASK(5, 4)
+ #define MAX77705_FCHGTIME_DISABLE 0
+ #define MAX77705_CHG_RSTRT_DISABLE 0x3
+
+-#define MAX77705_PQEN_SHIFT 7
+-#define MAX77705_PQEN_MASK BIT(7)
+ #define MAX77705_CHG_PQEN_DISABLE 0
+ #define MAX77705_CHG_PQEN_ENABLE 1
+
+ /* MAX77705_CHG_REG_CNFG_02 */
+-#define MAX77705_OTG_ILIM_SHIFT 6
+-#define MAX77705_OTG_ILIM_MASK GENMASK(7, 6)
+ #define MAX77705_OTG_ILIM_500 0
+ #define MAX77705_OTG_ILIM_900 1
+ #define MAX77705_OTG_ILIM_1200 2
+ #define MAX77705_OTG_ILIM_1500 3
+-#define MAX77705_CHG_CC GENMASK(5, 0)
+
+ /* MAX77705_CHG_REG_CNFG_03 */
+-#define MAX77705_TO_ITH_SHIFT 0
+-#define MAX77705_TO_ITH_MASK GENMASK(2, 0)
+-#define MAX77705_TO_TIME_SHIFT 3
+-#define MAX77705_TO_TIME_MASK GENMASK(5, 3)
+-#define MAX77705_SYS_TRACK_DIS_SHIFT 7
+-#define MAX77705_SYS_TRACK_DIS_MASK BIT(7)
+ #define MAX77705_TO_ITH_150MA 0
+ #define MAX77705_TO_TIME_30M 3
+ #define MAX77705_SYS_TRACK_ENABLE 0
+@@ -110,15 +96,8 @@
+ /* MAX77705_CHG_REG_CNFG_04 */
+ #define MAX77705_CHG_MINVSYS_SHIFT 6
+ #define MAX77705_CHG_MINVSYS_MASK GENMASK(7, 6)
+-#define MAX77705_CHG_PRM_SHIFT 0
+-#define MAX77705_CHG_PRM_MASK GENMASK(5, 0)
+-
+-#define MAX77705_CHG_CV_PRM_SHIFT 0
+-#define MAX77705_CHG_CV_PRM_MASK GENMASK(5, 0)
+
+ /* MAX77705_CHG_REG_CNFG_05 */
+-#define MAX77705_REG_B2SOVRC_SHIFT 0
+-#define MAX77705_REG_B2SOVRC_MASK GENMASK(3, 0)
+ #define MAX77705_B2SOVRC_DISABLE 0
+ #define MAX77705_B2SOVRC_4_5A 6
+ #define MAX77705_B2SOVRC_4_8A 8
+@@ -128,9 +107,8 @@
+ #define MAX77705_WDTCLR_SHIFT 0
+ #define MAX77705_WDTCLR_MASK GENMASK(1, 0)
+ #define MAX77705_WDTCLR 1
+-#define MAX77705_CHGPROT_MASK GENMASK(3, 2)
+-#define MAX77705_CHGPROT_UNLOCKED GENMASK(3, 2)
+-#define MAX77705_SLOWEST_LX_SLOPE GENMASK(6, 5)
++#define MAX77705_CHGPROT_UNLOCKED 3
++#define MAX77705_SLOWEST_LX_SLOPE 3
+
+ /* MAX77705_CHG_REG_CNFG_07 */
+ #define MAX77705_CHG_FMBST 4
+@@ -140,36 +118,14 @@
+ #define MAX77705_REG_FGSRC_MASK BIT(MAX77705_REG_FGSRC_SHIFT)
+
+ /* MAX77705_CHG_REG_CNFG_08 */
+-#define MAX77705_REG_FSW_SHIFT 0
+-#define MAX77705_REG_FSW_MASK GENMASK(1, 0)
+ #define MAX77705_CHG_FSW_3MHz 0
+ #define MAX77705_CHG_FSW_2MHz 1
+ #define MAX77705_CHG_FSW_1_5MHz 2
+
+ /* MAX77705_CHG_REG_CNFG_09 */
+-#define MAX77705_CHG_CHGIN_LIM_MASK GENMASK(6, 0)
+-#define MAX77705_CHG_EN_MASK BIT(7)
+ #define MAX77705_CHG_DISABLE 0
+-#define MAX77705_CHARGER_CHG_CHARGING(_reg) \
+- (((_reg) & MAX77705_CHG_EN_MASK) > 1)
+-
+-
+-/* MAX77705_CHG_REG_CNFG_10 */
+-#define MAX77705_CHG_WCIN_LIM GENMASK(5, 0)
+-
+-/* MAX77705_CHG_REG_CNFG_11 */
+-#define MAX77705_VBYPSET_SHIFT 0
+-#define MAX77705_VBYPSET_MASK GENMASK(6, 0)
+
+ /* MAX77705_CHG_REG_CNFG_12 */
+-#define MAX77705_CHGINSEL_SHIFT 5
+-#define MAX77705_CHGINSEL_MASK BIT(MAX77705_CHGINSEL_SHIFT)
+-#define MAX77705_WCINSEL_SHIFT 6
+-#define MAX77705_WCINSEL_MASK BIT(MAX77705_WCINSEL_SHIFT)
+-#define MAX77705_VCHGIN_REG_MASK GENMASK(4, 3)
+-#define MAX77705_WCIN_REG_MASK GENMASK(2, 1)
+-#define MAX77705_REG_DISKIP_SHIFT 0
+-#define MAX77705_REG_DISKIP_MASK BIT(MAX77705_REG_DISKIP_SHIFT)
+ /* REG=4.5V, UVLO=4.7V */
+ #define MAX77705_VCHGIN_4_5 0
+ /* REG=4.5V, UVLO=4.7V */
+@@ -183,9 +139,59 @@
+ #define MAX77705_CURRENT_CHGIN_MIN 100000
+ #define MAX77705_CURRENT_CHGIN_MAX 3200000
+
++enum max77705_field_idx {
++ MAX77705_CHGPROT,
++ MAX77705_CHG_EN,
++ MAX77705_CHG_CC_LIM,
++ MAX77705_CHG_CHGIN_LIM,
++ MAX77705_CHG_CV_PRM,
++ MAX77705_CHG_PQEN,
++ MAX77705_CHG_RSTRT,
++ MAX77705_CHG_WCIN,
++ MAX77705_FCHGTIME,
++ MAX77705_LX_SLOPE,
++ MAX77705_MODE,
++ MAX77705_OTG_ILIM,
++ MAX77705_REG_B2SOVRC,
++ MAX77705_REG_DISKIP,
++ MAX77705_REG_FSW,
++ MAX77705_SYS_TRACK,
++ MAX77705_TO,
++ MAX77705_TO_TIME,
++ MAX77705_VBYPSET,
++ MAX77705_VCHGIN,
++ MAX77705_WCIN,
++ MAX77705_N_REGMAP_FIELDS,
++};
++
++static const struct reg_field max77705_reg_field[MAX77705_N_REGMAP_FIELDS] = {
++ [MAX77705_MODE] = REG_FIELD(MAX77705_CHG_REG_CNFG_00, 0, 3),
++ [MAX77705_FCHGTIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 0, 2),
++ [MAX77705_CHG_RSTRT] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 4, 5),
++ [MAX77705_CHG_PQEN] = REG_FIELD(MAX77705_CHG_REG_CNFG_01, 7, 7),
++ [MAX77705_CHG_CC_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 0, 5),
++ [MAX77705_OTG_ILIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_02, 6, 7),
++ [MAX77705_TO] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 0, 2),
++ [MAX77705_TO_TIME] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 3, 5),
++ [MAX77705_SYS_TRACK] = REG_FIELD(MAX77705_CHG_REG_CNFG_03, 7, 7),
++ [MAX77705_CHG_CV_PRM] = REG_FIELD(MAX77705_CHG_REG_CNFG_04, 0, 5),
++ [MAX77705_REG_B2SOVRC] = REG_FIELD(MAX77705_CHG_REG_CNFG_05, 0, 3),
++ [MAX77705_CHGPROT] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 2, 3),
++ [MAX77705_LX_SLOPE] = REG_FIELD(MAX77705_CHG_REG_CNFG_06, 5, 6),
++ [MAX77705_REG_FSW] = REG_FIELD(MAX77705_CHG_REG_CNFG_08, 0, 1),
++ [MAX77705_CHG_CHGIN_LIM] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 0, 6),
++ [MAX77705_CHG_EN] = REG_FIELD(MAX77705_CHG_REG_CNFG_09, 7, 7),
++ [MAX77705_CHG_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_10, 0, 5),
++ [MAX77705_VBYPSET] = REG_FIELD(MAX77705_CHG_REG_CNFG_11, 0, 6),
++ [MAX77705_REG_DISKIP] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 0, 0),
++ [MAX77705_WCIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 1, 2),
++ [MAX77705_VCHGIN] = REG_FIELD(MAX77705_CHG_REG_CNFG_12, 3, 4),
++};
++
+ struct max77705_charger_data {
+ struct device *dev;
+ struct regmap *regmap;
++ struct regmap_field *rfield[MAX77705_N_REGMAP_FIELDS];
+ struct power_supply_battery_info *bat_info;
+ struct workqueue_struct *wqueue;
+ struct work_struct chgin_work;
+--
+2.51.0
+
--- /dev/null
+From 738f2169e016009875c940581adb0c99219b84e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 08:30:18 +0200
+Subject: powerpc/603: Really copy kernel PGD entries into all PGDIRs
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]
+
+Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
+PGDIRs and preallocate execmem page tables") was supposed to extend
+to powerpc 603 the copy of kernel PGD entries into all PGDIRs
+implemented in a previous patch on the 8xx. But 603 is book3s/32 and
+uses a duplicate of pgd_alloc() defined in another header.
+
+So really do the copy at the correct place for the 603.
+
+Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/752ab7514cae089a2dd7cc0f3d5e35849f76adb9.1755757797.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
+ arch/powerpc/include/asm/nohash/pgalloc.h | 2 +-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+index dd4eb30631758..f4390704d5ba2 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
+@@ -7,8 +7,14 @@
+
+ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+- pgtable_gfp_flags(mm, GFP_KERNEL));
++ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
++ pgtable_gfp_flags(mm, GFP_KERNEL));
++
++#ifdef CONFIG_PPC_BOOK3S_603
++ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
++ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
++#endif
++ return pgd;
+ }
+
+ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
+index bb5f3e8ea912d..4ef780b291bc3 100644
+--- a/arch/powerpc/include/asm/nohash/pgalloc.h
++++ b/arch/powerpc/include/asm/nohash/pgalloc.h
+@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+ pgtable_gfp_flags(mm, GFP_KERNEL));
+
+-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
++#ifdef CONFIG_PPC_8xx
+ memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
+ (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+ #endif
+--
+2.51.0
+
--- /dev/null
+From af5fb7bd21bf977f3ebaafd2399357c6f84d4c0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 18:33:26 +0200
+Subject: powerpc/8xx: Remove left-over instruction and comments in
+ DataStoreTLBMiss handler
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]
+
+Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
+DTLB misses") removed the test that needed the valeur in SPRN_EPN but
+failed to remove the read.
+
+Remove it.
+
+And remove related comments, including the very same comment
+in InstructionTLBMiss that should have been removed by
+commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
+ITLB misses").
+
+Also update the comment about absence of a second level table which
+has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
+remove tests on PGDIR entry validity").
+
+Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/5811c8d1d6187f280ad140d6c0ad6010e41eeaeb.1755361995.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 56c5ebe21b99a..613606400ee99 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -162,7 +162,7 @@ instruction_counter:
+ * For the MPC8xx, this is a software tablewalk to load the instruction
+ * TLB. The task switch loads the M_TWB register with the pointer to the first
+ * level table.
+- * If we discover there is no second level table (value is zero) or if there
++ * If there is no second level table (value is zero) or if there
+ * is an invalid pte, we load that into the TLB, which causes another fault
+ * into the TLB Error interrupt where we can handle such problems.
+ * We have to use the MD_xxx registers for the tablewalk because the
+@@ -183,9 +183,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+ mfspr r10, SPRN_SRR0 /* Get effective address of fault */
+ INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
+ mtspr SPRN_MD_EPN, r10
+@@ -228,10 +225,6 @@ instruction_counter:
+ mtspr SPRN_SPRG_SCRATCH2, r10
+ mtspr SPRN_M_TW, r11
+
+- /* If we are faulting a kernel address, we have to use the
+- * kernel page tables.
+- */
+- mfspr r10, SPRN_MD_EPN
+ mfspr r10, SPRN_M_TWB /* Get level 1 table */
+ lwz r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10) /* Get level 1 entry */
+
+--
+2.51.0
+
--- /dev/null
+From 25422bef427fc908d3abdc18a65f6b0ecf1ba4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:27:38 -0400
+Subject: powerpc/ftrace: ensure ftrace record ops are always set for NOPs
+
+From: Joe Lawrence <joe.lawrence@redhat.com>
+
+[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ]
+
+When an ftrace call site is converted to a NOP, its corresponding
+dyn_ftrace record should have its ftrace_ops pointer set to
+ftrace_nop_ops.
+
+Correct the powerpc implementation to ensure the
+ftrace_rec_set_nop_ops() helper is called on all successful NOP
+initialization paths. This ensures all ftrace records are consistent
+before being handled by the ftrace core.
+
+Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
+Suggested-by: Naveen N Rao <naveen@kernel.org>
+Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
+Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250912142740.3581368-2-joe.lawrence@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
+index 6dca92d5a6e82..841d077e28251 100644
+--- a/arch/powerpc/kernel/trace/ftrace.c
++++ b/arch/powerpc/kernel/trace/ftrace.c
+@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
+ return ret;
+
+ /* Set up out-of-line stub */
+- if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE))
+- return ftrace_init_ool_stub(mod, rec);
++ if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) {
++ ret = ftrace_init_ool_stub(mod, rec);
++ goto out;
++ }
+
+ /* Nop-out the ftrace location */
+ new = ppc_inst(PPC_RAW_NOP());
+@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
+ return -EINVAL;
+ }
+
++out:
++ if (!ret)
++ ret = ftrace_rec_set_nop_ops(rec);
++
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a1bbe423375827ec36cf9662b5b627f8d88b43f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:27:39 -0400
+Subject: powerpc64/modules: correctly iterate over stubs in
+ setup_ftrace_ool_stubs
+
+From: Joe Lawrence <joe.lawrence@redhat.com>
+
+[ Upstream commit f6b4df37ebfeb47e50e27780500d2d06b4d211bd ]
+
+CONFIG_PPC_FTRACE_OUT_OF_LINE introduced setup_ftrace_ool_stubs() to
+extend the ppc64le module .stubs section with an array of
+ftrace_ool_stub structures for each patchable function.
+
+Fix its ppc64_stub_entry stub reservation loop to properly write across
+all of the num_stubs used and not just the first entry.
+
+Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
+Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
+Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20250912142740.3581368-3-joe.lawrence@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/module_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 126bf3b06ab7e..0e45cac4de76b 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -1139,7 +1139,7 @@ static int setup_ftrace_ool_stubs(const Elf64_Shdr *sechdrs, unsigned long addr,
+
+ /* reserve stubs */
+ for (i = 0; i < num_stubs; i++)
+- if (patch_u32((void *)&stub->funcdata, PPC_RAW_NOP()))
++ if (patch_u32((void *)&stub[i].funcdata, PPC_RAW_NOP()))
+ return -1;
+ #endif
+
+--
+2.51.0
+
--- /dev/null
+From f91a324a2fab5d1e7706db24f12fa924b8262451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index 9463232af8d2e..c6b8b64782761 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From f5750bcfb0fb3cb846adf6d4768df269723ab79b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:29:08 +0530
+Subject: ptp: Add a upper bound on max_vclocks
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]
+
+syzbot reported WARNING in max_vclocks_store.
+
+This occurs when the argument max is too large for kcalloc to handle.
+
+Extend the guard to guard against values that are too large for
+kcalloc
+
+Reported-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
+Tested-by: syzbot+94d20db923b9f51be0df@syzkaller.appspotmail.com
+Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_private.h | 1 +
+ drivers/ptp/ptp_sysfs.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
+index b352df4cd3f97..f329263f33aa1 100644
+--- a/drivers/ptp/ptp_private.h
++++ b/drivers/ptp/ptp_private.h
+@@ -22,6 +22,7 @@
+ #define PTP_MAX_TIMESTAMPS 128
+ #define PTP_BUF_TIMESTAMPS 30
+ #define PTP_DEFAULT_MAX_VCLOCKS 20
++#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
+ #define PTP_MAX_CHANNELS 2048
+
+ enum {
+diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
+index 6b1b8f57cd951..200eaf5006968 100644
+--- a/drivers/ptp/ptp_sysfs.c
++++ b/drivers/ptp/ptp_sysfs.c
+@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
+ size_t size;
+ u32 max;
+
+- if (kstrtou32(buf, 0, &max) || max == 0)
++ if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
+ return -EINVAL;
+
+ if (max == ptp->max_vclocks)
+--
+2.51.0
+
--- /dev/null
+From 509ca4cb0a2af7d08f285836f094449745fa42ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:00:59 +0200
+Subject: pwm: tiehrpwm: Don't drop runtime PM reference in .free()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]
+
+The pwm driver calls pm_runtime_get_sync() when the hardware becomes
+enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
+state is kept when a consumer goes away, so the call to
+pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
+a non-functional device and a reference underlow for the second consumer.
+
+The easiest fix for that issue is to just not drop the runtime PM
+reference in .free(), so do that.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/bbb089c4b5650cc1f7b25cf582d817543fd25384.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 0125e73b98dfb..5e674a7bbf3be 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- if (pwm_is_enabled(pwm)) {
+- dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
+- pm_runtime_put_sync(pwmchip_parent(chip));
+- }
+-
+ /* set period value to zero on free */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 0ef0b064add70dd300da9c86845c3edf863b39c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a23e48b8523db..7a86cb090f76f 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(pwmchip_parent(chip), "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 7b39ce3c8a2c68fa9c0be7bac2d837c85759b347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:01 +0200
+Subject: pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
+ calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]
+
+In Up-Count Mode the timer is reset to zero one tick after it reaches
+TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
+the documentation and measurements. So the value written to the TBPRD has
+to be one less than the calculated period_cycles value.
+
+A complication here is that for a 100% relative duty-cycle the value
+written to the CMPx register has to be TBPRD + 1 which might overflow if
+TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
+has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
+be skipped.
+
+Additionally the AQCTL_PRD register field has to be 0 because that defines
+the hardware's action when the maximal counter value is reached, which is
+(as above) one clock tick before the period's end. The period start edge
+has to happen when the counter is reset and so is defined in the AQCTL_ZRO
+field.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/dc818c69b7cf05109ecda9ee6b0043a22de757c1.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
+ 1 file changed, 58 insertions(+), 85 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index a94b1e387b924..a23e48b8523db 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -36,7 +36,7 @@
+
+ #define CLKDIV_MAX 7
+ #define HSPCLKDIV_MAX 7
+-#define PERIOD_MAX 0xFFFF
++#define PERIOD_MAX 0x10000
+
+ /* compare module registers */
+ #define CMPA 0x12
+@@ -65,14 +65,10 @@
+ #define AQCTL_ZRO_FRCHIGH BIT(1)
+ #define AQCTL_ZRO_FRCTOGGLE (BIT(1) | BIT(0))
+
+-#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
+-#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
+- AQCTL_ZRO_FRCHIGH)
+-#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
+- AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANA_POLNORMAL (AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANA_POLINVERSED (AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
++#define AQCTL_CHANB_POLNORMAL (AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
++#define AQCTL_CHANB_POLINVERSED (AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
+
+ #define AQSFRC_RLDCSF_MASK (BIT(7) | BIT(6))
+ #define AQSFRC_RLDCSF_ZRO 0
+@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
+ unsigned long clk_rate;
+ void __iomem *mmio_base;
+ unsigned long period_cycles[NUM_PWM_CHANNEL];
+- enum pwm_polarity polarity[NUM_PWM_CHANNEL];
+ struct clk *tbclk;
+ struct ehrpwm_context ctx;
+ };
+@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+ return 1;
+ }
+
+-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
+-{
+- u16 aqctl_val, aqctl_mask;
+- unsigned int aqctl_reg;
+-
+- /*
+- * Configure PWM output to HIGH/LOW level on counter
+- * reaches compare register value and LOW/HIGH level
+- * on counter value reaches period register value and
+- * zero value on counter
+- */
+- if (chan == 1) {
+- aqctl_reg = AQCTLB;
+- aqctl_mask = AQCTL_CBU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANB_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANB_POLNORMAL;
+- } else {
+- aqctl_reg = AQCTLA;
+- aqctl_mask = AQCTL_CAU_MASK;
+-
+- if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
+- aqctl_val = AQCTL_CHANA_POLINVERSED;
+- else
+- aqctl_val = AQCTL_CHANA_POLNORMAL;
+- }
+-
+- aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
+- ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
+-}
+-
+ /*
+ * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
+ * duty_ns = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
+ */
+ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+- u64 duty_ns, u64 period_ns)
++ u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+ u32 period_cycles, duty_cycles;
+ u16 ps_divval, tb_divval;
+ unsigned int i, cmp_reg;
+ unsigned long long c;
++ u16 aqctl_val, aqctl_mask;
++ unsigned int aqctl_reg;
+
+ if (period_ns > NSEC_PER_SEC)
+ return -ERANGE;
+@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ do_div(c, NSEC_PER_SEC);
+ period_cycles = (unsigned long)c;
+
+- if (period_cycles < 1) {
+- period_cycles = 1;
+- duty_cycles = 1;
+- } else {
+- c = pc->clk_rate;
+- c = c * duty_ns;
+- do_div(c, NSEC_PER_SEC);
+- duty_cycles = (unsigned long)c;
+- }
++ c = pc->clk_rate;
++ c = c * duty_ns;
++ do_div(c, NSEC_PER_SEC);
++ duty_cycles = (unsigned long)c;
+
+ /*
+ * Period values should be same for multiple PWM channels as IP uses
+@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ return -EINVAL;
+ }
+
+- pm_runtime_get_sync(pwmchip_parent(chip));
+-
+- /* Update clock prescaler values */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+-
+ /* Update period & duty cycle with presacler division */
+ period_cycles = period_cycles / ps_divval;
+ duty_cycles = duty_cycles / ps_divval;
+
+- /* Configure shadow loading on Period register */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++ if (period_cycles < 1)
++ period_cycles = 1;
+
+- ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
++ pm_runtime_get_sync(pwmchip_parent(chip));
+
+- /* Configure ehrpwm counter for up-count mode */
+- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
+- TBCTL_CTRMODE_UP);
++ /* Update clock prescaler values */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
+
+- if (pwm->hwpwm == 1)
++ if (pwm->hwpwm == 1) {
+ /* Channel 1 configured with compare B register */
+ cmp_reg = CMPB;
+- else
++
++ aqctl_reg = AQCTLB;
++ aqctl_mask = AQCTL_CBU_MASK;
++
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANB_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANB_POLNORMAL;
++
++ /* if duty_cycle is big, don't toggle on CBU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CBU_MASK;
++
++ } else {
+ /* Channel 0 configured with compare A register */
+ cmp_reg = CMPA;
+
+- ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
++ aqctl_reg = AQCTLA;
++ aqctl_mask = AQCTL_CAU_MASK;
+
+- pm_runtime_put_sync(pwmchip_parent(chip));
++ if (polarity == PWM_POLARITY_INVERSED)
++ aqctl_val = AQCTL_CHANA_POLINVERSED;
++ else
++ aqctl_val = AQCTL_CHANA_POLNORMAL;
+
+- return 0;
+-}
++ /* if duty_cycle is big, don't toggle on CAU */
++ if (duty_cycles > period_cycles)
++ aqctl_val &= ~AQCTL_CAU_MASK;
++ }
+
+-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
+- struct pwm_device *pwm,
+- enum pwm_polarity polarity)
+-{
+- struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
++ aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
++ ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
++
++ /* Configure shadow loading on Period register */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
++
++ ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
++
++ /* Configure ehrpwm counter for up-count mode */
++ ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
++ TBCTL_CTRMODE_UP);
++
++ if (!(duty_cycles > period_cycles))
++ ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
+
+- /* Configuration of polarity in hardware delayed, do at enable */
+- pc->polarity[pwm->hwpwm] = polarity;
++ pm_runtime_put_sync(pwmchip_parent(chip));
+
+ return 0;
+ }
+@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+
+- /* Channels polarity can be configured from action qualifier module */
+- configure_polarity(pc, pwm->hwpwm);
+-
+ /* Enable TBCLK */
+ ret = clk_enable(pc->tbclk);
+ if (ret) {
+@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ ehrpwm_pwm_disable(chip, pwm);
+ enabled = false;
+ }
+-
+- err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
+- if (err)
+- return err;
+ }
+
+ if (!state->enabled) {
+@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ return 0;
+ }
+
+- err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
++ err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
+ if (err)
+ return err;
+
+--
+2.51.0
+
--- /dev/null
+From a30f84664d8a6ad0ab3549ae8836edf0933c8203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:00 +0200
+Subject: pwm: tiehrpwm: Make code comment in .free() more useful
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]
+
+Instead of explaining trivia to everyone who can read C describe the
+higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.
+
+Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/4c38dd119a77d7017115318a3f2c50bde62a6f21.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index 5e674a7bbf3be..a94b1e387b924 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+
+- /* set period value to zero on free */
++ /* Don't let a pwm without consumer block requests to the other channel */
+ pc->period_cycles[pwm->hwpwm] = 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1dfedd2023fe88c7553eabf94d38498caeecd723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 15:27:07 +0800
+Subject: raid6: riscv: Clean up unused header file inclusion
+
+From: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+
+[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ]
+
+These two C files don't reference things defined in simd.h or types.h
+so remove these redundant #inclusions.
+
+Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations")
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
+Link: https://lore.kernel.org/r/20250718072711.3865118-2-zhangchunyan@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/recov_rvv.c | 2 --
+ lib/raid6/rvv.c | 3 ---
+ 2 files changed, 5 deletions(-)
+
+diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c
+index 5d54c4b437df7..5f779719c3d34 100644
+--- a/lib/raid6/recov_rvv.c
++++ b/lib/raid6/recov_rvv.c
+@@ -4,9 +4,7 @@
+ * Author: Chunyan Zhang <zhangchunyan@iscas.ac.cn>
+ */
+
+-#include <asm/simd.h>
+ #include <asm/vector.h>
+-#include <crypto/internal/simd.h>
+ #include <linux/raid/pq.h>
+
+ static int rvv_has_vector(void)
+diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c
+index 7d82efa5b14f9..b193ea176d5d3 100644
+--- a/lib/raid6/rvv.c
++++ b/lib/raid6/rvv.c
+@@ -9,11 +9,8 @@
+ * Copyright 2002-2004 H. Peter Anvin
+ */
+
+-#include <asm/simd.h>
+ #include <asm/vector.h>
+-#include <crypto/internal/simd.h>
+ #include <linux/raid/pq.h>
+-#include <linux/types.h>
+ #include "rvv.h"
+
+ #define NSIZE (riscv_v_vsize / 32) /* NSIZE = vlenb */
+--
+2.51.0
+
--- /dev/null
+From f8c4b894fa491673bcc11cad34f7884ab495aedc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 92678e438ff4d..01bede8ba1055 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1049,8 +1049,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From d8117e07ff25e8438ce3ebd1481f4fee395542e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index be0743dac3fff..929e89841c12a 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 506053b2535c083a1b0016b724ddae0d60f78d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:39:56 +0300
+Subject: RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Or Har-Toov <ohartoov@nvidia.com>
+
+[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]
+
+The mlx5 driver currently derives max_qp_wr directly from the
+log_max_qp_sz HCA capability:
+
+ props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+
+However, this value represents the number of WQEs in units of Basic
+Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size
+of a WQE can vary depending on transport type and features (e.g., atomic
+operations, UMR, LSO), the actual number of WQEs can be significantly
+smaller than the WQEBB count suggests.
+
+This patch introduces a conservative estimation of the worst-case WQE size
+— considering largest segments possible with 1 SGE and no inline data or
+special features. It uses this to derive a more accurate max_qp_wr value.
+
+Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
+Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org
+Reported-by: Chuck Lever <cel@kernel.org>
+Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/
+Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index d456e4fde3e1f..20d15207a5f1f 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -13,6 +13,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
+ #include <linux/bitmap.h>
++#include <linux/log2.h>
+ #include <linux/sched.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/task.h>
+@@ -883,6 +884,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
+ resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
+ }
+
++/*
++ * Calculate maximum SQ overhead across all QP types.
++ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
++ * have smaller overhead than the types calculated below,
++ * so they are implicitly included.
++ */
++static u32 mlx5_ib_calc_max_sq_overhead(void)
++{
++ u32 max_overhead_xrc, overhead_ud_lso, a, b;
++
++ /* XRC_INI */
++ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
++ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
++ a = sizeof(struct mlx5_wqe_atomic_seg) +
++ sizeof(struct mlx5_wqe_raddr_seg);
++ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
++ sizeof(struct mlx5_mkey_seg) +
++ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
++ max_overhead_xrc += max(a, b);
++
++ /* UD with LSO */
++ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
++ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
++
++ return max(max_overhead_xrc, overhead_ud_lso);
++}
++
++static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
++{
++ struct mlx5_core_dev *mdev = dev->mdev;
++ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ u32 max_wqe_size;
++ /* max QP overhead + 1 SGE, no inline, no special features */
++ max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
++ sizeof(struct mlx5_wqe_data_seg);
++
++ max_wqe_size = roundup_pow_of_two(max_wqe_size);
++
++ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
++
++ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
++}
++
+ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ struct ib_device_attr *props,
+ struct ib_udata *uhw)
+@@ -1041,7 +1087,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ props->max_mr_size = ~0ull;
+ props->page_size_cap = ~(min_page_size - 1);
+ props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
+- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
++ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
+ max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
+ sizeof(struct mlx5_wqe_data_seg);
+ max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
+--
+2.51.0
+
--- /dev/null
+From 806c2e67e154ad0fe7a36cd1dddae9b5982828e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 17:48:39 +0300
+Subject: RDMA/mlx5: Fix page size bitmap calculation for KSM mode
+
+From: Edward Srouji <edwards@nvidia.com>
+
+[ Upstream commit 372fdb5c75b61f038f4abf596abdcf01acbdb7af ]
+
+When using KSM (Key Scatter-gather Memory) access mode, the HW requires
+the IOVA to be aligned to the selected page size.
+Without this alignment, the HW may not function correctly.
+
+Currently, mlx5_umem_mkc_find_best_pgsz() does not filter out page sizes
+that would result in misaligned IOVAs for KSM mode. This can lead to
+selecting page sizes that are incompatible with the given IOVA.
+
+Fix this by filtering the page size bitmap when in KSM mode, keeping
+only page sizes to which the IOVA is aligned to.
+
+Fixes: fcfb03597b7d ("RDMA/mlx5: Align mkc page size capability check to PRM")
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250824144839.154717-1-edwards@nvidia.com
+Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 8d21ecf8a996f..15e3962633dc3 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1803,6 +1803,10 @@ mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem,
+
+ bitmap = GENMASK_ULL(max_log_entity_size_cap, min_log_entity_size_cap);
+
++ /* In KSM mode HW requires IOVA and mkey's page size to be aligned */
++ if (access_mode == MLX5_MKC_ACCESS_MODE_KSM && iova)
++ bitmap &= GENMASK_ULL(__ffs64(iova), 0);
++
+ return ib_umem_find_best_pgsz(umem, bitmap, iova);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f1d830ff001b842b92d69cf3a6b934dfc860d934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:41:19 +0300
+Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
+
+Previously loopback for MPV was supposed to be permanently enabled,
+however other driver flows were able to over-ride that configuration and
+disable it.
+
+Add force_lb parameter that indicates that loopback should always be
+enabled which prevents all other driver flows from disabling it.
+
+Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
+Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++----
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 20d15207a5f1f..5fabd39b7492a 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1839,7 +1839,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
+ }
+
+ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ int err;
+
+@@ -1851,6 +1852,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ if (err)
+ goto out;
+
++ lb_state->force_enable = true;
+ return 0;
+
+ out:
+@@ -1859,16 +1861,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ }
+
+ static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ mlx5_nic_vport_update_local_lb(slave, false);
+ mlx5_nic_vport_update_local_lb(master, false);
++
++ lb_state->force_enable = false;
+ }
+
+ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
+ int err = 0;
+
++ if (dev->lb.force_enable)
++ return 0;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td++;
+@@ -1890,6 +1898,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+
+ void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
++ if (dev->lb.force_enable)
++ return;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td--;
+@@ -3569,7 +3580,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
+
+ lockdep_assert_held(&mlx5_ib_multiport_mutex);
+
+- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+
+ mlx5_core_mp_event_replay(ibdev->mdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
+@@ -3666,7 +3677,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_DONE,
+ &key);
+
+- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+ if (err)
+ goto unbind;
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 7ffc7ee92cf03..8d21ecf8a996f 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1109,6 +1109,7 @@ struct mlx5_ib_lb_state {
+ u32 user_td;
+ int qps;
+ bool enabled;
++ bool force_enable;
+ };
+
+ struct mlx5_ib_pf_eq {
+--
+2.51.0
+
--- /dev/null
+From 706031767a5b0c49932986020a5609b1016fb24a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 02:52:12 +0000
+Subject: RDMA/rxe: Fix race in do_task() when draining
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
+
+When do_task() exhausts its iteration budget (!ret), it sets the state
+to TASK_STATE_IDLE to reschedule, without a secondary check on the
+current task->state. This can overwrite the TASK_STATE_DRAINING state
+set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
+
+While state changes are protected by a spinlock, both rxe_cleanup_task()
+and rxe_disable_task() release the lock while waiting for the task to
+finish draining in the while(!is_done(task)) loop. The race occurs if
+do_task() hits its iteration limit and acquires the lock in this window.
+The cleanup logic may then proceed while the task incorrectly
+reschedules itself, leading to a potential use-after-free.
+
+This bug was introduced during the migration from tasklets to workqueues,
+where the special handling for the draining case was lost.
+
+Fix this by restoring the original pre-migration behavior. If the state is
+TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
+force a new loop iteration. This allows the task to finish its work, so
+that a subsequent iteration can reach the switch statement and correctly
+transition the state to TASK_STATE_DRAINED, stopping the task as intended.
+
+Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 6f8f353e95838..f522820b950c7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
+ * yield the cpu and reschedule the task
+ */
+ if (!ret) {
+- task->state = TASK_STATE_IDLE;
+- resched = 1;
++ if (task->state != TASK_STATE_DRAINING) {
++ task->state = TASK_STATE_IDLE;
++ resched = 1;
++ } else {
++ cont = 1;
++ }
+ goto exit;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a8f06f506819a5b78b0735456fcb0c0067877578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 35c3bde0d00af..efa2f097b5828 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -769,7 +769,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -955,9 +955,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -982,15 +990,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 303eb732681a6558325190d0ef11b64738c8edd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 1f3f782a04ba2..6883e1a43fe5d 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+ if (config->reg_update_bits)
+ map->reg_update_bits = config->reg_update_bits;
+--
+2.51.0
+
--- /dev/null
+From 6ef67f69c98ca3227921edffd5a4ebeab8238222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index 9df726f10ad12..6d609c42e4793 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 1887f6be4e5fcb052e7c845d6af8f1393c305468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:35 +0200
+Subject: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 142964960c7c35de5c5f7bdd61c32699de693630 ]
+
+The ADSP firmware on X1E has separate firmware binaries for the main
+firmware and the DTB. The same applies for the "lite" firmware loaded by
+the boot firmware.
+
+When preparing to load the new ADSP firmware we shutdown the lite_pas_id
+for the main firmware, but we don't shutdown the corresponding lite pas_id
+for the DTB. The fact that we're leaving it "running" forever becomes
+obvious if you try to reuse (or just access) the memory region used by the
+"lite" firmware: The &adsp_boot_mem is accessible, but accessing the
+&adsp_boot_dtb_mem results in a crash.
+
+We don't support reusing the memory regions currently, but nevertheless we
+should not keep part of the lite firmware running. Fix this by adding the
+lite_dtb_pas_id and shutting it down as well.
+
+We don't have a way to detect if the lite firmware is actually running yet,
+so ignore the return status of qcom_scm_pas_shutdown() for now. This was
+already the case before, the assignment to "ret" is not used anywhere.
+
+Fixes: 62210f7509e1 ("remoteproc: qcom_q6v5_pas: Unload lite firmware on ADSP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-3-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 02e29171cbbee..f3ec5b06261e8 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -42,6 +42,7 @@ struct qcom_pas_data {
+ int pas_id;
+ int dtb_pas_id;
+ int lite_pas_id;
++ int lite_dtb_pas_id;
+ unsigned int minidump_id;
+ bool auto_boot;
+ bool decrypt_shutdown;
+@@ -80,6 +81,7 @@ struct qcom_pas {
+ int pas_id;
+ int dtb_pas_id;
+ int lite_pas_id;
++ int lite_dtb_pas_id;
+ unsigned int minidump_id;
+ int crash_reason_smem;
+ unsigned int smem_host_id;
+@@ -226,6 +228,8 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw)
+
+ if (pas->lite_pas_id)
+ ret = qcom_scm_pas_shutdown(pas->lite_pas_id);
++ if (pas->lite_dtb_pas_id)
++ qcom_scm_pas_shutdown(pas->lite_dtb_pas_id);
+
+ if (pas->dtb_pas_id) {
+ ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
+@@ -722,6 +726,7 @@ static int qcom_pas_probe(struct platform_device *pdev)
+ pas->minidump_id = desc->minidump_id;
+ pas->pas_id = desc->pas_id;
+ pas->lite_pas_id = desc->lite_pas_id;
++ pas->lite_dtb_pas_id = desc->lite_dtb_pas_id;
+ pas->info_name = desc->sysmon_name;
+ pas->smem_host_id = desc->smem_host_id;
+ pas->decrypt_shutdown = desc->decrypt_shutdown;
+@@ -1085,6 +1090,7 @@ static const struct qcom_pas_data x1e80100_adsp_resource = {
+ .pas_id = 1,
+ .dtb_pas_id = 0x24,
+ .lite_pas_id = 0x1f,
++ .lite_dtb_pas_id = 0x29,
+ .minidump_id = 5,
+ .auto_boot = true,
+ .proxy_pd_names = (char*[]){
+--
+2.51.0
+
--- /dev/null
+From 8cd7d44b5bd4d2a90bdb7b1c8a0161f4f63d59c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 4ee5e67a9f03f..769c6d6d6a731 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From 0d4aeb79a04d401346b1424ec5c7c81ffba1041e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 17:47:08 +0300
+Subject: remoteproc: qcom_q6v5_mss: support loading MBN file on msm8974
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 581e3dea0ece4b59cf714c9dfe195a178d3ae13b ]
+
+On MSM8974 / APQ8074, MSM8226 and MSM8926 the MSS requires loading raw
+MBA image instead of the ELF file. Skip the ELF headers if mba.mbn was
+specified as the firmware image.
+
+Fixes: a5a4e02d083d ("remoteproc: qcom: Add support for parsing fw dt bindings")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Tested-by: Luca Weiss <luca@lucaweiss.eu> # msm8974pro-fairphone-fp2
+Link: https://lore.kernel.org/r/20250706-msm8974-fix-mss-v4-1-630907dbd898@oss.qualcomm.com
+[bjorn: Unwrapped the long memcpy line, to taste]
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 0c0199fb0e68d..3087d895b87f4 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -498,6 +498,8 @@ static void q6v5_debug_policy_load(struct q6v5 *qproc, void *mba_region)
+ release_firmware(dp_fw);
+ }
+
++#define MSM8974_B00_OFFSET 0x1000
++
+ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
+ {
+ struct q6v5 *qproc = rproc->priv;
+@@ -516,7 +518,14 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw)
+ return -EBUSY;
+ }
+
+- memcpy(mba_region, fw->data, fw->size);
++ if ((qproc->version == MSS_MSM8974 ||
++ qproc->version == MSS_MSM8226 ||
++ qproc->version == MSS_MSM8926) &&
++ fw->size > MSM8974_B00_OFFSET &&
++ !memcmp(fw->data, ELFMAG, SELFMAG))
++ memcpy(mba_region, fw->data + MSM8974_B00_OFFSET, fw->size - MSM8974_B00_OFFSET);
++ else
++ memcpy(mba_region, fw->data, fw->size);
+ q6v5_debug_policy_load(qproc, mba_region);
+ memunmap(mba_region);
+
+--
+2.51.0
+
--- /dev/null
+From 65b6f76861c511a52b694b6a1c12295897b09e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 19:58:14 +0530
+Subject: Revert "arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x
+ carveout locations"
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit 932424a925ce79cbed0a93d36c5f1b69a0128de1 ]
+
+This reverts commit 1a314099b7559690fe23cdf3300dfff6e830ecb1.
+
+The C6x carveouts are reversed intentionally. This is due to the
+requirement to keep the DMA memory region as non-cached, however the
+minimum granular cache region for C6x is 16MB. So, C66x_0 marks the
+entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA
+memory region of C66x_1 as its own, and vice-versa.
+
+This was also called out in the original commit which introduced these
+reversed carveouts:
+ "The minimum granularity on the Cache settings on C66x DSP
+ cores is 16MB, so the DMA memory regions are chosen such that
+ they are in separate 16MB regions for each DSP, while reserving
+ a total of 16 MB for each DSP and not changing the overall DSP
+ remoteproc carveouts."
+
+Fixes: 1a314099b755 ("arm64: dts: ti: k3-j721e-beagleboneai64: Fix reversed C6x carveout locations")
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Acked-by: Andrew Davis <afd@ti.com>
+Link: https://patch.msgid.link/20250908142826.1828676-23-b-padhi@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+index 6a1b32169678e..bb771ce823ec1 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+@@ -123,7 +123,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 {
+ no-map;
+ };
+
+- c66_0_dma_memory_region: memory@a6000000 {
++ /* Carveout locations are flipped due to caching */
++ c66_1_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+@@ -135,7 +136,8 @@ c66_0_memory_region: memory@a6100000 {
+ no-map;
+ };
+
+- c66_1_dma_memory_region: memory@a7000000 {
++ /* Carveout locations are flipped due to caching */
++ c66_0_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+--
+2.51.0
+
--- /dev/null
+From 929118aec001e85abe65dd207c1de8c504ae1feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 19:58:13 +0530
+Subject: Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout
+ locations"
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit 79a1778c7819c8491cdbdc1f7e46d478cb84d5cf ]
+
+This reverts commit 9f3814a7c06b7c7296cf8c1622078ad71820454b.
+
+The C6x carveouts are reversed intentionally. This is due to the
+requirement to keep the DMA memory region as non-cached, however the
+minimum granular cache region for C6x is 16MB. So, C66x_0 marks the
+entire C66x_1 16MB memory carveouts as non-cached, and uses the DMA
+memory region of C66x_1 as its own, and vice-versa.
+
+This was also called out in the original commit which introduced these
+reversed carveouts:
+ "The minimum granularity on the Cache settings on C66x DSP cores
+ is 16MB, so the DMA memory regions are chosen such that they are
+ in separate 16MB regions for each DSP, while reserving a total
+ of 16 MB for each DSP and not changing the overall DSP
+ remoteproc carveouts."
+
+Fixes: 9f3814a7c06b ("arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations")
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Acked-by: Andrew Davis <afd@ti.com>
+Link: https://patch.msgid.link/20250908142826.1828676-22-b-padhi@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index d1b0257048de2..488c5ebe9e272 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -120,7 +120,8 @@ main_r5fss1_core1_memory_region: memory@a5100000 {
+ no-map;
+ };
+
+- c66_0_dma_memory_region: memory@a6000000 {
++ /* Carveout locations are flipped due to caching */
++ c66_1_dma_memory_region: memory@a6000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa6000000 0x00 0x100000>;
+ no-map;
+@@ -132,7 +133,8 @@ c66_0_memory_region: memory@a6100000 {
+ no-map;
+ };
+
+- c66_1_dma_memory_region: memory@a7000000 {
++ /* Carveout locations are flipped due to caching */
++ c66_0_dma_memory_region: memory@a7000000 {
+ compatible = "shared-dma-pool";
+ reg = <0x00 0xa7000000 0x00 0x100000>;
+ no-map;
+--
+2.51.0
+
--- /dev/null
+From e6b6bf3530e1f981abff85db35b22b189c001b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index 66d276a1be836..f4a19ffbb641c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 15eded36b872a..21bb88c5d3dce 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -49,7 +49,6 @@
+ #include "en.h"
+ #include "en/dim.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -3041,11 +3040,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -3055,18 +3052,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 85d6aa5daba3f5b1e3a1e2d7b8074df9824a380b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 4f8f5aab109d0..6309200e93dc3 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1262,19 +1262,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command) {
+--
+2.51.0
+
--- /dev/null
+From d5da05cb392568cd7317126190d22fed65b0b88b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 10:25:40 -0400
+Subject: RISC-V: KVM: Write hgatp register with valid mode bits
+
+From: Fangyu Yu <fangyu.yu@linux.alibaba.com>
+
+[ Upstream commit 2b351e3d04be9e1533f26c3464f1e44a5beace30 ]
+
+According to the RISC-V Privileged Architecture Spec, when MODE=Bare
+is selected,software must write zero to the remaining fields of hgatp.
+
+We have detected the valid mode supported by the HW before, So using a
+valid mode to detect how many vmid bits are supported.
+
+Fixes: fd7bb4a251df ("RISC-V: KVM: Implement VMID allocator")
+Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.spacemit.com>
+Reviewed-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
+Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+Link: https://lore.kernel.org/r/20250821142542.2472079-2-guoren@kernel.org
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/vmid.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kvm/vmid.c b/arch/riscv/kvm/vmid.c
+index 3b426c800480c..5f33625f40706 100644
+--- a/arch/riscv/kvm/vmid.c
++++ b/arch/riscv/kvm/vmid.c
+@@ -14,6 +14,7 @@
+ #include <linux/smp.h>
+ #include <linux/kvm_host.h>
+ #include <asm/csr.h>
++#include <asm/kvm_mmu.h>
+ #include <asm/kvm_tlb.h>
+ #include <asm/kvm_vmid.h>
+
+@@ -28,7 +29,7 @@ void __init kvm_riscv_gstage_vmid_detect(void)
+
+ /* Figure-out number of VMID bits in HW */
+ old = csr_read(CSR_HGATP);
+- csr_write(CSR_HGATP, old | HGATP_VMID);
++ csr_write(CSR_HGATP, (kvm_riscv_gstage_mode << HGATP_MODE_SHIFT) | HGATP_VMID);
+ vmid_bits = csr_read(CSR_HGATP);
+ vmid_bits = (vmid_bits & HGATP_VMID) >> HGATP_VMID_SHIFT;
+ vmid_bits = fls_long(vmid_bits);
+--
+2.51.0
+
--- /dev/null
+From 400f0bd9481b2cafc87eb737ffd08b600aaee1a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 01:24:48 +0000
+Subject: riscv, bpf: Sign extend struct ops return values properly
+
+From: Hengqi Chen <hengqi.chen@gmail.com>
+
+[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]
+
+The ns_bpf_qdisc selftest triggers a kernel panic:
+
+ Unable to handle kernel paging request at virtual address ffffffffa38dbf58
+ Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
+ [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
+ Oops [#1]
+ Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
+ CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE
+ Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+ Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
+ epc : __qdisc_run+0x82/0x6f0
+ ra : __qdisc_run+0x6e/0x6f0
+ epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
+ gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
+ t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
+ s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
+ a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
+ a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
+ s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
+ s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
+ s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
+ s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
+ t5 : 0000000000000000 t6 : ff60000093a6a8b6
+ status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
+ [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
+ [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
+ [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
+ [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
+ [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
+ [<ffffffff80d31446>] ip6_output+0x5e/0x178
+ [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
+ [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
+ [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
+ [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
+ [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
+ [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
+ [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
+ [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
+ [<ffffffff80b42bee>] __sys_connect+0x96/0xc8
+ [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
+ [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
+ [<ffffffff80e69af2>] handle_exception+0x14a/0x156
+ Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
+ ---[ end trace 0000000000000000 ]---
+
+The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
+is treated as a 32bit value and sign extend to 64bit in epilogue. This
+behavior is right for most bpf prog types but wrong for struct ops which
+requires RISC-V ABI.
+
+So let's sign extend struct ops return values according to the function
+model and RISC-V ABI([0]).
+
+ [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf
+
+Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
+Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Pu Lehui <pulehui@huawei.com>
+Reviewed-by: Pu Lehui <pulehui@huawei.com>
+Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
+index 9883a55d61b5b..f1efa4d6b27f3 100644
+--- a/arch/riscv/net/bpf_jit_comp64.c
++++ b/arch/riscv/net/bpf_jit_comp64.c
+@@ -765,6 +765,39 @@ static int emit_atomic_rmw(u8 rd, u8 rs, const struct bpf_insn *insn,
+ return 0;
+ }
+
++/*
++ * Sign-extend the register if necessary
++ */
++static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
++{
++ if (!sign && (sz == 1 || sz == 2)) {
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ return 0;
++ }
++
++ switch (sz) {
++ case 1:
++ emit_sextb(rd, rs, ctx);
++ break;
++ case 2:
++ emit_sexth(rd, rs, ctx);
++ break;
++ case 4:
++ emit_sextw(rd, rs, ctx);
++ break;
++ case 8:
++ if (rd != rs)
++ emit_mv(rd, rs, ctx);
++ break;
++ default:
++ pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0)
+ #define BPF_FIXUP_REG_MASK GENMASK(31, 27)
+ #define REG_DONT_CLEAR_MARKER 0 /* RV_REG_ZERO unused in pt_regmap */
+@@ -1226,8 +1259,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
+
+ if (save_ret) {
+- emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
+ emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
++ if (is_struct_ops) {
++ ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
++ m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
++ if (ret)
++ goto out;
++ } else {
++ emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
++ }
+ }
+
+ emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
+--
+2.51.0
+
--- /dev/null
+From 80ab5f12e52cd46dda4a1d5d66a599ab09d6f0ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 22:02:58 +0200
+Subject: rpmsg: qcom_smd: Fix fallback to qcom,ipc parse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 09390ed9af37ed612dd0967ff2b0d639872b8776 ]
+
+mbox_request_channel() returning value was changed in case of error.
+It uses returning value of of_parse_phandle_with_args().
+It is returning with -ENOENT instead of -ENODEV when no mboxes property
+exists.
+
+Fixes: 24fdd5074b20 ("mailbox: use error ret code of of_parse_phandle_with_args()")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Tested-by: Stephan Gerhold <stephan.gerhold@linaro.org> # msm8939
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20250725-fix-qcom-smd-v2-1-e4e43613f874@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_smd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index 87c944d4b4f31..1cbe457b4e96f 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1368,7 +1368,7 @@ static int qcom_smd_parse_edge(struct device *dev,
+ edge->mbox_client.knows_txdone = true;
+ edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0);
+ if (IS_ERR(edge->mbox_chan)) {
+- if (PTR_ERR(edge->mbox_chan) != -ENODEV) {
++ if (PTR_ERR(edge->mbox_chan) != -ENOENT) {
+ ret = dev_err_probe(dev, PTR_ERR(edge->mbox_chan),
+ "failed to acquire IPC mailbox\n");
+ goto put_node;
+--
+2.51.0
+
--- /dev/null
+From beee5dcc9c827d87ec9c555d06864d9a2493d56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:42:11 +0200
+Subject: rust: cpumask: Mark CpumaskVar as transparent
+
+From: Baptiste Lepers <baptiste.lepers@gmail.com>
+
+[ Upstream commit 23fca458f6ab18927e50c2134fb7b60297f18b4e ]
+
+Unsafe code in CpumaskVar's methods assumes that the type has the same
+layout as `bindings::cpumask_var_t`. This is not guaranteed by
+the default struct representation in Rust, but requires specifying the
+`transparent` representation.
+
+Fixes: 8961b8cb3099a ("rust: cpumask: Add initial abstractions")
+Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/cpumask.rs | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rust/kernel/cpumask.rs b/rust/kernel/cpumask.rs
+index 3fcbff4386705..05e1c882404e4 100644
+--- a/rust/kernel/cpumask.rs
++++ b/rust/kernel/cpumask.rs
+@@ -212,6 +212,7 @@ impl Cpumask {
+ /// }
+ /// assert_eq!(mask2.weight(), count);
+ /// ```
++#[repr(transparent)]
+ pub struct CpumaskVar {
+ #[cfg(CONFIG_CPUMASK_OFFSTACK)]
+ ptr: NonNull<Cpumask>,
+--
+2.51.0
+
--- /dev/null
+From 4ab96e2b1e4125dbb4a5b9636c4e6eb1dbb5ba95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:28 +0200
+Subject: s390/bpf: Do not write tail call counter into helper and kfunc frames
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit eada40e057fc1842358d9daca3abe5cacb21e8a1 ]
+
+Only BPF functions make use of the tail call counter; helpers and
+kfuncs ignore and most likely also clobber it. Writing it into these
+functions' frames is pointless and misleading, so do not do it.
+
+Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-2-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index bb17efe29d657..bfac1ddf3447b 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1790,6 +1790,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+
+ REG_SET_SEEN(BPF_REG_5);
+ jit->seen |= SEEN_FUNC;
++
+ /*
+ * Copy the tail call counter to where the callee expects it.
+ *
+@@ -1800,10 +1801,17 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ * Note 2: We assume that the verifier does not let us call the
+ * main program, which clears the tail call counter on entry.
+ */
+- /* mvc tail_call_cnt(4,%r15),frame_off+tail_call_cnt(%r15) */
+- _EMIT6(0xd203f000 | offsetof(struct prog_frame, tail_call_cnt),
+- 0xf000 | (jit->frame_off +
+- offsetof(struct prog_frame, tail_call_cnt)));
++
++ if (insn->src_reg == BPF_PSEUDO_CALL)
++ /*
++ * mvc tail_call_cnt(4,%r15),
++ * frame_off+tail_call_cnt(%r15)
++ */
++ _EMIT6(0xd203f000 | offsetof(struct prog_frame,
++ tail_call_cnt),
++ 0xf000 | (jit->frame_off +
++ offsetof(struct prog_frame,
++ tail_call_cnt)));
+
+ /* Sign-extend the kfunc arguments. */
+ if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL) {
+--
+2.51.0
+
--- /dev/null
+From 3f0e29c3616064333c42b8acf6c39522cc733534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:29 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
+
+The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
+as follows:
+
+ entry()
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+
+entry() copies its tail call counter to the subprog_tail()'s frame,
+which then increments it. However, the incremented result is discarded,
+leading to an astronomically large number of tail calls.
+
+Fix by writing the incremented counter back to the entry()'s frame.
+
+Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index bfac1ddf3447b..ccb83ac3e6f32 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1793,13 +1793,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+
+ /*
+ * Copy the tail call counter to where the callee expects it.
+- *
+- * Note 1: The callee can increment the tail call counter, but
+- * we do not load it back, since the x86 JIT does not do this
+- * either.
+- *
+- * Note 2: We assume that the verifier does not let us call the
+- * main program, which clears the tail call counter on entry.
+ */
+
+ if (insn->src_reg == BPF_PSEUDO_CALL)
+@@ -1833,6 +1826,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ call_r1(jit);
+ /* lgr %b0,%r2: load return value into %b0 */
+ EMIT4(0xb9040000, BPF_REG_0, REG_2);
++
++ /*
++ * Copy the potentially updated tail call counter back.
++ */
++
++ if (insn->src_reg == BPF_PSEUDO_CALL)
++ /*
++ * mvc frame_off+tail_call_cnt(%r15),
++ * tail_call_cnt(4,%r15)
++ */
++ _EMIT6(0xd203f000 | (jit->frame_off +
++ offsetof(struct prog_frame,
++ tail_call_cnt)),
++ 0xf000 | offsetof(struct prog_frame,
++ tail_call_cnt));
++
+ break;
+ }
+ case BPF_JMP | BPF_TAIL_CALL: {
+--
+2.51.0
+
--- /dev/null
+From fc3f6661f3d74f43156fc56a3e0bea3e9d7283ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:30 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
+
+The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
+graph is as follows:
+
+ entry()
+ subprog_tail()
+ trampoline()
+ fentry()
+ the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG
+ return to entry()
+
+The problem is that the rest of subprog_tail() increments the tail call
+counter, but the trampoline discards the incremented value. This
+results in an astronomically large number of tail calls.
+
+Fix by making the trampoline write the incremented tail call counter
+back.
+
+Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index ccb83ac3e6f32..b2b8eb62b82e0 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -2839,6 +2839,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ /* stg %r2,retval_off(%r15) */
+ EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
+ tjit->retval_off);
++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
++ _EMIT6(0xd203f000 | tjit->tccnt_off,
++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt));
+
+ im->ip_after_call = jit->prg_buf + jit->prg;
+
+--
+2.51.0
+
--- /dev/null
+From b41ddedb18a039d2e0b3d6b010d6257f2f82709c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 12:02:44 +0000
+Subject: sched/fair: Get rid of sched_domains_curr_level hack for
+ tl->cpumask()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 661f951e371cc134ea31c84238dbdc9a898b8403 ]
+
+Leon [1] and Vinicius [2] noted a topology_span_sane() warning during
+their testing starting from v6.16-rc1. Debug that followed pointed to
+the tl->mask() for the NODE domain being incorrectly resolved to that of
+the highest NUMA domain.
+
+tl->mask() for NODE is set to the sd_numa_mask() which depends on the
+global "sched_domains_curr_level" hack. "sched_domains_curr_level" is
+set to the "tl->numa_level" during tl traversal in build_sched_domains()
+calling sd_init() but was not reset before topology_span_sane().
+
+Since "tl->numa_level" still reflected the old value from
+build_sched_domains(), topology_span_sane() for the NODE domain trips
+when the span of the last NUMA domain overlaps.
+
+Instead of replicating the "sched_domains_curr_level" hack, get rid of
+it entirely and instead, pass the entire "sched_domain_topology_level"
+object to tl->cpumask() function to prevent such mishap in the future.
+
+sd_numa_mask() now directly references "tl->numa_level" instead of
+relying on the global "sched_domains_curr_level" hack to index into
+sched_domains_numa_masks[].
+
+The original warning was reproducible on the following NUMA topology
+reported by Leon:
+
+ $ sudo numactl -H
+ available: 5 nodes (0-4)
+ node 0 cpus: 0 1
+ node 0 size: 2927 MB
+ node 0 free: 1603 MB
+ node 1 cpus: 2 3
+ node 1 size: 3023 MB
+ node 1 free: 3008 MB
+ node 2 cpus: 4 5
+ node 2 size: 3023 MB
+ node 2 free: 3007 MB
+ node 3 cpus: 6 7
+ node 3 size: 3023 MB
+ node 3 free: 3002 MB
+ node 4 cpus: 8 9
+ node 4 size: 3022 MB
+ node 4 free: 2718 MB
+ node distances:
+ node 0 1 2 3 4
+ 0: 10 39 38 37 36
+ 1: 39 10 38 37 36
+ 2: 38 38 10 37 36
+ 3: 37 37 37 10 36
+ 4: 36 36 36 36 10
+
+The above topology can be mimicked using the following QEMU cmd that was
+used to reproduce the warning and test the fix:
+
+ sudo qemu-system-x86_64 -enable-kvm -cpu host \
+ -m 20G -smp cpus=10,sockets=10 -machine q35 \
+ -object memory-backend-ram,size=4G,id=m0 \
+ -object memory-backend-ram,size=4G,id=m1 \
+ -object memory-backend-ram,size=4G,id=m2 \
+ -object memory-backend-ram,size=4G,id=m3 \
+ -object memory-backend-ram,size=4G,id=m4 \
+ -numa node,cpus=0-1,memdev=m0,nodeid=0 \
+ -numa node,cpus=2-3,memdev=m1,nodeid=1 \
+ -numa node,cpus=4-5,memdev=m2,nodeid=2 \
+ -numa node,cpus=6-7,memdev=m3,nodeid=3 \
+ -numa node,cpus=8-9,memdev=m4,nodeid=4 \
+ -numa dist,src=0,dst=1,val=39 \
+ -numa dist,src=0,dst=2,val=38 \
+ -numa dist,src=0,dst=3,val=37 \
+ -numa dist,src=0,dst=4,val=36 \
+ -numa dist,src=1,dst=0,val=39 \
+ -numa dist,src=1,dst=2,val=38 \
+ -numa dist,src=1,dst=3,val=37 \
+ -numa dist,src=1,dst=4,val=36 \
+ -numa dist,src=2,dst=0,val=38 \
+ -numa dist,src=2,dst=1,val=38 \
+ -numa dist,src=2,dst=3,val=37 \
+ -numa dist,src=2,dst=4,val=36 \
+ -numa dist,src=3,dst=0,val=37 \
+ -numa dist,src=3,dst=1,val=37 \
+ -numa dist,src=3,dst=2,val=37 \
+ -numa dist,src=3,dst=4,val=36 \
+ -numa dist,src=4,dst=0,val=36 \
+ -numa dist,src=4,dst=1,val=36 \
+ -numa dist,src=4,dst=2,val=36 \
+ -numa dist,src=4,dst=3,val=36 \
+ ...
+
+ [ prateek: Moved common functions to include/linux/sched/topology.h,
+ reuse the common bits for s390 and ppc, commit message ]
+
+Closes: https://lore.kernel.org/lkml/20250610110701.GA256154@unreal/ [1]
+Fixes: ccf74128d66c ("sched/topology: Assert non-NUMA topology masks don't (partially) overlap") # ce29a7da84cd, f55dac1dafb3
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reported-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Valentin Schneider <vschneid@redhat.com>
+Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Tested-by: Valentin Schneider <vschneid@redhat.com> # x86
+Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com> # powerpc
+Link: https://lore.kernel.org/lkml/a3de98387abad28592e6ab591f3ff6107fe01dc1.1755893468.git.tim.c.chen@linux.intel.com/ [2]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 4 ++++
+ arch/powerpc/include/asm/topology.h | 2 ++
+ arch/powerpc/kernel/smp.c | 27 +++++++++++----------------
+ arch/s390/kernel/topology.c | 20 +++++++-------------
+ arch/x86/kernel/smpboot.c | 8 ++++----
+ include/linux/sched/topology.h | 28 +++++++++++++++++++++++++++-
+ include/linux/topology.h | 2 +-
+ kernel/sched/topology.c | 28 ++++++++++------------------
+ 8 files changed, 66 insertions(+), 53 deletions(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 93402a1d9c9fc..e51a595a06228 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -971,6 +971,10 @@ config SCHED_SMT
+ when dealing with POWER5 cpus at a cost of slightly increased
+ overhead in some places. If unsure say N here.
+
++config SCHED_MC
++ def_bool y
++ depends on SMP
++
+ config PPC_DENORMALISATION
+ bool "PowerPC denormalisation exception handling"
+ depends on PPC_BOOK3S_64
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index da15b5efe8071..f19ca44512d1e 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -131,6 +131,8 @@ static inline int cpu_to_coregroup_id(int cpu)
+ #ifdef CONFIG_SMP
+ #include <asm/cputable.h>
+
++struct cpumask *cpu_coregroup_mask(int cpu);
++
+ #ifdef CONFIG_PPC64
+ #include <asm/smp.h>
+
+diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
+index f59e4b9cc2074..68edb66c2964b 100644
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -1028,19 +1028,19 @@ static int powerpc_shared_proc_flags(void)
+ * We can't just pass cpu_l2_cache_mask() directly because
+ * returns a non-const pointer and the compiler barfs on that.
+ */
+-static const struct cpumask *shared_cache_mask(int cpu)
++static const struct cpumask *tl_cache_mask(struct sched_domain_topology_level *tl, int cpu)
+ {
+ return per_cpu(cpu_l2_cache_map, cpu);
+ }
+
+ #ifdef CONFIG_SCHED_SMT
+-static const struct cpumask *smallcore_smt_mask(int cpu)
++static const struct cpumask *tl_smallcore_smt_mask(struct sched_domain_topology_level *tl, int cpu)
+ {
+ return cpu_smallcore_mask(cpu);
+ }
+ #endif
+
+-static struct cpumask *cpu_coregroup_mask(int cpu)
++struct cpumask *cpu_coregroup_mask(int cpu)
+ {
+ return per_cpu(cpu_coregroup_map, cpu);
+ }
+@@ -1054,11 +1054,6 @@ static bool has_coregroup_support(void)
+ return coregroup_enabled;
+ }
+
+-static const struct cpumask *cpu_mc_mask(int cpu)
+-{
+- return cpu_coregroup_mask(cpu);
+-}
+-
+ static int __init init_big_cores(void)
+ {
+ int cpu;
+@@ -1448,7 +1443,7 @@ static bool update_mask_by_l2(int cpu, cpumask_var_t *mask)
+ return false;
+ }
+
+- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
++ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
+
+ /* Update l2-cache mask with all the CPUs that are part of submask */
+ or_cpumasks_related(cpu, cpu, submask_fn, cpu_l2_cache_mask);
+@@ -1538,7 +1533,7 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)
+ return;
+ }
+
+- cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
++ cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
+
+ /* Update coregroup mask with all the CPUs that are part of submask */
+ or_cpumasks_related(cpu, cpu, submask_fn, cpu_coregroup_mask);
+@@ -1601,7 +1596,7 @@ static void add_cpu_to_masks(int cpu)
+
+ /* If chip_id is -1; limit the cpu_core_mask to within PKG */
+ if (chip_id == -1)
+- cpumask_and(mask, mask, cpu_cpu_mask(cpu));
++ cpumask_and(mask, mask, cpu_node_mask(cpu));
+
+ for_each_cpu(i, mask) {
+ if (chip_id == cpu_to_chip_id(i)) {
+@@ -1701,22 +1696,22 @@ static void __init build_sched_topology(void)
+ if (has_big_cores) {
+ pr_info("Big cores detected but using small core scheduling\n");
+ powerpc_topology[i++] =
+- SDTL_INIT(smallcore_smt_mask, powerpc_smt_flags, SMT);
++ SDTL_INIT(tl_smallcore_smt_mask, powerpc_smt_flags, SMT);
+ } else {
+- powerpc_topology[i++] = SDTL_INIT(cpu_smt_mask, powerpc_smt_flags, SMT);
++ powerpc_topology[i++] = SDTL_INIT(tl_smt_mask, powerpc_smt_flags, SMT);
+ }
+ #endif
+ if (shared_caches) {
+ powerpc_topology[i++] =
+- SDTL_INIT(shared_cache_mask, powerpc_shared_cache_flags, CACHE);
++ SDTL_INIT(tl_cache_mask, powerpc_shared_cache_flags, CACHE);
+ }
+
+ if (has_coregroup_support()) {
+ powerpc_topology[i++] =
+- SDTL_INIT(cpu_mc_mask, powerpc_shared_proc_flags, MC);
++ SDTL_INIT(tl_mc_mask, powerpc_shared_proc_flags, MC);
+ }
+
+- powerpc_topology[i++] = SDTL_INIT(cpu_cpu_mask, powerpc_shared_proc_flags, PKG);
++ powerpc_topology[i++] = SDTL_INIT(tl_pkg_mask, powerpc_shared_proc_flags, PKG);
+
+ /* There must be one trailing NULL entry left. */
+ BUG_ON(i >= ARRAY_SIZE(powerpc_topology) - 1);
+diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
+index 46569b8e47dde..1594c80e9bc4d 100644
+--- a/arch/s390/kernel/topology.c
++++ b/arch/s390/kernel/topology.c
+@@ -509,33 +509,27 @@ int topology_cpu_init(struct cpu *cpu)
+ return rc;
+ }
+
+-static const struct cpumask *cpu_thread_mask(int cpu)
+-{
+- return &cpu_topology[cpu].thread_mask;
+-}
+-
+-
+ const struct cpumask *cpu_coregroup_mask(int cpu)
+ {
+ return &cpu_topology[cpu].core_mask;
+ }
+
+-static const struct cpumask *cpu_book_mask(int cpu)
++static const struct cpumask *tl_book_mask(struct sched_domain_topology_level *tl, int cpu)
+ {
+ return &cpu_topology[cpu].book_mask;
+ }
+
+-static const struct cpumask *cpu_drawer_mask(int cpu)
++static const struct cpumask *tl_drawer_mask(struct sched_domain_topology_level *tl, int cpu)
+ {
+ return &cpu_topology[cpu].drawer_mask;
+ }
+
+ static struct sched_domain_topology_level s390_topology[] = {
+- SDTL_INIT(cpu_thread_mask, cpu_smt_flags, SMT),
+- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
+- SDTL_INIT(cpu_book_mask, NULL, BOOK),
+- SDTL_INIT(cpu_drawer_mask, NULL, DRAWER),
+- SDTL_INIT(cpu_cpu_mask, NULL, PKG),
++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
++ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
++ SDTL_INIT(tl_book_mask, NULL, BOOK),
++ SDTL_INIT(tl_drawer_mask, NULL, DRAWER),
++ SDTL_INIT(tl_pkg_mask, NULL, PKG),
+ { NULL, },
+ };
+
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 33e166f6ab122..eb289abece237 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -479,14 +479,14 @@ static int x86_cluster_flags(void)
+ static bool x86_has_numa_in_package;
+
+ static struct sched_domain_topology_level x86_topology[] = {
+- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
+ #ifdef CONFIG_SCHED_CLUSTER
+- SDTL_INIT(cpu_clustergroup_mask, x86_cluster_flags, CLS),
++ SDTL_INIT(tl_cls_mask, x86_cluster_flags, CLS),
+ #endif
+ #ifdef CONFIG_SCHED_MC
+- SDTL_INIT(cpu_coregroup_mask, x86_core_flags, MC),
++ SDTL_INIT(tl_mc_mask, x86_core_flags, MC),
+ #endif
+- SDTL_INIT(cpu_cpu_mask, x86_sched_itmt_flags, PKG),
++ SDTL_INIT(tl_pkg_mask, x86_sched_itmt_flags, PKG),
+ { NULL },
+ };
+
+diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
+index 5263746b63e8c..a3a24e115d446 100644
+--- a/include/linux/sched/topology.h
++++ b/include/linux/sched/topology.h
+@@ -30,11 +30,19 @@ struct sd_flag_debug {
+ };
+ extern const struct sd_flag_debug sd_flag_debug[];
+
++struct sched_domain_topology_level;
++
+ #ifdef CONFIG_SCHED_SMT
+ static inline int cpu_smt_flags(void)
+ {
+ return SD_SHARE_CPUCAPACITY | SD_SHARE_LLC;
+ }
++
++static inline const
++struct cpumask *tl_smt_mask(struct sched_domain_topology_level *tl, int cpu)
++{
++ return cpu_smt_mask(cpu);
++}
+ #endif
+
+ #ifdef CONFIG_SCHED_CLUSTER
+@@ -42,6 +50,12 @@ static inline int cpu_cluster_flags(void)
+ {
+ return SD_CLUSTER | SD_SHARE_LLC;
+ }
++
++static inline const
++struct cpumask *tl_cls_mask(struct sched_domain_topology_level *tl, int cpu)
++{
++ return cpu_clustergroup_mask(cpu);
++}
+ #endif
+
+ #ifdef CONFIG_SCHED_MC
+@@ -49,8 +63,20 @@ static inline int cpu_core_flags(void)
+ {
+ return SD_SHARE_LLC;
+ }
++
++static inline const
++struct cpumask *tl_mc_mask(struct sched_domain_topology_level *tl, int cpu)
++{
++ return cpu_coregroup_mask(cpu);
++}
+ #endif
+
++static inline const
++struct cpumask *tl_pkg_mask(struct sched_domain_topology_level *tl, int cpu)
++{
++ return cpu_node_mask(cpu);
++}
++
+ #ifdef CONFIG_NUMA
+ static inline int cpu_numa_flags(void)
+ {
+@@ -172,7 +198,7 @@ bool cpus_equal_capacity(int this_cpu, int that_cpu);
+ bool cpus_share_cache(int this_cpu, int that_cpu);
+ bool cpus_share_resources(int this_cpu, int that_cpu);
+
+-typedef const struct cpumask *(*sched_domain_mask_f)(int cpu);
++typedef const struct cpumask *(*sched_domain_mask_f)(struct sched_domain_topology_level *tl, int cpu);
+ typedef int (*sched_domain_flags_f)(void);
+
+ struct sd_data {
+diff --git a/include/linux/topology.h b/include/linux/topology.h
+index 33b7fda97d390..6575af39fd10f 100644
+--- a/include/linux/topology.h
++++ b/include/linux/topology.h
+@@ -260,7 +260,7 @@ static inline bool topology_is_primary_thread(unsigned int cpu)
+
+ #endif
+
+-static inline const struct cpumask *cpu_cpu_mask(int cpu)
++static inline const struct cpumask *cpu_node_mask(int cpu)
+ {
+ return cpumask_of_node(cpu_to_node(cpu));
+ }
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 6e2f54169e66c..36d4f9f063516 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1591,7 +1591,6 @@ static void claim_allocations(int cpu, struct sched_domain *sd)
+ enum numa_topology_type sched_numa_topology_type;
+
+ static int sched_domains_numa_levels;
+-static int sched_domains_curr_level;
+
+ int sched_max_numa_distance;
+ static int *sched_domains_numa_distance;
+@@ -1632,14 +1631,7 @@ sd_init(struct sched_domain_topology_level *tl,
+ int sd_id, sd_weight, sd_flags = 0;
+ struct cpumask *sd_span;
+
+-#ifdef CONFIG_NUMA
+- /*
+- * Ugly hack to pass state to sd_numa_mask()...
+- */
+- sched_domains_curr_level = tl->numa_level;
+-#endif
+-
+- sd_weight = cpumask_weight(tl->mask(cpu));
++ sd_weight = cpumask_weight(tl->mask(tl, cpu));
+
+ if (tl->sd_flags)
+ sd_flags = (*tl->sd_flags)();
+@@ -1677,7 +1669,7 @@ sd_init(struct sched_domain_topology_level *tl,
+ };
+
+ sd_span = sched_domain_span(sd);
+- cpumask_and(sd_span, cpu_map, tl->mask(cpu));
++ cpumask_and(sd_span, cpu_map, tl->mask(tl, cpu));
+ sd_id = cpumask_first(sd_span);
+
+ sd->flags |= asym_cpu_capacity_classify(sd_span, cpu_map);
+@@ -1737,17 +1729,17 @@ sd_init(struct sched_domain_topology_level *tl,
+ */
+ static struct sched_domain_topology_level default_topology[] = {
+ #ifdef CONFIG_SCHED_SMT
+- SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
++ SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
+ #endif
+
+ #ifdef CONFIG_SCHED_CLUSTER
+- SDTL_INIT(cpu_clustergroup_mask, cpu_cluster_flags, CLS),
++ SDTL_INIT(tl_cls_mask, cpu_cluster_flags, CLS),
+ #endif
+
+ #ifdef CONFIG_SCHED_MC
+- SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
++ SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
+ #endif
+- SDTL_INIT(cpu_cpu_mask, NULL, PKG),
++ SDTL_INIT(tl_pkg_mask, NULL, PKG),
+ { NULL, },
+ };
+
+@@ -1769,9 +1761,9 @@ void __init set_sched_topology(struct sched_domain_topology_level *tl)
+
+ #ifdef CONFIG_NUMA
+
+-static const struct cpumask *sd_numa_mask(int cpu)
++static const struct cpumask *sd_numa_mask(struct sched_domain_topology_level *tl, int cpu)
+ {
+- return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)];
++ return sched_domains_numa_masks[tl->numa_level][cpu_to_node(cpu)];
+ }
+
+ static void sched_numa_warn(const char *str)
+@@ -2413,7 +2405,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
+ * breaks the linking done for an earlier span.
+ */
+ for_each_cpu(cpu, cpu_map) {
+- const struct cpumask *tl_cpu_mask = tl->mask(cpu);
++ const struct cpumask *tl_cpu_mask = tl->mask(tl, cpu);
+ int id;
+
+ /* lowest bit set in this mask is used as a unique id */
+@@ -2421,7 +2413,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
+
+ if (cpumask_test_cpu(id, id_seen)) {
+ /* First CPU has already been seen, ensure identical spans */
+- if (!cpumask_equal(tl->mask(id), tl_cpu_mask))
++ if (!cpumask_equal(tl->mask(tl, id), tl_cpu_mask))
+ return false;
+ } else {
+ /* First CPU hasn't been seen before, ensure it's a completely new span */
+--
+2.51.0
+
--- /dev/null
+From a865160638ed4bd2c8b39002efb724fa1e138e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 17:00:37 +0200
+Subject: scripts/misc-check: update export checks for
+ EXPORT_SYMBOL_FOR_MODULES()
+
+From: Vlastimil Babka <vbabka@suse.cz>
+
+[ Upstream commit 0354e81b7bd629f9c3379c9524e988ebc504fa25 ]
+
+The module export checks are looking for EXPORT_SYMBOL_GPL_FOR_MODULES()
+which was renamed to EXPORT_SYMBOL_FOR_MODULES(). Update the checks.
+
+Fixes: 6d3c3ca4c77e ("module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES")
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Link: https://lore.kernel.org/r/20250825-export_modules_fix-v1-1-5c331e949538@suse.cz
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/misc-check | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/misc-check b/scripts/misc-check
+index 84f08da17b2c0..40e5a4b01ff47 100755
+--- a/scripts/misc-check
++++ b/scripts/misc-check
+@@ -45,7 +45,7 @@ check_tracked_ignored_files () {
+ # does not automatically fix it.
+ check_missing_include_linux_export_h () {
+
+- git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' \
++ git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' \
+ -- '*.[ch]' :^tools/ :^include/linux/export.h |
+ xargs -r git -C "${srctree:-.}" grep --files-without-match '#include[[:space:]]*<linux/export\.h>' |
+ xargs -r printf "%s: warning: EXPORT_SYMBOL() is used, but #include <linux/export.h> is missing\n" >&2
+@@ -58,7 +58,7 @@ check_unnecessary_include_linux_export_h () {
+
+ git -C "${srctree:-.}" grep --files-with-matches '#include[[:space:]]*<linux/export\.h>' \
+ -- '*.[c]' :^tools/ |
+- xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' |
++ xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' |
+ xargs -r printf "%s: warning: EXPORT_SYMBOL() is not used, but #include <linux/export.h> is present\n" >&2
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b49b661c0c2fb4150cad61dba9d8fd510067f67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:18 +0200
+Subject: scsi: libsas: Add dev_parent_is_expander() helper
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit e5eb72c92eb724aa14c50c7d92d1a576dd50d7e6 ]
+
+Many libsas drivers check if the parent of the device is an expander.
+Create a helper that the libsas drivers will use in follow up commits.
+
+Suggested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-15-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 5 +----
+ include/scsi/libsas.h | 8 ++++++++
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 869b5d4db44cb..d953225f6cc24 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -1313,10 +1313,7 @@ static int sas_check_parent_topology(struct domain_device *child)
+ int i;
+ int res = 0;
+
+- if (!child->parent)
+- return 0;
+-
+- if (!dev_is_expander(child->parent->dev_type))
++ if (!dev_parent_is_expander(child))
+ return 0;
+
+ parent_ex = &child->parent->ex_dev;
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index ba460b6c0374d..8d38565e99fa1 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -203,6 +203,14 @@ static inline bool dev_is_expander(enum sas_device_type type)
+ type == SAS_FANOUT_EXPANDER_DEVICE;
+ }
+
++static inline bool dev_parent_is_expander(struct domain_device *dev)
++{
++ if (!dev->parent)
++ return false;
++
++ return dev_is_expander(dev->parent->dev_type);
++}
++
+ static inline void INIT_SAS_WORK(struct sas_work *sw, void (*fn)(struct work_struct *))
+ {
+ INIT_WORK(&sw->work, fn);
+--
+2.51.0
+
--- /dev/null
+From c4ac4ed59482f7e301bbd6740b714863a9c18958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index dc74ebc6405ac..66fd301f03b0d 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From f99fec551fc73a93a3341b2dca336d41e72a6f7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index 95af3bb03834c..a58abd796603b 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From 865c5b7d216c9b107ed3d925592679ca3fc0cc11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:23 +0200
+Subject: scsi: pm80xx: Add helper function to get the local phy id
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit b4ec98303f9fc9b1da0053106716db6a7e002d8b ]
+
+Avoid duplicated code by adding a helper to get the local phy id.
+
+No functional changes intended.
+
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-20-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 7 +++----
+ drivers/scsi/pm8001/pm8001_sas.c | 10 ++++++++++
+ drivers/scsi/pm8001/pm8001_sas.h | 1 +
+ drivers/scsi/pm8001/pm80xx_hwi.c | 6 ++----
+ 4 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index fb4913547b00f..8005995a317c1 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4184,10 +4184,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ dev_is_expander(pm8001_dev->dev_type))
+ stp_sspsmp_sata = 0x01; /*ssp or smp*/
+ }
+- if (dev_parent_is_expander(dev))
+- phy_id = dev->parent->ex_dev.ex_phy->phy_id;
+- else
+- phy_id = pm8001_dev->attached_phy;
++
++ phy_id = pm80xx_get_local_phy_id(dev);
++
+ opc = OPC_INB_REG_DEV;
+ linkrate = (pm8001_dev->sas_device->linkrate < dev->port->linkrate) ?
+ pm8001_dev->sas_device->linkrate : dev->port->linkrate;
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 2bdeace6c6bfe..5595913eb7fc1 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -130,6 +130,16 @@ static void pm80xx_get_tag_opcodes(struct sas_task *task, int *ata_op,
+ }
+ }
+
++u32 pm80xx_get_local_phy_id(struct domain_device *dev)
++{
++ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++
++ if (dev_parent_is_expander(dev))
++ return dev->parent->ex_dev.ex_phy->phy_id;
++
++ return pm8001_dev->attached_phy;
++}
++
+ void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
+ struct pm8001_device *target_pm8001_dev)
+ {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 334485bb2c12d..91b2cdf3535cd 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -798,6 +798,7 @@ void pm8001_setds_completion(struct domain_device *dev);
+ void pm8001_tmf_aborted(struct sas_task *task);
+ void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
+ struct pm8001_device *dev);
++u32 pm80xx_get_local_phy_id(struct domain_device *dev);
+
+ #endif
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 546d0d26f7a17..31960b72c1e92 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4797,10 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ dev_is_expander(pm8001_dev->dev_type))
+ stp_sspsmp_sata = 0x01; /*ssp or smp*/
+ }
+- if (dev_parent_is_expander(dev))
+- phy_id = dev->parent->ex_dev.ex_phy->phy_id;
+- else
+- phy_id = pm8001_dev->attached_phy;
++
++ phy_id = pm80xx_get_local_phy_id(dev);
+
+ opc = OPC_INB_REG_DEV;
+
+--
+2.51.0
+
--- /dev/null
+From 02b880b288204da564ef0dce4051458f06863e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 753c09363cbbc..3e1dac4b820fe 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From ad7bd44ac0a20351295a705db5164fed4cff0740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:24 +0200
+Subject: scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an
+ expander
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit ad70c6bc776b53e61c8db6533c833aff0ff5da8b ]
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander.
+
+Thus, you cannot use attached_phy to index the pm8001_ha->phy array,
+without first verifying that the device is directly attached.
+
+Use the pm80xx_get_local_phy_id() helper to make sure that we use the
+local phy id to index the array, regardless if the device is directly
+attached or not.
+
+Fixes: 869ddbdcae3b ("scsi: pm80xx: corrected SATA abort handling sequence.")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-21-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 5595913eb7fc1..c5354263b45e8 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -1063,7 +1063,7 @@ int pm8001_abort_task(struct sas_task *task)
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev;
+ int rc = TMF_RESP_FUNC_FAILED, ret;
+- u32 phy_id, port_id;
++ u32 port_id;
+ struct sas_task_slow slow_task;
+
+ if (!task->lldd_task || !task->dev)
+@@ -1072,7 +1072,6 @@ int pm8001_abort_task(struct sas_task *task)
+ dev = task->dev;
+ pm8001_dev = dev->lldd_dev;
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+- phy_id = pm8001_dev->attached_phy;
+
+ if (PM8001_CHIP_DISP->fatal_errors(pm8001_ha)) {
+ // If the controller is seeing fatal errors
+@@ -1104,7 +1103,8 @@ int pm8001_abort_task(struct sas_task *task)
+ if (pm8001_ha->chip_id == chip_8006) {
+ DECLARE_COMPLETION_ONSTACK(completion_reset);
+ DECLARE_COMPLETION_ONSTACK(completion);
+- struct pm8001_phy *phy = pm8001_ha->phy + phy_id;
++ u32 phy_id = pm80xx_get_local_phy_id(dev);
++ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+ port_id = phy->port->port_id;
+
+ /* 1. Set Device state as Recovery */
+--
+2.51.0
+
--- /dev/null
+From e4a679a4fc55d0caf179b9b6db114d089b25f7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:16 +0200
+Subject: scsi: pm80xx: Restore support for expanders
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit eeee1086073e0058243c8554738271561bde81f1 ]
+
+Commit 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID") broke
+support for expanders. After the commit, devices behind an expander are
+no longer detected.
+
+Simply reverting the commit restores support for devices behind an
+expander.
+
+Instead of reverting the commit (and reintroducing a helper to get the
+port), get the port directly from the lldd_port pointer in struct
+asd_sas_port.
+
+Fixes: 0f630c58e31a ("scsi: pm80xx: Do not use libsas port ID")
+Suggested-by: Igor Pylypiv <ipylypiv@google.com>
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-13-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index f7067878b34f3..753c09363cbbc 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -477,7 +477,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
+ bool internal_abort = sas_is_internal_abort(task);
+ struct pm8001_hba_info *pm8001_ha;
+- struct pm8001_port *port = NULL;
++ struct pm8001_port *port;
+ struct pm8001_ccb_info *ccb;
+ unsigned long flags;
+ u32 n_elem = 0;
+@@ -502,8 +502,7 @@ int pm8001_queue_command(struct sas_task *task, gfp_t gfp_flags)
+
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+
+- pm8001_dev = dev->lldd_dev;
+- port = pm8001_ha->phy[pm8001_dev->attached_phy].port;
++ port = dev->port->lldd_port;
+
+ if (!internal_abort &&
+ (DEV_IS_GONE(pm8001_dev) || !port || !port->port_attached)) {
+--
+2.51.0
+
--- /dev/null
+From 21d26177b66948f88442e9f2e738717d2d942818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:22 +0200
+Subject: scsi: pm80xx: Use dev_parent_is_expander() helper
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 35e388696c3f3b6bf70e2010873c5e0c1d37d579 ]
+
+Make use of the dev_parent_is_expander() helper.
+
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-19-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 8 +++-----
+ drivers/scsi/pm8001/pm8001_sas.c | 5 ++---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++-----
+ 3 files changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 42a4eeac24c94..fb4913547b00f 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -2163,8 +2163,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ /* Print sas address of IO failed device */
+ if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) &&
+ (status != IO_UNDERFLOW)) {
+- if (!((t->dev->parent) &&
+- (dev_is_expander(t->dev->parent->dev_type)))) {
++ if (!dev_parent_is_expander(t->dev)) {
+ for (i = 0, j = 4; j <= 7 && i <= 3; i++, j++)
+ sata_addr_low[i] = pm8001_ha->sas_addr[j];
+ for (i = 0, j = 0; j <= 3 && i <= 3; i++, j++)
+@@ -4168,7 +4167,6 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ u16 firstBurstSize = 0;
+ u16 ITNT = 2000;
+ struct domain_device *dev = pm8001_dev->sas_device;
+- struct domain_device *parent_dev = dev->parent;
+ struct pm8001_port *port = dev->port->lldd_port;
+
+ memset(&payload, 0, sizeof(payload));
+@@ -4186,8 +4184,8 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ dev_is_expander(pm8001_dev->dev_type))
+ stp_sspsmp_sata = 0x01; /*ssp or smp*/
+ }
+- if (parent_dev && dev_is_expander(parent_dev->dev_type))
+- phy_id = parent_dev->ex_dev.ex_phy->phy_id;
++ if (dev_parent_is_expander(dev))
++ phy_id = dev->parent->ex_dev.ex_phy->phy_id;
+ else
+ phy_id = pm8001_dev->attached_phy;
+ opc = OPC_INB_REG_DEV;
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index 3e1dac4b820fe..2bdeace6c6bfe 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -700,7 +700,7 @@ static int pm8001_dev_found_notify(struct domain_device *dev)
+ dev->lldd_dev = pm8001_device;
+ pm8001_device->dev_type = dev->dev_type;
+ pm8001_device->dcompletion = &completion;
+- if (parent_dev && dev_is_expander(parent_dev->dev_type)) {
++ if (dev_parent_is_expander(dev)) {
+ int phy_id;
+
+ phy_id = sas_find_attached_phy_id(&parent_dev->ex_dev, dev);
+@@ -749,7 +749,6 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
+- struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -771,7 +770,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ * The phy array only contains local phys. Thus, we cannot clear
+ * phy_attached for a device behind an expander.
+ */
+- if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ if (!dev_parent_is_expander(dev))
+ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index c1bae995a4128..546d0d26f7a17 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -2340,8 +2340,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha,
+ /* Print sas address of IO failed device */
+ if ((status != IO_SUCCESS) && (status != IO_OVERFLOW) &&
+ (status != IO_UNDERFLOW)) {
+- if (!((t->dev->parent) &&
+- (dev_is_expander(t->dev->parent->dev_type)))) {
++ if (!dev_parent_is_expander(t->dev)) {
+ for (i = 0, j = 4; i <= 3 && j <= 7; i++, j++)
+ sata_addr_low[i] = pm8001_ha->sas_addr[j];
+ for (i = 0, j = 0; i <= 3 && j <= 3; i++, j++)
+@@ -4780,7 +4779,6 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ u16 firstBurstSize = 0;
+ u16 ITNT = 2000;
+ struct domain_device *dev = pm8001_dev->sas_device;
+- struct domain_device *parent_dev = dev->parent;
+ struct pm8001_port *port = dev->port->lldd_port;
+
+ memset(&payload, 0, sizeof(payload));
+@@ -4799,8 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+ dev_is_expander(pm8001_dev->dev_type))
+ stp_sspsmp_sata = 0x01; /*ssp or smp*/
+ }
+- if (parent_dev && dev_is_expander(parent_dev->dev_type))
+- phy_id = parent_dev->ex_dev.ex_phy->phy_id;
++ if (dev_parent_is_expander(dev))
++ phy_id = dev->parent->ex_dev.ex_phy->phy_id;
+ else
+ phy_id = pm8001_dev->attached_phy;
+
+--
+2.51.0
+
--- /dev/null
+From f78286f5fddc4cddf6f08da5485e96453ebdaddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index 91bbd3b75bff9..ccd4485087a10 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1798,7 +1798,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3649,7 +3649,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 6e5d56b91951a13a1947234b7b2e664dead29636 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:45 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ qla_nvme_xmt_ls_rsp()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
+
+Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
+align with qla2x00_start_sp() returning negative error codes or
+QLA_SUCCESS, preventing logical errors.
+
+Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 8ee2e337c9e1b..316594aa40cc5 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(PURLS_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < PURLS_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 57e5bf6bb6b9ef9e0846d275c559a304575ff484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index be211ff22acbd..6a2e1c7fd1251 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 6759d89fb5aa69879ebcf93ac4d00d86aa44a111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 17:41:43 +0800
+Subject: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
+
+From: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+
+[ Upstream commit 79dde5f7dc7c038eec903745dc1550cd4139980e ]
+
+The cpu_latency_qos_add/remove/update_request interfaces lack internal
+synchronization by design, requiring the caller to ensure thread safety.
+The current implementation relies on the 'pm_qos_enabled' flag, which is
+insufficient to prevent concurrent access and cannot serve as a proper
+synchronization mechanism. This has led to data races and list
+corruption issues.
+
+A typical race condition call trace is:
+
+[Thread A]
+ufshcd_pm_qos_exit()
+ --> cpu_latency_qos_remove_request()
+ --> cpu_latency_qos_apply();
+ --> pm_qos_update_target()
+ --> plist_del <--(1) delete plist node
+ --> memset(req, 0, sizeof(*req));
+ --> hba->pm_qos_enabled = false;
+
+[Thread B]
+ufshcd_devfreq_target
+ --> ufshcd_devfreq_scale
+ --> ufshcd_scale_clks
+ --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true
+ --> cpu_latency_qos_update_request
+ --> pm_qos_update_target
+ --> plist_del <--(3) plist node use-after-free
+
+Introduces a dedicated mutex to serialize PM QoS operations, preventing
+data races and ensuring safe access to PM QoS resources, including sysfs
+interface reads.
+
+Fixes: 2777e73fc154 ("scsi: ufs: core: Add CPU latency QoS support for UFS driver")
+Signed-off-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Huan Tang <tanghuan@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs-sysfs.c | 2 ++
+ drivers/ufs/core/ufshcd.c | 9 +++++++++
+ include/ufs/ufshcd.h | 3 +++
+ 3 files changed, 14 insertions(+)
+
+diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c
+index 4bd7d491e3c5a..0086816b27cd9 100644
+--- a/drivers/ufs/core/ufs-sysfs.c
++++ b/drivers/ufs/core/ufs-sysfs.c
+@@ -512,6 +512,8 @@ static ssize_t pm_qos_enable_show(struct device *dev,
+ {
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ return sysfs_emit(buf, "%d\n", hba->pm_qos_enabled);
+ }
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 9a43102b2b21e..f2b6d1e94f76b 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -1045,6 +1045,7 @@ EXPORT_SYMBOL_GPL(ufshcd_is_hba_active);
+ */
+ void ufshcd_pm_qos_init(struct ufs_hba *hba)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
+
+ if (hba->pm_qos_enabled)
+ return;
+@@ -1061,6 +1062,8 @@ void ufshcd_pm_qos_init(struct ufs_hba *hba)
+ */
+ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ if (!hba->pm_qos_enabled)
+ return;
+
+@@ -1075,6 +1078,8 @@ void ufshcd_pm_qos_exit(struct ufs_hba *hba)
+ */
+ static void ufshcd_pm_qos_update(struct ufs_hba *hba, bool on)
+ {
++ guard(mutex)(&hba->pm_qos_mutex);
++
+ if (!hba->pm_qos_enabled)
+ return;
+
+@@ -10756,6 +10761,10 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ mutex_init(&hba->ee_ctrl_mutex);
+
+ mutex_init(&hba->wb_mutex);
++
++ /* Initialize mutex for PM QoS request synchronization */
++ mutex_init(&hba->pm_qos_mutex);
++
+ init_rwsem(&hba->clk_scaling_lock);
+
+ ufshcd_init_clk_gating(hba);
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 1d39437775842..a3fa98540d184 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -963,6 +963,7 @@ enum ufshcd_mcq_opr {
+ * @ufs_rtc_update_work: A work for UFS RTC periodic update
+ * @pm_qos_req: PM QoS request handle
+ * @pm_qos_enabled: flag to check if pm qos is enabled
++ * @pm_qos_mutex: synchronizes PM QoS request and status updates
+ * @critical_health_count: count of critical health exceptions
+ * @dev_lvl_exception_count: count of device level exceptions since last reset
+ * @dev_lvl_exception_id: vendor specific information about the
+@@ -1136,6 +1137,8 @@ struct ufs_hba {
+ struct delayed_work ufs_rtc_update_work;
+ struct pm_qos_request pm_qos_req;
+ bool pm_qos_enabled;
++ /* synchronizes PM QoS request and status updates */
++ struct mutex pm_qos_mutex;
+
+ int critical_health_count;
+ atomic_t dev_lvl_exception_count;
+--
+2.51.0
+
--- /dev/null
+From a78921af9c6075f59fba439aef8b85335625c687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 18:31:18 +0200
+Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
+ fast
+
+From: Johannes Nixdorf <johannes@nixdorf.dev>
+
+[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
+
+Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
+event to the tracer, and starts to wait interruptibly. With
+SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
+message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
+and is subsequently interrupted, the tracee begins to wait again
+uninterruptibly (but killable).
+
+This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
+is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
+condition to begin waiting again. In this case the tracee is interrupted
+even though the tracer already acted on its behalf. This breaks the
+assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
+namely that the tracer can be sure the syscall is not interrupted or
+restarted on the tracee after it is received on the tracer. Fix this
+by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
+switch to uninterruptible waiting.
+
+With the condition changed the loop in seccomp_do_user_notification()
+would exit immediately after deciding that noninterruptible waiting
+is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
+skipping the code that processes pending addfd commands first. Prevent
+this by executing the remaining loop body one last time in this case.
+
+Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
+Reported-by: Ali Polatel <alip@chesswob.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
+Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
+Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 41aa761c7738c..3bbfba30a777a 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1139,7 +1139,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
+ static bool should_sleep_killable(struct seccomp_filter *match,
+ struct seccomp_knotif *n)
+ {
+- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
+ }
+
+ static int seccomp_do_user_notification(int this_syscall,
+@@ -1186,13 +1186,11 @@ static int seccomp_do_user_notification(int this_syscall,
+
+ if (err != 0) {
+ /*
+- * Check to see if the notifcation got picked up and
+- * whether we should switch to wait killable.
++ * Check to see whether we should switch to wait
++ * killable. Only return the interrupted error if not.
+ */
+- if (!wait_killable && should_sleep_killable(match, &n))
+- continue;
+-
+- goto interrupted;
++ if (!(!wait_killable && should_sleep_killable(match, &n)))
++ goto interrupted;
+ }
+
+ addfd = list_first_entry_or_null(&n.addfd,
+--
+2.51.0
+
--- /dev/null
+From c56868089813b424a8212ae345e6b3e47be5ca77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:26:30 +0200
+Subject: selftest/futex: Compile also with libnuma < 2.0.16
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit ed323aeda5e09fa1ab95946673939c8c425c329c ]
+
+After using numa_set_mempolicy_home_node() the test fails to compile on
+systems with libnuma library versioned lower than 2.0.16.
+
+In order to allow lower library version add a pkg-config related check
+and exclude that part of the code. Without the proper MPOL setup it
+can't be tested.
+
+Make a total number of tests two. The first one is the first batch and
+the second is the MPOL related one. The goal is to let the user know if
+it has been skipped due to library limitation.
+
+Remove test_futex_mpol(), it was unused and it is now complained by the
+compiler if the part is not compiled.
+
+Fixes: 0ecb4232fc65e ("selftests/futex: Set the home_node in futex_numa_mpol")
+Closes: https://lore.kernel.org/oe-lkp/202507150858.bedaf012-lkp@intel.com
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/futex/functional/Makefile | 5 ++++-
+ .../futex/functional/futex_numa_mpol.c | 21 +++++++++----------
+ 2 files changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
+index ddfa61d857b9b..bd50aecfca8a3 100644
+--- a/tools/testing/selftests/futex/functional/Makefile
++++ b/tools/testing/selftests/futex/functional/Makefile
+@@ -1,6 +1,9 @@
+ # SPDX-License-Identifier: GPL-2.0
++PKG_CONFIG ?= pkg-config
++LIBNUMA_TEST = $(shell sh -c "$(PKG_CONFIG) numa --atleast-version 2.0.16 > /dev/null 2>&1 && echo SUFFICIENT || echo NO")
++
+ INCLUDES := -I../include -I../../ $(KHDR_INCLUDES)
+-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES)
++CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES) -DLIBNUMA_VER_$(LIBNUMA_TEST)=1
+ LDLIBS := -lpthread -lrt -lnuma
+
+ LOCAL_HDRS := \
+diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+index dd7b05e8cda45..7f2b2e1ff9f8a 100644
+--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+@@ -131,11 +131,6 @@ static void test_futex(void *futex_ptr, int err_value)
+ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
+ }
+
+-static void test_futex_mpol(void *futex_ptr, int err_value)
+-{
+- __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
+-}
+-
+ static void usage(char *prog)
+ {
+ printf("Usage: %s\n", prog);
+@@ -148,7 +143,7 @@ static void usage(char *prog)
+ int main(int argc, char *argv[])
+ {
+ struct futex32_numa *futex_numa;
+- int mem_size, i;
++ int mem_size;
+ void *futex_ptr;
+ int c;
+
+@@ -171,7 +166,7 @@ int main(int argc, char *argv[])
+ }
+
+ ksft_print_header();
+- ksft_set_plan(1);
++ ksft_set_plan(2);
+
+ mem_size = sysconf(_SC_PAGE_SIZE);
+ futex_ptr = mmap(NULL, mem_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+@@ -205,8 +200,11 @@ int main(int argc, char *argv[])
+ ksft_print_msg("Memory back to RW\n");
+ test_futex(futex_ptr, 0);
+
++ ksft_test_result_pass("futex2 memory boundarie tests passed\n");
++
+ /* MPOL test. Does not work as expected */
+- for (i = 0; i < 4; i++) {
++#ifdef LIBNUMA_VER_SUFFICIENT
++ for (int i = 0; i < 4; i++) {
+ unsigned long nodemask;
+ int ret;
+
+@@ -225,15 +223,16 @@ int main(int argc, char *argv[])
+ ret = futex2_wake(futex_ptr, 0, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
+ if (ret < 0)
+ ksft_test_result_fail("Failed to wake 0 with MPOL: %m\n");
+- if (0)
+- test_futex_mpol(futex_numa, 0);
+ if (futex_numa->numa != i) {
+ ksft_exit_fail_msg("Returned NUMA node is %d expected %d\n",
+ futex_numa->numa, i);
+ }
+ }
+ }
+- ksft_test_result_pass("NUMA MPOL tests passed\n");
++ ksft_test_result_pass("futex2 MPOL hints test passed\n");
++#else
++ ksft_test_result_skip("futex2 MPOL hints test requires libnuma 2.0.16+\n");
++#endif
+ ksft_finished();
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 91d9b3d2ecf968cf52d90771ece4eb17eb0c0b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 23:26:28 +0200
+Subject: selftest/futex: Make the error check more precise for futex_numa_mpol
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Almeida <andrealmeid@igalia.com>
+
+[ Upstream commit c1c863457780adfb2e29fa9a85897179ad3903e6 ]
+
+Instead of just checking if the syscall failed as expected, check as
+well if the returned error code matches the expected error code.
+
+[ bigeasy: reword the commmit message ]
+
+Signed-off-by: André Almeida <andrealmeid@igalia.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Waiman Long <longman@redhat.com>
+Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../futex/functional/futex_numa_mpol.c | 36 +++++++++++--------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+index 802c15c821906..dd7b05e8cda45 100644
+--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+@@ -77,7 +77,7 @@ static void join_max_threads(void)
+ }
+ }
+
+-static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flags)
++static void __test_futex(void *futex_ptr, int err_value, unsigned int futex_flags)
+ {
+ int to_wake, ret, i, need_exit = 0;
+
+@@ -88,11 +88,17 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
+
+ do {
+ ret = futex2_wake(futex_ptr, to_wake, futex_flags);
+- if (must_fail) {
+- if (ret < 0)
+- break;
+- ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
+- to_wake, futex_flags);
++
++ if (err_value) {
++ if (ret >= 0)
++ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
++ to_wake, futex_flags);
++
++ if (errno != err_value)
++ ksft_exit_fail_msg("futex2_wake(%d, 0x%x) expected error was %d, but returned %d (%s)\n",
++ to_wake, futex_flags, err_value, errno, strerror(errno));
++
++ break;
+ }
+ if (ret < 0) {
+ ksft_exit_fail_msg("Failed futex2_wake(%d, 0x%x): %m\n",
+@@ -106,12 +112,12 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
+ join_max_threads();
+
+ for (i = 0; i < MAX_THREADS; i++) {
+- if (must_fail && thread_args[i].result != -1) {
++ if (err_value && thread_args[i].result != -1) {
+ ksft_print_msg("Thread %d should fail but succeeded (%d)\n",
+ i, thread_args[i].result);
+ need_exit = 1;
+ }
+- if (!must_fail && thread_args[i].result != 0) {
++ if (!err_value && thread_args[i].result != 0) {
+ ksft_print_msg("Thread %d failed (%d)\n", i, thread_args[i].result);
+ need_exit = 1;
+ }
+@@ -120,14 +126,14 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
+ ksft_exit_fail_msg("Aborting due to earlier errors.\n");
+ }
+
+-static void test_futex(void *futex_ptr, int must_fail)
++static void test_futex(void *futex_ptr, int err_value)
+ {
+- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
++ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
+ }
+
+-static void test_futex_mpol(void *futex_ptr, int must_fail)
++static void test_futex_mpol(void *futex_ptr, int err_value)
+ {
+- __test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
++ __test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
+ }
+
+ static void usage(char *prog)
+@@ -184,16 +190,16 @@ int main(int argc, char *argv[])
+
+ /* FUTEX2_NUMA futex must be 8-byte aligned */
+ ksft_print_msg("Mis-aligned futex\n");
+- test_futex(futex_ptr + mem_size - 4, 1);
++ test_futex(futex_ptr + mem_size - 4, EINVAL);
+
+ futex_numa->numa = FUTEX_NO_NODE;
+ mprotect(futex_ptr, mem_size, PROT_READ);
+ ksft_print_msg("Memory, RO\n");
+- test_futex(futex_ptr, 1);
++ test_futex(futex_ptr, EFAULT);
+
+ mprotect(futex_ptr, mem_size, PROT_NONE);
+ ksft_print_msg("Memory, no access\n");
+- test_futex(futex_ptr, 1);
++ test_futex(futex_ptr, EFAULT);
+
+ mprotect(futex_ptr, mem_size, PROT_READ | PROT_WRITE);
+ ksft_print_msg("Memory back to RW\n");
+--
+2.51.0
+
--- /dev/null
+From c9ee549b5779f36aa8f676bc7bb41ef7a369f77a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:56:36 +0200
+Subject: selftests: always install UAPI headers to the correct directory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 2c55daf7de07158df2ab3835321086beca25a691 ]
+
+Currently the UAPI headers are always installed into the source directory.
+When building out-of-tree this doesn't work, as the include path will be
+wrong and it dirties the source tree, leading to complains by kbuild.
+
+Make sure the 'headers' target installs the UAPI headers in the correctly.
+
+The real target directory can come from multiple places. To handle them all
+extract the target directory from KHDR_INCLUDES.
+
+Link: https://lore.kernel.org/r/20250918-kselftest-uapi-out-of-tree-v1-1-f4434f28adcd@linutronix.de
+Reported-by: Jason Gunthorpe <jgg@nvidia.com>
+Closes: https://lore.kernel.org/lkml/20250917153209.GA2023406@nvidia.com/
+Fixes: 1a59f5d31569 ("selftests: Add headers target")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lib.mk | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index 5303900339292..a448fae57831d 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -228,7 +228,10 @@ $(OUTPUT)/%:%.S
+ $(LINK.S) $^ $(LDLIBS) -o $@
+ endif
+
++# Extract the expected header directory
++khdr_output := $(patsubst %/usr/include,%,$(filter %/usr/include,$(KHDR_INCLUDES)))
++
+ headers:
+- $(Q)$(MAKE) -C $(top_srcdir) headers
++ $(Q)$(MAKE) -f $(top_srcdir)/Makefile -C $(khdr_output) headers
+
+ .PHONY: run_tests all clean install emit_tests gen_mods_dir clean_mods_dir headers
+--
+2.51.0
+
--- /dev/null
+From 67af2dc3971d110a8f1e77bc17c6e05d3675fbec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From 5d669a2a51feb44e27bbaed12c182ce92191b815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 17:12:29 +0530
+Subject: selftests: arm64: Fix -Waddress warning in tpidr2 test
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit 50af02425afc72b1b47c4a0a0b9c9bdaa1a1b347 ]
+
+Thanks to -Waddress, the compiler warns that the ksft_test_result()
+invocations in the arm64 tpidr2 selftest are always true. Oops.
+
+Fix the test by, err, actually running the test functions.
+
+Fixes: 6d80cb73131d ("kselftest/arm64: Convert tpidr2 test to use kselftest.h")
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/abi/tpidr2.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c
+index f58a9f89b952c..4c89ab0f10101 100644
+--- a/tools/testing/selftests/arm64/abi/tpidr2.c
++++ b/tools/testing/selftests/arm64/abi/tpidr2.c
+@@ -227,10 +227,10 @@ int main(int argc, char **argv)
+ ret = open("/proc/sys/abi/sme_default_vector_length", O_RDONLY, 0);
+ if (ret >= 0) {
+ ksft_test_result(default_value(), "default_value\n");
+- ksft_test_result(write_read, "write_read\n");
+- ksft_test_result(write_sleep_read, "write_sleep_read\n");
+- ksft_test_result(write_fork_read, "write_fork_read\n");
+- ksft_test_result(write_clone_read, "write_clone_read\n");
++ ksft_test_result(write_read(), "write_read\n");
++ ksft_test_result(write_sleep_read(), "write_sleep_read\n");
++ ksft_test_result(write_fork_read(), "write_fork_read\n");
++ ksft_test_result(write_clone_read(), "write_clone_read\n");
+
+ } else {
+ ksft_print_msg("SME support not present\n");
+--
+2.51.0
+
--- /dev/null
+From 689b0a87d71a17198e474aea95eaa0686354ea28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 10:50:39 -0700
+Subject: selftests/bpf: Copy test_kmods when installing selftest
+
+From: Amery Hung <ameryhung@gmail.com>
+
+[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ]
+
+Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into
+common directory") consolidated the Makefile of test_kmods. However,
+since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel
+modules required by bpf selftests are now missing from kselftest_install
+when "make install". Fix it by adding test_kmod to TEST_GEN_FILES.
+
+Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory")
+Signed-off-by: Amery Hung <ameryhung@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250812175039.2323570-1-ameryhung@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 4863106034dfb..77794efc020ea 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -137,7 +137,7 @@ TEST_GEN_PROGS_EXTENDED = \
+ xdping \
+ xskxceiver
+
+-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
++TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi
+
+ ifneq ($(V),1)
+ submake_extras := feature_display=0
+--
+2.51.0
+
--- /dev/null
+From 65ce0aaf794a2da376ea76ed2f8b11f79d7feaa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:33:49 -0300
+Subject: selftests/bpf: Fix count write in testapp_xdp_metadata_copy()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ricardo B. Marlière <rbm@suse.com>
+
+[ Upstream commit c9110e6f7237f4a314e2b87b75a8a158b9877a7b ]
+
+Commit 4b302092553c ("selftests/xsk: Add tail adjustment tests and support
+check") added a new global to xsk_xdp_progs.c, but left out the access in
+the testapp_xdp_metadata_copy() function. Since bpf_map_update_elem() will
+write to the whole bss section, it gets truncated. Fix by writing to
+skel_rx->bss->count directly.
+
+Fixes: 4b302092553c ("selftests/xsk: Add tail adjustment tests and support check")
+Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250829-selftests-bpf-xsk_regression_fix-v1-1-5f5acdb9fe6b@suse.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 14 +-------------
+ 1 file changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index a29de0713f19f..352adc8df2d1c 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -2276,25 +2276,13 @@ static int testapp_xdp_metadata_copy(struct test_spec *test)
+ {
+ struct xsk_xdp_progs *skel_rx = test->ifobj_rx->xdp_progs;
+ struct xsk_xdp_progs *skel_tx = test->ifobj_tx->xdp_progs;
+- struct bpf_map *data_map;
+- int count = 0;
+- int key = 0;
+
+ test_spec_set_xdp_prog(test, skel_rx->progs.xsk_xdp_populate_metadata,
+ skel_tx->progs.xsk_xdp_populate_metadata,
+ skel_rx->maps.xsk, skel_tx->maps.xsk);
+ test->ifobj_rx->use_metadata = true;
+
+- data_map = bpf_object__find_map_by_name(skel_rx->obj, "xsk_xdp_.bss");
+- if (!data_map || !bpf_map__is_internal(data_map)) {
+- ksft_print_msg("Error: could not find bss section of XDP program\n");
+- return TEST_FAILURE;
+- }
+-
+- if (bpf_map_update_elem(bpf_map__fd(data_map), &key, &count, BPF_ANY)) {
+- ksft_print_msg("Error: could not update count element\n");
+- return TEST_FAILURE;
+- }
++ skel_rx->bss->count = 0;
+
+ return testapp_validate_traffic(test);
+ }
+--
+2.51.0
+
--- /dev/null
+From 0f507380f7206595ce342198dfd0f0339c068a46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 14:22:23 +0200
+Subject: selftests/bpf: Fix realloc size in bpf_get_addrs
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 0c342bfc9949dffeaa83ebdde3b4b0ce59009348 ]
+
+We will segfault once we call realloc in bpf_get_addrs due to
+wrong size argument.
+
+Fixes: 6302bdeb91df ("selftests/bpf: Add a kprobe_multi subtest to use addrs instead of syms")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/trace_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
+index d24baf244d1f3..03f223333aa4a 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.c
++++ b/tools/testing/selftests/bpf/trace_helpers.c
+@@ -712,7 +712,7 @@ int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
+
+ if (cnt == max_cnt) {
+ max_cnt += inc_cnt;
+- tmp_addrs = realloc(addrs, max_cnt);
++ tmp_addrs = realloc(addrs, max_cnt * sizeof(long));
+ if (!tmp_addrs) {
+ err = -ENOMEM;
+ goto error;
+--
+2.51.0
+
--- /dev/null
+From 1e455c9d2fa6ffb110a7fe04d06da6661a2ae6dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:27:46 +0530
+Subject: selftests/bpf: Fix typos and grammar in test sources
+
+From: Shubham Sharma <slopixelz@gmail.com>
+
+[ Upstream commit d3abefe897408718799ae3bd06295b89b870a38e ]
+
+Fix spelling typos and grammar errors in BPF selftests source code.
+
+Signed-off-by: Shubham Sharma <slopixelz@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250826125746.17983-1-slopixelz@gmail.com
+Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 2 +-
+ tools/testing/selftests/bpf/bench.c | 2 +-
+ tools/testing/selftests/bpf/prog_tests/btf_dump.c | 2 +-
+ tools/testing/selftests/bpf/prog_tests/fd_array.c | 2 +-
+ .../testing/selftests/bpf/prog_tests/kprobe_multi_test.c | 2 +-
+ tools/testing/selftests/bpf/prog_tests/module_attach.c | 2 +-
+ tools/testing/selftests/bpf/prog_tests/reg_bounds.c | 4 ++--
+ .../selftests/bpf/prog_tests/stacktrace_build_id.c | 2 +-
+ .../selftests/bpf/prog_tests/stacktrace_build_id_nmi.c | 2 +-
+ tools/testing/selftests/bpf/prog_tests/stacktrace_map.c | 2 +-
+ .../selftests/bpf/prog_tests/stacktrace_map_raw_tp.c | 2 +-
+ .../selftests/bpf/prog_tests/stacktrace_map_skip.c | 2 +-
+ tools/testing/selftests/bpf/progs/bpf_cc_cubic.c | 2 +-
+ tools/testing/selftests/bpf/progs/bpf_dctcp.c | 2 +-
+ .../selftests/bpf/progs/freplace_connect_v4_prog.c | 2 +-
+ tools/testing/selftests/bpf/progs/iters_state_safety.c | 2 +-
+ tools/testing/selftests/bpf/progs/rbtree_search.c | 2 +-
+ .../testing/selftests/bpf/progs/struct_ops_kptr_return.c | 2 +-
+ tools/testing/selftests/bpf/progs/struct_ops_refcounted.c | 2 +-
+ tools/testing/selftests/bpf/progs/test_cls_redirect.c | 2 +-
+ .../selftests/bpf/progs/test_cls_redirect_dynptr.c | 2 +-
+ tools/testing/selftests/bpf/progs/uretprobe_stack.c | 4 ++--
+ tools/testing/selftests/bpf/progs/verifier_scalar_ids.c | 2 +-
+ tools/testing/selftests/bpf/progs/verifier_var_off.c | 6 +++---
+ tools/testing/selftests/bpf/test_sockmap.c | 2 +-
+ tools/testing/selftests/bpf/verifier/calls.c | 8 ++++----
+ tools/testing/selftests/bpf/xdping.c | 2 +-
+ tools/testing/selftests/bpf/xsk.h | 4 ++--
+ 28 files changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 77794efc020ea..fd6b370c81698 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -398,7 +398,7 @@ $(HOST_BPFOBJ): $(wildcard $(BPFDIR)/*.[ch] $(BPFDIR)/Makefile) \
+ DESTDIR=$(HOST_SCRATCH_DIR)/ prefix= all install_headers
+ endif
+
+-# vmlinux.h is first dumped to a temprorary file and then compared to
++# vmlinux.h is first dumped to a temporary file and then compared to
+ # the previous version. This helps to avoid unnecessary re-builds of
+ # $(TRUNNER_BPF_OBJS)
+ $(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) $(BPFTOOL) | $(INCLUDE_DIR)
+diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c
+index ddd73d06a1eb2..3ecc226ea7b25 100644
+--- a/tools/testing/selftests/bpf/bench.c
++++ b/tools/testing/selftests/bpf/bench.c
+@@ -499,7 +499,7 @@ extern const struct bench bench_rename_rawtp;
+ extern const struct bench bench_rename_fentry;
+ extern const struct bench bench_rename_fexit;
+
+-/* pure counting benchmarks to establish theoretical lmits */
++/* pure counting benchmarks to establish theoretical limits */
+ extern const struct bench bench_trig_usermode_count;
+ extern const struct bench bench_trig_syscall_count;
+ extern const struct bench bench_trig_kernel_count;
+diff --git a/tools/testing/selftests/bpf/prog_tests/btf_dump.c b/tools/testing/selftests/bpf/prog_tests/btf_dump.c
+index 82903585c8700..10cba526d3e63 100644
+--- a/tools/testing/selftests/bpf/prog_tests/btf_dump.c
++++ b/tools/testing/selftests/bpf/prog_tests/btf_dump.c
+@@ -63,7 +63,7 @@ static int test_btf_dump_case(int n, struct btf_dump_test_case *t)
+
+ /* tests with t->known_ptr_sz have no "long" or "unsigned long" type,
+ * so it's impossible to determine correct pointer size; but if they
+- * do, it should be 8 regardless of host architecture, becaues BPF
++ * do, it should be 8 regardless of host architecture, because BPF
+ * target is always 64-bit
+ */
+ if (!t->known_ptr_sz) {
+diff --git a/tools/testing/selftests/bpf/prog_tests/fd_array.c b/tools/testing/selftests/bpf/prog_tests/fd_array.c
+index 241b2c8c6e0f1..c534b4d5f9da8 100644
+--- a/tools/testing/selftests/bpf/prog_tests/fd_array.c
++++ b/tools/testing/selftests/bpf/prog_tests/fd_array.c
+@@ -293,7 +293,7 @@ static int get_btf_id_by_fd(int btf_fd, __u32 *id)
+ * 1) Create a new btf, it's referenced only by a file descriptor, so refcnt=1
+ * 2) Load a BPF prog with fd_array[0] = btf_fd; now btf's refcnt=2
+ * 3) Close the btf_fd, now refcnt=1
+- * Wait and check that BTF stil exists.
++ * Wait and check that BTF still exists.
+ */
+ static void check_fd_array_cnt__referenced_btfs(void)
+ {
+diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+index e19ef509ebf85..f377bea0b82d4 100644
+--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
++++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+@@ -463,7 +463,7 @@ static bool skip_entry(char *name)
+ return false;
+ }
+
+-/* Do comparision by ignoring '.llvm.<hash>' suffixes. */
++/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
+ static int compare_name(const char *name1, const char *name2)
+ {
+ const char *res1, *res2;
+diff --git a/tools/testing/selftests/bpf/prog_tests/module_attach.c b/tools/testing/selftests/bpf/prog_tests/module_attach.c
+index 6d391d95f96e0..70fa7ae93173b 100644
+--- a/tools/testing/selftests/bpf/prog_tests/module_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/module_attach.c
+@@ -90,7 +90,7 @@ void test_module_attach(void)
+
+ test_module_attach__detach(skel);
+
+- /* attach fentry/fexit and make sure it get's module reference */
++ /* attach fentry/fexit and make sure it gets module reference */
+ link = bpf_program__attach(skel->progs.handle_fentry);
+ if (!ASSERT_OK_PTR(link, "attach_fentry"))
+ goto cleanup;
+diff --git a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
+index e261b0e872dbb..d93a0c7b1786f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
++++ b/tools/testing/selftests/bpf/prog_tests/reg_bounds.c
+@@ -623,7 +623,7 @@ static void range_cond(enum num_t t, struct range x, struct range y,
+ *newx = range(t, x.a, x.b);
+ *newy = range(t, y.a + 1, y.b);
+ } else if (x.a == x.b && x.b == y.b) {
+- /* X is a constant matching rigth side of Y */
++ /* X is a constant matching right side of Y */
+ *newx = range(t, x.a, x.b);
+ *newy = range(t, y.a, y.b - 1);
+ } else if (y.a == y.b && x.a == y.a) {
+@@ -631,7 +631,7 @@ static void range_cond(enum num_t t, struct range x, struct range y,
+ *newx = range(t, x.a + 1, x.b);
+ *newy = range(t, y.a, y.b);
+ } else if (y.a == y.b && x.b == y.b) {
+- /* Y is a constant matching rigth side of X */
++ /* Y is a constant matching right side of X */
+ *newx = range(t, x.a, x.b - 1);
+ *newy = range(t, y.a, y.b);
+ } else {
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
+index b7ba5cd47d96f..271b5cc9fc015 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id.c
+@@ -39,7 +39,7 @@ void test_stacktrace_build_id(void)
+ bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+ /* for every element in stackid_hmap, we can find a corresponding one
+- * in stackmap, and vise versa.
++ * in stackmap, and vice versa.
+ */
+ err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+ if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+index 0832fd7874575..b277dddd5af7f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_build_id_nmi.c
+@@ -66,7 +66,7 @@ void test_stacktrace_build_id_nmi(void)
+ bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+ /* for every element in stackid_hmap, we can find a corresponding one
+- * in stackmap, and vise versa.
++ * in stackmap, and vice versa.
+ */
+ err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+ if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
+index df59e4ae29510..84a7e405e9129 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map.c
+@@ -50,7 +50,7 @@ void test_stacktrace_map(void)
+ bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+ /* for every element in stackid_hmap, we can find a corresponding one
+- * in stackmap, and vise versa.
++ * in stackmap, and vice versa.
+ */
+ err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+ if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
+index c6ef06f55cdb4..e0cb4697b4b3c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_raw_tp.c
+@@ -46,7 +46,7 @@ void test_stacktrace_map_raw_tp(void)
+ bpf_map_update_elem(control_map_fd, &key, &val, 0);
+
+ /* for every element in stackid_hmap, we can find a corresponding one
+- * in stackmap, and vise versa.
++ * in stackmap, and vice versa.
+ */
+ err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+ if (CHECK(err, "compare_map_keys stackid_hmap vs. stackmap",
+diff --git a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
+index 1932b1e0685cf..dc2ccf6a14d13 100644
+--- a/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
++++ b/tools/testing/selftests/bpf/prog_tests/stacktrace_map_skip.c
+@@ -40,7 +40,7 @@ void test_stacktrace_map_skip(void)
+ skel->bss->control = 1;
+
+ /* for every element in stackid_hmap, we can find a corresponding one
+- * in stackmap, and vise versa.
++ * in stackmap, and vice versa.
+ */
+ err = compare_map_keys(stackid_hmap_fd, stackmap_fd);
+ if (!ASSERT_OK(err, "compare_map_keys stackid_hmap vs. stackmap"))
+diff --git a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
+index 1654a530aa3dc..4e51785e7606e 100644
+--- a/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
++++ b/tools/testing/selftests/bpf/progs/bpf_cc_cubic.c
+@@ -101,7 +101,7 @@ static void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked,
+ tp->snd_cwnd = pkts_in_flight + sndcnt;
+ }
+
+-/* Decide wheather to run the increase function of congestion control. */
++/* Decide whether to run the increase function of congestion control. */
+ static bool tcp_may_raise_cwnd(const struct sock *sk, const int flag)
+ {
+ if (tcp_sk(sk)->reordering > TCP_REORDERING)
+diff --git a/tools/testing/selftests/bpf/progs/bpf_dctcp.c b/tools/testing/selftests/bpf/progs/bpf_dctcp.c
+index 7cd73e75f52a2..32c511bcd60b3 100644
+--- a/tools/testing/selftests/bpf/progs/bpf_dctcp.c
++++ b/tools/testing/selftests/bpf/progs/bpf_dctcp.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /* Copyright (c) 2019 Facebook */
+
+-/* WARNING: This implemenation is not necessarily the same
++/* WARNING: This implementation is not necessarily the same
+ * as the tcp_dctcp.c. The purpose is mainly for testing
+ * the kernel BPF logic.
+ */
+diff --git a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
+index 544e5ac904610..d09bbd8ae8a85 100644
+--- a/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
++++ b/tools/testing/selftests/bpf/progs/freplace_connect_v4_prog.c
+@@ -12,7 +12,7 @@
+ SEC("freplace/connect_v4_prog")
+ int new_connect_v4_prog(struct bpf_sock_addr *ctx)
+ {
+- // return value thats in invalid range
++ // return value that's in invalid range
+ return 255;
+ }
+
+diff --git a/tools/testing/selftests/bpf/progs/iters_state_safety.c b/tools/testing/selftests/bpf/progs/iters_state_safety.c
+index f41257eadbb25..b381ac0c736cf 100644
+--- a/tools/testing/selftests/bpf/progs/iters_state_safety.c
++++ b/tools/testing/selftests/bpf/progs/iters_state_safety.c
+@@ -345,7 +345,7 @@ int __naked read_from_iter_slot_fail(void)
+ "r3 = 1000;"
+ "call %[bpf_iter_num_new];"
+
+- /* attemp to leak bpf_iter_num state */
++ /* attempt to leak bpf_iter_num state */
+ "r7 = *(u64 *)(r6 + 0);"
+ "r8 = *(u64 *)(r6 + 8);"
+
+diff --git a/tools/testing/selftests/bpf/progs/rbtree_search.c b/tools/testing/selftests/bpf/progs/rbtree_search.c
+index 098ef970fac16..b05565d1db0d4 100644
+--- a/tools/testing/selftests/bpf/progs/rbtree_search.c
++++ b/tools/testing/selftests/bpf/progs/rbtree_search.c
+@@ -183,7 +183,7 @@ long test_##op##_spinlock_##dolock(void *ctx) \
+ }
+
+ /*
+- * Use a spearate MSG macro instead of passing to TEST_XXX(..., MSG)
++ * Use a separate MSG macro instead of passing to TEST_XXX(..., MSG)
+ * to ensure the message itself is not in the bpf prog lineinfo
+ * which the verifier includes in its log.
+ * Otherwise, the test_loader will incorrectly match the prog lineinfo
+diff --git a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
+index 36386b3c23a1f..2b98b7710816d 100644
+--- a/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
++++ b/tools/testing/selftests/bpf/progs/struct_ops_kptr_return.c
+@@ -9,7 +9,7 @@ void bpf_task_release(struct task_struct *p) __ksym;
+
+ /* This test struct_ops BPF programs returning referenced kptr. The verifier should
+ * allow a referenced kptr or a NULL pointer to be returned. A referenced kptr to task
+- * here is acquried automatically as the task argument is tagged with "__ref".
++ * here is acquired automatically as the task argument is tagged with "__ref".
+ */
+ SEC("struct_ops/test_return_ref_kptr")
+ struct task_struct *BPF_PROG(kptr_return, int dummy,
+diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
+index 76dcb6089d7f8..9c0a65466356c 100644
+--- a/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
++++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted.c
+@@ -9,7 +9,7 @@ __attribute__((nomerge)) extern void bpf_task_release(struct task_struct *p) __k
+
+ /* This is a test BPF program that uses struct_ops to access a referenced
+ * kptr argument. This is a test for the verifier to ensure that it
+- * 1) recongnizes the task as a referenced object (i.e., ref_obj_id > 0), and
++ * 1) recognizes the task as a referenced object (i.e., ref_obj_id > 0), and
+ * 2) the same reference can be acquired from multiple paths as long as it
+ * has not been released.
+ */
+diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.c b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
+index f344c6835e84e..823169fb6e4c7 100644
+--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.c
++++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.c
+@@ -129,7 +129,7 @@ typedef uint8_t *net_ptr __attribute__((align_value(8)));
+ typedef struct buf {
+ struct __sk_buff *skb;
+ net_ptr head;
+- /* NB: tail musn't have alignment other than 1, otherwise
++ /* NB: tail mustn't have alignment other than 1, otherwise
+ * LLVM will go and eliminate code, e.g. when checking packet lengths.
+ */
+ uint8_t *const tail;
+diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
+index d0f7670351e58..dfd4a2710391d 100644
+--- a/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
++++ b/tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c
+@@ -494,7 +494,7 @@ static ret_t get_next_hop(struct bpf_dynptr *dynptr, __u64 *offset, encap_header
+
+ *offset += sizeof(*next_hop);
+
+- /* Skip the remainig next hops (may be zero). */
++ /* Skip the remaining next hops (may be zero). */
+ return skip_next_hops(offset, encap->unigue.hop_count - encap->unigue.next_hop - 1);
+ }
+
+diff --git a/tools/testing/selftests/bpf/progs/uretprobe_stack.c b/tools/testing/selftests/bpf/progs/uretprobe_stack.c
+index 9fdcf396b8f46..a2951e2f1711b 100644
+--- a/tools/testing/selftests/bpf/progs/uretprobe_stack.c
++++ b/tools/testing/selftests/bpf/progs/uretprobe_stack.c
+@@ -26,8 +26,8 @@ int usdt_len;
+ SEC("uprobe//proc/self/exe:target_1")
+ int BPF_UPROBE(uprobe_1)
+ {
+- /* target_1 is recursive wit depth of 2, so we capture two separate
+- * stack traces, depending on which occurence it is
++ /* target_1 is recursive with depth of 2, so we capture two separate
++ * stack traces, depending on which occurrence it is
+ */
+ static bool recur = false;
+
+diff --git a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
+index 7c5e5e6d10ebc..dba3ca728f6e6 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
++++ b/tools/testing/selftests/bpf/progs/verifier_scalar_ids.c
+@@ -349,7 +349,7 @@ __naked void precision_two_ids(void)
+ SEC("socket")
+ __success __log_level(2)
+ __flag(BPF_F_TEST_STATE_FREQ)
+-/* check thar r0 and r6 have different IDs after 'if',
++/* check that r0 and r6 have different IDs after 'if',
+ * collect_linked_regs() can't tie more than 6 registers for a single insn.
+ */
+ __msg("8: (25) if r0 > 0x7 goto pc+0 ; R0=scalar(id=1")
+diff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c
+index 1d36d01b746e7..f345466bca686 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c
++++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c
+@@ -114,8 +114,8 @@ __naked void stack_write_priv_vs_unpriv(void)
+ }
+
+ /* Similar to the previous test, but this time also perform a read from the
+- * address written to with a variable offset. The read is allowed, showing that,
+- * after a variable-offset write, a priviledged program can read the slots that
++ * address written to with a variable offet. The read is allowed, showing that,
++ * after a variable-offset write, a privileged program can read the slots that
+ * were in the range of that write (even if the verifier doesn't actually know if
+ * the slot being read was really written to or not.
+ *
+@@ -157,7 +157,7 @@ __naked void stack_write_followed_by_read(void)
+ SEC("socket")
+ __description("variable-offset stack write clobbers spilled regs")
+ __failure
+-/* In the priviledged case, dereferencing a spilled-and-then-filled
++/* In the privileged case, dereferencing a spilled-and-then-filled
+ * register is rejected because the previous variable offset stack
+ * write might have overwritten the spilled pointer (i.e. we lose track
+ * of the spilled register when we analyze the write).
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index fd2da2234cc9b..76568db7a6642 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -1372,7 +1372,7 @@ static int run_options(struct sockmap_options *options, int cg_fd, int test)
+ } else
+ fprintf(stderr, "unknown test\n");
+ out:
+- /* Detatch and zero all the maps */
++ /* Detach and zero all the maps */
+ bpf_prog_detach2(bpf_program__fd(progs[3]), cg_fd, BPF_CGROUP_SOCK_OPS);
+
+ for (i = 0; i < ARRAY_SIZE(links); i++) {
+diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
+index f3492efc88346..c8d640802cce4 100644
+--- a/tools/testing/selftests/bpf/verifier/calls.c
++++ b/tools/testing/selftests/bpf/verifier/calls.c
+@@ -1375,7 +1375,7 @@
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+ /* write into map value */
+ BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
+- /* fetch secound map_value_ptr from the stack */
++ /* fetch second map_value_ptr from the stack */
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+ /* write into map value */
+@@ -1439,7 +1439,7 @@
+ /* second time with fp-16 */
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
+- /* fetch secound map_value_ptr from the stack */
++ /* fetch second map_value_ptr from the stack */
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
+ /* write into map value */
+ BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
+@@ -1493,7 +1493,7 @@
+ /* second time with fp-16 */
+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
+ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
+- /* fetch secound map_value_ptr from the stack */
++ /* fetch second map_value_ptr from the stack */
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
+ /* write into map value */
+ BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
+@@ -2380,7 +2380,7 @@
+ */
+ BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 1),
+ BPF_MOV64_REG(BPF_REG_9, BPF_REG_8),
+- /* r9 = *r9 ; verifier get's to this point via two paths:
++ /* r9 = *r9 ; verifier gets to this point via two paths:
+ * ; (I) one including r9 = r8, verified first;
+ * ; (II) one excluding r9 = r8, verified next.
+ * ; After load of *r9 to r9 the frame[0].fp[-24].id == r9.id.
+diff --git a/tools/testing/selftests/bpf/xdping.c b/tools/testing/selftests/bpf/xdping.c
+index 1503a1d2faa09..9ed8c796645d0 100644
+--- a/tools/testing/selftests/bpf/xdping.c
++++ b/tools/testing/selftests/bpf/xdping.c
+@@ -155,7 +155,7 @@ int main(int argc, char **argv)
+ }
+
+ if (!server) {
+- /* Only supports IPv4; see hints initiailization above. */
++ /* Only supports IPv4; see hints initialization above. */
+ if (getaddrinfo(argv[optind], NULL, &hints, &a) || !a) {
+ fprintf(stderr, "Could not resolve %s\n", argv[optind]);
+ return 1;
+diff --git a/tools/testing/selftests/bpf/xsk.h b/tools/testing/selftests/bpf/xsk.h
+index 93c2cc413cfcd..48729da142c24 100644
+--- a/tools/testing/selftests/bpf/xsk.h
++++ b/tools/testing/selftests/bpf/xsk.h
+@@ -93,8 +93,8 @@ static inline __u32 xsk_prod_nb_free(struct xsk_ring_prod *r, __u32 nb)
+ /* Refresh the local tail pointer.
+ * cached_cons is r->size bigger than the real consumer pointer so
+ * that this addition can be avoided in the more frequently
+- * executed code that computs free_entries in the beginning of
+- * this function. Without this optimization it whould have been
++ * executed code that computes free_entries in the beginning of
++ * this function. Without this optimization it would have been
+ * free_entries = r->cached_prod - r->cached_cons + r->size.
+ */
+ r->cached_cons = __atomic_load_n(r->consumer, __ATOMIC_ACQUIRE);
+--
+2.51.0
+
--- /dev/null
+From 44d5d5cd98ed180ae19aa177ffab7c6e50643b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 10:10:09 +0800
+Subject: selftests/bpf: move get_ksyms and get_addrs to trace_helpers.c
+
+From: Menglong Dong <menglong8.dong@gmail.com>
+
+[ Upstream commit 8bad31edf5490a38dc26163502cd7005a033ee05 ]
+
+We need to get all the kernel function that can be traced sometimes, so we
+move the get_syms() and get_addrs() in kprobe_multi_test.c to
+trace_helpers.c and rename it to bpf_get_ksyms() and bpf_get_addrs().
+
+Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
+Link: https://lore.kernel.org/r/20250904021011.14069-2-dongml2@chinatelecom.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 0c342bfc9949 ("selftests/bpf: Fix realloc size in bpf_get_addrs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bpf/prog_tests/kprobe_multi_test.c | 220 +-----------------
+ tools/testing/selftests/bpf/trace_helpers.c | 214 +++++++++++++++++
+ tools/testing/selftests/bpf/trace_helpers.h | 3 +
+ 3 files changed, 220 insertions(+), 217 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+index f377bea0b82d4..171706e78da88 100644
+--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
++++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+@@ -422,220 +422,6 @@ static void test_unique_match(void)
+ kprobe_multi__destroy(skel);
+ }
+
+-static size_t symbol_hash(long key, void *ctx __maybe_unused)
+-{
+- return str_hash((const char *) key);
+-}
+-
+-static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused)
+-{
+- return strcmp((const char *) key1, (const char *) key2) == 0;
+-}
+-
+-static bool is_invalid_entry(char *buf, bool kernel)
+-{
+- if (kernel && strchr(buf, '['))
+- return true;
+- if (!kernel && !strchr(buf, '['))
+- return true;
+- return false;
+-}
+-
+-static bool skip_entry(char *name)
+-{
+- /*
+- * We attach to almost all kernel functions and some of them
+- * will cause 'suspicious RCU usage' when fprobe is attached
+- * to them. Filter out the current culprits - arch_cpu_idle
+- * default_idle and rcu_* functions.
+- */
+- if (!strcmp(name, "arch_cpu_idle"))
+- return true;
+- if (!strcmp(name, "default_idle"))
+- return true;
+- if (!strncmp(name, "rcu_", 4))
+- return true;
+- if (!strcmp(name, "bpf_dispatcher_xdp_func"))
+- return true;
+- if (!strncmp(name, "__ftrace_invalid_address__",
+- sizeof("__ftrace_invalid_address__") - 1))
+- return true;
+- return false;
+-}
+-
+-/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
+-static int compare_name(const char *name1, const char *name2)
+-{
+- const char *res1, *res2;
+- int len1, len2;
+-
+- res1 = strstr(name1, ".llvm.");
+- res2 = strstr(name2, ".llvm.");
+- len1 = res1 ? res1 - name1 : strlen(name1);
+- len2 = res2 ? res2 - name2 : strlen(name2);
+-
+- if (len1 == len2)
+- return strncmp(name1, name2, len1);
+- if (len1 < len2)
+- return strncmp(name1, name2, len1) <= 0 ? -1 : 1;
+- return strncmp(name1, name2, len2) >= 0 ? 1 : -1;
+-}
+-
+-static int load_kallsyms_compare(const void *p1, const void *p2)
+-{
+- return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name);
+-}
+-
+-static int search_kallsyms_compare(const void *p1, const struct ksym *p2)
+-{
+- return compare_name(p1, p2->name);
+-}
+-
+-static int get_syms(char ***symsp, size_t *cntp, bool kernel)
+-{
+- size_t cap = 0, cnt = 0;
+- char *name = NULL, *ksym_name, **syms = NULL;
+- struct hashmap *map;
+- struct ksyms *ksyms;
+- struct ksym *ks;
+- char buf[256];
+- FILE *f;
+- int err = 0;
+-
+- ksyms = load_kallsyms_custom_local(load_kallsyms_compare);
+- if (!ASSERT_OK_PTR(ksyms, "load_kallsyms_custom_local"))
+- return -EINVAL;
+-
+- /*
+- * The available_filter_functions contains many duplicates,
+- * but other than that all symbols are usable in kprobe multi
+- * interface.
+- * Filtering out duplicates by using hashmap__add, which won't
+- * add existing entry.
+- */
+-
+- if (access("/sys/kernel/tracing/trace", F_OK) == 0)
+- f = fopen("/sys/kernel/tracing/available_filter_functions", "r");
+- else
+- f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r");
+-
+- if (!f)
+- return -EINVAL;
+-
+- map = hashmap__new(symbol_hash, symbol_equal, NULL);
+- if (IS_ERR(map)) {
+- err = libbpf_get_error(map);
+- goto error;
+- }
+-
+- while (fgets(buf, sizeof(buf), f)) {
+- if (is_invalid_entry(buf, kernel))
+- continue;
+-
+- free(name);
+- if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1)
+- continue;
+- if (skip_entry(name))
+- continue;
+-
+- ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare);
+- if (!ks) {
+- err = -EINVAL;
+- goto error;
+- }
+-
+- ksym_name = ks->name;
+- err = hashmap__add(map, ksym_name, 0);
+- if (err == -EEXIST) {
+- err = 0;
+- continue;
+- }
+- if (err)
+- goto error;
+-
+- err = libbpf_ensure_mem((void **) &syms, &cap,
+- sizeof(*syms), cnt + 1);
+- if (err)
+- goto error;
+-
+- syms[cnt++] = ksym_name;
+- }
+-
+- *symsp = syms;
+- *cntp = cnt;
+-
+-error:
+- free(name);
+- fclose(f);
+- hashmap__free(map);
+- if (err)
+- free(syms);
+- return err;
+-}
+-
+-static int get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
+-{
+- unsigned long *addr, *addrs, *tmp_addrs;
+- int err = 0, max_cnt, inc_cnt;
+- char *name = NULL;
+- size_t cnt = 0;
+- char buf[256];
+- FILE *f;
+-
+- if (access("/sys/kernel/tracing/trace", F_OK) == 0)
+- f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r");
+- else
+- f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r");
+-
+- if (!f)
+- return -ENOENT;
+-
+- /* In my local setup, the number of entries is 50k+ so Let us initially
+- * allocate space to hold 64k entries. If 64k is not enough, incrementally
+- * increase 1k each time.
+- */
+- max_cnt = 65536;
+- inc_cnt = 1024;
+- addrs = malloc(max_cnt * sizeof(long));
+- if (addrs == NULL) {
+- err = -ENOMEM;
+- goto error;
+- }
+-
+- while (fgets(buf, sizeof(buf), f)) {
+- if (is_invalid_entry(buf, kernel))
+- continue;
+-
+- free(name);
+- if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2)
+- continue;
+- if (skip_entry(name))
+- continue;
+-
+- if (cnt == max_cnt) {
+- max_cnt += inc_cnt;
+- tmp_addrs = realloc(addrs, max_cnt);
+- if (!tmp_addrs) {
+- err = -ENOMEM;
+- goto error;
+- }
+- addrs = tmp_addrs;
+- }
+-
+- addrs[cnt++] = (unsigned long)addr;
+- }
+-
+- *addrsp = addrs;
+- *cntp = cnt;
+-
+-error:
+- free(name);
+- fclose(f);
+- if (err)
+- free(addrs);
+- return err;
+-}
+-
+ static void do_bench_test(struct kprobe_multi_empty *skel, struct bpf_kprobe_multi_opts *opts)
+ {
+ long attach_start_ns, attach_end_ns;
+@@ -670,7 +456,7 @@ static void test_kprobe_multi_bench_attach(bool kernel)
+ char **syms = NULL;
+ size_t cnt = 0;
+
+- if (!ASSERT_OK(get_syms(&syms, &cnt, kernel), "get_syms"))
++ if (!ASSERT_OK(bpf_get_ksyms(&syms, &cnt, kernel), "bpf_get_ksyms"))
+ return;
+
+ skel = kprobe_multi_empty__open_and_load();
+@@ -696,13 +482,13 @@ static void test_kprobe_multi_bench_attach_addr(bool kernel)
+ size_t cnt = 0;
+ int err;
+
+- err = get_addrs(&addrs, &cnt, kernel);
++ err = bpf_get_addrs(&addrs, &cnt, kernel);
+ if (err == -ENOENT) {
+ test__skip();
+ return;
+ }
+
+- if (!ASSERT_OK(err, "get_addrs"))
++ if (!ASSERT_OK(err, "bpf_get_addrs"))
+ return;
+
+ skel = kprobe_multi_empty__open_and_load();
+diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
+index 81943c6254e6b..d24baf244d1f3 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.c
++++ b/tools/testing/selftests/bpf/trace_helpers.c
+@@ -17,6 +17,7 @@
+ #include <linux/limits.h>
+ #include <libelf.h>
+ #include <gelf.h>
++#include "bpf/hashmap.h"
+ #include "bpf/libbpf_internal.h"
+
+ #define TRACEFS_PIPE "/sys/kernel/tracing/trace_pipe"
+@@ -519,3 +520,216 @@ void read_trace_pipe(void)
+ {
+ read_trace_pipe_iter(trace_pipe_cb, NULL, 0);
+ }
++
++static size_t symbol_hash(long key, void *ctx __maybe_unused)
++{
++ return str_hash((const char *) key);
++}
++
++static bool symbol_equal(long key1, long key2, void *ctx __maybe_unused)
++{
++ return strcmp((const char *) key1, (const char *) key2) == 0;
++}
++
++static bool is_invalid_entry(char *buf, bool kernel)
++{
++ if (kernel && strchr(buf, '['))
++ return true;
++ if (!kernel && !strchr(buf, '['))
++ return true;
++ return false;
++}
++
++static bool skip_entry(char *name)
++{
++ /*
++ * We attach to almost all kernel functions and some of them
++ * will cause 'suspicious RCU usage' when fprobe is attached
++ * to them. Filter out the current culprits - arch_cpu_idle
++ * default_idle and rcu_* functions.
++ */
++ if (!strcmp(name, "arch_cpu_idle"))
++ return true;
++ if (!strcmp(name, "default_idle"))
++ return true;
++ if (!strncmp(name, "rcu_", 4))
++ return true;
++ if (!strcmp(name, "bpf_dispatcher_xdp_func"))
++ return true;
++ if (!strncmp(name, "__ftrace_invalid_address__",
++ sizeof("__ftrace_invalid_address__") - 1))
++ return true;
++ return false;
++}
++
++/* Do comparison by ignoring '.llvm.<hash>' suffixes. */
++static int compare_name(const char *name1, const char *name2)
++{
++ const char *res1, *res2;
++ int len1, len2;
++
++ res1 = strstr(name1, ".llvm.");
++ res2 = strstr(name2, ".llvm.");
++ len1 = res1 ? res1 - name1 : strlen(name1);
++ len2 = res2 ? res2 - name2 : strlen(name2);
++
++ if (len1 == len2)
++ return strncmp(name1, name2, len1);
++ if (len1 < len2)
++ return strncmp(name1, name2, len1) <= 0 ? -1 : 1;
++ return strncmp(name1, name2, len2) >= 0 ? 1 : -1;
++}
++
++static int load_kallsyms_compare(const void *p1, const void *p2)
++{
++ return compare_name(((const struct ksym *)p1)->name, ((const struct ksym *)p2)->name);
++}
++
++static int search_kallsyms_compare(const void *p1, const struct ksym *p2)
++{
++ return compare_name(p1, p2->name);
++}
++
++int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel)
++{
++ size_t cap = 0, cnt = 0;
++ char *name = NULL, *ksym_name, **syms = NULL;
++ struct hashmap *map;
++ struct ksyms *ksyms;
++ struct ksym *ks;
++ char buf[256];
++ FILE *f;
++ int err = 0;
++
++ ksyms = load_kallsyms_custom_local(load_kallsyms_compare);
++ if (!ksyms)
++ return -EINVAL;
++
++ /*
++ * The available_filter_functions contains many duplicates,
++ * but other than that all symbols are usable to trace.
++ * Filtering out duplicates by using hashmap__add, which won't
++ * add existing entry.
++ */
++
++ if (access("/sys/kernel/tracing/trace", F_OK) == 0)
++ f = fopen("/sys/kernel/tracing/available_filter_functions", "r");
++ else
++ f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r");
++
++ if (!f)
++ return -EINVAL;
++
++ map = hashmap__new(symbol_hash, symbol_equal, NULL);
++ if (IS_ERR(map)) {
++ err = libbpf_get_error(map);
++ goto error;
++ }
++
++ while (fgets(buf, sizeof(buf), f)) {
++ if (is_invalid_entry(buf, kernel))
++ continue;
++
++ free(name);
++ if (sscanf(buf, "%ms$*[^\n]\n", &name) != 1)
++ continue;
++ if (skip_entry(name))
++ continue;
++
++ ks = search_kallsyms_custom_local(ksyms, name, search_kallsyms_compare);
++ if (!ks) {
++ err = -EINVAL;
++ goto error;
++ }
++
++ ksym_name = ks->name;
++ err = hashmap__add(map, ksym_name, 0);
++ if (err == -EEXIST) {
++ err = 0;
++ continue;
++ }
++ if (err)
++ goto error;
++
++ err = libbpf_ensure_mem((void **) &syms, &cap,
++ sizeof(*syms), cnt + 1);
++ if (err)
++ goto error;
++
++ syms[cnt++] = ksym_name;
++ }
++
++ *symsp = syms;
++ *cntp = cnt;
++
++error:
++ free(name);
++ fclose(f);
++ hashmap__free(map);
++ if (err)
++ free(syms);
++ return err;
++}
++
++int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel)
++{
++ unsigned long *addr, *addrs, *tmp_addrs;
++ int err = 0, max_cnt, inc_cnt;
++ char *name = NULL;
++ size_t cnt = 0;
++ char buf[256];
++ FILE *f;
++
++ if (access("/sys/kernel/tracing/trace", F_OK) == 0)
++ f = fopen("/sys/kernel/tracing/available_filter_functions_addrs", "r");
++ else
++ f = fopen("/sys/kernel/debug/tracing/available_filter_functions_addrs", "r");
++
++ if (!f)
++ return -ENOENT;
++
++ /* In my local setup, the number of entries is 50k+ so Let us initially
++ * allocate space to hold 64k entries. If 64k is not enough, incrementally
++ * increase 1k each time.
++ */
++ max_cnt = 65536;
++ inc_cnt = 1024;
++ addrs = malloc(max_cnt * sizeof(long));
++ if (addrs == NULL) {
++ err = -ENOMEM;
++ goto error;
++ }
++
++ while (fgets(buf, sizeof(buf), f)) {
++ if (is_invalid_entry(buf, kernel))
++ continue;
++
++ free(name);
++ if (sscanf(buf, "%p %ms$*[^\n]\n", &addr, &name) != 2)
++ continue;
++ if (skip_entry(name))
++ continue;
++
++ if (cnt == max_cnt) {
++ max_cnt += inc_cnt;
++ tmp_addrs = realloc(addrs, max_cnt);
++ if (!tmp_addrs) {
++ err = -ENOMEM;
++ goto error;
++ }
++ addrs = tmp_addrs;
++ }
++
++ addrs[cnt++] = (unsigned long)addr;
++ }
++
++ *addrsp = addrs;
++ *cntp = cnt;
++
++error:
++ free(name);
++ fclose(f);
++ if (err)
++ free(addrs);
++ return err;
++}
+diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h
+index 2ce873c9f9aad..9437bdd4afa50 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.h
++++ b/tools/testing/selftests/bpf/trace_helpers.h
+@@ -41,4 +41,7 @@ ssize_t get_rel_offset(uintptr_t addr);
+
+ int read_build_id(const char *path, char *build_id, size_t size);
+
++int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel);
++int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel);
++
+ #endif
+--
+2.51.0
+
--- /dev/null
+From dbef66d2c18a83e280b4eeae86b0dcf90bfd7eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:53:00 +0200
+Subject: selftests: cgroup: Make test_pids backwards compatible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Koutný <mkoutny@suse.com>
+
+[ Upstream commit 3b0dec689a6301845761681b852f9538cb75a1d2 ]
+
+The predicates in test expect event counting from 73e75e6fc352b
+("cgroup/pids: Separate semantics of pids.events related to pids.max")
+and the test would fail on older kernels. We want to have one version of
+tests for all, so detect the feature and skip the test on old kernels.
+(The test could even switch to check v1 semantics based on the flag but
+keep it simple for now.)
+
+Fixes: 9f34c566027b6 ("selftests: cgroup: Add basic tests for pids controller")
+Signed-off-by: Michal Koutný <mkoutny@suse.com>
+Tested-by: Sebastian Chlad <sebastian.chlad@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/lib/cgroup_util.c | 12 ++++++++++++
+ .../selftests/cgroup/lib/include/cgroup_util.h | 1 +
+ tools/testing/selftests/cgroup/test_pids.c | 3 +++
+ 3 files changed, 16 insertions(+)
+
+diff --git a/tools/testing/selftests/cgroup/lib/cgroup_util.c b/tools/testing/selftests/cgroup/lib/cgroup_util.c
+index 0e89fcff4d05d..44c52f620fda1 100644
+--- a/tools/testing/selftests/cgroup/lib/cgroup_util.c
++++ b/tools/testing/selftests/cgroup/lib/cgroup_util.c
+@@ -522,6 +522,18 @@ int proc_mount_contains(const char *option)
+ return strstr(buf, option) != NULL;
+ }
+
++int cgroup_feature(const char *feature)
++{
++ char buf[PAGE_SIZE];
++ ssize_t read;
++
++ read = read_text("/sys/kernel/cgroup/features", buf, sizeof(buf));
++ if (read < 0)
++ return read;
++
++ return strstr(buf, feature) != NULL;
++}
++
+ ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size)
+ {
+ char path[PATH_MAX];
+diff --git a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+index c69cab66254b4..9dc90a1b386d7 100644
+--- a/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
++++ b/tools/testing/selftests/cgroup/lib/include/cgroup_util.h
+@@ -60,6 +60,7 @@ extern int cg_run_nowait(const char *cgroup,
+ extern int cg_wait_for_proc_count(const char *cgroup, int count);
+ extern int cg_killall(const char *cgroup);
+ int proc_mount_contains(const char *option);
++int cgroup_feature(const char *feature);
+ extern ssize_t proc_read_text(int pid, bool thread, const char *item, char *buf, size_t size);
+ extern int proc_read_strstr(int pid, bool thread, const char *item, const char *needle);
+ extern pid_t clone_into_cgroup(int cgroup_fd);
+diff --git a/tools/testing/selftests/cgroup/test_pids.c b/tools/testing/selftests/cgroup/test_pids.c
+index 9ecb83c6cc5cb..d8a1d1cd50072 100644
+--- a/tools/testing/selftests/cgroup/test_pids.c
++++ b/tools/testing/selftests/cgroup/test_pids.c
+@@ -77,6 +77,9 @@ static int test_pids_events(const char *root)
+ char *cg_parent = NULL, *cg_child = NULL;
+ int pid;
+
++ if (cgroup_feature("pids_localevents") <= 0)
++ return KSFT_SKIP;
++
+ cg_parent = cg_name(root, "pids_parent");
+ cg_child = cg_name(cg_parent, "pids_child");
+ if (!cg_parent || !cg_child)
+--
+2.51.0
+
--- /dev/null
+From fc394bf06262d8add4a3e31701fc357ccf483270 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:00:11 +0200
+Subject: selftests/futex: Fix futex_wait() for 32bit ARM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 237bfb76c90b184f57bb18fe35ff366c19393dc8 ]
+
+On 32bit ARM systems gcc-12 will use 32bit timestamps while gcc-13 and later
+will use 64bit timestamps. The problem is that SYS_futex will continue
+pointing at the 32bit system call. This makes the futex_wait test fail like
+this:
+
+ waiter failed errno 110
+ not ok 1 futex_wake private returned: 0 Success
+ waiter failed errno 110
+ not ok 2 futex_wake shared (page anon) returned: 0 Success
+ waiter failed errno 110
+ not ok 3 futex_wake shared (file backed) returned: 0 Success
+
+Instead of compiling differently depending on the gcc version, use the
+-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 options to ensure that 64bit timestamps
+are used. Then use ifdefs to make SYS_futex point to the 64bit system call.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: André Almeida <andrealmeid@igalia.com>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Link: https://lore.kernel.org/20250827130011.677600-6-bigeasy@linutronix.de
+Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/futex/functional/Makefile | 2 +-
+ tools/testing/selftests/futex/include/futextest.h | 11 +++++++++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
+index 8cfb87f7f7c50..ddfa61d857b9b 100644
+--- a/tools/testing/selftests/futex/functional/Makefile
++++ b/tools/testing/selftests/futex/functional/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ INCLUDES := -I../include -I../../ $(KHDR_INCLUDES)
+-CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread $(INCLUDES) $(KHDR_INCLUDES)
++CFLAGS := $(CFLAGS) -g -O2 -Wall -pthread -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64 $(INCLUDES) $(KHDR_INCLUDES)
+ LDLIBS := -lpthread -lrt -lnuma
+
+ LOCAL_HDRS := \
+diff --git a/tools/testing/selftests/futex/include/futextest.h b/tools/testing/selftests/futex/include/futextest.h
+index 7a5fd1d5355e7..3d48e9789d9fe 100644
+--- a/tools/testing/selftests/futex/include/futextest.h
++++ b/tools/testing/selftests/futex/include/futextest.h
+@@ -58,6 +58,17 @@ typedef volatile u_int32_t futex_t;
+ #define SYS_futex SYS_futex_time64
+ #endif
+
++/*
++ * On 32bit systems if we use "-D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64" or if
++ * we are using a newer compiler then the size of the timestamps will be 64bit,
++ * however, the SYS_futex will still point to the 32bit futex system call.
++ */
++#if __SIZEOF_POINTER__ == 4 && defined(SYS_futex_time64) && \
++ defined(_TIME_BITS) && _TIME_BITS == 64
++# undef SYS_futex
++# define SYS_futex SYS_futex_time64
++#endif
++
+ /**
+ * futex() - SYS_futex syscall wrapper
+ * @uaddr: address of first futex
+--
+2.51.0
+
--- /dev/null
+From 3c12bdda42d6cdc9a661a9b7bbb0fd74e08eb8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:00:08 +0200
+Subject: selftests/futex: Fix some futex_numa_mpol subtests
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit d8e2f919997b14665e4509ef9a5278f291598d6e ]
+
+The "Memory out of range" subtest of futex_numa_mpol assumes that memory
+access outside of the mmap'ed area is invalid. That may not be the case
+depending on the actual memory layout of the test application. When that
+subtest was run on an x86-64 system with latest upstream kernel, the test
+passed as an error was returned from futex_wake(). On another PowerPC system,
+the same subtest failed because futex_wake() returned 0.
+
+ Bail out! futex2_wake(64, 0x86) should fail, but didn't
+
+Looking further into the passed subtest on x86-64, it was found that an
+-EINVAL was returned instead of -EFAULT. The -EINVAL error was returned
+because the node value test with FLAGS_NUMA set failed with a node value
+of 0x7f7f. IOW, the futex memory was accessible and futex_wake() failed
+because the supposed node number wasn't valid. If that memory location
+happens to have a very small value (e.g. 0), the test will pass and no
+error will be returned.
+
+Since this subtest is non-deterministic, drop it unless a guard page beyond
+the mmap region is explicitly set.
+
+The other problematic test is the "Memory too small" test. The futex_wake()
+function returns the -EINVAL error code because the given futex address isn't
+8-byte aligned, not because only 4 of the 8 bytes are valid and the other
+4 bytes are not. So change the name of this subtest to "Mis-aligned futex" to
+reflect the reality.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 3163369407ba ("selftests/futex: Add futex_numa_mpol")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/20250827130011.677600-3-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/futex/functional/futex_numa_mpol.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+index a9ecfb2d3932a..802c15c821906 100644
+--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
++++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+@@ -182,12 +182,10 @@ int main(int argc, char *argv[])
+ if (futex_numa->numa == FUTEX_NO_NODE)
+ ksft_exit_fail_msg("NUMA node is left uninitialized\n");
+
+- ksft_print_msg("Memory too small\n");
++ /* FUTEX2_NUMA futex must be 8-byte aligned */
++ ksft_print_msg("Mis-aligned futex\n");
+ test_futex(futex_ptr + mem_size - 4, 1);
+
+- ksft_print_msg("Memory out of range\n");
+- test_futex(futex_ptr + mem_size, 1);
+-
+ futex_numa->numa = FUTEX_NO_NODE;
+ mprotect(futex_ptr, mem_size, PROT_READ);
+ ksft_print_msg("Memory, RO\n");
+--
+2.51.0
+
--- /dev/null
+From 0aa87fd1884ba8b994aba5a285b0b1b7891cdc1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:00:07 +0200
+Subject: selftests/futex: Remove the -g parameter from futex_priv_hash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 2e62688d583809e832433f461194334408b10817 ]
+
+The -g parameter was meant to the test the immutable global hash instead of the
+private hash which has been made immutable. The global hash is tested as part
+at the end of the regular test. The immutable private hash been removed.
+
+Remove last traces of the immutable private hash.
+
+Fixes: 16adc7f136dc1 ("selftests/futex: Remove support for IMMUTABLE")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: André Almeida <andrealmeid@igalia.com>
+Link: https://lore.kernel.org/20250827130011.677600-2-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/futex/functional/futex_priv_hash.c | 1 -
+ tools/testing/selftests/futex/functional/run.sh | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/tools/testing/selftests/futex/functional/futex_priv_hash.c b/tools/testing/selftests/futex/functional/futex_priv_hash.c
+index aea001ac49460..ec032faca6a91 100644
+--- a/tools/testing/selftests/futex/functional/futex_priv_hash.c
++++ b/tools/testing/selftests/futex/functional/futex_priv_hash.c
+@@ -132,7 +132,6 @@ static void usage(char *prog)
+ {
+ printf("Usage: %s\n", prog);
+ printf(" -c Use color\n");
+- printf(" -g Test global hash instead intead local immutable \n");
+ printf(" -h Display this help message\n");
+ printf(" -v L Verbosity level: %d=QUIET %d=CRITICAL %d=INFO\n",
+ VQUIET, VCRITICAL, VINFO);
+diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh
+index 81739849f2994..5470088dc4dfb 100755
+--- a/tools/testing/selftests/futex/functional/run.sh
++++ b/tools/testing/selftests/futex/functional/run.sh
+@@ -85,7 +85,6 @@ echo
+
+ echo
+ ./futex_priv_hash $COLOR
+-./futex_priv_hash -g $COLOR
+
+ echo
+ ./futex_numa_mpol $COLOR
+--
+2.51.0
+
--- /dev/null
+From 41457d235b9e45f7fe3b528422800eadef9443b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 16:26:19 +0800
+Subject: selftests/kselftest_harness: Add harness-selftest.expected to
+ TEST_FILES
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yi Lai <yi1.lai@intel.com>
+
+[ Upstream commit 3e23a3f688b457288c37899f8898180cc231ff97 ]
+
+The harness-selftest.expected is not installed in INSTALL_PATH.
+Attempting to execute harness-selftest.sh shows warning:
+
+diff: ./kselftest_harness/harness-selftest.expected: No such file or
+directory
+
+Add harness-selftest.expected to TEST_FILES.
+
+Link: https://lore.kernel.org/r/20250909082619.584470-1-yi1.lai@intel.com
+Fixes: df82ffc5a3c1 ("selftests: harness: Add kselftest harness selftest")
+Signed-off-by: Yi Lai <yi1.lai@intel.com>
+Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_harness/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/kselftest_harness/Makefile b/tools/testing/selftests/kselftest_harness/Makefile
+index 0617535a6ce42..d2369c01701a0 100644
+--- a/tools/testing/selftests/kselftest_harness/Makefile
++++ b/tools/testing/selftests/kselftest_harness/Makefile
+@@ -2,6 +2,7 @@
+
+ TEST_GEN_PROGS_EXTENDED := harness-selftest
+ TEST_PROGS := harness-selftest.sh
++TEST_FILES := harness-selftest.expected
+ EXTRA_CLEAN := harness-selftest.seen
+
+ include ../lib.mk
+--
+2.51.0
+
--- /dev/null
+From b521b24975840bab924f18e4ffa39f79e292c67e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:37:11 +0800
+Subject: selftests/mm: fix va_high_addr_switch.sh failure on x86_64
+
+From: Chunyu Hu <chuhu@redhat.com>
+
+[ Upstream commit c56325259abc026205c98964616dcc0df5648912 ]
+
+The test will fail as below on x86_64 with cpu la57 support (will skip if
+no la57 support). Note, the test requries nr_hugepages to be set first.
+
+ # running bash ./va_high_addr_switch.sh
+ # -------------------------------------
+ # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
+ # mmap(addr_switch_hint - pagesize, (2 * pagesize)): 0x7f55b60f9000 - OK
+ # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
+ # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
+ # mmap(NULL): 0x7f55b60f9000 - OK
+ # mmap(low_addr): 0x40000000 - OK
+ # mmap(high_addr): 0x1000000000000 - OK
+ # mmap(high_addr) again: 0xffff55b6136000 - OK
+ # mmap(high_addr, MAP_FIXED): 0x1000000000000 - OK
+ # mmap(-1): 0xffff55b6134000 - OK
+ # mmap(-1) again: 0xffff55b6132000 - OK
+ # mmap(addr_switch_hint - pagesize, pagesize): 0x7f55b60fa000 - OK
+ # mmap(addr_switch_hint - pagesize, 2 * pagesize): 0x7f55b60f9000 - OK
+ # mmap(addr_switch_hint - pagesize/2 , 2 * pagesize): 0x7f55b60f7000 - OK
+ # mmap(addr_switch_hint, pagesize): 0x800000000000 - OK
+ # mmap(addr_switch_hint, 2 * pagesize, MAP_FIXED): 0x800000000000 - OK
+ # mmap(NULL, MAP_HUGETLB): 0x7f55b5c00000 - OK
+ # mmap(low_addr, MAP_HUGETLB): 0x40000000 - OK
+ # mmap(high_addr, MAP_HUGETLB): 0x1000000000000 - OK
+ # mmap(high_addr, MAP_HUGETLB) again: 0xffff55b5e00000 - OK
+ # mmap(high_addr, MAP_FIXED | MAP_HUGETLB): 0x1000000000000 - OK
+ # mmap(-1, MAP_HUGETLB): 0x7f55b5c00000 - OK
+ # mmap(-1, MAP_HUGETLB) again: 0x7f55b5a00000 - OK
+ # mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB): 0x800000000000 - FAILED
+ # mmap(addr_switch_hint , 2*hugepagesize, MAP_FIXED | MAP_HUGETLB): 0x800000000000 - OK
+ # [FAIL]
+
+addr_switch_hint is defined as DFEFAULT_MAP_WINDOW in the failed test (for
+x86_64, DFEFAULT_MAP_WINDOW is defined as (1UL<<47) - pagesize) in 64 bit.
+
+Before commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
+functions"), for x86_64 hugetlb_get_unmapped_area() is handled in arch
+code arch/x86/mm/hugetlbpage.c and addr is checked with
+map_address_hint_valid() after align with 'addr &= huge_page_mask(h)'
+which is a round down way, and it will fail the check because the addr is
+within the DEFAULT_MAP_WINDOW but (addr + len) is above the
+DFEFAULT_MAP_WINDOW. So it wil go through the
+hugetlb_get_unmmaped_area_top_down() to find an area within the
+DFEFAULT_MAP_WINDOW.
+
+After commit cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*}
+functions"). The addr hint for hugetlb_get_unmmaped_area() will be
+rounded up and aligned to hugepage size with ALIGN() for all arches. And
+after the align, the addr will be above the default MAP_DEFAULT_WINDOW,
+and the map_addresshint_valid() check will pass because both aligned addr
+(addr0) and (addr + len) are above the DEFAULT_MAP_WINDOW, and the aligned
+hint address (0x800000000000) is returned as an suitable gap is found
+there, in arch_get_unmapped_area_topdown().
+
+To still cover the case that addr is within the DEFAULT_MAP_WINDOW, and
+addr + len is above the DFEFAULT_MAP_WINDOW, change to choose the last
+hugepage aligned address within the DEFAULT_MAP_WINDOW as the hint addr,
+and the addr + len (2 hugepages) will be one hugepage above the
+DEFAULT_MAP_WINDOW. An aligned address won't be affected by the page
+round up or round down from kernel, so it's determistic.
+
+Link: https://lkml.kernel.org/r/20250912013711.3002969-4-chuhu@redhat.com
+Fixes: cc92882ee218 ("mm: drop hugetlb_get_unmapped_area{_*} functions")
+Signed-off-by: Chunyu Hu <chuhu@redhat.com>
+Suggested-by: David Hildenbrand <david@redhat.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/mm/va_high_addr_switch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/mm/va_high_addr_switch.c b/tools/testing/selftests/mm/va_high_addr_switch.c
+index 896b3f73fc53b..306eba8251077 100644
+--- a/tools/testing/selftests/mm/va_high_addr_switch.c
++++ b/tools/testing/selftests/mm/va_high_addr_switch.c
+@@ -230,10 +230,10 @@ void testcases_init(void)
+ .msg = "mmap(-1, MAP_HUGETLB) again",
+ },
+ {
+- .addr = (void *)(addr_switch_hint - pagesize),
++ .addr = (void *)(addr_switch_hint - hugepagesize),
+ .size = 2 * hugepagesize,
+ .flags = MAP_HUGETLB | MAP_PRIVATE | MAP_ANONYMOUS,
+- .msg = "mmap(addr_switch_hint - pagesize, 2*hugepagesize, MAP_HUGETLB)",
++ .msg = "mmap(addr_switch_hint - hugepagesize, 2*hugepagesize, MAP_HUGETLB)",
+ .low_addr_required = 1,
+ .keep_mapped = 1,
+ },
+--
+2.51.0
+
--- /dev/null
+From 4695c0af2556b2804a94db2b68b5bdd679255a82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 22:12:22 +0200
+Subject: selftests/nolibc: fix EXPECT_NZ macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
+
+The expect non-zero macro was incorrect and never used. Fix its
+definition.
+
+Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
+index cc4d730ac4656..d074878eb2341 100644
+--- a/tools/testing/selftests/nolibc/nolibc-test.c
++++ b/tools/testing/selftests/nolibc/nolibc-test.c
+@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
+ }
+
+
+-#define EXPECT_NZ(cond, expr, val) \
+- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
++#define EXPECT_NZ(cond, expr) \
++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
+
+ static __attribute__((unused))
+ int expect_nz(int expr, int llen)
+--
+2.51.0
+
--- /dev/null
+From 196a33a040f60f92b06b4d6a0e88481e9b64c5dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:02 +0200
+Subject: selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]
+
+The _rval register variable is meant to be an output operand of the asm
+statement but is instead used as input operand.
+clang 20.1 notices this and triggers -Wuninitialized warnings:
+
+tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
+ 154 | return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
+ 59 | : "r" (_rval) \
+ | ^~~~~
+tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
+tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
+ 47 | register long _rval asm ("r3"); \
+ | ^
+
+It seems the list of input and output operands have been switched around.
+However as the argument registers are not always initialized they can not
+be marked as pure inputs as that would trigger -Wuninitialized warnings.
+Adding _rval as another input and output operand does also not work as it
+would collide with the existing _r3 variable.
+
+Instead reuse _r3 for both the argument and the return value.
+
+Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-1-90f499dd35f8@linutronix.de
+Closes: https://lore.kernel.org/oe-kbuild-all/202506180223.BOOk5jDK-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
+index bb237d771051b..e7205584cbdca 100644
+--- a/tools/testing/selftests/vDSO/vdso_call.h
++++ b/tools/testing/selftests/vDSO/vdso_call.h
+@@ -44,7 +44,6 @@
+ register long _r6 asm ("r6"); \
+ register long _r7 asm ("r7"); \
+ register long _r8 asm ("r8"); \
+- register long _rval asm ("r3"); \
+ \
+ LOADARGS_##nr(fn, args); \
+ \
+@@ -54,13 +53,13 @@
+ " bns+ 1f\n" \
+ " neg 3, 3\n" \
+ "1:" \
+- : "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5), \
++ : "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5), \
+ "+r" (_r6), "+r" (_r7), "+r" (_r8) \
+- : "r" (_rval) \
++ : \
+ : "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5", \
+ "cr6", "cr7", "xer", "lr", "ctr", "memory" \
+ ); \
+- _rval; \
++ _r3; \
+ })
+
+ #else
+--
+2.51.0
+
--- /dev/null
+From ec479d5d63b6f46ea5fff7137693073f7482a9d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:39:03 +0200
+Subject: selftests: vDSO: vdso_test_abi: Correctly skip whole test with
+ missing vDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]
+
+If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
+Currently this results in the following output:
+
+ TAP version 13
+ 1..16
+ # AT_SYSINFO_EHDR is not present!
+
+This output is incorrect, as "1..16" still requires the subtest lines to
+be printed, which isn't done however.
+
+Switch to the correct skipping functions, so the output now correctly
+indicates that no subtests are being run:
+
+ TAP version 13
+ 1..0 # SKIP AT_SYSINFO_EHDR is not present!
+
+Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250812-vdso-tests-fixes-v2-2-90f499dd35f8@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
+index a54424e2336f4..67cbfc56e4e1b 100644
+--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
++++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
+@@ -182,12 +182,11 @@ int main(int argc, char **argv)
+ unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
+
+ ksft_print_header();
+- ksft_set_plan(VDSO_TEST_PLAN);
+
+- if (!sysinfo_ehdr) {
+- ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
+- return KSFT_SKIP;
+- }
++ if (!sysinfo_ehdr)
++ ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
++
++ ksft_set_plan(VDSO_TEST_PLAN);
+
+ version = versions[VDSO_VERSION];
+ name = (const char **)&names[VDSO_NAMES];
+--
+2.51.0
+
--- /dev/null
+From f5227f01053e3ea9e7e984926614a23e98b7dc67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index a1f506ba55786..4f09c5db0c7f3 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 194b3c3dd7ac2b6580a4bebaf58a9ab5def5079a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index ce260e9949c3c..d9a0100b92d2b 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1644,6 +1644,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regcfg_i2c.name = max310x_regmap_name(i);
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+--
+2.51.0
+
--- /dev/null
+arch-copy_thread-pass-clone_flags-as-u64.patch
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+pid-use-ns_capable_noaudit-when-determining-net-sysc.patch
+fix-cc_has_asm_goto_output-on-non-x86-architectures.patch
+seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+kbuild-add-missing-objtree-prefix-to-powerpc-crtsavr.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+selftests-arm64-fix-waddress-warning-in-tpidr2-test.patch
+kselftest-arm64-gcs-correctly-check-return-value-whe.patch
+hfsplus-fix-slab-out-of-bounds-read-in-hfsplus_uni2a.patch
+gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
+gfs2-remove-space-before-newline.patch
+gfs2-further-sanitize-lock_dlm.c.patch
+gfs2-fix-lm_flag_try-logic-in-add_to_queue.patch
+gfs2-remove-duplicate-check-in-do_xmote.patch
+gfs2-get-rid-of-glf_invalidate_in_progress.patch
+gfs2-do_xmote-cleanup.patch
+gfs2-add-proper-lockspace-locking.patch
+powerpc-8xx-remove-left-over-instruction-and-comment.patch
+powerpc-603-really-copy-kernel-pgd-entries-into-all-.patch
+powerpc-ftrace-ensure-ftrace-record-ops-are-always-s.patch
+powerpc64-modules-correctly-iterate-over-stubs-in-se.patch
+uprobes-uprobe_warn-should-use-passed-task.patch
+raid6-riscv-clean-up-unused-header-file-inclusion.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+erofs-avoid-reading-more-for-fragment-maps.patch
+smb-client-fix-sending-the-iwrap-custom-ird-ord-nego.patch
+smb-server-fix-ird-ord-negotiation-with-the-client.patch
+edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
+perf-x86-intel-use-early_initcall-to-hook-bts_init.patch
+perf-x86-intel-fix-ia32_pmc_x_cfg_b-msrs-access-erro.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+selftests-cgroup-make-test_pids-backwards-compatible.patch
+sched-fair-get-rid-of-sched_domains_curr_level-hack-.patch
+lsm-config_lsm-can-depend-on-config_security.patch
+cpuset-fix-failure-to-enable-isolated-partition-when.patch
+btrfs-return-any-hit-error-from-extent_writepage_io.patch
+btrfs-fix-symbolic-link-reading-when-bs-ps.patch
+pinctrl-renesas-rzg2l-fix-invalid-unsigned-return-in.patch
+gpio-todo-remove-the-task-for-converting-to-the-new-.patch
+arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+bpf-tidy-verifier-bug-message.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+selftests-bpf-copy-test_kmods-when-installing-selfte.patch
+rust-cpumask-mark-cpumaskvar-as-transparent.patch
+bpf-selftests-fix-test_tcpnotify_user.patch
+bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+libbpf-fix-reuse-of-devmap.patch
+tools-nolibc-fix-error-return-value-of-clock_nanosle.patch
+arm-dts-renesas-porter-fix-can-pin-group.patch
+leds-max77705-function-return-instead-of-variable-as.patch
+leds-flash-leds-qcom-flash-update-torch-current-clam.patch
+s390-bpf-do-not-write-tail-call-counter-into-helper-.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+arm64-dts-renesas-sparrow-hawk-invert-microsd-voltag.patch
+arm64-dts-renesas-sparrow-hawk-set-vddq18_25_avb-vol.patch
+libbpf-export-bpf_object__prepare-symbol.patch
+firmware-arm_scmi-mark-virtio-ready-before-registeri.patch
+arm64-dts-imx93-kontron-fix-gpio-for-panel-regulator.patch
+arm64-dts-imx93-kontron-fix-usb-port-assignment.patch
+arm64-dts-imx95-correct-the-lpuart7-and-lpuart8-srci.patch
+bpf-remove-preempt_disable-in-bpf_try_get_buffers.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+genirq-add-irq_chip_-startup-shutdown-_parent.patch
+pci-msi-add-startup-shutdown-for-per-device-domains.patch
+irqchip-sg2042-msi-fix-broken-affinity-setting.patch
+scripts-misc-check-update-export-checks-for-export_s.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+selftests-futex-remove-the-g-parameter-from-futex_pr.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+selftests-futex-fix-some-futex_numa_mpol-subtests.patch
+tools-nolibc-avoid-error-in-dup2-if-old-fd-equals-ne.patch
+selftests-nolibc-fix-expect_nz-macro.patch
+leds-leds-lp55xx-use-correct-address-for-memory-prog.patch
+pci-msi-check-msi_flag_pci_msi_mask_parent-in-cond_-.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+arm-dts-stm32-stm32mp151c-plyaqm-use-correct-dai-for.patch
+dt-bindings-vendor-prefixes-add-undocumented-vendor-.patch
+genirq-test-fix-depth-tests-on-architectures-with-no.patch
+genirq-test-select-irq_domain.patch
+genirq-test-depend-on-sparse_irq.patch
+genirq-test-drop-config_generic_irq_migration-assump.patch
+genirq-test-ensure-cpu-1-is-online-for-hotplug-test.patch
+selftests-bpf-fix-count-write-in-testapp_xdp_metadat.patch
+vdso-datastore-gate-time-data-behind-config_generic_.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+blk-mq-fix-elevator-depth_updated-method.patch
+vdso-add-struct-__kernel_old_timeval-forward-declara.patch
+arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
+arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
+arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
+pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+hwmon-asus-ec-sensors-narrow-lock-for-x870e-creator-.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+pinctrl-eswin-fix-regulator-error-check-and-kconfig-.patch
+null_blk-fix-the-description-of-the-cache_size-modul.patch
+blk-throttle-fix-access-race-during-throttle-policy-.patch
+selftests-vdso-fix-wunitialized-in-powerpc-vdso_call.patch
+selftests-vdso-vdso_test_abi-correctly-skip-whole-te.patch
+irqchip-gic-v5-fix-loop-in-gicv5_its_create_itt_two_.patch
+irqchip-gic-v5-fix-error-handling-in-gicv5_its_irq_d.patch
+tick-do-not-set-device-to-detached-state-in-tick_shu.patch
+arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
+arm64-dts-mediatek-mt8183-fix-out-of-range-pull-valu.patch
+nbd-restrict-sockets-to-tcp-and-udp.patch
+pm-devfreq-rockchip-dfi-double-count-on-rk3588.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+dts-arm-amlogic-fix-pwm-node-for-c3.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8183-prob.patch
+soc-mediatek-mtk-svs-fix-device-leaks-on-mt8192-prob.patch
+cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+block-cleanup-bio_issue.patch
+block-initialize-bio-issue-time-in-blk_mq_submit_bio.patch
+block-factor-out-a-helper-bio_submit_split_bioset.patch
+block-skip-unnecessary-checks-for-split-bio.patch
+block-fix-ordering-of-recursive-split-io.patch
+blk-mq-remove-useless-checkings-in-blk_mq_update_nr_.patch
+blk-mq-check-invalid-nr_requests-in-queue_requests_s.patch
+blk-mq-convert-to-serialize-updating-nr_requests-wit.patch
+blk-mq-cleanup-shared-tags-case-in-blk_mq_update_nr_.patch
+blk-mq-split-bitmap-grow-and-resize-case-in-blk_mq_u.patch
+blk-mq-sched-add-new-parameter-nr_requests-in-blk_mq.patch
+blk-mq-fix-potential-deadlock-while-nr_requests-grow.patch
+arm64-dts-allwinner-a527-cubie-a5e-add-ethernet-phy-.patch
+arm64-dts-allwinner-t527-avaota-a1-add-ethernet-phy-.patch
+arm64-dts-rockchip-add-rtc-on-rk3576-evb1-v10.patch
+arm64-dts-rockchip-add-wifi-on-rk3576-evb1-v10.patch
+arm64-dts-rockchip-fix-network-on-rk3576-evb1-board.patch
+arm64-dts-ti-k3-j742s2-mcu-wakeup-override-firmware-.patch
+arm64-dts-ti-k3-rename-rproc-reserved-mem-nodes-to-m.patch
+revert-arm64-dts-ti-k3-j721e-sk-fix-reversed-c6x-car.patch
+revert-arm64-dts-ti-k3-j721e-beagleboneai64-fix-reve.patch
+arm64-dts-mediatek-mt8188-change-efuse-fallback-comp.patch
+arm64-dts-mediatek-mt8186-tentacruel-fix-touchscreen.patch
+arm64-dts-ti-k3-pinctrl-fix-the-bug-in-existing-macr.patch
+arm64-dts-renesas-r9a09g047e57-smarc-fix-gpio-key-s-.patch
+arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
+mmc-core-fix-variable-shadowing-in-mmc_route_rpmb_fr.patch
+arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
+arm64-dts-mediatek-mt7986a-fix-pci-express-t-phy-nod.patch
+arm64-dts-mediatek-mt8395-kontron-i1200-fix-mt6360-r.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+arm64-dts-allwinner-a527-cubie-a5e-add-leds.patch
+arm64-dts-allwinner-a527-cubie-a5e-drop-external-32..patch
+arm64-dts-allwinner-t527-avaota-a1-hook-up-external-.patch
+arm64-dts-allwinner-t527-orangepi-4a-hook-up-externa.patch
+pwm-tiehrpwm-don-t-drop-runtime-pm-reference-in-.fre.patch
+pwm-tiehrpwm-make-code-comment-in-.free-more-useful.patch
+pwm-tiehrpwm-fix-various-off-by-one-errors-in-duty-c.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+acpica-apply-acpi_nonstring.patch
+acpica-fix-largest-possible-resource-descriptor-inde.patch
+riscv-bpf-sign-extend-struct-ops-return-values-prope.patch
+nvme-auth-update-bi_directional-flag.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+nvmet-fcloop-call-done-callback-even-when-remote-por.patch
+nvme-tcp-send-only-permitted-commands-for-secure-con.patch
+i3c-master-svc-use-manual-response-for-ibi-events.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+block-update-validation-of-atomic-writes-boundary-fo.patch
+block-fix-stacking-of-atomic-writes-when-atomics-are.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+selftests-kselftest_harness-add-harness-selftest.exp.patch
+blk-throttle-fix-throtl_data-leak-during-disk-releas.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+mmc-select-regmap_mmio-with-mmc_loongson2.patch
+selftests-futex-fix-futex_wait-for-32bit-arm.patch
+selftest-futex-make-the-error-check-more-precise-for.patch
+selftest-futex-compile-also-with-libnuma-2.0.16.patch
+bpf-dont-report-verifier-bug-for-missing-bpf_scc_vis.patch
+bpf-arm64-call-bpf_jit_binary_pack_finalize-in-bpf_j.patch
+arm64-dts-apple-t600x-add-missing-wifi-properties.patch
+arm64-dts-apple-t600x-add-bluetooth-device-nodes.patch
+arm64-dts-apple-add-ethernet0-alias-for-j375-templat.patch
+selftests-always-install-uapi-headers-to-the-correct.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+mfd-max77705-max77705_charger-move-active-discharge-.patch
+power-supply-max77705_charger-refactoring-rename-cha.patch
+power-supply-max77705_charger-use-regfields-for-conf.patch
+power-supply-max77705_charger-rework-interrupts.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+spi-fix-return-code-when-spi-device-has-too-many-chi.patch
+clocksource-drivers-timer-tegra186-avoid-64-bit-divi.patch
+clocksource-drivers-tegra186-avoid-64-bit-division.patch
+bpf-mark-kfuncs-as-__noclone.patch
+once-fix-race-by-moving-do_once-to-separate-section.patch
+hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+tools-nolibc-add-stdbool.h-to-nolibc-includes.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-spacemit-ensure-bus-release-check-runs-when-wait.patch
+i2c-spacemit-remove-stop-function-to-avoid-bus-error.patch
+i2c-spacemit-disable-sda-glitch-fix-to-avoid-restart.patch
+i2c-spacemit-check-sda-instead-of-scl-after-bus-rese.patch
+i2c-spacemit-ensure-sda-is-released-after-bus-reset.patch
+i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+libbpf-fix-error-when-st-prefix_ops-and-ops-from-dif.patch
+bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+i3c-fix-big-endian-fifo-transfers.patch
+mfd-max77705-setup-the-core-driver-as-an-interrupt-c.patch
+drm-sched-fix-a-race-in-drm_gpu_sched_stat_no_hang-t.patch
+drm-panel-edp-add-disable-to-100ms-for-mnb601ls1-4.patch
+drm-display-bridge-connector-correct-cec-bridge-poin.patch
+drm-panel-edp-add-50ms-disable-delay-for-four-panels.patch
+drm-vmwgfx-fix-missing-assignment-to-ts.patch
+drm-amd-display-reduce-stack-usage-by-moving-audio_o.patch
+drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+drm-amdgpu-fix-link-error-for-pm_sleep.patch
+drm-amdgpu-fix-jpeg-v4.0.3-poison-irq-call-trace-on-.patch
+drm-amdgpu-fix-vcn-v4.0.3-poison-irq-call-trace-on-s.patch
+pci-endpoint-pci-ep-msi-fix-null-vs-is_err-check-in-.patch
+pci-xgene-msi-return-negative-einval-in-xgene_msi_ha.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+f2fs-fix-condition-in-__allow_reserved_blocks.patch
+f2fs-fix-to-avoid-overflow-while-left-shift-operatio.patch
+f2fs-fix-to-zero-data-after-eof-for-compressed-file-.patch
+drm-bridge-it6505-select-regmap_i2c.patch
+wifi-rtw88-lock-rtwdev-mutex-before-setting-the-led.patch
+hid-steelseries-refactor-probe-and-remove.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
+media-zoran-remove-zoran_fh-structure.patch
+phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
+drm-bridge-cdns-dsi-fix-the-_atomic_check.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
+pci-pwrctrl-fix-double-cleanup-on-devm_add_action_or.patch
+misc-pci_endpoint_test-fix-array-underflow-in-pci_en.patch
+serial-max310x-add-error-checking-in-probe.patch
+drm-amd-display-remove-redundant-semicolons.patch
+drm-amd-display-add-null-pointer-checks-in-dc_stream.patch
+crypto-keembay-add-missing-check-after-sg_nents_for_.patch
+hwrng-nomadik-add-arm_amba-dependency.patch
+docs-iio-ad3552r-fix-malformed-code-block-directive.patch
+fwctl-mlx5-fix-memory-alloc-free-in-mlx5ctl_fw_rpc.patch
+scsi-pm80xx-restore-support-for-expanders.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-libsas-add-dev_parent_is_expander-helper.patch
+scsi-pm80xx-use-dev_parent_is_expander-helper.patch
+scsi-pm80xx-add-helper-function-to-get-the-local-phy.patch
+scsi-pm80xx-fix-pm8001_abort_task-for-chip_8006-when.patch
+mptcp-fix-up-subflow-s-memcg-when-config_sock_cgroup.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+f2fs-fix-to-clear-unusable_cap-for-checkpoint-enable.patch
+f2fs-fix-to-avoid-null-pointer-dereference-in-f2fs_c.patch
+f2fs-fix-to-allow-removing-qf_name.patch
+drm-dp-drm_edp_backlight_set_level-do-not-always-sen.patch
+crypto-octeontx2-call-strscpy-with-correct-size-argu.patch
+drm-re-allow-no-op-changes-on-non-primary-planes-in-.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+media-staging-ipu7-convert-to-use-pci_alloc_irq_vect.patch
+media-staging-ipu7-don-t-set-name-for-ipu7-pci-devic.patch
+media-staging-ipu7-cleanup-the-mmu-correctly-in-ipu7.patch
+media-i2c-vd55g1-fix-duster-register-address.patch
+drm-panel-allow-powering-on-panel-follower-after-pan.patch
+hid-i2c-hid-make-elan-touch-controllers-power-on-aft.patch
+rdma-mlx5-better-estimate-max_qp_wr-to-reflect-wqe-c.patch
+rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
+wifi-rtw88-use-led-brightness_set_blocking-for-pci-t.patch
+net-phy-introduce-phy_id_compare_vendor-phy-id-helpe.patch
+net-phy-as21xxx-better-handle-phy-hw-reset-on-soft-r.patch
+pci-rcar-host-pass-proper-irq-domain-to-generic_hand.patch
+fuse-remove-unneeded-offset-assignment-when-filling-.patch
+pci-qcom-restrict-port-parsing-only-to-pcie-bridge-c.patch
+cdx-don-t-select-config_generic_msi_irq.patch
+pci-acpi-fix-pci_acpi_preserve_config-memory-leak.patch
+hid-i2c-hid-fix-test-in-i2c_hid_core_register_panel_.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+media-st-delta-avoid-excessive-stack-usage.patch
+drm-amdgpu-vcn-add-regdump-helper-functions.patch
+drm-amdgpu-vcn-hold-pg_lock-before-vcn-power-off.patch
+drm-amdgpu-check-vcn-state-before-profile-switch.patch
+accel-amdxdna-use-int-instead-of-u32-to-store-error-.patch
+efi-explain-ovmf-acronym-in-ovmf_debug_log-help-text.patch
+net-dst-introduce-dst-dev_rcu.patch
+ipv6-mcast-add-ip6_mc_find_idev-helper.patch
+ipv6-start-using-dst_dev_rcu.patch
+ipv6-use-rcu-in-ip6_xmit.patch
+ipv6-use-rcu-in-ip6_output.patch
+net-use-dst_dev_rcu-in-sk_setup_caps.patch
+tcp_metrics-use-dst_dev_net_rcu.patch
+ipv4-start-using-dst_dev_rcu.patch
+crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+crypto-hisilicon-check-the-sva-module-status-while-e.patch
+crypto-hisilicon-qm-check-whether-the-input-function.patch
+crypto-hisilicon-qm-request-reserved-interrupt-for-v.patch
+inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
+dmaengine-fix-dma_async_tx_descriptor-tx_submit-docu.patch
+coresight-trbe-add-isb-after-trblimitr-write.patch
+coresight-fix-missing-include-for-field_get.patch
+coresight-only-register-perf-symlink-for-sinks-with-.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+drm-amd-pm-fix-si_upload_smc_data-v3.patch
+drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+wifi-mac80211-make-connection_monitor-optional-for-m.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+wifi-brcmfmac-fix-43752-sdio-fwvid-incorrectly-label.patch
+drm-msm-do-not-validate-sspp-when-it-is-not-ready.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+wifi-mac80211-consider-links-for-validating-scan_fla.patch
+pci-qcom-add-equalization-settings-for-8.0-gt-s-and-.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+fanotify-validate-the-return-value-of-mnt_ns_from_de.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+drm-msm-fix-obj-leak-in-vm_bind-error-path.patch
+drm-msm-fix-missing-vm_bind-offset-range-validation.patch
+wifi-iwlwifi-remove-redundant-header-files.patch
+drm-msm-mdp4-stop-supporting-no-iommu-configuration.patch
+drm-msm-stop-supporting-no-iommu-configuration.patch
+idpf-fix-rx-descriptor-ready-check-barrier-in-splitq.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+ipv6-snmp-do-not-use-snmp_mib_sentinel-anymore.patch
+ipv6-snmp-do-not-track-per-idev-icmp6_mib_ratelimith.patch
+drm-msm-fix-bootup-splat-with-separate_gpu_drm-modpa.patch
+drm-msm-dpu-fix-incorrect-type-for-ret.patch
+wifi-mac80211-fix-reporting-of-all-valid-links-in-st.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
+iio-consumers-fix-handling-of-negative-channel-scale.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+mm-slub-fix-cmp_loc_by_count-to-return-0-when-counts.patch
+tools-ynl-fix-undefined-variable-name.patch
+rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-m.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+ipvs-use-read_once-write_once-for-ipvs-enable.patch
+hid-steelseries-fix-steelseries_srws1-handling-in-st.patch
+watchdog-intel_oc_wdt-do-not-try-to-write-into-const.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+pci-endpoint-pci-epf-test-fix-doorbell-test-support.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-mt7996-fix-mt7996_mcu_sta_ba-wcid-configur.patch
+wifi-mt76-mt7996-fix-mt7996_mcu_bss_mld_tlv-routine.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+wifi-mt76-mt7996-use-proper-link_id-in-link_sta_rc_u.patch
+wifi-mt76-mt7996-check-phy-before-init-msta_link-in-.patch
+wifi-mt76-mt7996-fix-tx-queues-initialization-for-se.patch
+wifi-mt76-mt7996-fix-rx-packets-configuration-for-pr.patch
+wifi-mt76-mt7996-convert-mt7996_wed_rro_addr-to-le.patch
+wifi-mt76-mt7915-fix-mt7981-pre-calibration.patch
+wifi-mt76-mt7996-remove-redundant-per-phy-mac80211-c.patch
+asoc-intel-hda-sdw-bpt-set-persistent_buffer-false.patch
+srcu-tiny-remove-preempt_disable-enable-in-srcu_gp_s.patch
+drm-amdgpu-fix-allocating-extra-dwords-for-rings-v2.patch
+f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
+f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
+f2fs-fix-to-avoid-migrating-empty-section.patch
+f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
+risc-v-kvm-write-hgatp-register-with-valid-mode-bits.patch
+alsa-pcm-disable-bottom-softirqs-as-part-of-spin_loc.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+pci-fix-pdev_resources_assignable-disparity.patch
+pci-use-pci_release_resource-instead-of-release_reso.patch
+pci-preserve-bridge-window-resource-type-flags.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
+hid-hidraw-tighten-ioctl-command-parsing.patch
+f2fs-fix-zero-sized-extent-for-precache-extents.patch
+smc-fix-use-after-free-in-__pnet_find_base_ndev.patch
+smc-use-__sk_dst_get-and-dst_dev_rcu-in-in-smc_clc_p.patch
+smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_clc_prfx.patch
+smc-use-__sk_dst_get-and-dst_dev_rcu-in-smc_vlan_by_.patch
+tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_f.patch
+mptcp-call-dst_release-in-mptcp_active_enable.patch
+mptcp-use-__sk_dst_get-and-dst_dev_rcu-in-mptcp_acti.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+asoc-sof-ipc4-pcm-fix-incorrect-comparison-with-numb.patch
+wifi-ath12k-initialize-eirp_power-before-use.patch
+wifi-ath12k-fix-overflow-warning-on-num_pwr_levels.patch
+wifi-ath12k-fix-signal-in-radiotap-for-wcn7850.patch
+wifi-ath12k-fix-hal_phyrx_common_user_info-handling-.patch
+wifi-ath12k-fix-the-fetching-of-combined-rssi.patch
+wifi-ath12k-add-fallback-for-invalid-channel-number-.patch
+wifi-ath12k-fix-wrong-logging-id-used-for-ce.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+iommu-vt-d-debugfs-fix-legacy-mode-page-table-dump-l.patch
+wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+asoc-intel-sof_sdw-prevent-jump-to-null-add_sidecar-.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-26037
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-16989
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-29384
+vfio-pds-replace-bitmap_free-with-vfree.patch
+crypto-comp-use-same-definition-of-context-alloc-and.patch
+crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+wifi-ath12k-fix-peer-lookup-in-ath12k_dp_mon_rx_deli.patch
+rpmsg-qcom_smd-fix-fallback-to-qcom-ipc-parse.patch
+remoteproc-qcom_q6v5_mss-support-loading-mbn-file-on.patch
+rdma-rxe-fix-race-in-do_task-when-draining.patch
+selftests-mm-fix-va_high_addr_switch.sh-failure-on-x.patch
+wifi-rtw89-fix-leak-in-rtw89_core_send_nullfunc.patch
+wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+remoteproc-qcom-pas-shutdown-lite-adsp-dtb-on-x1e.patch
+wifi-ath12k-refactor-rx-tid-deletion-handling-into-h.patch
+wifi-ath12k-fix-flush-cache-failure-during-rx-queue-.patch
+wifi-cfg80211-fix-width-unit-in-cfg80211_radio_chand.patch
+dm-vdo-return-error-on-corrupted-metadata-in-start_r.patch
+coresight-fix-indentation-error-in-cscfg_remove_owne.patch
+coresight-etm4x-conditionally-access-register-trcext.patch
+coresight-tmc-support-atclk.patch
+coresight-catu-support-atclk.patch
+coresight-etm4x-support-atclk.patch
+coresight-appropriately-disable-programming-clocks.patch
+coresight-appropriately-disable-trace-bus-clocks.patch
+coresight-avoid-enable-programming-clock-duplicately.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+coresight-tpda-fix-the-logic-to-setup-the-element-si.patch
+coresight-fix-incorrect-handling-for-return-value-of.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+net-ethtool-tsconfig-set-command-must-provide-a-repl.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+netfilter-nfnetlink-reset-nlh-pointer-during-batch-r.patch
+netfilter-nf_conntrack-do-not-skip-entries-in-proc-n.patch
+scsi-ufs-core-fix-data-race-in-cpu-latency-pm-qos-re.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+pci-rcar-gen4-add-missing-1ms-delay-after-pwr-reset-.patch
+pci-rcar-gen4-assure-reset-occurs-before-dbi-access.patch
+pci-rcar-gen4-fix-inverted-break-condition-in-phy-in.patch
+asoc-qcom-sc8280xp-use-sa8775p-subdir-for-qcs9100-qc.patch
+iommu-vt-d-disallow-dirty-tracking-if-incoherent-pag.patch
+iommu-selftest-prevent-use-of-uninitialized-variable.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-enetc-fix-probing-error-message-typo-for-the-ene.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+ptp-add-a-upper-bound-on-max_vclocks.patch
+vhost-vringh-fix-copy_to_iter-return-value-check.patch
+net-macb-remove-illusion-about-tbqph-rbqph-being-per.patch
+net-macb-move-ring-size-computation-to-functions.patch
+net-macb-single-dma_alloc_coherent-for-dma-descripto.patch
+bluetooth-btintel_pcie-refactor-device-coredump.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+bluetooth-iso-free-rx_skb-if-not-consumed.patch
+bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+cramfs-fix-incorrect-physical-page-address-calculati.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
+f2fs-fix-uaf-issue-in-f2fs_merge_page_bio.patch
+mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+pci-j721e-fix-incorrect-error-message-in-probe.patch
+idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch
+tcp-use-skb-len-instead-of-skb-truesize-in-tcp_can_i.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+net-mlx5-stop-polling-for-command-response-if-interf.patch
+net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+net-mlx5-fw-reset-add-reset-timeout-work.patch
+smb-client-fix-crypto-buffers-in-non-linear-memory.patch
+bonding-fix-xfrm-offload-feature-setup-on-active-bac.patch
+net-enetc-initialize-sw-pir-and-cir-based-hw-pir-and.patch
+iommufd-register-iommufd-mock-devices-with-fwspec.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+nfsd-filecache-add-statx_dioalign-and-statx_dio_read.patch
+nfs-localio-avoid-issuing-misaligned-io-using-o_dire.patch
+octeontx2-vf-fix-bitmap-leak.patch
+octeontx2-pf-fix-bitmap-leak.patch
+vhost-vringh-modify-the-return-value-check.patch
+selftests-bpf-fix-typos-and-grammar-in-test-sources.patch
+selftests-bpf-move-get_ksyms-and-get_addrs-to-trace_.patch
+selftests-bpf-fix-realloc-size-in-bpf_get_addrs.patch
+bpf-skip-scalar-adjustment-for-bpf_neg-if-dst-is-a-p.patch
+bpf-reject-negative-offsets-for-alu-ops.patch
--- /dev/null
+From cce7c36f11e76c4e0abb0f2009d85d8be4870fcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 12:10:33 -0300
+Subject: smb: client: fix crypto buffers in non-linear memory
+
+From: Enzo Matsumiya <ematsumiya@suse.de>
+
+[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
+
+The crypto API, through the scatterlist API, expects input buffers to be
+in linear memory. We handle this with the cifs_sg_set_buf() helper
+that converts vmalloc'd memory to their corresponding pages.
+
+However, when we allocate our aead_request buffer (@creq in
+smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
+puts aead_request->__ctx in vmalloc area.
+
+AEAD algorithm then uses ->__ctx for its private/internal data and
+operations, and uses sg_set_buf() for such data on a few places.
+
+This works fine as long as @creq falls into kmalloc zone (small
+requests) or vmalloc'd memory is still within linear range.
+
+Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
+many tasks will increment the base stacks' addresses to a point where
+virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
+happens.
+
+In practice: too many parallel reads and writes on an encrypted mount
+will trigger this bug.
+
+To fix this, always alloc @creq with kmalloc() instead.
+Also drop the @sensitive_size variable/arguments since
+kfree_sensitive() doesn't need it.
+
+Backtrace:
+
+[ 945.272081] ------------[ cut here ]------------
+[ 945.272774] kernel BUG at include/linux/scatterlist.h:209!
+[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
+[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
+[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
+[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
+[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
+[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
+[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
+[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
+[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
+[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
+[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
+[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
+[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
+[ 945.286683] Call Trace:
+[ 945.286952] <TASK>
+[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs]
+[ 945.287719] crypto_gcm_encrypt+0x36/0xe0
+[ 945.288152] crypt_message+0x54a/0xad0 [cifs]
+[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs]
+[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs]
+[ 945.289944] cifs_call_async+0x178/0x340 [cifs]
+[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
+[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs]
+[ 945.291759] ? find_held_lock+0x32/0x90
+[ 945.292212] ? netfs_advance_write+0xf2/0x310
+[ 945.292723] netfs_advance_write+0xf2/0x310
+[ 945.293210] netfs_write_folio+0x346/0xcc0
+[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10
+[ 945.294250] netfs_writepages+0x117/0x460
+[ 945.294724] do_writepages+0xbe/0x170
+[ 945.295152] ? find_held_lock+0x32/0x90
+[ 945.295600] ? kvm_sched_clock_read+0x11/0x20
+[ 945.296103] __writeback_single_inode+0x56/0x4b0
+[ 945.296643] writeback_sb_inodes+0x229/0x550
+[ 945.297140] __writeback_inodes_wb+0x4c/0xe0
+[ 945.297642] wb_writeback+0x2f1/0x3f0
+[ 945.298069] wb_workfn+0x300/0x490
+[ 945.298472] process_one_work+0x1fe/0x590
+[ 945.298949] worker_thread+0x1ce/0x3c0
+[ 945.299397] ? __pfx_worker_thread+0x10/0x10
+[ 945.299900] kthread+0x119/0x210
+[ 945.300285] ? __pfx_kthread+0x10/0x10
+[ 945.300729] ret_from_fork+0x119/0x1b0
+[ 945.301163] ? __pfx_kthread+0x10/0x10
+[ 945.301601] ret_from_fork_asm+0x1a/0x30
+[ 945.302055] </TASK>
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index e586f3f4b5c93..68286673afc99 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4219,7 +4219,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+ struct aead_request **req, struct sg_table *sgt,
+- unsigned int *num_sgs, size_t *sensitive_size)
++ unsigned int *num_sgs)
+ {
+ unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
+ unsigned int iv_size = crypto_aead_ivsize(tfm);
+@@ -4236,9 +4236,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+ len += req_size;
+ len = ALIGN(len, __alignof__(struct scatterlist));
+ len += array_size(*num_sgs, sizeof(struct scatterlist));
+- *sensitive_size = len;
+
+- p = kvzalloc(len, GFP_NOFS);
++ p = kzalloc(len, GFP_NOFS);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -4252,16 +4251,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+
+ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+- struct aead_request **req, struct scatterlist **sgl,
+- size_t *sensitive_size)
++ struct aead_request **req, struct scatterlist **sgl)
+ {
+ struct sg_table sgtable = {};
+ unsigned int skip, num_sgs, i, j;
+ ssize_t rc;
+ void *p;
+
+- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
+- &num_sgs, sensitive_size);
++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
+ if (IS_ERR(p))
+ return ERR_CAST(p);
+
+@@ -4350,7 +4347,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ DECLARE_CRYPTO_WAIT(wait);
+ unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+ void *creq;
+- size_t sensitive_size;
+
+ rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
+ if (rc) {
+@@ -4376,8 +4372,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ return rc;
+ }
+
+- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
+- &sensitive_size);
++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
+ if (IS_ERR(creq))
+ return PTR_ERR(creq);
+
+@@ -4407,7 +4402,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ if (!rc && enc)
+ memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
+
+- kvfree_sensitive(creq, sensitive_size);
++ kfree_sensitive(creq);
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From cb03d3086e9f5bcfe48ea5532528a3958d9c1f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 11:25:06 +0200
+Subject: smb: client: fix sending the iwrap custom IRD/ORD negotiation
+ messages
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit ef71f1e046489c77a2f7d012edc762fba0a7aadc ]
+
+Do a real negotiation and check the servers initiator_depth and
+responder_resources.
+
+This should use big endian in order to be useful.
+I have captures of windows clients showing this.
+
+The fact that we used little endian up to now
+means that we sent very large numbers and the
+negotiation with the server truncated them to the
+server limits.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+The inconsitency regarding the initiator_depth
+and responder_resources values being reversed
+for iwarp devices in RDMA_CM_EVENT_ESTABLISHED
+should also be fixed later, but for now we should
+fix it.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 110 ++++++++++++++++++++++++++++++++++----
+ fs/smb/client/smbdirect.h | 4 +-
+ 2 files changed, 103 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index e0fce5033004c..6480945c24592 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -179,6 +179,8 @@ static int smbd_conn_upcall(
+ struct smbd_connection *info = id->context;
+ struct smbdirect_socket *sc = &info->socket;
+ const char *event_name = rdma_event_msg(event->event);
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+
+ log_rdma_event(INFO, "event=%s status=%d\n",
+ event_name, event->status);
+@@ -204,6 +206,85 @@ static int smbd_conn_upcall(
+
+ case RDMA_CM_EVENT_ESTABLISHED:
+ log_rdma_event(INFO, "connected event=%s\n", event_name);
++
++ /*
++ * Here we work around an inconsistency between
++ * iWarp and other devices (at least rxe and irdma using RoCEv2)
++ */
++ if (rdma_protocol_iwarp(id->device, id->port_num)) {
++ /*
++ * iWarp devices report the peer's values
++ * with the perspective of the peer here.
++ * Tested with siw and irdma (in iwarp mode)
++ * We need to change to our perspective here,
++ * so we need to switch the values.
++ */
++ peer_initiator_depth = event->param.conn.responder_resources;
++ peer_responder_resources = event->param.conn.initiator_depth;
++ } else {
++ /*
++ * Non iWarp devices report the peer's values
++ * already changed to our perspective here.
++ * Tested with rxe and irdma (in roce mode).
++ */
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ }
++ if (rdma_protocol_iwarp(id->device, id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ info->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ info->initiator_depth =
++ min_t(u8, info->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ info->responder_resources =
++ min_t(u8, info->responder_resources,
++ peer_responder_resources);
++
+ sc->status = SMBDIRECT_SOCKET_CONNECTED;
+ wake_up_interruptible(&info->status_wait);
+ break;
+@@ -1551,7 +1632,7 @@ static struct smbd_connection *_smbd_get_connection(
+ struct ib_qp_init_attr qp_attr;
+ struct sockaddr_in *addr_in = (struct sockaddr_in *) dstaddr;
+ struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+
+ info = kzalloc(sizeof(struct smbd_connection), GFP_KERNEL);
+ if (!info)
+@@ -1559,6 +1640,9 @@ static struct smbd_connection *_smbd_get_connection(
+ sc = &info->socket;
+ sp = &sc->parameters;
+
++ info->initiator_depth = 1;
++ info->responder_resources = SMBD_CM_RESPONDER_RESOURCES;
++
+ sc->status = SMBDIRECT_SOCKET_CONNECTING;
+ rc = smbd_ia_open(info, dstaddr, port);
+ if (rc) {
+@@ -1639,22 +1723,22 @@ static struct smbd_connection *_smbd_get_connection(
+ }
+ sc->ib.qp = sc->rdma.cm_id->qp;
+
+- memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = 0;
+-
+- conn_param.responder_resources =
+- min(sc->ib.dev->attrs.max_qp_rd_atom,
+- SMBD_CM_RESPONDER_RESOURCES);
+- info->responder_resources = conn_param.responder_resources;
++ info->responder_resources =
++ min_t(u8, info->responder_resources,
++ sc->ib.dev->attrs.max_qp_rd_atom);
+ log_rdma_mr(INFO, "responder_resources=%d\n",
+ info->responder_resources);
+
++ memset(&conn_param, 0, sizeof(conn_param));
++ conn_param.initiator_depth = info->initiator_depth;
++ conn_param.responder_resources = info->responder_resources;
++
+ /* Need to send IRD/ORD in private data for iWARP */
+ sc->ib.dev->ops.get_port_immutable(
+ sc->ib.dev, sc->rdma.cm_id->port_num, &port_immutable);
+ if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = info->responder_resources;
+- ird_ord_hdr[1] = 1;
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2121,6 +2205,12 @@ static int allocate_mr_list(struct smbd_connection *info)
+ atomic_set(&info->mr_used_count, 0);
+ init_waitqueue_head(&info->wait_for_mr_cleanup);
+ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
++
++ if (info->responder_resources == 0) {
++ log_rdma_mr(ERR, "responder_resources negotiated as 0\n");
++ return -EINVAL;
++ }
++
+ /* Allocate more MRs (2x) than hardware responder_resources */
+ for (i = 0; i < info->responder_resources * 2; i++) {
+ smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
+diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h
+index e45aa9ddd71da..4ca9b2b2c57f9 100644
+--- a/fs/smb/client/smbdirect.h
++++ b/fs/smb/client/smbdirect.h
+@@ -67,7 +67,9 @@ struct smbd_connection {
+
+ /* Memory registrations */
+ /* Maximum number of RDMA read/write outstanding on this connection */
+- int responder_resources;
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ /* Maximum number of pages in a single RDMA write/read on this connection */
+ int max_frmr_depth;
+ /*
+--
+2.51.0
+
--- /dev/null
+From 8028c7f6caa13fb541f8109b48d5f2ebcd31f1af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:34:58 +0200
+Subject: smb: server: fix IRD/ORD negotiation with the client
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
+
+Already do real negotiation in smb_direct_handle_connect_request()
+where we see the requested initiator_depth and responder_resources
+from the client.
+
+We should detect legacy iwarp clients using MPA v1
+with the custom IRD/ORD negotiation.
+
+We need to send the custom IRD/ORD in big endian,
+but we need to try to let clients with broken requests
+using little endian (older cifs.ko) to work.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
+ 1 file changed, 85 insertions(+), 14 deletions(-)
+
+diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
+index 74dfb6496095d..e1f659d3b4cf5 100644
+--- a/fs/smb/server/transport_rdma.c
++++ b/fs/smb/server/transport_rdma.c
+@@ -153,6 +153,10 @@ struct smb_direct_transport {
+ struct work_struct disconnect_work;
+
+ bool negotiation_requested;
++
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ };
+
+ #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
+@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
+ t->cm_id = cm_id;
+ cm_id->context = t;
+
++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
++ t->responder_resources = 1;
++
+ t->status = SMB_DIRECT_CS_NEW;
+ init_waitqueue_head(&t->wait_status);
+
+@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
+ static int smb_direct_accept_client(struct smb_direct_transport *t)
+ {
+ struct rdma_conn_param conn_param;
+- struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+ int ret;
+
++ /*
++ * smb_direct_handle_connect_request()
++ * already negotiated t->initiator_depth
++ * and t->responder_resources
++ */
+ memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
+- SMB_DIRECT_CM_INITIATOR_DEPTH);
+- conn_param.responder_resources = 0;
+-
+- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
+- t->cm_id->port_num,
+- &port_immutable);
+- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = conn_param.responder_resources;
+- ird_ord_hdr[1] = 1;
++ conn_param.initiator_depth = t->initiator_depth;
++ conn_param.responder_resources = t->responder_resources;
++
++ if (t->legacy_iwarp) {
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
+ return true;
+ }
+
+-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
++ struct rdma_cm_event *event)
+ {
+ struct smb_direct_transport *t;
+ struct task_struct *handler;
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+ int ret;
+
+ if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
+@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+ if (!t)
+ return -ENOMEM;
+
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ t->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * First set what the we as server are able to support
++ */
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ new_cm_id->device->attrs.max_qp_rd_atom);
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ t->responder_resources = min_t(u8, t->responder_resources,
++ peer_responder_resources);
++
+ ret = smb_direct_connect(t);
+ if (ret)
+ goto out_err;
+@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
+ {
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST: {
+- int ret = smb_direct_handle_connect_request(cm_id);
++ int ret = smb_direct_handle_connect_request(cm_id, event);
+
+ if (ret) {
+ pr_err("Can't create transport: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From 256e8a49013c736f28db3100717b62d8782a65b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:19 +0000
+Subject: smc: Fix use-after-free in __pnet_find_base_ndev().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 3d3466878afd8d43ec0ca2facfbc7f03e40d0f79 ]
+
+syzbot reported use-after-free of net_device in __pnet_find_base_ndev(),
+which was called during connect(). [0]
+
+smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes
+down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened
+at __pnet_find_base_ndev() when the dev is first used.
+
+This means dev had already been freed before acquiring RTNL in
+pnet_find_base_ndev().
+
+While dev is going away, dst->dev could be swapped with blackhole_netdev,
+and the dev's refcnt by dst will be released.
+
+We must hold dev's refcnt before calling smc_pnet_find_ism_resource().
+
+Also, smc_pnet_find_roce_resource() has the same problem.
+
+Let's use __sk_dst_get() and dst_dev_rcu() in the two functions.
+
+[0]:
+BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926
+Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609
+
+CPU: 1 UID: 0 PID: 18609 Comm: syz.0.3632 Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0xca/0x240 mm/kasan/report.c:482
+ kasan_report+0x118/0x150 mm/kasan/report.c:595
+ __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926
+ pnet_find_base_ndev net/smc/smc_pnet.c:946 [inline]
+ smc_pnet_find_ism_by_pnetid net/smc/smc_pnet.c:1103 [inline]
+ smc_pnet_find_ism_resource+0xef/0x390 net/smc/smc_pnet.c:1154
+ smc_find_ism_device net/smc/af_smc.c:1030 [inline]
+ smc_find_proposal_devices net/smc/af_smc.c:1115 [inline]
+ __smc_connect+0x372/0x1890 net/smc/af_smc.c:1545
+ smc_connect+0x877/0xd90 net/smc/af_smc.c:1715
+ __sys_connect_file net/socket.c:2086 [inline]
+ __sys_connect+0x313/0x440 net/socket.c:2105
+ __do_sys_connect net/socket.c:2111 [inline]
+ __se_sys_connect net/socket.c:2108 [inline]
+ __x64_sys_connect+0x7a/0x90 net/socket.c:2108
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7f47cbf8eba9
+Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007f47ccdb1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
+RAX: ffffffffffffffda RBX: 00007f47cc1d5fa0 RCX: 00007f47cbf8eba9
+RDX: 0000000000000010 RSI: 0000200000000280 RDI: 000000000000000b
+RBP: 00007f47cc011e19 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 00007f47cc1d6038 R14: 00007f47cc1d5fa0 R15: 00007ffc512f8aa8
+ </TASK>
+
+The buggy address belongs to the physical page:
+page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036bacd00 pfn:0x36bac
+flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
+raw: 00fff00000000000 ffffea0001243d08 ffff8880b863fdc0 0000000000000000
+raw: ffff888036bacd00 0000000000000000 00000000ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+page_owner tracks the page as freed
+page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 16741, tgid 16741 (syz-executor), ts 343313197788, free_ts 380670750466
+ set_page_owner include/linux/page_owner.h:32 [inline]
+ post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
+ prep_new_page mm/page_alloc.c:1859 [inline]
+ get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
+ __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
+ alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
+ ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:4317
+ __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:4348
+ __do_kmalloc_node mm/slub.c:4364 [inline]
+ __kvmalloc_node_noprof+0x6d/0x5f0 mm/slub.c:5067
+ alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11812
+ tun_set_iff+0x532/0xef0 drivers/net/tun.c:2775
+ __tun_chr_ioctl+0x788/0x1df0 drivers/net/tun.c:3085
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+page last free pid 18610 tgid 18608 stack trace:
+ reset_page_owner include/linux/page_owner.h:25 [inline]
+ free_pages_prepare mm/page_alloc.c:1395 [inline]
+ __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
+ free_large_kmalloc+0x13a/0x1f0 mm/slub.c:4820
+ device_release+0x99/0x1c0 drivers/base/core.c:-1
+ kobject_cleanup lib/kobject.c:689 [inline]
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0x22b/0x480 lib/kobject.c:737
+ netdev_run_todo+0xd2e/0xea0 net/core/dev.c:11513
+ rtnl_unlock net/core/rtnetlink.c:157 [inline]
+ rtnl_net_unlock include/linux/rtnetlink.h:135 [inline]
+ rtnl_dellink+0x537/0x710 net/core/rtnetlink.c:3563
+ rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6946
+ netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
+ netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
+ netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
+ netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
+ sock_sendmsg_nosec net/socket.c:714 [inline]
+ __sock_sendmsg+0x219/0x270 net/socket.c:729
+ ____sys_sendmsg+0x505/0x830 net/socket.c:2614
+ ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
+ __sys_sendmsg net/socket.c:2700 [inline]
+ __do_sys_sendmsg net/socket.c:2705 [inline]
+ __se_sys_sendmsg net/socket.c:2703 [inline]
+ __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Memory state around the buggy address:
+ ffff888036bac200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff888036bac280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+>ffff888036bac300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ^
+ ffff888036bac380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff888036bac400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+
+Fixes: 0afff91c6f5e ("net/smc: add pnetid support")
+Fixes: 1619f770589a ("net/smc: add pnetid support for SMC-D and ISM")
+Reported-by: syzbot+ea28e9d85be2f327b6c6@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/68c237c7.050a0220.3c6139.0036.GAE@google.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-2-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_pnet.c | 43 ++++++++++++++++++++++---------------------
+ 1 file changed, 22 insertions(+), 21 deletions(-)
+
+diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
+index 76ad29e31d605..db3043b1e3fdb 100644
+--- a/net/smc/smc_pnet.c
++++ b/net/smc/smc_pnet.c
+@@ -1126,37 +1126,38 @@ static void smc_pnet_find_ism_by_pnetid(struct net_device *ndev,
+ */
+ void smc_pnet_find_roce_resource(struct sock *sk, struct smc_init_info *ini)
+ {
+- struct dst_entry *dst = sk_dst_get(sk);
+-
+- if (!dst)
+- goto out;
+- if (!dst->dev)
+- goto out_rel;
++ struct net_device *dev;
++ struct dst_entry *dst;
+
+- smc_pnet_find_roce_by_pnetid(dst->dev, ini);
++ rcu_read_lock();
++ dst = __sk_dst_get(sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ dev_hold(dev);
++ rcu_read_unlock();
+
+-out_rel:
+- dst_release(dst);
+-out:
+- return;
++ if (dev) {
++ smc_pnet_find_roce_by_pnetid(dev, ini);
++ dev_put(dev);
++ }
+ }
+
+ void smc_pnet_find_ism_resource(struct sock *sk, struct smc_init_info *ini)
+ {
+- struct dst_entry *dst = sk_dst_get(sk);
++ struct net_device *dev;
++ struct dst_entry *dst;
+
+ ini->ism_dev[0] = NULL;
+- if (!dst)
+- goto out;
+- if (!dst->dev)
+- goto out_rel;
+
+- smc_pnet_find_ism_by_pnetid(dst->dev, ini);
++ rcu_read_lock();
++ dst = __sk_dst_get(sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ dev_hold(dev);
++ rcu_read_unlock();
+
+-out_rel:
+- dst_release(dst);
+-out:
+- return;
++ if (dev) {
++ smc_pnet_find_ism_by_pnetid(dev, ini);
++ dev_put(dev);
++ }
+ }
+
+ /* Lookup and apply a pnet table entry to the given ib device.
+--
+2.51.0
+
--- /dev/null
+From d00ea1c0bbe48b73a526eee44564e5aa975b6f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:20 +0000
+Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 935d783e5de9b64587f3adb25641dd8385e64ddb ]
+
+smc_clc_prfx_set() is called during connect() and not under RCU
+nor RTNL.
+
+Using sk_dst_get(sk)->dev could trigger UAF.
+
+Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock()
+after kernel_getsockname().
+
+Note that the returned value of smc_clc_prfx_set() is not used
+in the caller.
+
+While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu()
+not to touch dst there.
+
+Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_clc.c | 41 ++++++++++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 19 deletions(-)
+
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 08be56dfb3f24..976b2102bdfcd 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -509,10 +509,10 @@ static bool smc_clc_msg_hdr_valid(struct smc_clc_msg_hdr *clcm, bool check_trl)
+ }
+
+ /* find ipv4 addr on device and get the prefix len, fill CLC proposal msg */
+-static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4,
++static int smc_clc_prfx_set4_rcu(struct net_device *dev, __be32 ipv4,
+ struct smc_clc_msg_proposal_prefix *prop)
+ {
+- struct in_device *in_dev = __in_dev_get_rcu(dst->dev);
++ struct in_device *in_dev = __in_dev_get_rcu(dev);
+ const struct in_ifaddr *ifa;
+
+ if (!in_dev)
+@@ -530,12 +530,12 @@ static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4,
+ }
+
+ /* fill CLC proposal msg with ipv6 prefixes from device */
+-static int smc_clc_prfx_set6_rcu(struct dst_entry *dst,
++static int smc_clc_prfx_set6_rcu(struct net_device *dev,
+ struct smc_clc_msg_proposal_prefix *prop,
+ struct smc_clc_ipv6_prefix *ipv6_prfx)
+ {
+ #if IS_ENABLED(CONFIG_IPV6)
+- struct inet6_dev *in6_dev = __in6_dev_get(dst->dev);
++ struct inet6_dev *in6_dev = __in6_dev_get(dev);
+ struct inet6_ifaddr *ifa;
+ int cnt = 0;
+
+@@ -564,41 +564,44 @@ static int smc_clc_prfx_set(struct socket *clcsock,
+ struct smc_clc_msg_proposal_prefix *prop,
+ struct smc_clc_ipv6_prefix *ipv6_prfx)
+ {
+- struct dst_entry *dst = sk_dst_get(clcsock->sk);
+ struct sockaddr_storage addrs;
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr;
++ struct net_device *dev;
++ struct dst_entry *dst;
+ int rc = -ENOENT;
+
+- if (!dst) {
+- rc = -ENOTCONN;
+- goto out;
+- }
+- if (!dst->dev) {
+- rc = -ENODEV;
+- goto out_rel;
+- }
+ /* get address to which the internal TCP socket is bound */
+ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0)
+- goto out_rel;
++ goto out;
++
+ /* analyze IP specific data of net_device belonging to TCP socket */
+ addr6 = (struct sockaddr_in6 *)&addrs;
++
+ rcu_read_lock();
++
++ dst = __sk_dst_get(clcsock->sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ if (!dev) {
++ rc = -ENODEV;
++ goto out_unlock;
++ }
++
+ if (addrs.ss_family == PF_INET) {
+ /* IPv4 */
+ addr = (struct sockaddr_in *)&addrs;
+- rc = smc_clc_prfx_set4_rcu(dst, addr->sin_addr.s_addr, prop);
++ rc = smc_clc_prfx_set4_rcu(dev, addr->sin_addr.s_addr, prop);
+ } else if (ipv6_addr_v4mapped(&addr6->sin6_addr)) {
+ /* mapped IPv4 address - peer is IPv4 only */
+- rc = smc_clc_prfx_set4_rcu(dst, addr6->sin6_addr.s6_addr32[3],
++ rc = smc_clc_prfx_set4_rcu(dev, addr6->sin6_addr.s6_addr32[3],
+ prop);
+ } else {
+ /* IPv6 */
+- rc = smc_clc_prfx_set6_rcu(dst, prop, ipv6_prfx);
++ rc = smc_clc_prfx_set6_rcu(dev, prop, ipv6_prfx);
+ }
++
++out_unlock:
+ rcu_read_unlock();
+-out_rel:
+- dst_release(dst);
+ out:
+ return rc;
+ }
+--
+2.51.0
+
--- /dev/null
+From 14e9a2049050993aa80154be9ca76593370eefc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:21 +0000
+Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 235f81045c008169cc4e1955b4a64e118eebe61b ]
+
+smc_clc_prfx_match() is called from smc_listen_work() and
+not under RCU nor RTNL.
+
+Using sk_dst_get(sk)->dev could trigger UAF.
+
+Let's use __sk_dst_get() and dst_dev_rcu().
+
+Note that the returned value of smc_clc_prfx_match() is not
+used in the caller.
+
+Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_clc.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 976b2102bdfcd..09745baa10170 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -657,26 +657,26 @@ static int smc_clc_prfx_match6_rcu(struct net_device *dev,
+ int smc_clc_prfx_match(struct socket *clcsock,
+ struct smc_clc_msg_proposal_prefix *prop)
+ {
+- struct dst_entry *dst = sk_dst_get(clcsock->sk);
++ struct net_device *dev;
++ struct dst_entry *dst;
+ int rc;
+
+- if (!dst) {
+- rc = -ENOTCONN;
+- goto out;
+- }
+- if (!dst->dev) {
++ rcu_read_lock();
++
++ dst = __sk_dst_get(clcsock->sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ if (!dev) {
+ rc = -ENODEV;
+- goto out_rel;
++ goto out;
+ }
+- rcu_read_lock();
++
+ if (!prop->ipv6_prefixes_cnt)
+- rc = smc_clc_prfx_match4_rcu(dst->dev, prop);
++ rc = smc_clc_prfx_match4_rcu(dev, prop);
+ else
+- rc = smc_clc_prfx_match6_rcu(dst->dev, prop);
+- rcu_read_unlock();
+-out_rel:
+- dst_release(dst);
++ rc = smc_clc_prfx_match6_rcu(dev, prop);
+ out:
++ rcu_read_unlock();
++
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2dea499c0286d4383d91c9192cda7e4d634654c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:22 +0000
+Subject: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 0b0e4d51c6554e5ecc3f8cc73c2eaf12da21249a ]
+
+smc_vlan_by_tcpsk() fetches sk_dst_get(sk)->dev before RTNL and
+passes it to netdev_walk_all_lower_dev(), which is illegal.
+
+Also, smc_vlan_by_tcpsk_walk() does not require RTNL at all.
+
+Let's use __sk_dst_get(), dst_dev_rcu(), and
+netdev_walk_all_lower_dev_rcu().
+
+Note that the returned value of smc_vlan_by_tcpsk() is not used
+in the caller.
+
+Fixes: 0cfdd8f92cac ("smc: connection and link group creation")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250916214758.650211-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 262746e304dda..2a559a98541c7 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -1883,35 +1883,32 @@ static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
+ /* Determine vlan of internal TCP socket. */
+ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
+ {
+- struct dst_entry *dst = sk_dst_get(clcsock->sk);
+ struct netdev_nested_priv priv;
+ struct net_device *ndev;
++ struct dst_entry *dst;
+ int rc = 0;
+
+ ini->vlan_id = 0;
+- if (!dst) {
+- rc = -ENOTCONN;
+- goto out;
+- }
+- if (!dst->dev) {
++
++ rcu_read_lock();
++
++ dst = __sk_dst_get(clcsock->sk);
++ ndev = dst ? dst_dev_rcu(dst) : NULL;
++ if (!ndev) {
+ rc = -ENODEV;
+- goto out_rel;
++ goto out;
+ }
+
+- ndev = dst->dev;
+ if (is_vlan_dev(ndev)) {
+ ini->vlan_id = vlan_dev_vlan_id(ndev);
+- goto out_rel;
++ goto out;
+ }
+
+ priv.data = (void *)&ini->vlan_id;
+- rtnl_lock();
+- netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
+- rtnl_unlock();
+-
+-out_rel:
+- dst_release(dst);
++ netdev_walk_all_lower_dev_rcu(ndev, smc_vlan_by_tcpsk_walk, &priv);
+ out:
++ rcu_read_unlock();
++
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From cd3db57a95ac21a183332538c3bf72dff24cacd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 56f83aa58ec82..02f52291fae42 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -884,16 +884,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From 3874bae3ff6e8f7d70e00af46942c39cf55cfe49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:50 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-2-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index 7c349a94b45c0..48804e1e5a6c8 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
+ return dev;
+ }
+
++static void svs_put_device(void *_dev)
++{
++ struct device *dev = _dev;
++
++ put_device(dev);
++}
++
+ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ dev = svs_add_device_link(svsp, "thermal-sensor");
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get thermal device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 7963762c3d0e4a2f42c805abf2ee377a5e70c8a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:56:51 +0200
+Subject: soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit f1a68ba5739e42353609438e27a83b08d7f5cfd6 ]
+
+Make sure to drop the references taken by of_find_device_by_node() when
+looking up the thermal sensor and opp devices during probe on probe
+failure (e.g. probe deferral) and on driver unbind.
+
+Fixes: 0bbb09b2af9d ("soc: mediatek: SVS: add mt8192 SVS GPU driver")
+Cc: Roger Lu <roger.lu@mediatek.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250909095651.5530-3-johan@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-svs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
+index 48804e1e5a6c8..f45537546553e 100644
+--- a/drivers/soc/mediatek/mtk-svs.c
++++ b/drivers/soc/mediatek/mtk-svs.c
+@@ -2176,6 +2176,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ {
+ struct device *dev;
+ u32 idx;
++ int ret;
+
+ svsp->rst = devm_reset_control_get_optional(svsp->dev, "svs_rst");
+ if (IS_ERR(svsp->rst))
+@@ -2186,6 +2187,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ if (IS_ERR(dev))
+ return dev_err_probe(svsp->dev, PTR_ERR(dev),
+ "failed to get lvts device\n");
++ put_device(dev);
+
+ for (idx = 0; idx < svsp->bank_max; idx++) {
+ struct svs_bank *svsb = &svsp->banks[idx];
+@@ -2195,6 +2197,7 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ case SVSB_SWID_CPU_LITTLE:
+ case SVSB_SWID_CPU_BIG:
+ svsb->opp_dev = get_cpu_device(bdata->cpu_id);
++ get_device(svsb->opp_dev);
+ break;
+ case SVSB_SWID_CCI:
+ svsb->opp_dev = svs_add_device_link(svsp, "cci");
+@@ -2214,6 +2217,11 @@ static int svs_mt8192_platform_probe(struct svs_platform *svsp)
+ return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
+ "failed to get OPP device for bank %d\n",
+ idx);
++
++ ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
++ svsb->opp_dev);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 7fbb2a6ac1a48a4204ca393b372fe2c4591fd7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index fdab2b1067dbb..c6f7d5c9c493d 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
+--
+2.51.0
+
--- /dev/null
+From 093b16bc2bec9449e5adb41bc52e22c9201f1f72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index 635398ec7540e..154fbd35400ca 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From ec62fb3f95f1a9617beb4dfafd375a173ef864bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index ee51c12306894..bbd3ea0a64822 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -79,8 +79,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From fa020a7d5f6e3ea619bda1278aa6dd0a303af27e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From 971a8db853603f933f02f3706b2cbe9179cbdc2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From 1949bcd9e8c7314612bc876762a360bc4562262a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From 908793043c71556ff26828277f099f02991d7ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 20:37:19 +0200
+Subject: spi: fix return code when spi device has too many chipselects
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]
+
+Don't return a positive value when there are too many chipselects.
+
+Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20250915183725.219473-2-jonas.gorski@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index a388f372b27a7..19c2a6eb9922a 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2449,7 +2449,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
+ if (rc > ctlr->num_chipselect) {
+ dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
+ nc, rc);
+- return rc;
++ return -EINVAL;
+ }
+ if ((of_property_present(nc, "parallel-memories")) &&
+ (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
+--
+2.51.0
+
--- /dev/null
+From 2c9dec862be0ccfe3e327289c1f071ea286cbf38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 20:51:55 +0800
+Subject: srcu/tiny: Remove preempt_disable/enable() in
+ srcu_gp_start_if_needed()
+
+From: Zqiang <qiang.zhang@linux.dev>
+
+[ Upstream commit e6a43aeb71852a39432332dcc3a6d11bb464b075 ]
+
+Currently, the srcu_gp_start_if_needed() is always be invoked in
+preempt disable's critical section, this commit therefore remove
+redundant preempt_disable/enable() in srcu_gp_start_if_needed()
+and adds a call to lockdep_assert_preemption_disabled() in order
+to enable lockdep to diagnose mistaken invocations of this function
+from preempts-enabled code.
+
+Fixes: 65b4a59557f6 ("srcu: Make Tiny SRCU explicitly disable preemption")
+Signed-off-by: Zqiang <qiang.zhang@linux.dev>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/srcutiny.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
+index 6e9fe2ce1075d..e3b64a5e0ec7e 100644
+--- a/kernel/rcu/srcutiny.c
++++ b/kernel/rcu/srcutiny.c
+@@ -176,10 +176,9 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
+ {
+ unsigned long cookie;
+
+- preempt_disable(); // Needed for PREEMPT_LAZY
++ lockdep_assert_preemption_disabled(); // Needed for PREEMPT_LAZY
+ cookie = get_state_synchronize_srcu(ssp);
+ if (ULONG_CMP_GE(READ_ONCE(ssp->srcu_idx_max), cookie)) {
+- preempt_enable();
+ return;
+ }
+ WRITE_ONCE(ssp->srcu_idx_max, cookie);
+@@ -189,7 +188,6 @@ static void srcu_gp_start_if_needed(struct srcu_struct *ssp)
+ else if (list_empty(&ssp->srcu_work.entry))
+ list_add(&ssp->srcu_work.entry, &srcu_boot_list);
+ }
+- preempt_enable();
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 7d5e8326e603a7afc73efe1a1d1410019556767e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index ad76556800f2b..89040007c7b70 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3099,8 +3099,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -3119,11 +3119,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From bbd4b557f01463b3307346ef891aa6ae2c5ee988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 09:28:27 +0000
+Subject: tcp: use skb->len instead of skb->truesize in tcp_can_ingest()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f017c1f768b670bced4464476655b27dfb937e67 ]
+
+Some applications are stuck to the 20th century and still use
+small SO_RCVBUF values.
+
+After the blamed commit, we can drop packets especially
+when using LRO/hw-gro enabled NIC and small MSS (1500) values.
+
+LRO/hw-gro NIC pack multiple segments into pages, allowing
+tp->scaling_ratio to be set to a high value.
+
+Whenever the receive queue gets full, we can receive a small packet
+filling RWIN, but with a high skb->truesize, because most NIC use 4K page
+plus sk_buff metadata even when receiving less than 1500 bytes of payload.
+
+Even if we refine how tp->scaling_ratio is estimated,
+we could have an issue at the start of the flow, because
+the first round of packets (IW10) will be sent based on
+the initial tp->scaling_ratio (1/2)
+
+Relax tcp_can_ingest() to use skb->len instead of skb->truesize,
+allowing the peer to use final RWIN, assuming a 'perfect'
+scaling_ratio of 1.
+
+Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250927092827.2707901-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 71b76e98371a6..64f93668a8452 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4890,12 +4890,23 @@ static int tcp_prune_queue(struct sock *sk, const struct sk_buff *in_skb);
+
+ /* Check if this incoming skb can be added to socket receive queues
+ * while satisfying sk->sk_rcvbuf limit.
++ *
++ * In theory we should use skb->truesize, but this can cause problems
++ * when applications use too small SO_RCVBUF values.
++ * When LRO / hw gro is used, the socket might have a high tp->scaling_ratio,
++ * allowing RWIN to be close to available space.
++ * Whenever the receive queue gets full, we can receive a small packet
++ * filling RWIN, but with a high skb->truesize, because most NIC use 4K page
++ * plus sk_buff metadata even when receiving less than 1500 bytes of payload.
++ *
++ * Note that we use skb->len to decide to accept or drop this packet,
++ * but sk->sk_rmem_alloc is the sum of all skb->truesize.
+ */
+ static bool tcp_can_ingest(const struct sock *sk, const struct sk_buff *skb)
+ {
+- unsigned int new_mem = atomic_read(&sk->sk_rmem_alloc) + skb->truesize;
++ unsigned int rmem = atomic_read(&sk->sk_rmem_alloc);
+
+- return new_mem <= sk->sk_rcvbuf;
++ return rmem + skb->len <= sk->sk_rcvbuf;
+ }
+
+ static int tcp_try_rmem_schedule(struct sock *sk, const struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 524d0cf4547e98f4ce0175645f640a6d71e6ac4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:21 +0000
+Subject: tcp_metrics: use dst_dev_net_rcu()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 50c127a69cd6285300931853b352a1918cfa180f ]
+
+Replace three dst_dev() with a lockdep enabled helper.
+
+Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-7-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_metrics.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index 03c068ea27b6a..10e86f1008e9d 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -170,7 +170,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
+ struct net *net;
+
+ spin_lock_bh(&tcp_metrics_lock);
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+
+ /* While waiting for the spin-lock the cache might have been populated
+ * with this entry and so we have to check again.
+@@ -273,7 +273,7 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
+ return NULL;
+ }
+
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+ hash ^= net_hash_mix(net);
+ hash = hash_32(hash, tcp_metrics_hash_log);
+
+@@ -318,7 +318,7 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
+ else
+ return NULL;
+
+- net = dev_net_rcu(dst_dev(dst));
++ net = dst_dev_net_rcu(dst);
+ hash ^= net_hash_mix(net);
+ hash = hash_32(hash, tcp_metrics_hash_log);
+
+--
+2.51.0
+
--- /dev/null
+From 51c0c8caf9cbf85c8d6f619ea8063a4eeb1c6f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index 75eaa9a68ab8a..c681a3c89ffa0 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From ec9a52cdd39f640e5ca979244784d2b1071542bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index 2c7f3f9a26ebb..a6bb01082ec69 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From a069c3d5fc34980e83250cc1427ab4fc165fa056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 14:49:51 +0800
+Subject: tick: Do not set device to detached state in tick_shutdown()
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ]
+
+tick_shutdown() sets the state of the clockevent device to detached
+first and the invokes clockevents_exchange_device(), which in turn
+invokes clockevents_switch_state().
+
+But clockevents_switch_state() returns without invoking the device shutdown
+callback as the device is already in detached state. As a consequence the
+timer device is not shutdown when a CPU goes offline.
+
+tick_shutdown() does this because it was originally invoked on a online CPU
+and not on the outgoing CPU. It therefore could not access the clockevent
+device of the already offlined CPU and just set the state.
+
+Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so
+the hardware device can be accessed.
+
+Remove the state set before calling clockevents_exchange_device(), so that
+the subsequent clockevents_switch_state() handles the state transition and
+invokes the shutdown callback of the clockevent device.
+
+[ tglx: Massaged change log ]
+
+Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING")
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lore.kernel.org/all/20250906064952.3749122-2-maobibo@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/clockevents.c | 2 +-
+ kernel/time/tick-common.c | 16 +++++-----------
+ kernel/time/tick-internal.h | 2 +-
+ 3 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index f3e831f62906f..a59bc75ab7c5b 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu)
+ raw_spin_lock(&clockevents_lock);
+
+ tick_broadcast_offline(cpu);
+- tick_shutdown(cpu);
++ tick_shutdown();
+
+ /*
+ * Unregister the clock event devices which were
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 9a3859443c042..7e33d3f2e889b 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu)
+ }
+
+ /*
+- * Shutdown an event device on a given cpu:
++ * Shutdown an event device on the outgoing CPU:
+ *
+- * This is called on a life CPU, when a CPU is dead. So we cannot
+- * access the hardware device itself.
+- * We just set the mode and remove it from the lists.
++ * Called by the dying CPU during teardown, with clockevents_lock held
++ * and interrupts disabled.
+ */
+-void tick_shutdown(unsigned int cpu)
++void tick_shutdown(void)
+ {
+- struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
++ struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
+ struct clock_event_device *dev = td->evtdev;
+
+ td->mode = TICKDEV_MODE_PERIODIC;
+ if (dev) {
+- /*
+- * Prevent that the clock events layer tries to call
+- * the set mode function!
+- */
+- clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
+ clockevents_exchange_device(dev, NULL);
+ dev->event_handler = clockevents_handle_noop;
+ td->evtdev = NULL;
+diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
+index faac36de35b9e..4e4f7bbe2a64b 100644
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
+ extern void tick_handle_periodic(struct clock_event_device *dev);
+ extern void tick_check_new_device(struct clock_event_device *dev);
+ extern void tick_offline_cpu(unsigned int cpu);
+-extern void tick_shutdown(unsigned int cpu);
++extern void tick_shutdown(void);
+ extern void tick_suspend(void);
+ extern void tick_resume(void);
+ extern bool tick_check_replacement(struct clock_event_device *curdev,
+--
+2.51.0
+
--- /dev/null
+From b3f7ce8c872236ad34d88c73ac7a836551ced71f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:47:23 +0000
+Subject: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit c65f27b9c3be2269918e1cbad6d8884741f835c5 ]
+
+get_netdev_for_sock() is called during setsockopt(),
+so not under RCU.
+
+Using sk_dst_get(sk)->dev could trigger UAF.
+
+Let's use __sk_dst_get() and dst_dev_rcu().
+
+Note that the only ->ndo_sk_get_lower_dev() user is
+bond_sk_get_lower_dev(), which uses RCU.
+
+Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_device.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
+index f672a62a9a52f..a82fdcf199690 100644
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -123,17 +123,19 @@ static void tls_device_queue_ctx_destruction(struct tls_context *ctx)
+ /* We assume that the socket is already connected */
+ static struct net_device *get_netdev_for_sock(struct sock *sk)
+ {
+- struct dst_entry *dst = sk_dst_get(sk);
+- struct net_device *netdev = NULL;
++ struct net_device *dev, *lowest_dev = NULL;
++ struct dst_entry *dst;
+
+- if (likely(dst)) {
+- netdev = netdev_sk_get_lowest_dev(dst->dev, sk);
+- dev_hold(netdev);
++ rcu_read_lock();
++ dst = __sk_dst_get(sk);
++ dev = dst ? dst_dev_rcu(dst) : NULL;
++ if (likely(dev)) {
++ lowest_dev = netdev_sk_get_lowest_dev(dev, sk);
++ dev_hold(lowest_dev);
+ }
++ rcu_read_unlock();
+
+- dst_release(dst);
+-
+- return netdev;
++ return lowest_dev;
+ }
+
+ static void destroy_record(struct tls_record_info *record)
+--
+2.51.0
+
--- /dev/null
+From e95295503c9888fc6600a31a4e0f93aaf0a84283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 11:14:23 -0300
+Subject: tools/nolibc: add stdbool.h to nolibc includes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Almeida <andrealmeid@igalia.com>
+
+[ Upstream commit 2d965c1ae4135ed6f505661458f6dabd39488dac ]
+
+Otherwise tests compiled with only "-include nolibc.h" will fail with
+"error: unknown type name 'bool'", even though a stdbool.h is available
+from nolibc.
+
+Fixes: ae1f550efc11 ("tools/nolibc: add stdbool.h header")
+Fixes: f2662ec26b26 ("selftests: kselftest: Create ksft_print_dbg_msg()")
+Reported-by: Mark Brown <broonie@kernel.org>
+Closes: https://lore.kernel.org/lkml/833f5ae5-190e-47ec-9ad9-127ad166c80c@sirena.org.uk/
+Signed-off-by: André Almeida <andrealmeid@igalia.com>
+[Thomas: add Fixes tags and massage commit message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/nolibc.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h
+index c199ade200c24..d2f5aa085f8e3 100644
+--- a/tools/include/nolibc/nolibc.h
++++ b/tools/include/nolibc/nolibc.h
+@@ -116,6 +116,7 @@
+ #include "sched.h"
+ #include "signal.h"
+ #include "unistd.h"
++#include "stdbool.h"
+ #include "stdio.h"
+ #include "stdlib.h"
+ #include "string.h"
+--
+2.51.0
+
--- /dev/null
+From 4171938995d28a46c84233909984e984c66d0dc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:29:27 +0200
+Subject: tools/nolibc: avoid error in dup2() if old fd equals new fd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit d1ff0e2d13d6ac3a15be7870e15216726b0a809a ]
+
+dup2() allows both 'old' and 'new' to have the same value, which dup3()
+does not. If libc dup2() is implemented through the dup3() system call,
+then it would incorrectly fail in this case.
+
+Avoid the error by handling old == new explicitly.
+
+Fixes: 30ca20517ac1 ("tools headers: Move the nolibc header from rcutorture to tools/include/nolibc/")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Link: https://lore.kernel.org/r/20250820-nolibc-dup2-einval-v2-1-807185a45c56@linutronix.de
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/sys.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h
+index 295e71d34abad..90aadad31f6cb 100644
+--- a/tools/include/nolibc/sys.h
++++ b/tools/include/nolibc/sys.h
+@@ -238,6 +238,19 @@ static __attribute__((unused))
+ int sys_dup2(int old, int new)
+ {
+ #if defined(__NR_dup3)
++ int ret, nr_fcntl;
++
++#ifdef __NR_fcntl64
++ nr_fcntl = __NR_fcntl64;
++#else
++ nr_fcntl = __NR_fcntl;
++#endif
++
++ if (old == new) {
++ ret = my_syscall2(nr_fcntl, old, F_GETFD);
++ return ret < 0 ? ret : old;
++ }
++
+ return my_syscall3(__NR_dup3, old, new, 0);
+ #elif defined(__NR_dup2)
+ return my_syscall2(__NR_dup2, old, new);
+--
+2.51.0
+
--- /dev/null
+From 8fae2bf039e9ecce9580491eac7200caa836fa5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 10:00:31 +0200
+Subject: tools/nolibc: fix error return value of clock_nanosleep()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 1201f6fb5bfdbd10985ac3c8f49ef8f4f88b5c94 ]
+
+clock_nanosleep() returns a positive error value. Unlike other libc
+functions it *does not* return -1 nor set errno.
+
+Fix the return value and also adapt nanosleep().
+
+Fixes: 7c02bc4088af ("tools/nolibc: add support for clock_nanosleep() and nanosleep()")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Link: https://lore.kernel.org/r/20250731-nolibc-clock_nanosleep-ret-v1-1-9e4af7855e61@linutronix.de
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/time.h | 5 +++--
+ tools/testing/selftests/nolibc/nolibc-test.c | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/include/nolibc/time.h b/tools/include/nolibc/time.h
+index d02bc44d2643a..e9c1b976791a6 100644
+--- a/tools/include/nolibc/time.h
++++ b/tools/include/nolibc/time.h
+@@ -133,7 +133,8 @@ static __attribute__((unused))
+ int clock_nanosleep(clockid_t clockid, int flags, const struct timespec *rqtp,
+ struct timespec *rmtp)
+ {
+- return __sysret(sys_clock_nanosleep(clockid, flags, rqtp, rmtp));
++ /* Directly return a positive error number */
++ return -sys_clock_nanosleep(clockid, flags, rqtp, rmtp);
+ }
+
+ static __inline__
+@@ -145,7 +146,7 @@ double difftime(time_t time1, time_t time2)
+ static __inline__
+ int nanosleep(const struct timespec *rqtp, struct timespec *rmtp)
+ {
+- return clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp);
++ return __sysret(sys_clock_nanosleep(CLOCK_REALTIME, 0, rqtp, rmtp));
+ }
+
+
+diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
+index a297ee0d6d075..cc4d730ac4656 100644
+--- a/tools/testing/selftests/nolibc/nolibc-test.c
++++ b/tools/testing/selftests/nolibc/nolibc-test.c
+@@ -1334,6 +1334,7 @@ int run_syscall(int min, int max)
+ CASE_TEST(chroot_root); EXPECT_SYSZR(euid0, chroot("/")); break;
+ CASE_TEST(chroot_blah); EXPECT_SYSER(1, chroot("/proc/self/blah"), -1, ENOENT); break;
+ CASE_TEST(chroot_exe); EXPECT_SYSER(1, chroot(argv0), -1, ENOTDIR); break;
++ CASE_TEST(clock_nanosleep); ts.tv_nsec = -1; EXPECT_EQ(1, EINVAL, clock_nanosleep(CLOCK_REALTIME, 0, &ts, NULL)); break;
+ CASE_TEST(close_m1); EXPECT_SYSER(1, close(-1), -1, EBADF); break;
+ CASE_TEST(close_dup); EXPECT_SYSZR(1, close(dup(0))); break;
+ CASE_TEST(dup_0); tmp = dup(0); EXPECT_SYSNE(1, tmp, -1); close(tmp); break;
+--
+2.51.0
+
--- /dev/null
+From 2740f5c752e12161bcaf1619ff7aa61d1aaa0882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index ba950f0e73384..2c1ad23b9b5c1 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -29,6 +29,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From 98c1e291c33149eb804bb3002f3210b4d4173d96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 23:07:47 +0200
+Subject: tools: ynl: fix undefined variable name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit 7a3aaaa9fce710938c3557e5708ba5b00dd38226 ]
+
+This variable used in the error path was not defined according to Ruff.
+msg_format.attr_set is used instead, presumably the one that was
+supposed to be used originally.
+
+This is linked to Ruff error F821 [1]:
+
+ An undefined name is likely to raise NameError at runtime.
+
+Fixes: 1769e2be4baa ("tools/net/ynl: Add 'sub-message' attribute decoding to ynl")
+Link: https://docs.astral.sh/ruff/rules/undefined-name/ [1]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Reviewed-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+Link: https://patch.msgid.link/20250909-net-next-ynl-ruff-v1-1-238c2bccdd99@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/pyynl/lib/ynl.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/net/ynl/pyynl/lib/ynl.py b/tools/net/ynl/pyynl/lib/ynl.py
+index 8244a5f440b2b..15ddb0b1adb63 100644
+--- a/tools/net/ynl/pyynl/lib/ynl.py
++++ b/tools/net/ynl/pyynl/lib/ynl.py
+@@ -746,7 +746,7 @@ class YnlFamily(SpecFamily):
+ subdict = self._decode(NlAttrs(attr.raw, offset), msg_format.attr_set)
+ decoded.update(subdict)
+ else:
+- raise Exception(f"Unknown attribute-set '{attr_space}' when decoding '{attr_spec.name}'")
++ raise Exception(f"Unknown attribute-set '{msg_format.attr_set}' when decoding '{attr_spec.name}'")
+ return decoded
+
+ def _decode(self, attrs, space, outer_attrs = None):
+--
+2.51.0
+
--- /dev/null
+From 615505296e9950d13e7642f451a9a13a4541a65f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:26:56 +0300
+Subject: tty: n_gsm: Don't block input queue by waiting MSC
+
+From: Seppo Takalo <seppo.takalo@nordicsemi.no>
+
+[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
+
+Currently gsm_queue() processes incoming frames and when opening
+a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
+If basic mode is used it calls gsm_modem_upd_via_msc() and it
+cannot block the input queue by waiting the response to come
+into the same input queue.
+
+Instead allow sending Modem Status Command without waiting for remote
+end to respond. Define a new function gsm_modem_send_initial_msc()
+for this purpose. As MSC is only valid for basic encoding, it does
+not do anything for advanced or when convergence layer type 2 is used.
+
+Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
+Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
+Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 7fc535452c0b3..553d8c70352b1 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
+ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
+ static void gsmld_write_trigger(struct gsm_mux *gsm);
+ static void gsmld_write_task(struct work_struct *work);
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
+
+ /**
+ * gsm_fcs_add - update FCS
+@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
+ pr_debug("DLCI %d goes open.\n", dlci->addr);
+ /* Send current modem state */
+ if (dlci->addr) {
+- gsm_modem_update(dlci, 0);
++ gsm_modem_send_initial_msc(dlci);
+ } else {
+ /* Start keep-alive control */
+ gsm->ka_num = 0;
+@@ -4161,6 +4162,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
+ return gsm_control_wait(dlci->gsm, ctrl);
+ }
+
++/**
++ * gsm_modem_send_initial_msc - Send initial modem status message
++ *
++ * @dlci channel
++ *
++ * Send an initial MSC message after DLCI open to set the initial
++ * modem status lines. This is only done for basic mode.
++ * Does not wait for a response as we cannot block the input queue
++ * processing.
++ */
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
++{
++ u8 modembits[2];
++
++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
++ return 0;
++
++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
++}
++
+ /**
+ * gsm_modem_update - send modem status line state
+ * @dlci: channel
+--
+2.51.0
+
--- /dev/null
+From b71a1be3f684fa6fd44846c1d0680990fcba50a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 22:34:21 -0500
+Subject: uprobes: uprobe_warn should use passed task
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit ba1afc94deb849eab843a372b969444581add2c9 ]
+
+uprobe_warn() is passed a task structure, yet its using current. For
+the most part this shouldn't matter, but since a task structure is
+provided, lets use it.
+
+Fixes: 248d3a7b2f10 ("uprobes: Change uprobe_copy_process() to dup return_instances")
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 7ca1940607bd8..4b97d16f731c1 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -121,7 +121,7 @@ struct xol_area {
+
+ static void uprobe_warn(struct task_struct *t, const char *msg)
+ {
+- pr_warn("uprobe: %s:%d failed to %s\n", current->comm, current->pid, msg);
++ pr_warn("uprobe: %s:%d failed to %s\n", t->comm, t->pid, msg);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 8c90b6a87a7977b0a3cf1b61170b07b7dbe7d4ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index f94ea196ce547..6bcac85c55501 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From f937b36f9e6ab6ba2454c61a3be7598caa6fe0b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index dcf31a592f5d1..4b5f03f683f77 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From 9c7c274b608730429fcff6a88171198d85c1038d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:31:32 +0530
+Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
+
+From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+
+[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
+
+EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
+as read-only for operating system running at EL1, enforcing access
+restrictions that prohibit direct memory-mapped writes via writel().
+
+Attempts to write to this region from HLOS can result in silent failures
+or memory access violations, particularly when toggling EUD (Embedded
+USB Debugger) state. To ensure secure register access, modify the driver
+to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
+Secure Channel Monitor (SCM). SCM has the necessary permissions to access
+protected memory regions, enabling reliable control over EUD state.
+
+SC7280, the only user of EUD is also affected, indicating that this could
+never have worked on a properly fused device.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/Kconfig | 1 +
+ drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
+ 2 files changed, 25 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
+index 6497c4e81e951..9bf8fc6247bac 100644
+--- a/drivers/usb/misc/Kconfig
++++ b/drivers/usb/misc/Kconfig
+@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
+ config USB_QCOM_EUD
+ tristate "QCOM Embedded USB Debugger(EUD) Driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ select USB_ROLE_SWITCH
+ help
+ This module enables support for Qualcomm Technologies, Inc.
+diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
+index 83079c414b4f2..05c8bdc943a88 100644
+--- a/drivers/usb/misc/qcom_eud.c
++++ b/drivers/usb/misc/qcom_eud.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/sysfs.h>
+ #include <linux/usb/role.h>
++#include <linux/firmware/qcom/qcom_scm.h>
+
+ #define EUD_REG_INT1_EN_MASK 0x0024
+ #define EUD_REG_INT_STATUS_1 0x0044
+@@ -34,7 +35,7 @@ struct eud_chip {
+ struct device *dev;
+ struct usb_role_switch *role_sw;
+ void __iomem *base;
+- void __iomem *mode_mgr;
++ phys_addr_t mode_mgr;
+ unsigned int int_status;
+ int irq;
+ bool enabled;
+@@ -43,18 +44,29 @@ struct eud_chip {
+
+ static int enable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
++ if (ret)
++ return ret;
++
+ writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
+ writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
+ priv->base + EUD_REG_INT1_EN_MASK);
+- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+
+ return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
+ }
+
+-static void disable_eud(struct eud_chip *priv)
++static int disable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
++ if (ret)
++ return ret;
++
+ writel(0, priv->base + EUD_REG_CSR_EUD_EN);
+- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
++ return 0;
+ }
+
+ static ssize_t enable_show(struct device *dev,
+@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
+ chip->enabled = enable;
+ else
+ disable_eud(chip);
++
+ } else {
+- disable_eud(chip);
++ ret = disable_eud(chip);
+ }
+
+- return count;
++ return ret < 0 ? ret : count;
+ }
+
+ static DEVICE_ATTR_RW(enable);
+@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
+ static int eud_probe(struct platform_device *pdev)
+ {
+ struct eud_chip *chip;
++ struct resource *res;
+ int ret;
+
+ chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
+ if (IS_ERR(chip->base))
+ return PTR_ERR(chip->base);
+
+- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
+- if (IS_ERR(chip->mode_mgr))
+- return PTR_ERR(chip->mode_mgr);
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res)
++ return -ENODEV;
++ chip->mode_mgr = res->start;
+
+ chip->irq = platform_get_irq(pdev, 0);
+ if (chip->irq < 0)
+--
+2.51.0
+
--- /dev/null
+From 74ef4d653e3defdf367474bbe167120e67e0d0ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 49d79c1257f3a..8c09db750bfd6 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From baca44372d07b1562643b4c19dd0cde43287e2e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index e70fba9f55d6a..0d6c10a8490c0 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -765,6 +765,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -785,6 +796,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From 2a5b4bf663232e0ab91989bc13b6873476d92431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:41:10 +0200
+Subject: vdso: Add struct __kernel_old_timeval forward declaration to
+ gettime.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]
+
+The prototype of __vdso_gettimeofday() uses this struct. However
+gettime.h's own includes do not provide a definition for it.
+
+Add a forward declaration, similar to other used structs.
+
+Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250815-vdso-sparc64-generic-2-v2-1-b5ff80672347@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/vdso/gettime.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
+index c50d152e7b3e0..9ac161866653a 100644
+--- a/include/vdso/gettime.h
++++ b/include/vdso/gettime.h
+@@ -5,6 +5,7 @@
+ #include <linux/types.h>
+
+ struct __kernel_timespec;
++struct __kernel_old_timeval;
+ struct timezone;
+
+ #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
+--
+2.51.0
+
--- /dev/null
+From 2e51e8e8d4416730aae65b4e767c4aa72e84e002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 08:17:04 +0200
+Subject: vdso/datastore: Gate time data behind CONFIG_GENERIC_GETTIMEOFDAY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 7c0c01a216e6d9e1d169c0f6f3b5522e6da708ed ]
+
+When the generic vDSO does not provide time functions, as for example on
+riscv32, then the time data store is not necessary.
+
+Avoid allocating these time data pages when not used.
+
+Fixes: df7fcbefa710 ("vdso: Add generic time data storage")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250826-vdso-cleanups-v1-1-d9b65750e49f@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/vdso/datastore.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/vdso/datastore.c b/lib/vdso/datastore.c
+index 3693c6caf2c4d..a565c30c71a04 100644
+--- a/lib/vdso/datastore.c
++++ b/lib/vdso/datastore.c
+@@ -11,14 +11,14 @@
+ /*
+ * The vDSO data page.
+ */
+-#ifdef CONFIG_HAVE_GENERIC_VDSO
++#ifdef CONFIG_GENERIC_GETTIMEOFDAY
+ static union {
+ struct vdso_time_data data;
+ u8 page[PAGE_SIZE];
+ } vdso_time_data_store __page_aligned_data;
+ struct vdso_time_data *vdso_k_time_data = &vdso_time_data_store.data;
+ static_assert(sizeof(vdso_time_data_store) == PAGE_SIZE);
+-#endif /* CONFIG_HAVE_GENERIC_VDSO */
++#endif /* CONFIG_GENERIC_GETTIMEOFDAY */
+
+ #ifdef CONFIG_VDSO_GETRANDOM
+ static union {
+@@ -46,7 +46,7 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
+
+ switch (vmf->pgoff) {
+ case VDSO_TIME_PAGE_OFFSET:
+- if (!IS_ENABLED(CONFIG_HAVE_GENERIC_VDSO))
++ if (!IS_ENABLED(CONFIG_GENERIC_GETTIMEOFDAY))
+ return VM_FAULT_SIGBUS;
+ pfn = __phys_to_pfn(__pa_symbol(vdso_k_time_data));
+ if (timens_page) {
+--
+2.51.0
+
--- /dev/null
+From 0aba69f40748cfef03c123a1ef92516b7aa1b5f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:31:54 +0000
+Subject: vfio/pds: replace bitmap_free with vfree
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
+
+host_seq_bmp is allocated with vzalloc but is currently freed with
+bitmap_free, which uses kfree internally. This mismach prevents the
+resource from being released properly and may result in memory leaks
+or other issues.
+
+Fix this by freeing host_seq_bmp with vfree to match the vzalloc
+allocation.
+
+Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/pds/dirty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
+index c51f5e4c3dd6d..481992142f790 100644
+--- a/drivers/vfio/pci/pds/dirty.c
++++ b/drivers/vfio/pci/pds/dirty.c
+@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
+
+ host_ack_bmp = vzalloc(bytes);
+ if (!host_ack_bmp) {
+- bitmap_free(host_seq_bmp);
++ vfree(host_seq_bmp);
+ return -ENOMEM;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 77df13f4cc9b3efe12f1888121766c690873d636 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:04:08 -0400
+Subject: vhost: vringh: Fix copy_to_iter return value check
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
+
+The return value of copy_to_iter can't be negative, check whether the
+copied length is equal to the requested length instead of checking for
+negative values.
+
+Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 9f27c3f6091b8..1778eff7ab006 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1161,6 +1161,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
+ len - total_translated, &translated,
+@@ -1178,9 +1179,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_to_iter(src, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_to_iter(src, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From 8407c82ca1915ce46bce47f9bc19781187c705f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:17:38 +0800
+Subject: vhost: vringh: Modify the return value check
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
+
+The return value of copy_from_iter and copy_to_iter can't be negative,
+check whether the copied lengths are equal.
+
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Cc: "Stefano Garzarella" <sgarzare@redhat.com>
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 1778eff7ab006..925858cc60964 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1115,6 +1115,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
+ len - total_translated, &translated,
+@@ -1132,9 +1133,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_from_iter(dst, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_from_iter(dst, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From f0654bcd1e7ab9cbbb30b3fcb121702e10f7cbb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Aug 2025 07:48:17 -0700
+Subject: watchdog: intel_oc_wdt: Do not try to write into const memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit bdbb4a2d2aeae3d115bbdc402adac72aec071492 ]
+
+The code tries to update the intel_oc_wdt_info data structure if the
+watchdog is locked. That data structure is marked as const and can not
+be written into. Copy it into struct intel_oc_wdt and modify it there
+to fix the problem.
+
+Reported-by: Petar Kulić <cooleech@gmail.com>
+Cc: Diogo Ivo <diogo.ivo@siemens.com>
+Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Diogo Ivo <diogo.ivo@siemens.com>
+Tested-by: Diogo Ivo <diogo.ivo@siemens.com>
+Link: https://lore.kernel.org/linux-watchdog/20250818031838.3359-1-diogo.ivo@tecnico.ulisboa.pt/T/#t
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/intel_oc_wdt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/watchdog/intel_oc_wdt.c b/drivers/watchdog/intel_oc_wdt.c
+index 7c0551106981b..a39892c10770e 100644
+--- a/drivers/watchdog/intel_oc_wdt.c
++++ b/drivers/watchdog/intel_oc_wdt.c
+@@ -41,6 +41,7 @@
+ struct intel_oc_wdt {
+ struct watchdog_device wdd;
+ struct resource *ctrl_res;
++ struct watchdog_info info;
+ bool locked;
+ };
+
+@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_oc_wdt_ops = {
+
+ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ {
+- struct watchdog_info *info;
+ unsigned long val;
+
+ val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt));
+@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status);
+
+ if (oc_wdt->locked) {
+- info = (struct watchdog_info *)&intel_oc_wdt_info;
+ /*
+ * Set nowayout unconditionally as we cannot stop
+ * the watchdog.
+@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ * and inform the core we can't change it.
+ */
+ oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1;
+- info->options &= ~WDIOF_SETTIMEOUT;
++ oc_wdt->info.options &= ~WDIOF_SETTIMEOUT;
+
+ dev_info(oc_wdt->wdd.parent,
+ "Register access locked, heartbeat fixed at: %u s\n",
+@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct platform_device *pdev)
+ wdd->min_timeout = INTEL_OC_WDT_MIN_TOV;
+ wdd->max_timeout = INTEL_OC_WDT_MAX_TOV;
+ wdd->timeout = INTEL_OC_WDT_DEF_TOV;
+- wdd->info = &intel_oc_wdt_info;
++ oc_wdt->info = intel_oc_wdt_info;
++ wdd->info = &oc_wdt->info;
+ wdd->ops = &intel_oc_wdt_ops;
+ wdd->parent = dev;
+
+--
+2.51.0
+
--- /dev/null
+From 22819cdb5733a23a819d56b828da6048bc96bab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 867f9f3113797..a4b497ecfa205 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0d9ef5d994853286e8e11eeca8e62f9684ea948a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index cb8ae751eb312..e595b0979a56d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From ba0611c783161c608ebf8a1769d97f8c53fa98c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 00:36:51 +0530
+Subject: wifi: ath12k: Add fallback for invalid channel number in PHY metadata
+
+From: Sriram R <quic_srirrama@quicinc.com>
+
+[ Upstream commit 26f8fc0b24fd1a9dba1000bc9b5f2b199b7775a0 ]
+
+Currently, ath12k_dp_rx_h_ppdu() determines the band and frequency
+based on the channel number and center frequency from the RX descriptor's
+PHY metadata. However, in rare cases, it is observed that frequency
+retrieved from the metadata may be invalid or unexpected especially for
+6 GHz frames.
+This can result in a NULL sband, which prevents proper frequency assignment
+in rx_status and potentially leading to incorrect RX packet classification.
+
+To fix this potential issue, add a fallback mechanism that uses
+ar->rx_channel to populate the band and frequency when the derived
+sband is invalid or missing.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Co-developed-by: Vinith Kumar R <quic_vinithku@quicinc.com>
+Signed-off-by: Vinith Kumar R <quic_vinithku@quicinc.com>
+Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250723190651.699828-1-aishwarya.r@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_rx.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
+index 8ab91273592c8..adb0cfe109e67 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
+@@ -2533,6 +2533,8 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
+ channel_num = meta_data;
+ center_freq = meta_data >> 16;
+
++ rx_status->band = NUM_NL80211_BANDS;
++
+ if (center_freq >= ATH12K_MIN_6GHZ_FREQ &&
+ center_freq <= ATH12K_MAX_6GHZ_FREQ) {
+ rx_status->band = NL80211_BAND_6GHZ;
+@@ -2541,21 +2543,33 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct ath12k_dp_rx_info *rx_info)
+ rx_status->band = NL80211_BAND_2GHZ;
+ } else if (channel_num >= 36 && channel_num <= 173) {
+ rx_status->band = NL80211_BAND_5GHZ;
+- } else {
++ }
++
++ if (unlikely(rx_status->band == NUM_NL80211_BANDS ||
++ !ath12k_ar_to_hw(ar)->wiphy->bands[rx_status->band])) {
++ ath12k_warn(ar->ab, "sband is NULL for status band %d channel_num %d center_freq %d pdev_id %d\n",
++ rx_status->band, channel_num, center_freq, ar->pdev_idx);
++
+ spin_lock_bh(&ar->data_lock);
+ channel = ar->rx_channel;
+ if (channel) {
+ rx_status->band = channel->band;
+ channel_num =
+ ieee80211_frequency_to_channel(channel->center_freq);
++ rx_status->freq = ieee80211_channel_to_frequency(channel_num,
++ rx_status->band);
++ } else {
++ ath12k_err(ar->ab, "unable to determine channel, band for rx packet");
+ }
+ spin_unlock_bh(&ar->data_lock);
++ goto h_rate;
+ }
+
+ if (rx_status->band != NL80211_BAND_6GHZ)
+ rx_status->freq = ieee80211_channel_to_frequency(channel_num,
+ rx_status->band);
+
++h_rate:
+ ath12k_dp_rx_h_rate(ar, rx_info);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From cfa4efda944f8c07e0fc70673daf1fd63164ff60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:47:49 +0530
+Subject: wifi: ath12k: Fix flush cache failure during RX queue update
+
+From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+
+[ Upstream commit 5e32edc6942570429d9c64d0641fc2addbf92be1 ]
+
+Flush cache failures were observed after RX queue update for TID
+delete. This occurred because the queue was invalid during flush.
+Set the VLD bit in the RX queue update command for TID delete.
+This ensures the queue remains valid during the flush cache process.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250806111750.3214584-7-nithyanantham.paramasivam@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_rx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
+index 8c61c7f3bbdc9..9048818984f19 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
+@@ -781,6 +781,8 @@ static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
+ cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
+ cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
+ cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
++ /* Observed flush cache failure, to avoid that set vld bit during delete */
++ cmd.upd1 |= HAL_REO_CMD_UPD1_VLD;
+
+ return ath12k_dp_reo_cmd_send(ab, rx_tid,
+ HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
+--
+2.51.0
+
--- /dev/null
+From c90cd6d5213a6234769e6b829533d96830b5faad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 17:59:33 +0800
+Subject: wifi: ath12k: fix HAL_PHYRX_COMMON_USER_INFO handling in monitor mode
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit 6b46e85129185ec076f9c3bd2813dfd2f968522b ]
+
+Current monitor mode will parse TLV HAL_PHYRX_OTHER_RECEIVE_INFO with
+struct hal_phyrx_common_user_info.
+
+Obviously, they do not match. The original intention here was to parse
+HAL_PHYRX_COMMON_USER_INFO. So fix it by correctly parsing
+HAL_PHYRX_COMMON_USER_INFO instead.
+
+Also add LTF parsing and report to radiotap along with GI.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d939919a36f4 ("wifi: ath12k: Add HAL_PHYRX_OTHER_RECEIVE_INFO TLV parsing support")
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250722095934.67-3-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 35 ++++++++++++++++++++----
+ drivers/net/wireless/ath/ath12k/hal_rx.h | 3 +-
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index ec1587d0b917c..e93ede5e6197c 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -1440,6 +1440,34 @@ static void ath12k_dp_mon_parse_rx_msdu_end_err(u32 info, u32 *errmap)
+ *errmap |= HAL_RX_MPDU_ERR_MPDU_LEN;
+ }
+
++static void
++ath12k_parse_cmn_usr_info(const struct hal_phyrx_common_user_info *cmn_usr_info,
++ struct hal_rx_mon_ppdu_info *ppdu_info)
++{
++ struct hal_rx_radiotap_eht *eht = &ppdu_info->eht_info.eht;
++ u32 known, data, cp_setting, ltf_size;
++
++ known = __le32_to_cpu(eht->known);
++ known |= IEEE80211_RADIOTAP_EHT_KNOWN_GI |
++ IEEE80211_RADIOTAP_EHT_KNOWN_EHT_LTF;
++ eht->known = cpu_to_le32(known);
++
++ cp_setting = le32_get_bits(cmn_usr_info->info0,
++ HAL_RX_CMN_USR_INFO0_CP_SETTING);
++ ltf_size = le32_get_bits(cmn_usr_info->info0,
++ HAL_RX_CMN_USR_INFO0_LTF_SIZE);
++
++ data = __le32_to_cpu(eht->data[0]);
++ data |= u32_encode_bits(cp_setting, IEEE80211_RADIOTAP_EHT_DATA0_GI);
++ data |= u32_encode_bits(ltf_size, IEEE80211_RADIOTAP_EHT_DATA0_LTF);
++ eht->data[0] = cpu_to_le32(data);
++
++ if (!ppdu_info->ltf_size)
++ ppdu_info->ltf_size = ltf_size;
++ if (!ppdu_info->gi)
++ ppdu_info->gi = cp_setting;
++}
++
+ static void
+ ath12k_dp_mon_parse_status_msdu_end(struct ath12k_mon_data *pmon,
+ const struct hal_rx_msdu_end *msdu_end)
+@@ -1641,11 +1669,8 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
+ HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
+ break;
+ }
+- case HAL_PHYRX_OTHER_RECEIVE_INFO: {
+- const struct hal_phyrx_common_user_info *cmn_usr_info = tlv_data;
+-
+- ppdu_info->gi = le32_get_bits(cmn_usr_info->info0,
+- HAL_RX_PHY_CMN_USER_INFO0_GI);
++ case HAL_PHYRX_COMMON_USER_INFO: {
++ ath12k_parse_cmn_usr_info(tlv_data, ppdu_info);
+ break;
+ }
+ case HAL_RX_PPDU_START_USER_INFO:
+diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
+index a3ab588aae19d..801a5f6d3458b 100644
+--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
+@@ -695,7 +695,8 @@ struct hal_rx_resp_req_info {
+ #define HAL_RX_MPDU_ERR_MPDU_LEN BIT(6)
+ #define HAL_RX_MPDU_ERR_UNENCRYPTED_FRAME BIT(7)
+
+-#define HAL_RX_PHY_CMN_USER_INFO0_GI GENMASK(17, 16)
++#define HAL_RX_CMN_USR_INFO0_CP_SETTING GENMASK(17, 16)
++#define HAL_RX_CMN_USR_INFO0_LTF_SIZE GENMASK(19, 18)
+
+ struct hal_phyrx_common_user_info {
+ __le32 rsvd[2];
+--
+2.51.0
+
--- /dev/null
+From 6d1ffb39e0480d55f68a1365cd3a48122f9c0608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 11:03:11 +0800
+Subject: wifi: ath12k: fix overflow warning on num_pwr_levels
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit ea2b0af4c9e3f7187b5be4b7fc1511ea239046c0 ]
+
+In ath12k_mac_parse_tx_pwr_env(), for the non-PSD case num_pwr_levels is
+limited by ATH12K_NUM_PWR_LEVELS which is 16:
+
+ if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+ tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
+
+Then it is used to iterate entries in local_non_psd->power[] and
+reg_non_psd->power[]:
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_non_psd->power[i],
+ reg_non_psd->power[i]) / 2;
+
+Since the two array are of size 5, Smatch warns:
+
+drivers/net/wireless/ath/ath12k/mac.c:9812
+ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'local_non_psd->power' 5 <= 15
+drivers/net/wireless/ath/ath12k/mac.c:9812
+ath12k_mac_parse_tx_pwr_env() error: buffer overflow 'reg_non_psd->power' 5 <= 15
+
+This is a false positive as there is already implicit limitation:
+
+ tpc_info->num_pwr_levels = max(local_non_psd->count,
+ reg_non_psd->count);
+
+meaning it won't exceed 5.
+
+However, to make robot happy, add explicit limit there.
+
+Also add the same to the PSD case, although no warning due to
+ATH12K_NUM_PWR_LEVELS equals IEEE80211_TPE_PSD_ENTRIES_320MHZ.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
+
+Fixes: cccbb9d0dd6a ("wifi: ath12k: add parse of transmit power envelope element")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202505180703.Kr9OfQRP-lkp@intel.com/
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-2-56f1e54152ab@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 93a9c2bc3c596..2644b5d4b0bc8 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -11447,8 +11447,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
+
+ tpc_info->num_pwr_levels = max(local_psd->count,
+ reg_psd->count);
+- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
++ tpc_info->num_pwr_levels =
++ min3(tpc_info->num_pwr_levels,
++ IEEE80211_TPE_PSD_ENTRIES_320MHZ,
++ ATH12K_NUM_PWR_LEVELS);
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_psd->power[i],
+@@ -11463,8 +11465,10 @@ static void ath12k_mac_parse_tx_pwr_env(struct ath12k *ar,
+
+ tpc_info->num_pwr_levels = max(local_non_psd->count,
+ reg_non_psd->count);
+- if (tpc_info->num_pwr_levels > ATH12K_NUM_PWR_LEVELS)
+- tpc_info->num_pwr_levels = ATH12K_NUM_PWR_LEVELS;
++ tpc_info->num_pwr_levels =
++ min3(tpc_info->num_pwr_levels,
++ IEEE80211_TPE_EIRP_ENTRIES_320MHZ,
++ ATH12K_NUM_PWR_LEVELS);
+
+ for (i = 0; i < tpc_info->num_pwr_levels; i++) {
+ tpc_info->tpe[i] = min(local_non_psd->power[i],
+--
+2.51.0
+
--- /dev/null
+From d3c2ca64f94ef3f76255614fc199fa5a4ddcf061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 09:35:52 +0530
+Subject: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
+
+From: Hari Chandrakanthan <quic_haric@quicinc.com>
+
+[ Upstream commit 7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566 ]
+
+In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because
+rxcb->peer_id is not updated with a valid value. This is expected
+in monitor mode, where RX frames bypass the regular RX
+descriptor path that typically sets rxcb->peer_id.
+As a result, the peer is NULL, and link_id and link_valid fields
+in the RX status are not populated. This leads to a WARN_ON in
+mac80211 when it receives data frame from an associated station
+with invalid link_id.
+
+Fix this potential issue by using ppduinfo->peer_id, which holds
+the correct peer id for the received frame. This ensures that the
+peer is correctly found and the associated link metadata is updated
+accordingly.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: bd00cc7e8a4c ("wifi: ath12k: replace the usage of rx desc with rx_info")
+Signed-off-by: Hari Chandrakanthan <quic_haric@quicinc.com>
+Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250724040552.1170642-1-aishwarya.r@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index abd611ac37f06..009c495021489 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -2273,6 +2273,7 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
+
+ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *napi,
+ struct sk_buff *msdu,
++ const struct hal_rx_mon_ppdu_info *ppduinfo,
+ struct ieee80211_rx_status *status,
+ u8 decap)
+ {
+@@ -2286,7 +2287,6 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
+ struct ieee80211_sta *pubsta = NULL;
+ struct ath12k_peer *peer;
+ struct ath12k_skb_rxcb *rxcb = ATH12K_SKB_RXCB(msdu);
+- struct ath12k_dp_rx_info rx_info;
+ bool is_mcbc = rxcb->is_mcbc;
+ bool is_eapol_tkip = rxcb->is_eapol;
+
+@@ -2300,8 +2300,7 @@ static void ath12k_dp_mon_rx_deliver_msdu(struct ath12k *ar, struct napi_struct
+ }
+
+ spin_lock_bh(&ar->ab->base_lock);
+- rx_info.addr2_present = false;
+- peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu, &rx_info);
++ peer = ath12k_peer_find_by_id(ar->ab, ppduinfo->peer_id);
+ if (peer && peer->sta) {
+ pubsta = peer->sta;
+ if (pubsta->valid_links) {
+@@ -2394,7 +2393,7 @@ static int ath12k_dp_mon_rx_deliver(struct ath12k *ar,
+ decap = mon_mpdu->decap_format;
+
+ ath12k_dp_mon_update_radiotap(ar, ppduinfo, mon_skb, rxs);
+- ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, rxs, decap);
++ ath12k_dp_mon_rx_deliver_msdu(ar, napi, mon_skb, ppduinfo, rxs, decap);
+ mon_skb = skb_next;
+ } while (mon_skb);
+ rxs->flag = 0;
+--
+2.51.0
+
--- /dev/null
+From fa0dd31b48baecb7233e2211b3d95a641c3afed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 17:59:32 +0800
+Subject: wifi: ath12k: fix signal in radiotap for WCN7850
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit cf412ae7b7124e2b3bfe472616ec24b117b6008a ]
+
+Currently host will add ATH12K_DEFAULT_NOISE_FLOOR to rssi_comb to
+convert RSSI from dB to dBm.
+
+For WCN7850, this conversion is unnecessary because the RSSI value is
+already reported in dBm units.
+
+No longer convert for those firmware that already support dBM conversion.
+
+This patch won't affect QCN chips.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250722095934.67-2-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index 8189e52ed0071..ec1587d0b917c 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -2154,8 +2154,12 @@ static void ath12k_dp_mon_update_radiotap(struct ath12k *ar,
+ spin_unlock_bh(&ar->data_lock);
+
+ rxs->flag |= RX_FLAG_MACTIME_START;
+- rxs->signal = ppduinfo->rssi_comb + noise_floor;
+ rxs->nss = ppduinfo->nss + 1;
++ if (test_bit(WMI_TLV_SERVICE_HW_DB2DBM_CONVERSION_SUPPORT,
++ ar->ab->wmi_ab.svc_map))
++ rxs->signal = ppduinfo->rssi_comb;
++ else
++ rxs->signal = ppduinfo->rssi_comb + noise_floor;
+
+ if (ppduinfo->userstats[ppduinfo->userid].ampdu_present) {
+ rxs->flag |= RX_FLAG_AMPDU_DETAILS;
+--
+2.51.0
+
--- /dev/null
+From 91979bcf44ce092f0d4097ef179b75a07b3a5fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 17:59:34 +0800
+Subject: wifi: ath12k: fix the fetching of combined rssi
+
+From: Kang Yang <kang.yang@oss.qualcomm.com>
+
+[ Upstream commit 7695fa71c1d50a375e54426421acbc8d457bc5a3 ]
+
+Currently, host fetches combined rssi from rssi_comb in struct
+hal_rx_phyrx_rssi_legacy_info.
+
+rssi_comb is 8th to 15th bits of the second to last variable.
+rssi_comb_ppdu is the 0th to 7th of the last variable.
+
+When bandwidth = 20MHz, rssi_comb = rssi_comb_ppdu. But when bandwidth >
+20MHz, rssi_comb < rssi_comb_ppdu because rssi_comb only includes power
+of primary 20 MHz while rssi_comb_ppdu includes power of active
+RUs/subchannels. So should fetch combined rssi from rssi_comb_ppdu.
+
+Also related macro definitions are too long, rename them.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Kang Yang <kang.yang@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250722095934.67-4-kang.yang@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_mon.c | 8 ++++----
+ drivers/net/wireless/ath/ath12k/hal_rx.h | 9 +++++----
+ 2 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_mon.c b/drivers/net/wireless/ath/ath12k/dp_mon.c
+index e93ede5e6197c..abd611ac37f06 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_mon.c
++++ b/drivers/net/wireless/ath/ath12k/dp_mon.c
+@@ -1655,18 +1655,18 @@ ath12k_dp_mon_rx_parse_status_tlv(struct ath12k *ar,
+ const struct hal_rx_phyrx_rssi_legacy_info *rssi = tlv_data;
+
+ info[0] = __le32_to_cpu(rssi->info0);
+- info[1] = __le32_to_cpu(rssi->info1);
++ info[2] = __le32_to_cpu(rssi->info2);
+
+ /* TODO: Please note that the combined rssi will not be accurate
+ * in MU case. Rssi in MU needs to be retrieved from
+ * PHYRX_OTHER_RECEIVE_INFO TLV.
+ */
+ ppdu_info->rssi_comb =
+- u32_get_bits(info[1],
+- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB);
++ u32_get_bits(info[2],
++ HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU);
+
+ ppdu_info->bw = u32_get_bits(info[0],
+- HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW);
++ HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW);
+ break;
+ }
+ case HAL_PHYRX_COMMON_USER_INFO: {
+diff --git a/drivers/net/wireless/ath/ath12k/hal_rx.h b/drivers/net/wireless/ath/ath12k/hal_rx.h
+index 801a5f6d3458b..d1ad7747b82c4 100644
+--- a/drivers/net/wireless/ath/ath12k/hal_rx.h
++++ b/drivers/net/wireless/ath/ath12k/hal_rx.h
+@@ -483,15 +483,16 @@ enum hal_rx_ul_reception_type {
+ HAL_RECEPTION_TYPE_FRAMELESS
+ };
+
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
+-#define HAL_RX_PHYRX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RECEPTION GENMASK(3, 0)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO0_RX_BW GENMASK(7, 5)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO1_RSSI_COMB GENMASK(15, 8)
++#define HAL_RX_RSSI_LEGACY_INFO_INFO2_RSSI_COMB_PPDU GENMASK(7, 0)
+
+ struct hal_rx_phyrx_rssi_legacy_info {
+ __le32 info0;
+ __le32 rsvd0[39];
+ __le32 info1;
+- __le32 rsvd1;
++ __le32 info2;
+ } __packed;
+
+ #define HAL_RX_MPDU_START_INFO0_PPDU_ID GENMASK(31, 16)
+--
+2.51.0
+
--- /dev/null
+From 5a7b4641d751521e9e7d8ea02f0d713111986351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:44:57 +0800
+Subject: wifi: ath12k: fix wrong logging ID used for CE
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 43746f13fec67f6f223d64cfe96c095c9b468e70 ]
+
+ATH12K_DBG_AHB is used for CE logging which is not proper. Add
+ATH12K_DBG_CE and replace ATH12K_DBG_AHB with it.
+
+Compile tested only.
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250815-ath-dont-warn-on-ce-enqueue-fail-v1-2-f955ddc3ba7a@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/ce.c | 2 +-
+ drivers/net/wireless/ath/ath12k/debug.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c
+index f93a419abf65e..c5aadbc6367ce 100644
+--- a/drivers/net/wireless/ath/ath12k/ce.c
++++ b/drivers/net/wireless/ath/ath12k/ce.c
+@@ -478,7 +478,7 @@ static void ath12k_ce_recv_process_cb(struct ath12k_ce_pipe *pipe)
+ }
+
+ while ((skb = __skb_dequeue(&list))) {
+- ath12k_dbg(ab, ATH12K_DBG_AHB, "rx ce pipe %d len %d\n",
++ ath12k_dbg(ab, ATH12K_DBG_CE, "rx ce pipe %d len %d\n",
+ pipe->pipe_num, skb->len);
+ pipe->recv_cb(ab, skb);
+ }
+diff --git a/drivers/net/wireless/ath/ath12k/debug.h b/drivers/net/wireless/ath/ath12k/debug.h
+index 48916e4e1f601..bf254e43a68d0 100644
+--- a/drivers/net/wireless/ath/ath12k/debug.h
++++ b/drivers/net/wireless/ath/ath12k/debug.h
+@@ -26,6 +26,7 @@ enum ath12k_debug_mask {
+ ATH12K_DBG_DP_TX = 0x00002000,
+ ATH12K_DBG_DP_RX = 0x00004000,
+ ATH12K_DBG_WOW = 0x00008000,
++ ATH12K_DBG_CE = 0x00010000,
+ ATH12K_DBG_ANY = 0xffffffff,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e14cd5905ccaf3ef1956c40c89a7e7158cde54d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 11:03:10 +0800
+Subject: wifi: ath12k: initialize eirp_power before use
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit bba2f9faf41ee9607c78fcd669527b7654543cfe ]
+
+Currently, at the end of ath12k_mac_fill_reg_tpc_info(), the
+reg_tpc_info struct is populated, including the following:
+reg_tpc_info->is_psd_power = is_psd_power;
+reg_tpc_info->eirp_power = eirp_power;
+
+Kernel test robot complains on uninitialized symbol:
+drivers/net/wireless/ath/ath12k/mac.c:10069
+ath12k_mac_fill_reg_tpc_info() error: uninitialized symbol 'eirp_power'
+
+This is because there are some code paths that never set eirp_power, so
+the assignment of reg_tpc_info->eirp_power can come from an
+uninitialized variable. Functionally this is OK since the eirp_power
+only has meaning when is_psd_power is true, and all code paths which set
+is_psd_power to true also set eirp_power. However, to keep the robot
+happy, always initialize eirp_power before use.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
+
+Fixes: aeda163bb0c7 ("wifi: ath12k: fill parameters for vdev set TPC power WMI command")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202505180927.tbNWr3vE-lkp@intel.com/
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250804-ath12k-fix-smatch-warning-on-6g-vlp-v1-1-56f1e54152ab@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 3a3965b79942d..93a9c2bc3c596 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -11240,8 +11240,8 @@ void ath12k_mac_fill_reg_tpc_info(struct ath12k *ar,
+ struct ieee80211_channel *chan, *temp_chan;
+ u8 pwr_lvl_idx, num_pwr_levels, pwr_reduction;
+ bool is_psd_power = false, is_tpe_present = false;
+- s8 max_tx_power[ATH12K_NUM_PWR_LEVELS],
+- psd_power, tx_power, eirp_power;
++ s8 max_tx_power[ATH12K_NUM_PWR_LEVELS], psd_power, tx_power;
++ s8 eirp_power = 0;
+ struct ath12k_vif *ahvif = arvif->ahvif;
+ u16 start_freq, center_freq;
+ u8 reg_6ghz_power_mode;
+--
+2.51.0
+
--- /dev/null
+From ecadbccde8d6c8b28e3b12e13461f5d8a8d0997b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:47:45 +0530
+Subject: wifi: ath12k: Refactor RX TID deletion handling into helper function
+
+From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+
+[ Upstream commit 7c32476253f11210ac24c7818ca07e19bc032521 ]
+
+Refactor RX TID deletion handling by moving the REO command
+setup and send sequence into a new helper function:
+ath12k_dp_rx_tid_delete_handler().
+
+This improves code readability and modularity, and prepares
+the codebase for potential reuse of the REO command logic in
+other contexts where RX TID deletion is required.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250806111750.3214584-3-nithyanantham.paramasivam@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Stable-dep-of: 5e32edc69425 ("wifi: ath12k: Fix flush cache failure during RX queue update")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp_rx.c | 27 +++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
+index adb0cfe109e67..8c61c7f3bbdc9 100644
+--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
+@@ -21,6 +21,9 @@
+
+ #define ATH12K_DP_RX_FRAGMENT_TIMEOUT_MS (2 * HZ)
+
++static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
++ struct ath12k_dp_rx_tid *rx_tid);
++
+ static enum hal_encrypt_type ath12k_dp_rx_h_enctype(struct ath12k_base *ab,
+ struct hal_rx_desc *desc)
+ {
+@@ -769,6 +772,21 @@ static void ath12k_dp_rx_tid_del_func(struct ath12k_dp *dp, void *ctx,
+ rx_tid->qbuf.vaddr = NULL;
+ }
+
++static int ath12k_dp_rx_tid_delete_handler(struct ath12k_base *ab,
++ struct ath12k_dp_rx_tid *rx_tid)
++{
++ struct ath12k_hal_reo_cmd cmd = {};
++
++ cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
++ cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
++ cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
++ cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
++
++ return ath12k_dp_reo_cmd_send(ab, rx_tid,
++ HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
++ ath12k_dp_rx_tid_del_func);
++}
++
+ static void ath12k_peer_rx_tid_qref_setup(struct ath12k_base *ab, u16 peer_id, u16 tid,
+ dma_addr_t paddr)
+ {
+@@ -828,20 +846,13 @@ static void ath12k_peer_rx_tid_qref_reset(struct ath12k_base *ab, u16 peer_id, u
+ void ath12k_dp_rx_peer_tid_delete(struct ath12k *ar,
+ struct ath12k_peer *peer, u8 tid)
+ {
+- struct ath12k_hal_reo_cmd cmd = {};
+ struct ath12k_dp_rx_tid *rx_tid = &peer->rx_tid[tid];
+ int ret;
+
+ if (!rx_tid->active)
+ return;
+
+- cmd.flag = HAL_REO_CMD_FLG_NEED_STATUS;
+- cmd.addr_lo = lower_32_bits(rx_tid->qbuf.paddr_aligned);
+- cmd.addr_hi = upper_32_bits(rx_tid->qbuf.paddr_aligned);
+- cmd.upd0 = HAL_REO_CMD_UPD0_VLD;
+- ret = ath12k_dp_reo_cmd_send(ar->ab, rx_tid,
+- HAL_REO_CMD_UPDATE_RX_QUEUE, &cmd,
+- ath12k_dp_rx_tid_del_func);
++ ret = ath12k_dp_rx_tid_delete_handler(ar->ab, rx_tid);
+ if (ret) {
+ ath12k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
+ tid, ret);
+--
+2.51.0
+
--- /dev/null
+From 39f956e76bbf8b36b555bbf311cf7d0974f3d15f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:41:36 +0530
+Subject: wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress
+ (CYW)
+
+From: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
+
+[ Upstream commit 74e2ef72bd4b25ce21c8f309d4f5b91b5df9ff5b ]
+
+Cypress(Infineon) is not the vendor for this 43752 SDIO WLAN chip, and so
+has not officially released any firmware binary for it. It is incorrect to
+maintain this WLAN chip with firmware vendor ID as "CYW". So relabel the
+chip's firmware Vendor ID as "WCC" as suggested by the maintainer.
+
+Fixes: d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization")
+Fixes: f74f1ec22dc2 ("wifi: brcmfmac: add support for Cypress firmware api")
+Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Link: https://patch.msgid.link/20250724101136.6691-1-gokulkumar.sivakumar@infineon.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 4 ++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 8 ++++----
+ .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 -
+ include/linux/mmc/sdio_ids.h | 2 +-
+ 5 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index 8ab7d1e34a6e1..6a3f187320fc4 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -997,9 +997,9 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356, WCC),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4359, WCC),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43751, WCC),
++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43752, WCC),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373, CYW),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012, CYW),
+- BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752, CYW),
+ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_89359, CYW),
+ CYW_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439, CYW),
+ { /* end: all zeroes */ }
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+index 9074ab49e8068..4239f2b21e542 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -738,8 +738,8 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci)
+ case BRCM_CC_4364_CHIP_ID:
+ case CY_CC_4373_CHIP_ID:
+ return 0x160000;
+- case CY_CC_43752_CHIP_ID:
+ case BRCM_CC_43751_CHIP_ID:
++ case BRCM_CC_43752_CHIP_ID:
+ case BRCM_CC_4377_CHIP_ID:
+ return 0x170000;
+ case BRCM_CC_4378_CHIP_ID:
+@@ -1452,7 +1452,7 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub)
+ return (reg & CC_SR_CTL0_ENABLE_MASK) != 0;
+ case BRCM_CC_4359_CHIP_ID:
+ case BRCM_CC_43751_CHIP_ID:
+- case CY_CC_43752_CHIP_ID:
++ case BRCM_CC_43752_CHIP_ID:
+ case CY_CC_43012_CHIP_ID:
+ addr = CORE_CC_REG(pmu->base, retention_ctl);
+ reg = chip->ops->read32(chip->ctx, addr);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 8a0bad5119a0d..8cf9d7e7c3f70 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -655,10 +655,10 @@ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
+ BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359),
+ BRCMF_FW_ENTRY(BRCM_CC_43751_CHIP_ID, 0xFFFFFFFF, 43752),
++ BRCMF_FW_ENTRY(BRCM_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752),
+ BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
+ BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012),
+ BRCMF_FW_ENTRY(CY_CC_43439_CHIP_ID, 0xFFFFFFFF, 43439),
+- BRCMF_FW_ENTRY(CY_CC_43752_CHIP_ID, 0xFFFFFFFF, 43752)
+ };
+
+ #define TXCTL_CREDITS 2
+@@ -3426,8 +3426,8 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
+ static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
+ {
+ if (bus->ci->chip == BRCM_CC_43751_CHIP_ID ||
+- bus->ci->chip == CY_CC_43012_CHIP_ID ||
+- bus->ci->chip == CY_CC_43752_CHIP_ID)
++ bus->ci->chip == BRCM_CC_43752_CHIP_ID ||
++ bus->ci->chip == CY_CC_43012_CHIP_ID)
+ return true;
+ else
+ return false;
+@@ -4278,8 +4278,8 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+
+ switch (sdiod->func1->device) {
+ case SDIO_DEVICE_ID_BROADCOM_43751:
++ case SDIO_DEVICE_ID_BROADCOM_43752:
+ case SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373:
+- case SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752:
+ brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
+ CY_4373_F2_WATERMARK);
+ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+index b39c5c1ee18b6..df3b67ba4db29 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -60,7 +60,6 @@
+ #define CY_CC_4373_CHIP_ID 0x4373
+ #define CY_CC_43012_CHIP_ID 43012
+ #define CY_CC_43439_CHIP_ID 43439
+-#define CY_CC_43752_CHIP_ID 43752
+
+ /* USB Device IDs */
+ #define BRCM_USB_43143_DEVICE_ID 0xbd1e
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index fe3d6d98f8da4..673cbdf434533 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -77,7 +77,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_43439 0xa9af
+ #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf
+ #define SDIO_DEVICE_ID_BROADCOM_43751 0xaae7
+-#define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752 0xaae8
++#define SDIO_DEVICE_ID_BROADCOM_43752 0xaae8
+
+ #define SDIO_VENDOR_ID_CYPRESS 0x04b4
+ #define SDIO_DEVICE_ID_BROADCOM_CYPRESS_43439 0xbd3d
+--
+2.51.0
+
--- /dev/null
+From b4f13508f663a50ce1dfb198b4bb24b27ba4e8a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 22:19:08 +0000
+Subject: wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid()
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit 17f34ab55a8518ecbd5dcacec48e6ee903f7c1d0 ]
+
+The original code used nl80211_chan_width_to_mhz(), which returns the width in MHz.
+However, the expected unit is KHz.
+
+Fixes: 510dba80ed66 ("wifi: cfg80211: add helper for checking if a chandef is valid on a radio")
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Link: https://patch.msgid.link/df54294e6c4ed0f3ceff6e818b710478ddfc62c0.1758579480.git.Ryder%20Lee%20ryder.lee@mediatek.com/
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 240c68baa3d1f..341dbf642181b 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -2992,7 +2992,7 @@ bool cfg80211_radio_chandef_valid(const struct wiphy_radio *radio,
+ u32 freq, width;
+
+ freq = ieee80211_chandef_to_khz(chandef);
+- width = cfg80211_chandef_get_width(chandef);
++ width = MHZ_TO_KHZ(cfg80211_chandef_get_width(chandef));
+ if (!ieee80211_radio_freq_range_valid(radio, freq, width))
+ return false;
+
+--
+2.51.0
+
--- /dev/null
+From d99de23938fc5dcedeeba47fc418da5682938c3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:11:51 +0800
+Subject: wifi: iwlwifi: Remove redundant header files
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]
+
+The header file "fw/img.h" is already included on line 9. Remove the
+redundant include.
+
+Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+index a07c512b6ed43..735482e7adf56 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+@@ -12,7 +12,6 @@
+ #include "fw/api/phy.h"
+ #include "fw/api/config.h"
+ #include "fw/api/nvm-reg.h"
+-#include "fw/img.h"
+ #include "iwl-trans.h"
+
+ #define BIOS_SAR_MAX_PROFILE_NUM 4
+--
+2.51.0
+
--- /dev/null
+From a53ee089764e616dd55c8f022e123b74e8353b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 12:53:30 +0530
+Subject: wifi: mac80211: consider links for validating SCAN_FLAG_AP in scan
+ request during MLO
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 36b75dcb1e25739a3a0975699208c98f4b55d012 ]
+
+Commit 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request
+during MLO") introduced a check that rejects scan requests if any link is
+already beaconing. This works fine when all links share the same radio, but
+breaks down in multi-radio setups.
+
+Consider a scenario where a 2.4 GHz link is beaconing and a scan is
+requested on a 5 GHz link, each backed by a different physical radio. The
+current logic still blocks the scan, even though it should be allowed. As a
+result, interface bring-up fails unnecessarily in valid configurations.
+
+Fix this by checking whether the scan is being requested on the same
+underlying radio as the beaconing link. Only reject the scan if it targets
+a link that is already beaconing and the NL80211_FEATURE_AP_SCAN is not
+set. This ensures correct behavior in multi-radio environments and avoids
+false rejections.
+
+Fixes: 78a7a126dc5b ("wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO")
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250812-fix_scan_ap_flag_requirement_during_mlo-v4-3-383ffb6da213@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 2ed07fa121ab7..7609c7c31df74 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -3001,6 +3001,9 @@ static int ieee80211_scan(struct wiphy *wiphy,
+ struct cfg80211_scan_request *req)
+ {
+ struct ieee80211_sub_if_data *sdata;
++ struct ieee80211_link_data *link;
++ struct ieee80211_channel *chan;
++ int radio_idx;
+
+ sdata = IEEE80211_WDEV_TO_SUB_IF(req->wdev);
+
+@@ -3028,10 +3031,20 @@ static int ieee80211_scan(struct wiphy *wiphy,
+ * the frames sent while scanning on other channel will be
+ * lost)
+ */
+- if (ieee80211_num_beaconing_links(sdata) &&
+- (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+- !(req->flags & NL80211_SCAN_FLAG_AP)))
+- return -EOPNOTSUPP;
++ for_each_link_data(sdata, link) {
++ /* if the link is not beaconing, ignore it */
++ if (!sdata_dereference(link->u.ap.beacon, sdata))
++ continue;
++
++ chan = link->conf->chanreq.oper.chan;
++ radio_idx = cfg80211_get_radio_idx_by_chan(wiphy, chan);
++
++ if (ieee80211_is_radio_idx_in_scan_req(wiphy, req,
++ radio_idx) &&
++ (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
++ !(req->flags & NL80211_SCAN_FLAG_AP)))
++ return -EOPNOTSUPP;
++ }
+ break;
+ case NL80211_IFTYPE_NAN:
+ default:
+--
+2.51.0
+
--- /dev/null
+From c6e82de6495c396420c0599bbfb1d5bf856aa74b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 16:10:54 +0530
+Subject: wifi: mac80211: fix reporting of all valid links in sta_set_sinfo()
+
+From: Sarika Sharma <quic_sarishar@quicinc.com>
+
+[ Upstream commit eebccbfea4184feb758c104783b870ec4ddb6aec ]
+
+Currently, sta_set_sinfo() fails to populate link-level station info
+when sinfo->valid_links is initially 0 and sta->sta.valid_links has
+bits set for links other than link 0. This typically occurs when
+association happens on a non-zero link or link 0 deleted dynamically.
+In such cases, the for_each_valid_link(sinfo, link_id) loop only
+executes for link 0 and terminates early, since sinfo->valid_links
+remains 0. As a result, only MLD-level information is reported to
+userspace.
+
+Hence to fix, initialize sinfo->valid_links with sta->sta.valid_links
+before entering the loop to ensure loop executes for each valid link.
+During iteration, mask out invalid links from sinfo->valid_links if
+any of sta->link[link_id], sdata->link[link_id], or sinfo->links[link_id]
+are not present, to report only valid link information.
+
+Fixes: 505991fba9ec ("wifi: mac80211: extend support to fill link level sinfo structure")
+Signed-off-by: Sarika Sharma <quic_sarishar@quicinc.com>
+Link: https://patch.msgid.link/20250904104054.790321-1-quic_sarishar@quicinc.com
+[clarify comment]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 8c550aab9bdce..ebcec5241a944 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -3206,16 +3206,20 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
+ struct link_sta_info *link_sta;
+
+ ether_addr_copy(sinfo->mld_addr, sta->addr);
++
++ /* assign valid links first for iteration */
++ sinfo->valid_links = sta->sta.valid_links;
++
+ for_each_valid_link(sinfo, link_id) {
+ link_sta = wiphy_dereference(sta->local->hw.wiphy,
+ sta->link[link_id]);
+ link = wiphy_dereference(sdata->local->hw.wiphy,
+ sdata->link[link_id]);
+
+- if (!link_sta || !sinfo->links[link_id] || !link)
++ if (!link_sta || !sinfo->links[link_id] || !link) {
++ sinfo->valid_links &= ~BIT(link_id);
+ continue;
+-
+- sinfo->valid_links = sta->sta.valid_links;
++ }
+ sta_set_link_sinfo(sta, sinfo->links[link_id],
+ link, tidstats);
+ }
+--
+2.51.0
+
--- /dev/null
+From 243bdb06e94d3a9299b021dc1981db224200723a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 12:42:03 +0530
+Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
+ available
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
+
+In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
+information, an attempt is made to find the station using the address 2
+(source address) field in the header. Since pubsta is missing, link
+information such as link_valid and link_id is also unavailable. Now if such
+a situation comes, and if a matching ML station entry is found based on
+the source address, currently the packet is dropped due to missing link ID
+in the status field which is not correct.
+
+Hence, to fix this issue, if link_valid is not set and the station is an
+ML station, make an attempt to find a link station entry using the source
+address. If a valid link station is found, derive the link ID and proceed
+with packet processing. Otherwise, drop the packet as per the existing
+flow.
+
+Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
+Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 4d4ff4d4917a2..59baca24aa6b9 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5230,12 +5230,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ continue;
++
++ link_id = link_sta->link_id;
++ }
++
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
+- continue;
+-
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+
+ prev_sta = sta;
+@@ -5243,10 +5251,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+- goto out;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ goto out;
++
++ link_id = link_sta->link_id;
++ }
++
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+--
+2.51.0
+
--- /dev/null
+From 8658ca1e58c7adff042e2377fa4e920936a76e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 13:54:31 +0200
+Subject: wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit ac36daa83650c26fd55dee1a6ee5144769239911 ]
+
+Since commit '1bc892d76a6f ("wifi: mac80211: extend connection
+monitoring for MLO")' mac80211 supports connection monitor for MLO
+client interfaces. Remove the CONNECTION_MONITOR requirement in
+ieee80211_register_hw routine.
+
+Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250826-remove-conn-mon-check-ieee80211_register_hw-v2-1-5a1e2f038245@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 3ae6104e5cb20..78f862f79aa82 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1164,9 +1164,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE)))
+ return -EINVAL;
+
+- if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR)))
+- return -EINVAL;
+-
+ if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC)))
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From f8e8bcf81304e10315c5e44a85db1ce9edddb866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index 08590aa68356f..1dd3723720480 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 92a98fa23d446430de51f08b60fa48115497237d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 14:48:24 +0800
+Subject: wifi: mt76: mt7915: fix mt7981 pre-calibration
+
+From: Zhi-Jun You <hujy652@gmail.com>
+
+[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]
+
+In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
+although the chip doesn't support it.
+
+mt76 doesn't take this into account which results in reading from the
+incorrect offset.
+
+For devices with precal, this would lead to lower bitrate.
+
+Fix this by aligning groupcal size with vendor driver and switch to
+freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.
+
+Below are iwinfo of the test device with two clients connected
+(iPhone 16, Intel AX210).
+Before :
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 612.4 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+After:
+ Mode: Master Channel: 36 (5.180 GHz) HT Mode: HE80
+ Center Channel 1: 42 2: unknown
+ Tx-Power: 23 dBm Link Quality: 43/70
+ Signal: -67 dBm Noise: -92 dBm
+ Bit Rate: 900.6 MBit/s
+ Encryption: WPA3 SAE (CCMP)
+ Type: nl80211 HW Mode(s): 802.11ac/ax/n
+ Hardware: embedded [MediaTek MT7981]
+
+Tested-on: mt7981 20240823
+
+Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
+Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
+Link: https://patch.msgid.link/20250909064824.16847-1-hujy652@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt7915/eeprom.h | 6 ++--
+ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 29 +++++--------------
+ 2 files changed, 10 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+index 31aec0f40232a..73611c9d26e15 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
+ #define MT_EE_CAL_GROUP_SIZE_7975 (54 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7976 (94 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_GROUP_SIZE_7916_6G (94 * MT_EE_CAL_UNIT + 16)
++#define MT_EE_CAL_GROUP_SIZE_7981 (144 * MT_EE_CAL_UNIT + 16)
+ #define MT_EE_CAL_DPD_SIZE_V1 (54 * MT_EE_CAL_UNIT)
+ #define MT_EE_CAL_DPD_SIZE_V2 (300 * MT_EE_CAL_UNIT)
+-#define MT_EE_CAL_DPD_SIZE_V2_7981 (102 * MT_EE_CAL_UNIT) /* no 6g dpd data */
+
+ #define MT_EE_WIFI_CONF0_TX_PATH GENMASK(2, 0)
+ #define MT_EE_WIFI_CONF0_RX_PATH GENMASK(5, 3)
+@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
+ val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
+ return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
+ MT_EE_CAL_GROUP_SIZE_7916;
++ } else if (is_mt7981(&dev->mt76)) {
++ return MT_EE_CAL_GROUP_SIZE_7981;
+ } else if (mt7915_check_adie(dev, false)) {
+ return MT_EE_CAL_GROUP_SIZE_7976;
+ } else {
+@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
+ {
+ if (is_mt7915(&dev->mt76))
+ return MT_EE_CAL_DPD_SIZE_V1;
+- else if (is_mt7981(&dev->mt76))
+- return MT_EE_CAL_DPD_SIZE_V2_7981;
+ else
+ return MT_EE_CAL_DPD_SIZE_V2;
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+index 2928e75b23976..c1fdd3c4f1ba6 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+@@ -3052,30 +3052,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
+ /* 5G BW160 */
+ 5250, 5570, 5815
+ };
+- static const u16 freq_list_v2_7981[] = {
+- /* 5G BW20 */
+- 5180, 5200, 5220, 5240,
+- 5260, 5280, 5300, 5320,
+- 5500, 5520, 5540, 5560,
+- 5580, 5600, 5620, 5640,
+- 5660, 5680, 5700, 5720,
+- 5745, 5765, 5785, 5805,
+- 5825, 5845, 5865, 5885,
+- /* 5G BW160 */
+- 5250, 5570, 5815
+- };
+- const u16 *freq_list = freq_list_v1;
+- int n_freqs = ARRAY_SIZE(freq_list_v1);
+- int idx;
++ const u16 *freq_list;
++ int idx, n_freqs;
+
+ if (!is_mt7915(&dev->mt76)) {
+- if (is_mt7981(&dev->mt76)) {
+- freq_list = freq_list_v2_7981;
+- n_freqs = ARRAY_SIZE(freq_list_v2_7981);
+- } else {
+- freq_list = freq_list_v2;
+- n_freqs = ARRAY_SIZE(freq_list_v2);
+- }
++ freq_list = freq_list_v2;
++ n_freqs = ARRAY_SIZE(freq_list_v2);
++ } else {
++ freq_list = freq_list_v1;
++ n_freqs = ARRAY_SIZE(freq_list_v1);
+ }
+
+ if (freq < 4000) {
+--
+2.51.0
+
--- /dev/null
+From 1acf47c480af2b84de74935aef6162091fe22898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 00:26:47 +0200
+Subject: wifi: mt76: mt7996: Check phy before init msta_link in
+ mt7996_mac_sta_add_links()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fe5fffadc6c77c56f122cf1042dc830f59e904bf ]
+
+In order to avoid a possible NULL pointer dereference in
+mt7996_mac_sta_init_link routine, move the phy pointer check before
+running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine.
+
+Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250830-mt7996_mac_sta_add_links-fix-v1-1-4219fb8755ee@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/main.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 81391db535866..d01b5778da20e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -1080,16 +1080,17 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
+ goto error_unlink;
+ }
+
+- err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
+- link_id);
+- if (err)
+- goto error_unlink;
+-
+ mphy = mt76_vif_link_phy(&link->mt76);
+ if (!mphy) {
+ err = -EINVAL;
+ goto error_unlink;
+ }
++
++ err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
++ link_id);
++ if (err)
++ goto error_unlink;
++
+ mphy->num_sta++;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a0ddb8ae098640575e099aff597cbba99ec8a90b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:19 +0200
+Subject: wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]
+
+Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
+break endianness
+
+Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-11-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 8 +++++---
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index be729db5b75c1..84015ab24af62 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
+ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
+ u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
+ struct mt7996_wed_rro_addr *addr;
+@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+
+ addr = dev->wed_rro.addr_elem[i].ptr;
+ for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
+ dev->wed_rro.session.ptr = ptr;
+ addr = dev->wed_rro.session.ptr;
+ for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
+- addr->signature = 0xff;
++ addr->data = cpu_to_le32(val);
+ addr++;
+ }
+
+@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
+ static void mt7996_wed_rro_work(struct work_struct *work)
+ {
+ #ifdef CONFIG_NET_MEDIATEK_SOC_WED
++ u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
+ struct mt7996_dev *dev;
+ LIST_HEAD(list);
+
+@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
+ MT7996_RRO_WINDOW_MAX_LEN;
+ reset:
+ elem = ptr + elem_id * sizeof(*elem);
+- elem->signature = 0xff;
++ elem->data |= cpu_to_le32(val);
+ }
+ mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
+ out:
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index b98cfe6e5be8c..048d9a9898c6e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -277,13 +277,12 @@ struct mt7996_hif {
+ int irq;
+ };
+
++#define WED_RRO_ADDR_SIGNATURE_MASK GENMASK(31, 24)
++#define WED_RRO_ADDR_COUNT_MASK GENMASK(14, 4)
++#define WED_RRO_ADDR_HEAD_HIGH_MASK GENMASK(3, 0)
+ struct mt7996_wed_rro_addr {
+- u32 head_low;
+- u32 head_high : 4;
+- u32 count: 11;
+- u32 oor: 1;
+- u32 rsv : 8;
+- u32 signature : 8;
++ __le32 head_low;
++ __le32 data;
+ };
+
+ struct mt7996_wed_rro_session_id {
+--
+2.51.0
+
--- /dev/null
+From 88a893e082220ada42c6d9c09c5972e781d75fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 10:26:19 +0200
+Subject: wifi: mt76: mt7996: Fix mt7996_mcu_bss_mld_tlv routine
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit ed01c310eca96453c11b59db46c855aa593cffdd ]
+
+Update mt7996_mcu_bss_mld_tlv routine to properly support MLO
+configuring the BSS.
+
+Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250710-mt7996-mlo-fixes-v3-v1-1-e7595b089f2c@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/main.c | 46 ++++++++++++++++++-
+ .../net/wireless/mediatek/mt76/mt7996/mcu.c | 26 ++++++++---
+ .../net/wireless/mediatek/mt76/mt7996/mcu.h | 3 +-
+ .../wireless/mediatek/mt76/mt7996/mt7996.h | 8 ++++
+ 4 files changed, 75 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 8a8a478391646..3c34a4980afa0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -138,6 +138,28 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask)
+ return -1;
+ }
+
++static int get_own_mld_idx(u64 mask, bool group_mld)
++{
++ u8 start = group_mld ? 0 : 16;
++ u8 end = group_mld ? 15 : 63;
++ int idx;
++
++ idx = get_free_idx(mask, start, end);
++ if (idx)
++ return idx - 1;
++
++ /* If the 16-63 range is not available, perform another lookup in the
++ * range 0-15
++ */
++ if (!group_mld) {
++ idx = get_free_idx(mask, 0, 15);
++ if (idx)
++ return idx - 1;
++ }
++
++ return -EINVAL;
++}
++
+ static void
+ mt7996_init_bitrate_mask(struct ieee80211_vif *vif, struct mt7996_vif_link *mlink)
+ {
+@@ -279,7 +301,7 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ struct mt7996_dev *dev = phy->dev;
+ u8 band_idx = phy->mt76->band_idx;
+ struct mt76_txq *mtxq;
+- int idx, ret;
++ int mld_idx, idx, ret;
+
+ mlink->idx = __ffs64(~dev->mt76.vif_mask);
+ if (mlink->idx >= mt7996_max_interface_num(dev))
+@@ -289,6 +311,17 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ if (idx < 0)
+ return -ENOSPC;
+
++ if (!dev->mld_idx_mask) { /* first link in the group */
++ mvif->mld_group_idx = get_own_mld_idx(dev->mld_idx_mask, true);
++ mvif->mld_remap_idx = get_free_idx(dev->mld_remap_idx_mask,
++ 0, 15);
++ }
++
++ mld_idx = get_own_mld_idx(dev->mld_idx_mask, false);
++ if (mld_idx < 0)
++ return -ENOSPC;
++
++ link->mld_idx = mld_idx;
+ link->phy = phy;
+ mlink->omac_idx = idx;
+ mlink->band_idx = band_idx;
+@@ -301,6 +334,11 @@ int mt7996_vif_link_add(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ return ret;
+
+ dev->mt76.vif_mask |= BIT_ULL(mlink->idx);
++ if (!dev->mld_idx_mask) {
++ dev->mld_idx_mask |= BIT_ULL(mvif->mld_group_idx);
++ dev->mld_remap_idx_mask |= BIT_ULL(mvif->mld_remap_idx);
++ }
++ dev->mld_idx_mask |= BIT_ULL(link->mld_idx);
+ phy->omac_mask |= BIT_ULL(mlink->omac_idx);
+
+ idx = MT7996_WTBL_RESERVED - mlink->idx;
+@@ -380,7 +418,13 @@ void mt7996_vif_link_remove(struct mt76_phy *mphy, struct ieee80211_vif *vif,
+ }
+
+ dev->mt76.vif_mask &= ~BIT_ULL(mlink->idx);
++ dev->mld_idx_mask &= ~BIT_ULL(link->mld_idx);
+ phy->omac_mask &= ~BIT_ULL(mlink->omac_idx);
++ if (!(dev->mld_idx_mask & ~BIT_ULL(mvif->mld_group_idx))) {
++ /* last link */
++ dev->mld_idx_mask &= ~BIT_ULL(mvif->mld_group_idx);
++ dev->mld_remap_idx_mask &= ~BIT_ULL(mvif->mld_remap_idx);
++ }
+
+ spin_lock_bh(&dev->mt76.sta_poll_lock);
+ if (!list_empty(&msta_link->wcid.poll_list))
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index e6db3e0b2ffda..aad58f7831c7b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -899,17 +899,28 @@ mt7996_mcu_bss_txcmd_tlv(struct sk_buff *skb, bool en)
+ }
+
+ static void
+-mt7996_mcu_bss_mld_tlv(struct sk_buff *skb, struct mt76_vif_link *mlink)
++mt7996_mcu_bss_mld_tlv(struct sk_buff *skb,
++ struct ieee80211_bss_conf *link_conf,
++ struct mt7996_vif_link *link)
+ {
++ struct ieee80211_vif *vif = link_conf->vif;
++ struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ struct bss_mld_tlv *mld;
+ struct tlv *tlv;
+
+ tlv = mt7996_mcu_add_uni_tlv(skb, UNI_BSS_INFO_MLD, sizeof(*mld));
+-
+ mld = (struct bss_mld_tlv *)tlv;
+- mld->group_mld_id = 0xff;
+- mld->own_mld_id = mlink->idx;
+- mld->remap_idx = 0xff;
++ mld->own_mld_id = link->mld_idx;
++ mld->link_id = link_conf->link_id;
++
++ if (ieee80211_vif_is_mld(vif)) {
++ mld->group_mld_id = mvif->mld_group_idx;
++ mld->remap_idx = mvif->mld_remap_idx;
++ memcpy(mld->mac_addr, vif->addr, ETH_ALEN);
++ } else {
++ mld->group_mld_id = 0xff;
++ mld->remap_idx = 0xff;
++ }
+ }
+
+ static void
+@@ -1108,6 +1119,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ goto out;
+
+ if (enable) {
++ struct mt7996_vif_link *link;
++
+ mt7996_mcu_bss_rfch_tlv(skb, phy);
+ mt7996_mcu_bss_bmc_tlv(skb, mlink, phy);
+ mt7996_mcu_bss_ra_tlv(skb, phy);
+@@ -1118,7 +1131,8 @@ int mt7996_mcu_add_bss_info(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ mt7996_mcu_bss_he_tlv(skb, vif, link_conf, phy);
+
+ /* this tag is necessary no matter if the vif is MLD */
+- mt7996_mcu_bss_mld_tlv(skb, mlink);
++ link = container_of(mlink, struct mt7996_vif_link, mt76);
++ mt7996_mcu_bss_mld_tlv(skb, link_conf, link);
+ }
+
+ mt7996_mcu_bss_mbssid_tlv(skb, link_conf, enable);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+index 130ea95626d5b..7b21d6ae7e435 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+@@ -481,7 +481,8 @@ struct bss_mld_tlv {
+ u8 own_mld_id;
+ u8 mac_addr[ETH_ALEN];
+ u8 remap_idx;
+- u8 __rsv[3];
++ u8 link_id;
++ u8 __rsv[2];
+ } __packed;
+
+ struct sta_rec_ht_uni {
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index bbd4679edc9d3..b98cfe6e5be8c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -248,11 +248,16 @@ struct mt7996_vif_link {
+
+ struct ieee80211_tx_queue_params queue_params[IEEE80211_NUM_ACS];
+ struct cfg80211_bitrate_mask bitrate_mask;
++
++ u8 mld_idx;
+ };
+
+ struct mt7996_vif {
+ struct mt7996_vif_link deflink; /* must be first */
+ struct mt76_vif_data mt76;
++
++ u8 mld_group_idx;
++ u8 mld_remap_idx;
+ };
+
+ /* crash-dump */
+@@ -337,6 +342,9 @@ struct mt7996_dev {
+ u32 q_int_mask[MT7996_MAX_QUEUE];
+ u32 q_wfdma_mask;
+
++ u64 mld_idx_mask;
++ u64 mld_remap_idx_mask;
++
+ const struct mt76_bus_ops *bus_ops;
+ struct mt7996_phy phy;
+
+--
+2.51.0
+
--- /dev/null
+From 64a930b156bedf2a03172ec0845fd5cf9e979b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 09:12:05 +0200
+Subject: wifi: mt76: mt7996: Fix mt7996_mcu_sta_ba wcid configuration
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fe219a41adaf5354c59e75ebb642b8cb8a851d38 ]
+
+Fix the wcid pointer used in mt7996_mcu_sta_ba routine to properly
+support MLO scenario.
+
+Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250708-mt7996-mlo-fixes-v2-v1-2-f2682818a8a3@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/main.c | 6 ++++--
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 12 +++++++-----
+ drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 3 ++-
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 84f731b387d20..8a8a478391646 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -1327,11 +1327,13 @@ mt7996_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ case IEEE80211_AMPDU_RX_START:
+ mt76_rx_aggr_start(&dev->mt76, &msta_link->wcid, tid,
+ ssn, params->buf_size);
+- ret = mt7996_mcu_add_rx_ba(dev, params, link, true);
++ ret = mt7996_mcu_add_rx_ba(dev, params, link,
++ msta_link, true);
+ break;
+ case IEEE80211_AMPDU_RX_STOP:
+ mt76_rx_aggr_stop(&dev->mt76, &msta_link->wcid, tid);
+- ret = mt7996_mcu_add_rx_ba(dev, params, link, false);
++ ret = mt7996_mcu_add_rx_ba(dev, params, link,
++ msta_link, false);
+ break;
+ case IEEE80211_AMPDU_TX_OPERATIONAL:
+ mtxq->aggr = true;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 0be03eb3cf461..e6db3e0b2ffda 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -1149,9 +1149,8 @@ int mt7996_mcu_set_timing(struct mt7996_phy *phy, struct ieee80211_vif *vif,
+ static int
+ mt7996_mcu_sta_ba(struct mt7996_dev *dev, struct mt76_vif_link *mvif,
+ struct ieee80211_ampdu_params *params,
+- bool enable, bool tx)
++ struct mt76_wcid *wcid, bool enable, bool tx)
+ {
+- struct mt76_wcid *wcid = (struct mt76_wcid *)params->sta->drv_priv;
+ struct sta_rec_ba_uni *ba;
+ struct sk_buff *skb;
+ struct tlv *tlv;
+@@ -1185,14 +1184,17 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ if (enable && !params->amsdu)
+ msta_link->wcid.amsdu = false;
+
+- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, true);
++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
++ enable, true);
+ }
+
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ struct ieee80211_ampdu_params *params,
+- struct mt7996_vif_link *link, bool enable)
++ struct mt7996_vif_link *link,
++ struct mt7996_sta_link *msta_link, bool enable)
+ {
+- return mt7996_mcu_sta_ba(dev, &link->mt76, params, enable, false);
++ return mt7996_mcu_sta_ba(dev, &link->mt76, params, &msta_link->wcid,
++ enable, false);
+ }
+
+ static void
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index 8509d508e1e19..bbd4679edc9d3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -608,7 +608,8 @@ int mt7996_mcu_add_tx_ba(struct mt7996_dev *dev,
+ struct mt7996_sta_link *msta_link, bool enable);
+ int mt7996_mcu_add_rx_ba(struct mt7996_dev *dev,
+ struct ieee80211_ampdu_params *params,
+- struct mt7996_vif_link *link, bool enable);
++ struct mt7996_vif_link *link,
++ struct mt7996_sta_link *msta_link, bool enable);
+ int mt7996_mcu_update_bss_color(struct mt7996_dev *dev,
+ struct mt76_vif_link *mlink,
+ struct cfg80211_he_bss_color *he_bss_color);
+--
+2.51.0
+
--- /dev/null
+From 366f8b0e6ab3160ab3b6273d1c1e3f2560af104e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:17 +0200
+Subject: wifi: mt76: mt7996: Fix RX packets configuration for primary WED
+ device
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]
+
+In order to properly set the number of rx packets for primary WED device
+if hif device is available, move hif pointer initialization before
+running mt7996_mmio_wed_init routine.
+
+Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-9-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+index 19e99bc1c6c41..f5ce50056ee94 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+@@ -137,6 +137,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+ mdev = &dev->mt76;
+ mt7996_wfsys_reset(dev);
+ hif2 = mt7996_pci_init_hif2(pdev);
++ dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
+ if (ret < 0)
+@@ -161,7 +162,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
+
+ if (hif2) {
+ hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
+- dev->hif2 = hif2;
+
+ ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
+ if (ret < 0)
+--
+2.51.0
+
--- /dev/null
+From 5a6754b8b781c25fa8909015aa670be2a54e5e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:45:16 +0200
+Subject: wifi: mt76: mt7996: Fix tx-queues initialization for second phy on
+ mt7996
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 77ff8caf3b17626ad91568cef63d75e288aa4052 ]
+
+Fix the second phy tx queue initialization if hif device is not
+available for MT7990 chipset.
+
+Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Co-developed-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Co-developed-by: Rex Lu <rex.lu@mediatek.com>
+Signed-off-by: Rex Lu <rex.lu@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250909-mt7996-rro-rework-v5-8-7d66f6eb7795@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/init.c | 21 ++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index a9599c286328e..be729db5b75c1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -671,13 +671,20 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)
+
+ /* init wiphy according to mphy and phy */
+ mt7996_init_wiphy_band(mphy->hw, phy);
+- ret = mt7996_init_tx_queues(mphy->priv,
+- MT_TXQ_ID(band),
+- MT7996_TX_RING_SIZE,
+- MT_TXQ_RING_BASE(band) + hif1_ofs,
+- wed);
+- if (ret)
+- goto error;
++
++ if (is_mt7996(&dev->mt76) && !dev->hif2 && band == MT_BAND1) {
++ int i;
++
++ for (i = 0; i <= MT_TXQ_PSD; i++)
++ mphy->q_tx[i] = dev->mt76.phys[MT_BAND0]->q_tx[0];
++ } else {
++ ret = mt7996_init_tx_queues(mphy->priv, MT_TXQ_ID(band),
++ MT7996_TX_RING_SIZE,
++ MT_TXQ_RING_BASE(band) + hif1_ofs,
++ wed);
++ if (ret)
++ goto error;
++ }
+
+ ret = mt76_register_phy(mphy, true, mt76_rates,
+ ARRAY_SIZE(mt76_rates));
+--
+2.51.0
+
--- /dev/null
+From 88286cca064f163f3c0d35786c2473d9ff845134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:58:56 +0200
+Subject: wifi: mt76: mt7996: remove redundant per-phy mac80211 calls during
+ restart
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 0a5df0ec47f7edc04957925a9644101682041d27 ]
+
+There is only one wiphy, so extra calls must be removed.
+For calls that need to remain per-wiphy, use mt7996_for_each_phy
+
+Fixes: 69d54ce7491d ("wifi: mt76: mt7996: switch to single multi-radio wiphy")
+Link: https://patch.msgid.link/20250915075910.47558-1-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/mac.c | 137 +++++-------------
+ 1 file changed, 35 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index b3fcca9bbb958..28477702c18b3 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1766,13 +1766,10 @@ void mt7996_tx_token_put(struct mt7996_dev *dev)
+ static int
+ mt7996_mac_restart(struct mt7996_dev *dev)
+ {
+- struct mt7996_phy *phy2, *phy3;
+ struct mt76_dev *mdev = &dev->mt76;
++ struct mt7996_phy *phy;
+ int i, ret;
+
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
+-
+ if (dev->hif2) {
+ mt76_wr(dev, MT_INT1_MASK_CSR, 0x0);
+ mt76_wr(dev, MT_INT1_SOURCE_CSR, ~0);
+@@ -1784,20 +1781,14 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ mt76_wr(dev, MT_PCIE1_MAC_INT_ENABLE, 0x0);
+ }
+
+- set_bit(MT76_RESET, &dev->mphy.state);
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
++ mt7996_for_each_phy(dev, phy)
++ set_bit(MT76_RESET, &phy->mt76->state);
+ wake_up(&dev->mt76.mcu.wait);
+- if (phy2)
+- set_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- set_bit(MT76_RESET, &phy3->mt76->state);
+
+ /* lock/unlock all queues to ensure that no tx is pending */
+- mt76_txq_schedule_all(&dev->mphy);
+- if (phy2)
+- mt76_txq_schedule_all(phy2->mt76);
+- if (phy3)
+- mt76_txq_schedule_all(phy3->mt76);
++ mt7996_for_each_phy(dev, phy)
++ mt76_txq_schedule_all(phy->mt76);
+
+ /* disable all tx/rx napi */
+ mt76_worker_disable(&dev->mt76.tx_worker);
+@@ -1855,36 +1846,25 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ goto out;
+
+ mt7996_mac_init(dev);
+- mt7996_init_txpower(&dev->phy);
+- mt7996_init_txpower(phy2);
+- mt7996_init_txpower(phy3);
++ mt7996_for_each_phy(dev, phy)
++ mt7996_init_txpower(phy);
+ ret = mt7996_txbf_init(dev);
++ if (ret)
++ goto out;
+
+- if (test_bit(MT76_STATE_RUNNING, &dev->mphy.state)) {
+- ret = mt7996_run(&dev->phy);
+- if (ret)
+- goto out;
+- }
+-
+- if (phy2 && test_bit(MT76_STATE_RUNNING, &phy2->mt76->state)) {
+- ret = mt7996_run(phy2);
+- if (ret)
+- goto out;
+- }
++ mt7996_for_each_phy(dev, phy) {
++ if (!test_bit(MT76_STATE_RUNNING, &phy->mt76->state))
++ continue;
+
+- if (phy3 && test_bit(MT76_STATE_RUNNING, &phy3->mt76->state)) {
+- ret = mt7996_run(phy3);
++ ret = mt7996_run(&dev->phy);
+ if (ret)
+ goto out;
+ }
+
+ out:
+ /* reset done */
+- clear_bit(MT76_RESET, &dev->mphy.state);
+- if (phy2)
+- clear_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- clear_bit(MT76_RESET, &phy3->mt76->state);
++ mt7996_for_each_phy(dev, phy)
++ clear_bit(MT76_RESET, &phy->mt76->state);
+
+ napi_enable(&dev->mt76.tx_napi);
+ local_bh_disable();
+@@ -1898,26 +1878,18 @@ mt7996_mac_restart(struct mt7996_dev *dev)
+ static void
+ mt7996_mac_full_reset(struct mt7996_dev *dev)
+ {
+- struct mt7996_phy *phy2, *phy3;
++ struct ieee80211_hw *hw = mt76_hw(dev);
++ struct mt7996_phy *phy;
+ int i;
+
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
+ dev->recovery.hw_full_reset = true;
+
+ wake_up(&dev->mt76.mcu.wait);
+- ieee80211_stop_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_stop_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_stop_queues(phy3->mt76->hw);
++ ieee80211_stop_queues(hw);
+
+ cancel_work_sync(&dev->wed_rro.work);
+- cancel_delayed_work_sync(&dev->mphy.mac_work);
+- if (phy2)
+- cancel_delayed_work_sync(&phy2->mt76->mac_work);
+- if (phy3)
+- cancel_delayed_work_sync(&phy3->mt76->mac_work);
++ mt7996_for_each_phy(dev, phy)
++ cancel_delayed_work_sync(&phy->mt76->mac_work);
+
+ mutex_lock(&dev->mt76.mutex);
+ for (i = 0; i < 10; i++) {
+@@ -1930,40 +1902,23 @@ mt7996_mac_full_reset(struct mt7996_dev *dev)
+ dev_err(dev->mt76.dev, "chip full reset failed\n");
+
+ ieee80211_restart_hw(mt76_hw(dev));
+- if (phy2)
+- ieee80211_restart_hw(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_restart_hw(phy3->mt76->hw);
+-
+ ieee80211_wake_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_wake_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_wake_queues(phy3->mt76->hw);
+
+ dev->recovery.hw_full_reset = false;
+- ieee80211_queue_delayed_work(mt76_hw(dev),
+- &dev->mphy.mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy2)
+- ieee80211_queue_delayed_work(phy2->mt76->hw,
+- &phy2->mt76->mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy3)
+- ieee80211_queue_delayed_work(phy3->mt76->hw,
+- &phy3->mt76->mac_work,
++ mt7996_for_each_phy(dev, phy)
++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
+ MT7996_WATCHDOG_TIME);
+ }
+
+ void mt7996_mac_reset_work(struct work_struct *work)
+ {
+- struct mt7996_phy *phy2, *phy3;
++ struct ieee80211_hw *hw;
+ struct mt7996_dev *dev;
++ struct mt7996_phy *phy;
+ int i;
+
+ dev = container_of(work, struct mt7996_dev, reset_work);
+- phy2 = mt7996_phy2(dev);
+- phy3 = mt7996_phy3(dev);
++ hw = mt76_hw(dev);
+
+ /* chip full reset */
+ if (dev->recovery.restart) {
+@@ -1994,7 +1949,7 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ return;
+
+ dev_info(dev->mt76.dev,"\n%s L1 SER recovery start.",
+- wiphy_name(dev->mt76.hw->wiphy));
++ wiphy_name(hw->wiphy));
+
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed_hif2))
+ mtk_wed_device_stop(&dev->mt76.mmio.wed_hif2);
+@@ -2003,25 +1958,17 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ mtk_wed_device_stop(&dev->mt76.mmio.wed);
+
+ ieee80211_stop_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_stop_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_stop_queues(phy3->mt76->hw);
+
+ set_bit(MT76_RESET, &dev->mphy.state);
+ set_bit(MT76_MCU_RESET, &dev->mphy.state);
+ wake_up(&dev->mt76.mcu.wait);
+
+ cancel_work_sync(&dev->wed_rro.work);
+- cancel_delayed_work_sync(&dev->mphy.mac_work);
+- if (phy2) {
+- set_bit(MT76_RESET, &phy2->mt76->state);
+- cancel_delayed_work_sync(&phy2->mt76->mac_work);
+- }
+- if (phy3) {
+- set_bit(MT76_RESET, &phy3->mt76->state);
+- cancel_delayed_work_sync(&phy3->mt76->mac_work);
++ mt7996_for_each_phy(dev, phy) {
++ set_bit(MT76_RESET, &phy->mt76->state);
++ cancel_delayed_work_sync(&phy->mt76->mac_work);
+ }
++
+ mt76_worker_disable(&dev->mt76.tx_worker);
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+@@ -2074,11 +2021,8 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ }
+
+ clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+- clear_bit(MT76_RESET, &dev->mphy.state);
+- if (phy2)
+- clear_bit(MT76_RESET, &phy2->mt76->state);
+- if (phy3)
+- clear_bit(MT76_RESET, &phy3->mt76->state);
++ mt7996_for_each_phy(dev, phy)
++ clear_bit(MT76_RESET, &phy->mt76->state);
+
+ mt76_for_each_q_rx(&dev->mt76, i) {
+ if (mtk_wed_device_active(&dev->mt76.mmio.wed) &&
+@@ -2100,25 +2044,14 @@ void mt7996_mac_reset_work(struct work_struct *work)
+ napi_schedule(&dev->mt76.tx_napi);
+ local_bh_enable();
+
+- ieee80211_wake_queues(mt76_hw(dev));
+- if (phy2)
+- ieee80211_wake_queues(phy2->mt76->hw);
+- if (phy3)
+- ieee80211_wake_queues(phy3->mt76->hw);
++ ieee80211_wake_queues(hw);
+
+ mutex_unlock(&dev->mt76.mutex);
+
+ mt7996_update_beacons(dev);
+
+- ieee80211_queue_delayed_work(mt76_hw(dev), &dev->mphy.mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy2)
+- ieee80211_queue_delayed_work(phy2->mt76->hw,
+- &phy2->mt76->mac_work,
+- MT7996_WATCHDOG_TIME);
+- if (phy3)
+- ieee80211_queue_delayed_work(phy3->mt76->hw,
+- &phy3->mt76->mac_work,
++ mt7996_for_each_phy(dev, phy)
++ ieee80211_queue_delayed_work(hw, &phy->mt76->mac_work,
+ MT7996_WATCHDOG_TIME);
+ dev_info(dev->mt76.dev,"\n%s L1 SER recovery completed.",
+ wiphy_name(dev->mt76.hw->wiphy));
+--
+2.51.0
+
--- /dev/null
+From e315276da867d46da2eac130eabe38b2c941f11e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 00:14:37 +0200
+Subject: wifi: mt76: mt7996: Use proper link_id in link_sta_rc_update callback
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit afff4325548f0cf872e404df2856bf8bd9581c7e ]
+
+Do not always use deflink_id in link_sta_rc_update mac80211
+callback but use the proper link_id provided by mac80211.
+
+Fixes: 0762bdd30279f ("wifi: mt76: mt7996: rework mt7996_mac_sta_rc_work to support MLO")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250901-mt7996-fix-link_sta_rc_update-callback-v1-1-e24caf196222@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/main.c | 43 ++++++++++++-------
+ 1 file changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index 3c34a4980afa0..81391db535866 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -1663,19 +1663,13 @@ static void mt7996_sta_statistics(struct ieee80211_hw *hw,
+ }
+ }
+
+-static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
++static void mt7996_link_rate_ctrl_update(void *data,
++ struct mt7996_sta_link *msta_link)
+ {
+- struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta *msta = msta_link->sta;
+ struct mt7996_dev *dev = msta->vif->deflink.phy->dev;
+- struct mt7996_sta_link *msta_link;
+ u32 *changed = data;
+
+- rcu_read_lock();
+-
+- msta_link = rcu_dereference(msta->link[msta->deflink_id]);
+- if (!msta_link)
+- goto out;
+-
+ spin_lock_bh(&dev->mt76.sta_poll_lock);
+
+ msta_link->changed |= *changed;
+@@ -1683,8 +1677,6 @@ static void mt7996_link_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
+ list_add_tail(&msta_link->rc_list, &dev->sta_rc_list);
+
+ spin_unlock_bh(&dev->mt76.sta_poll_lock);
+-out:
+- rcu_read_unlock();
+ }
+
+ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+@@ -1692,11 +1684,32 @@ static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+ struct ieee80211_link_sta *link_sta,
+ u32 changed)
+ {
+- struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ struct ieee80211_sta *sta = link_sta->sta;
++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta_link *msta_link;
+
+- mt7996_link_rate_ctrl_update(&changed, sta);
+- ieee80211_queue_work(hw, &dev->rc_work);
++ rcu_read_lock();
++
++ msta_link = rcu_dereference(msta->link[link_sta->link_id]);
++ if (msta_link) {
++ struct mt7996_dev *dev = mt7996_hw_dev(hw);
++
++ mt7996_link_rate_ctrl_update(&changed, msta_link);
++ ieee80211_queue_work(hw, &dev->rc_work);
++ }
++
++ rcu_read_unlock();
++}
++
++static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
++{
++ struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++ struct mt7996_sta_link *msta_link;
++ u32 *changed = data;
++
++ msta_link = rcu_dereference(msta->link[msta->deflink_id]);
++ if (msta_link)
++ mt7996_link_rate_ctrl_update(&changed, msta_link);
+ }
+
+ static int
+@@ -1717,7 +1730,7 @@ mt7996_set_bitrate_mask(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ * - multiple rates: if it's not in range format i.e 0-{7,8,9} for VHT
+ * then multiple MCS setting (MCS 4,5,6) is not supported.
+ */
+- ieee80211_iterate_stations_atomic(hw, mt7996_link_rate_ctrl_update,
++ ieee80211_iterate_stations_atomic(hw, mt7996_sta_rate_ctrl_update,
+ &changed);
+ ieee80211_queue_work(hw, &dev->rc_work);
+
+--
+2.51.0
+
--- /dev/null
+From 9c3e09526c0a14e1154c0a67417a1b8a9d52c35c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 4c8c7a5fdf23e..be23a29e7de09 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -686,10 +686,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From 2b9bfc75321e7ba9464ee8498e3ffbdd2d24409e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 23:08:24 +0300
+Subject: wifi: rtw88: Lock rtwdev->mutex before setting the LED
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 26a8bf978ae9cd7688af1d08bc8760674d372e22 ]
+
+Some users report that the LED blinking breaks AP mode somehow. Most
+likely the LED code and the dynamic mechanism are trying to access the
+hardware registers at the same time. Fix it by locking rtwdev->mutex
+before setting the LED and unlocking it after.
+
+Fixes: 4b6652bc6d8d ("wifi: rtw88: Add support for LED blinking")
+Closes: https://github.com/lwfinger/rtw88/issues/305
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/ed69fa07-8678-4a40-af44-65e7b1862197@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/led.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
+index 25aa6cbaa7286..7f9ace351a5b7 100644
+--- a/drivers/net/wireless/realtek/rtw88/led.c
++++ b/drivers/net/wireless/realtek/rtw88/led.c
+@@ -6,13 +6,23 @@
+ #include "debug.h"
+ #include "led.h"
+
+-static int rtw_led_set_blocking(struct led_classdev *led,
+- enum led_brightness brightness)
++static void rtw_led_set(struct led_classdev *led,
++ enum led_brightness brightness)
+ {
+ struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
+
++ mutex_lock(&rtwdev->mutex);
++
+ rtwdev->chip->ops->led_set(led, brightness);
+
++ mutex_unlock(&rtwdev->mutex);
++}
++
++static int rtw_led_set_blocking(struct led_classdev *led,
++ enum led_brightness brightness)
++{
++ rtw_led_set(led, brightness);
++
+ return 0;
+ }
+
+@@ -37,7 +47,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
+ return;
+
+ if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+- led->brightness_set = rtwdev->chip->ops->led_set;
++ led->brightness_set = rtw_led_set;
+ else
+ led->brightness_set_blocking = rtw_led_set_blocking;
+
+--
+2.51.0
+
--- /dev/null
+From cdd08e64b38f32c4b2f3d5a041b24217c52c5066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 21:46:02 +0300
+Subject: wifi: rtw88: Use led->brightness_set_blocking for PCI too
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit fce6fee0817b8899e0ee38ab6b98f0d7e939ceed ]
+
+Commit 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting
+the LED") made rtw_led_set() sleep, but that's not allowed. Fix it by
+using the brightness_set_blocking member of struct led_classdev for
+PCI devices too. This one is allowed to sleep.
+
+bad: scheduling from the idle thread!
+nix kernel: CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Tainted: G W O 6.16.0 #1-NixOS PREEMPT(voluntary)
+nix kernel: Tainted: [W]=WARN, [O]=OOT_MODULE
+nix kernel: Hardware name: [REDACTED]
+nix kernel: Call Trace:
+nix kernel: <IRQ>
+nix kernel: dump_stack_lvl+0x63/0x90
+nix kernel: dequeue_task_idle+0x2d/0x50
+nix kernel: __schedule+0x191/0x1310
+nix kernel: ? xas_load+0x11/0xd0
+nix kernel: schedule+0x2b/0xe0
+nix kernel: schedule_preempt_disabled+0x19/0x30
+nix kernel: __mutex_lock.constprop.0+0x3fd/0x7d0
+nix kernel: rtw_led_set+0x27/0x60 [rtw_core]
+nix kernel: led_blink_set_nosleep+0x56/0xb0
+nix kernel: led_trigger_blink+0x49/0x80
+nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
+nix kernel: call_timer_fn+0x2f/0x140
+nix kernel: ? __pfx_tpt_trig_timer+0x10/0x10 [mac80211]
+nix kernel: __run_timers+0x21a/0x2b0
+nix kernel: run_timer_softirq+0x8e/0x100
+nix kernel: handle_softirqs+0xea/0x2c0
+nix kernel: ? srso_alias_return_thunk+0x5/0xfbef5
+nix kernel: __irq_exit_rcu+0xdc/0x100
+nix kernel: sysvec_apic_timer_interrupt+0x7c/0x90
+nix kernel: </IRQ>
+nix kernel: <TASK>
+nix kernel: asm_sysvec_apic_timer_interrupt+0x1a/0x20
+nix kernel: RIP: 0010:cpuidle_enter_state+0xcc/0x450
+nix kernel: Code: 00 e8 08 7c 2e ff e8 d3 ee ff ff 49 89 c6 0f 1f 44 00 00 31 ff e8 c4 d1 2c ff 80 7d d7 00 0f 85 5d 02 00 00 fb 0f 1f 44 00 00 <45> 85 ff 0f 88 a0 01 00 00 49 63 f7 4c 89 f2 48 8d 0>
+nix kernel: RSP: 0018:ffffd579801c7e68 EFLAGS: 00000246
+nix kernel: RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
+nix kernel: RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+nix kernel: RBP: ffffd579801c7ea0 R08: 0000000000000000 R09: 0000000000000000
+nix kernel: R10: 0000000000000000 R11: 0000000000000000 R12: ffff8eab0462a400
+nix kernel: R13: ffffffff9a7d7a20 R14: 00000003aebe751d R15: 0000000000000003
+nix kernel: ? cpuidle_enter_state+0xbc/0x450
+nix kernel: cpuidle_enter+0x32/0x50
+nix kernel: do_idle+0x1b1/0x210
+nix kernel: cpu_startup_entry+0x2d/0x30
+nix kernel: start_secondary+0x118/0x140
+nix kernel: common_startup_64+0x13e/0x141
+nix kernel: </TASK>
+
+Fixes: 26a8bf978ae9 ("wifi: rtw88: Lock rtwdev->mutex before setting the LED")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/ad8a49ef-4f2d-4a61-8292-952db9c4eb65@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/led.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/led.c b/drivers/net/wireless/realtek/rtw88/led.c
+index 7f9ace351a5b7..4cc62e49d1679 100644
+--- a/drivers/net/wireless/realtek/rtw88/led.c
++++ b/drivers/net/wireless/realtek/rtw88/led.c
+@@ -6,8 +6,8 @@
+ #include "debug.h"
+ #include "led.h"
+
+-static void rtw_led_set(struct led_classdev *led,
+- enum led_brightness brightness)
++static int rtw_led_set(struct led_classdev *led,
++ enum led_brightness brightness)
+ {
+ struct rtw_dev *rtwdev = container_of(led, struct rtw_dev, led_cdev);
+
+@@ -16,12 +16,6 @@ static void rtw_led_set(struct led_classdev *led,
+ rtwdev->chip->ops->led_set(led, brightness);
+
+ mutex_unlock(&rtwdev->mutex);
+-}
+-
+-static int rtw_led_set_blocking(struct led_classdev *led,
+- enum led_brightness brightness)
+-{
+- rtw_led_set(led, brightness);
+
+ return 0;
+ }
+@@ -46,10 +40,7 @@ void rtw_led_init(struct rtw_dev *rtwdev)
+ if (!rtwdev->chip->ops->led_set)
+ return;
+
+- if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
+- led->brightness_set = rtw_led_set;
+- else
+- led->brightness_set_blocking = rtw_led_set_blocking;
++ led->brightness_set_blocking = rtw_led_set;
+
+ snprintf(rtwdev->led_name, sizeof(rtwdev->led_name),
+ "rtw88-%s", dev_name(rtwdev->dev));
+--
+2.51.0
+
--- /dev/null
+From 39b2b2a4236958859f4112a49f1678594e8a0b8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:50 +0300
+Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
+
+Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
+scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
+wiphy lock inside. However, this workqueue can be flushed when e.g.
+closing the interface and wiphy lock is already taken in that case.
+
+Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
+the global workqueue.
+
+[1]:
+
+ WARNING: possible circular locking dependency detected
+ 6.17.0-rc2 #17 Not tainted
+ ------------------------------------------------------
+ kworker/u32:1/61 is trying to acquire lock:
+ ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
+
+ but task is already holding lock:
+ ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
+ process_one_work+0x7c6/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
+ touch_wq_lockdep_map+0x8e/0x180
+ __flush_workqueue+0x129/0x10d0
+ ieee80211_stop_device+0xa8/0x110
+ ieee80211_do_stop+0x14ce/0x2880
+ ieee80211_stop+0x13a/0x2c0
+ __dev_close_many+0x18f/0x510
+ __dev_change_flags+0x25f/0x670
+ netif_change_flags+0x7b/0x160
+ do_setlink.isra.0+0x1640/0x35d0
+ rtnl_newlink+0xd8c/0x1d30
+ rtnetlink_rcv_msg+0x700/0xb80
+ netlink_rcv_skb+0x11d/0x350
+ netlink_unicast+0x49a/0x7a0
+ netlink_sendmsg+0x759/0xc20
+ ____sys_sendmsg+0x812/0xa00
+ ___sys_sendmsg+0xf7/0x180
+ __sys_sendmsg+0x11f/0x1b0
+ do_syscall_64+0xbb/0x360
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock((wq_completion)phy0);
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock(&rdev->wiphy.mtx);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u32:1/61:
+ #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
+ #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
+ Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ print_circular_bug.cold+0x178/0x1be
+ check_noncircular+0x14c/0x170
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index fe7beff8c4246..f99e179f7ff9f 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -205,7 +205,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
+
+ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ {
+- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ struct ser_msg *msg = NULL;
+
+ if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
+@@ -221,7 +220,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ list_add(&msg->list, &ser->msg_q);
+ spin_unlock_irq(&ser->msg_q_lock);
+
+- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
++ schedule_work(&ser->ser_hdl_work);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From be0c61f4be4543268b10ac7114d7f9bd5070a9e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:49 +0300
+Subject: wifi: rtw89: fix leak in rtw89_core_send_nullfunc()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit a9f0064f4716b0fd97085015ea1dd398bdfdc946 ]
+
+If there is no rtwsta_link found in rtw89_core_send_nullfunc(), allocated
+skb is leaked. Free it on the error handling path.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: a8ba4acab7db ("wifi: rtw89: send nullfunc based on the given link")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-4-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index b9c2224dde4a3..1837f17239ab6 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -3456,6 +3456,7 @@ int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rt
+ rtwsta_link = rtwsta->links[rtwvif_link->link_id];
+ if (unlikely(!rtwsta_link)) {
+ ret = -ENOLINK;
++ dev_kfree_skb_any(skb);
+ goto out;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9d32ec22d88b7f9aeb1419a55c25ff7bf9c476a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 77d8f49b92bdd..f59ae7186940a 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
--- /dev/null
+From 07496fd25be260df517a179056e52145813dee16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:45:18 +0100
+Subject: ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]
+
+There appears to be a cut-n-paste error with the incorrect field
+ndr_desc->numa_node being reported for the target node. Fix this by
+using ndr_desc->target_node instead.
+
+Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index a466ad6e5d93a..5a1ced5bf7f6f 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
+ if (ndr_desc->target_node == NUMA_NO_NODE) {
+ ndr_desc->target_node = phys_to_target_node(spa->address);
+ dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+- NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
++ NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From b2cf675d80aa194a0ae96ee85a812d9310b87a3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:06:11 +0800
+Subject: ACPI: processor: idle: Fix memory leak when register cpuidle device
+ failed
+
+From: Huisong Li <lihuisong@huawei.com>
+
+[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]
+
+The cpuidle device's memory is leaked when cpuidle device registration
+fails in acpi_processor_power_init(). Free it as appropriate.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Huisong Li <lihuisong@huawei.com>
+Link: https://patch.msgid.link/20250728070612.1260859-2-lihuisong@huawei.com
+[ rjw: Changed the order of the new statements, added empty line after if () ]
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 0888e4d618d53..b524cf27213d4 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
+ if (retval) {
+ if (acpi_processor_registered == 0)
+ cpuidle_unregister_driver(&acpi_idle_driver);
++
++ per_cpu(acpi_cpuidle_device, pr->id) = NULL;
++ kfree(dev);
+ return retval;
+ }
+ acpi_processor_registered++;
+--
+2.51.0
+
--- /dev/null
+From 44f82f5c82a4d5021bbc72b5dce4ed14f484788d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:03:16 +0200
+Subject: ACPICA: Fix largest possible resource descriptor index
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]
+
+ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
+used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).
+
+Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
+clamped incorrectly and resulting value may issue an out-of-bounds
+access for 'acpi_gbl_resource_types' array. Compile tested only.
+
+Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
+Link: https://github.com/acpica/acpica/commit/cf00116c
+Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/aclocal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
+index 82563b44af351..261dc8f87556d 100644
+--- a/drivers/acpi/acpica/aclocal.h
++++ b/drivers/acpi/acpica/aclocal.h
+@@ -1139,7 +1139,7 @@ struct acpi_port_info {
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION 0x91
+ #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG 0x92
+ #define ACPI_RESOURCE_NAME_CLOCK_INPUT 0x93
+-#define ACPI_RESOURCE_NAME_LARGE_MAX 0x94
++#define ACPI_RESOURCE_NAME_LARGE_MAX 0x93
+
+ /*****************************************************************************
+ *
+--
+2.51.0
+
--- /dev/null
+From 20030d1095310427f39e45697c02d27adfa895fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:13:10 +0800
+Subject: ALSA: lx_core: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]
+
+Change the 'ret' variable from u16 to int to store negative error codes or
+zero returned by lx_message_send_atomic().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://patch.msgid.link/20250828081312.393148-1-rongqianfeng@vivo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/lx6464es/lx_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
+index b5b0d43bb8dcd..c3f2717aebf25 100644
+--- a/sound/pci/lx6464es/lx_core.c
++++ b/sound/pci/lx6464es/lx_core.c
+@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
+ /* low-level dsp access */
+ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+ {
+- u16 ret;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
+
+ int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
+ {
+- u16 ret = 0;
+ u32 freq_raw = 0;
+ u32 freq = 0;
+ u32 frequency = 0;
++ int ret;
+
+ mutex_lock(&chip->msg_lock);
+
+--
+2.51.0
+
--- /dev/null
+From 7f3dd781cacd589388316aa33ca94648ecdf2b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 16:54:26 +0200
+Subject: ARM: at91: pm: fix MCKx restore routine
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]
+
+The at91_mckx_ps_restore() assembly function is responsible for setting
+back MCKx system bus clocks after exiting low power modes.
+
+Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
+to previously saved state.
+Tmp2 was used without the needed changes in CSS and DIV. Moreover the
+required bit 7, telling that MCR register's content is to be changed
+(CMD/write), was not set.
+
+Fix function comment to match tmp variables actually used.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
+Link: https://lore.kernel.org/r/20250827145427.46819-3-nicolas.ferre@microchip.com
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+[claudiu.beznea: s/sate/state in commit description]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index e5869cca5e791..94dece1839af3 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -872,7 +872,7 @@ e_done:
+ /**
+ * at91_mckx_ps_restore: restore MCK1..4 settings
+ *
+- * Side effects: overwrites tmp1, tmp2
++ * Side effects: overwrites tmp1, tmp2 and tmp3
+ */
+ .macro at91_mckx_ps_restore
+ #ifdef CONFIG_SOC_SAMA7
+@@ -916,7 +916,7 @@ r_ps:
+ bic tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
+ orr tmp3, tmp3, tmp1
+ orr tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
+- str tmp2, [pmc, #AT91_PMC_MCR_V2]
++ str tmp3, [pmc, #AT91_PMC_MCR_V2]
+
+ wait_mckrdy tmp1
+
+--
+2.51.0
+
--- /dev/null
+From fcbc4f43c224e3410b220b47fcbb06c573cc9305 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 23:59:57 +0200
+Subject: ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
+ property
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]
+
+The dtbs_check validation for am335x-cm-t335.dtb flags an error
+for an unevaluated 'num-serializer' property in the mcasp0 node.
+
+This property is obsolete; it is not defined in the davinci-mcasp-audio
+schema and is not used by the corresponding (or any) driver.
+
+Remove this unused property to fix the schema validation warning.
+
+Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250830215957.285694-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+index 72990e7ffe10e..44718a4cec474 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
++++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+@@ -483,8 +483,6 @@ &mcasp1 {
+
+ op-mode = <0>; /* MCASP_IIS_MODE */
+ tdm-slots = <2>;
+- /* 16 serializers */
+- num-serializer = <16>;
+ serial-dir = < /* 0: INACTIVE, 1: TX, 2: RX */
+ 0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
+ >;
+--
+2.51.0
+
--- /dev/null
+From 5173d28751bda112e480529732d7aabebee6380e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 15:49:48 +0200
+Subject: ARM: dts: renesas: porter: Fix CAN pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]
+
+According to the schematics, the CAN transceiver is connected to pins
+GP7_3 and GP7_4, which correspond to CAN0 data group B.
+
+Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/70ad9bc44d6cea92197c42eedcad6b3d0641d26a.1751032025.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+index fcc9a2313e1df..0cd08f7b8d8e0 100644
+--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+@@ -266,7 +266,7 @@ vin0_pins: vin0 {
+ };
+
+ can0_pins: can0 {
+- groups = "can0_data";
++ groups = "can0_data_b";
+ function = "can0";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 3209316181ff7f080233e43a4141e5e51afcd1e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:25:30 +0200
+Subject: ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in
+ DTS to use correct boolean syntax
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]
+
+The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
+schema, was incorrectly assigned a value (<1>) in the DTS file, causing
+a validation error: "size (4) error for type flag". The driver uses
+of_property_read_bool(), expecting a boolean. Remove the value to fix
+the dtbs_check error.
+
+Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/all/20250822222530.113520-1-jihed.chaibi.dev@gmail.com/
+Link: https://lore.kernel.org/r/20250822222530.113520-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+index c14d5b70c72f6..56f704082f94a 100644
+--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
++++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+@@ -270,7 +270,7 @@ &tps {
+ vcc7-supply = <&vbat>;
+ vccio-supply = <&vbat>;
+
+- ti,en-ck32k-xtal = <1>;
++ ti,en-ck32k-xtal;
+
+ regulators {
+ vrtc_reg: regulator@0 {
+--
+2.51.0
+
--- /dev/null
+From ce481415cfb6eea5f4eabb374b46c766eede7287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 00:50:52 +0200
+Subject: ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on
+ property to use correct boolean syntax in DTS
+
+From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+
+[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]
+
+The ti,keep-vref-on property, defined as a boolean flag in the Device
+Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
+causing a validation error: "size (4) error for type flag". Remove
+the value to match the schema and ensure compatibility with the driver
+using device_property_read_bool(). This fixes the dtbs_check error.
+
+Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
+Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
+Link: https://lore.kernel.org/r/20250822225052.136919-1-jihed.chaibi.dev@gmail.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+index a7f99ae0c1fe9..78c657429f641 100644
+--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
++++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+@@ -65,7 +65,7 @@ ads7846@0 {
+ ti,debounce-max = /bits/ 16 <10>;
+ ti,debounce-tol = /bits/ 16 <5>;
+ ti,debounce-rep = /bits/ 16 <1>;
+- ti,keep-vref-on = <1>;
++ ti,keep-vref-on;
+ ti,settle-delay-usec = /bits/ 16 <150>;
+
+ wakeup-source;
+--
+2.51.0
+
--- /dev/null
+From bfcfca5a1c3c51a8e2f7335c4c7484de136822ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 11:49:44 +0200
+Subject: arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
+
+From: Janne Grunau <j@jannau.net>
+
+[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]
+
+PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
+and disabled. Linux' PCI subsystem assigns the ethernet nic from
+`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
+disabled port as iommu. The `pcie0_dart_1` instance is disabled and
+probably fused off (it is on the M2 Pro Mac mini which has a disabled
+PCIe port as well).
+Without iommu the ethernet nic is not expected work.
+Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
+subsystem's bus number.
+
+Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Link: https://lore.kernel.org/r/20250823-apple-dt-sync-6-17-v2-1-6dc0daeb4786@jannau.net
+Signed-off-by: Sven Peter <sven@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
+index 152f95fd49a21..7089ccf3ce556 100644
+--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
++++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
+@@ -21,6 +21,14 @@ aliases {
+ };
+ };
+
++/*
++ * Adjust pcie0's iommu-map to account for the disabled port01.
++ */
++&pcie0 {
++ iommu-map = <0x100 &pcie0_dart_0 1 1>,
++ <0x200 &pcie0_dart_2 1 1>;
++};
++
+ &bluetooth0 {
+ brcm,board-type = "apple,santorini";
+ };
+@@ -36,10 +44,10 @@ &wifi0 {
+ */
+
+ &port02 {
+- bus-range = <3 3>;
++ bus-range = <2 2>;
+ status = "okay";
+ ethernet0: ethernet@0,0 {
+- reg = <0x30000 0x0 0x0 0x0 0x0>;
++ reg = <0x20000 0x0 0x0 0x0 0x0>;
+ /* To be filled by the loader */
+ local-mac-address = [00 10 18 00 00 00];
+ };
+--
+2.51.0
+
--- /dev/null
+From baebd80110e8251ce0f37125bba3ab5902d852c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:52 +0200
+Subject: arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node
+ names
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]
+
+The node names for "pmic", "regulators", "rtc", and "keys" are
+dictated by the PMIC MFD binding: change those to adhere to it.
+
+Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-17-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+index d89858c73ab1b..243afbffa21fd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+@@ -6,12 +6,12 @@
+ #include <dt-bindings/input/input.h>
+
+ &pwrap {
+- pmic: mt6331 {
++ pmic: pmic {
+ compatible = "mediatek,mt6331";
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6331regulator: mt6331regulator {
++ mt6331regulator: regulators {
+ compatible = "mediatek,mt6331-regulator";
+
+ mt6331_vdvfs11_reg: buck-vdvfs11 {
+@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
+ };
+
+ mt6331_vdig18_reg: ldo-vdig18 {
+- regulator-name = "dvdd18_dig";
++ regulator-name = "vdig18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-ramp-delay = <0>;
+@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
+ };
+ };
+
+- mt6331rtc: mt6331rtc {
++ mt6331rtc: rtc {
+ compatible = "mediatek,mt6331-rtc";
+ };
+
+- mt6331keys: mt6331keys {
++ mt6331keys: keys {
+ compatible = "mediatek,mt6331-keys";
+ power {
+ linux,keycodes = <KEY_POWER>;
+--
+2.51.0
+
--- /dev/null
+From 07958f94507367e7611631498b206848456b7673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:56 +0200
+Subject: arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]
+
+Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
+actually used, the final value that gets written to the register
+field for DAT_LATCH_CK_SEL is just 0x4.
+
+This also fixes dtbs_check warnings.
+
+Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250724083914.61351-21-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+index b5746e6d0b15a..110fae4ec11c9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
++++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+@@ -136,7 +136,7 @@ proximity@48 {
+
+ &mmc0 {
+ /* eMMC controller */
+- mediatek,latch-ck = <0x14>; /* hs400 */
++ mediatek,latch-ck = <4>; /* hs400 */
+ mediatek,hs200-cmd-int-delay = <1>;
+ mediatek,hs400-cmd-int-delay = <1>;
+ mediatek,hs400-ds-dly3 = <0x1a>;
+--
+2.51.0
+
--- /dev/null
+From 7454a85e254a1aa50a9d02003d4c6d1b68776d9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 17:59:59 +0800
+Subject: arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from
+ pcie0
+
+From: Guoqing Jiang <guoqing.jiang@canonical.com>
+
+[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]
+
+When test suspend resume with 6.8 based kernel, system can't resume
+and I got below error which can be also reproduced with 6.16 rc6+
+kernel.
+
+mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
+mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
+mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110
+
+After investigation, looks pcie0 has the same problem as pcie1 as
+decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
+Remove suspend-breaking reset from pcie1").
+
+Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
+Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Link: https://lore.kernel.org/r/20250721095959.57703-1-guoqing.jiang@canonical.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index 22604d3abde3b..4b701afe995e2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -1524,9 +1524,6 @@ pcie0: pcie@112f0000 {
+
+ power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
+
+- resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
+- reset-names = "mac";
+-
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc0 0>,
+--
+2.51.0
+
--- /dev/null
+From ee849fa2ed57bb2cac7b5d62d2e6ccb8b1d18642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:39:14 +0200
+Subject: arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]
+
+This devicetree contained only the SoC compatible but lacked the
+machine specific one: add a "mediatek,mt8516-pumpkin" compatible
+to the list to fix dtbs_check warnings.
+
+Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Link: https://lore.kernel.org/r/20250724083914.61351-39-angelogioacchino.delregno@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+index cce642c538128..3d3db33a64dc6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+@@ -11,7 +11,7 @@
+
+ / {
+ model = "Pumpkin MT8516";
+- compatible = "mediatek,mt8516";
++ compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
+
+ memory@40000000 {
+ device_type = "memory";
+--
+2.51.0
+
--- /dev/null
+From 72e3e8c9a4d93cd6fd1f25c1583a4ab4e83e369d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 13:19:53 +0100
+Subject: arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]
+
+On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
+are deleting a wrong and nonexistent node. Fixing the wrong node would
+invoke a dtb warning message, as channel0 is a required property.
+Disable CAN-FD channel0 instead of deleting the node.
+
+Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250801121959.267424-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+index 83fce96a25752..0234dbe95413c 100644
+--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+@@ -38,7 +38,10 @@ hdmi_con_out: endpoint {
+ #if (SW_SCIF_CAN || SW_RSPI_CAN)
+ &canfd {
+ pinctrl-0 = <&can1_pins>;
+- /delete-node/ channel@0;
++
++ channel0 {
++ status = "disabled";
++ };
+ };
+ #else
+ &canfd {
+--
+2.51.0
+
--- /dev/null
+From a8eed12753460686acbfc30901655d1ae0e8dc02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:19 +0200
+Subject: ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]
+
+When an invalid value is passed via quirk option, currently
+bytcht_es8316 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-2-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 7a30d2d36f199..fbd7e1f0783fd 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -46,7 +46,8 @@ enum {
+ BYT_CHT_ES8316_INTMIC_IN2_MAP,
+ };
+
+-#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_CHT_ES8316_MAP_MASK GENMASK(3, 0)
++#define BYT_CHT_ES8316_MAP(quirk) ((quirk) & BYT_CHT_ES8316_MAP_MASK)
+ #define BYT_CHT_ES8316_SSP0 BIT(16)
+ #define BYT_CHT_ES8316_MONO_SPEAKER BIT(17)
+ #define BYT_CHT_ES8316_JD_INVERTED BIT(18)
+@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
++ int map;
++
++ map = BYT_CHT_ES8316_MAP(quirk);
++ switch (map) {
++ case BYT_CHT_ES8316_INTMIC_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
++ break;
++ case BYT_CHT_ES8316_INTMIC_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
++ quirk &= ~BYT_CHT_ES8316_MAP_MASK;
++ quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
++ break;
++ }
++
+ if (quirk & BYT_CHT_ES8316_SSP0)
+ dev_info(dev, "quirk SSP0 enabled");
+ if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
+--
+2.51.0
+
--- /dev/null
+From c533c6ee484769656b2ed0f5a166332372b09186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:20 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver only shows an error message but leaves as is.
+This may lead to unepxected results like OOB access.
+
+This patch corrects the input mapping to the certain default value if
+an invalid value is passed.
+
+Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-3-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 6a85e8fdcae64..beca466dd468e 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -68,7 +68,8 @@ enum {
+ BYT_RT5640_OVCD_SF_1P5 = (RT5640_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5640_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5640_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5640_MAP(quirk) ((quirk) & BYT_RT5640_MAP_MASK)
+ #define BYT_RT5640_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5640_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5640_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
+ break;
+ default:
+- dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
++ byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
++ byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
+ break;
+ }
+ if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
+--
+2.51.0
+
--- /dev/null
+From 86f75c8e7d175665523b1ce37f9c95d46d79c6eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:18:21 +0200
+Subject: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]
+
+When an invalid value is passed via quirk option, currently
+bytcr_rt5640 driver just ignores and leaves as is, which may lead to
+unepxected results like OOB access.
+
+This patch adds the sanity check and corrects the input mapping to the
+certain default value if an invalid value is passed.
+
+Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <20250902171826.27329-4-tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 805afaf47b290..2abe47303ecdb 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -58,7 +58,8 @@ enum {
+ BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13),
+ };
+
+-#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0))
++#define BYT_RT5651_MAP_MASK GENMASK(3, 0)
++#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK)
+ #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4)
+ #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8)
+ #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13)
+@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
+
+ static void log_quirks(struct device *dev)
+ {
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
++ int map;
++
++ map = BYT_RT5651_MAP(byt_rt5651_quirk);
++ switch (map) {
++ case BYT_RT5651_DMIC_MAP:
+ dev_info(dev, "quirk DMIC_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
++ break;
++ case BYT_RT5651_IN1_MAP:
+ dev_info(dev, "quirk IN1_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
++ break;
++ case BYT_RT5651_IN2_MAP:
+ dev_info(dev, "quirk IN2_MAP enabled");
+- if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
++ break;
++ case BYT_RT5651_IN1_IN2_MAP:
+ dev_info(dev, "quirk IN1_IN2_MAP enabled");
++ break;
++ default:
++ dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
++ byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
++ byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
++ break;
++ }
++
+ if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
+ dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
+ BYT_RT5651_JDSRC(byt_rt5651_quirk));
+--
+2.51.0
+
--- /dev/null
+From cb3841bc323780e9b6eb3f9922ea925dca55b969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 16:48:54 +0800
+Subject: blk-mq: check kobject state_in_sysfs before deleting in
+ blk_mq_unregister_hctx
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]
+
+In __blk_mq_update_nr_hw_queues() the return value of
+blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
+fails, later changing the number of hw_queues or removing disk will
+trigger the following warning:
+
+ kernfs: can not remove 'nr_tags', no directory
+ WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
+ Call Trace:
+ remove_files.isra.1+0x38/0xb0
+ sysfs_remove_group+0x4d/0x100
+ sysfs_remove_groups+0x31/0x60
+ __kobject_del+0x23/0xf0
+ kobject_del+0x17/0x40
+ blk_mq_unregister_hctx+0x5d/0x80
+ blk_mq_sysfs_unregister_hctxs+0x94/0xd0
+ blk_mq_update_nr_hw_queues+0x124/0x760
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x92/0x120 [null_blk]
+
+kobjct_del() was called unconditionally even if sysfs creation failed.
+Fix it by checkig the kobject creation statusbefore deleting it.
+
+Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250826084854.1030545-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq-sysfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 156e9bb07abf1..2fb234ab467b1 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
+ return;
+
+ hctx_for_each_ctx(hctx, ctx, i)
+- kobject_del(&ctx->kobj);
++ if (ctx->kobj.state_in_sysfs)
++ kobject_del(&ctx->kobj);
+
+- kobject_del(&hctx->kobj);
++ if (hctx->kobj.state_in_sysfs)
++ kobject_del(&hctx->kobj);
+ }
+
+ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
+--
+2.51.0
+
--- /dev/null
+From 264ba4db500b050db8d873adf35c5eb36f6ea8f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 21:09:30 +0800
+Subject: block: use int to store blk_stack_limits() return value
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]
+
+Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
+as it needs to store negative value -1.
+
+Storing the negative error codes in unsigned type, or performing equality
+comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
+can be confusing. Additionally, assigning negative error codes to unsigned
+type may trigger a GCC warning when the -Wsign-conversion flag is enabled.
+
+No effect on runtime.
+
+Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20250902130930.68317-1-rongqianfeng@vivo.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-settings.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 021994f6d2d82..a891f27ff834d 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -553,7 +553,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
+ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ sector_t start)
+ {
+- unsigned int top, bottom, alignment, ret = 0;
++ unsigned int top, bottom, alignment;
++ int ret = 0;
+
+ t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
+ t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
+--
+2.51.0
+
--- /dev/null
+From 6c98042846b463a753cc7a1d5559559bef808152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 12:30:05 -0400
+Subject: Bluetooth: hci_sync: Fix using random address for BIG/PA
+ advertisements
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]
+
+When creating an advertisement for BIG the address shall not be
+non-resolvable since in case of acting as BASS/Broadcast Assistant the
+address must be the same as the connection in order to use the PAST
+method and even when PAST/BASS are not in the picture a Periodic
+Advertisement can still be synchronized thus the same argument as to
+connectable advertisements still stand.
+
+Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index dc9209f9f1a6a..a128e5709fa15 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -1347,7 +1347,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ {
+ struct hci_cp_le_set_ext_adv_params cp;
+ struct hci_rp_le_set_ext_adv_params rp;
+- bool connectable;
++ bool connectable, require_privacy;
+ u32 flags;
+ bdaddr_t random_addr;
+ u8 own_addr_type;
+@@ -1385,10 +1385,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
+ return -EPERM;
+
+ /* Set require_privacy to true only when non-connectable
+- * advertising is used. In that case it is fine to use a
+- * non-resolvable private address.
++ * advertising is used and it is not periodic.
++ * In that case it is fine to use a non-resolvable private address.
+ */
+- err = hci_get_random_address(hdev, !connectable,
++ require_privacy = !connectable && !(adv && adv->periodic);
++
++ err = hci_get_random_address(hdev, require_privacy,
+ adv_use_rpa(hdev, flags), adv,
+ &own_addr_type, &random_addr);
+ if (err < 0)
+--
+2.51.0
+
--- /dev/null
+From 822e8947b1486c37e4b64bfb4d0d29fce7fbe3b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 21:11:22 +0300
+Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]
+
+For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
+skb is leaked.
+
+Free skb after copying its data.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index be71082d9eafa..69529a3049e74 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -2091,7 +2091,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+ skb->len);
+ conn->rx_len -= skb->len;
+- return;
++ break;
+
+ case ISO_END:
+ skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+--
+2.51.0
+
--- /dev/null
+From 67ba4c7b3001f8ce314f13ce6b153dfe9d4477b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:27:51 -0400
+Subject: Bluetooth: ISO: Fix possible UAF on iso_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]
+
+This attempt to fix similar issue to sco_conn_free where if the
+conn->sk is not set to NULL may lead to UAF on iso_conn_free.
+
+Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index b94d202bf3745..be71082d9eafa 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk)
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
++ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ if (iso_pi(sk)->conn) {
++ iso_conn_lock(iso_pi(sk)->conn);
++ iso_pi(sk)->conn->sk = NULL;
++ iso_conn_unlock(iso_pi(sk)->conn);
++ }
++
+ /* Kill poor orphan */
+ bt_sock_unlink(&iso_sk_list, sk);
+ sock_set_flag(sk, SOCK_DEAD);
+--
+2.51.0
+
--- /dev/null
+From a690feaa77785e4358f547a4b8668341479b412f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 08:50:12 -0400
+Subject: Bluetooth: MGMT: Fix not exposing debug UUID on
+ MGMT_OP_READ_EXP_FEATURES_INFO
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]
+
+The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
+was not called with a specific index which breaks the likes of
+bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
+adapter is plugged, so instead of depending hdev not to be set just
+enable the UUID on any index like it was done with iso_sock_uuid.
+
+Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 9b01eaaa0eb2d..54ddbb2635e2f 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4405,13 +4405,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
+ return -ENOMEM;
+
+ #ifdef CONFIG_BT_FEATURE_DEBUG
+- if (!hdev) {
+- flags = bt_dbg_get() ? BIT(0) : 0;
++ flags = bt_dbg_get() ? BIT(0) : 0;
+
+- memcpy(rp->features[idx].uuid, debug_uuid, 16);
+- rp->features[idx].flags = cpu_to_le32(flags);
+- idx++;
+- }
++ memcpy(rp->features[idx].uuid, debug_uuid, 16);
++ rp->features[idx].flags = cpu_to_le32(flags);
++ idx++;
+ #endif
+
+ if (hdev && hci_dev_le_state_simultaneous(hdev)) {
+--
+2.51.0
+
--- /dev/null
+From 070f507097cd57e8172cdfa39d73501d10fff8c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 19:12:00 +0200
+Subject: bpf: Enforce expected_attach_type for tailcall compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]
+
+Yinhao et al. recently reported:
+
+ Our fuzzer tool discovered an uninitialized pointer issue in the
+ bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
+ This leads to a NULL pointer dereference when a BPF program attempts to
+ deference the txq member of struct xdp_buff object.
+
+The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
+entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
+neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
+of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
+to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
+egress_ifindex, and the latter is only allowed to be accessed under mentioned
+expected_attach_type. progB is then inserted into the tailcall which progA
+calls.
+
+The underlying issue goes beyond XDP though. Another example are programs
+of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
+as sock_addr_func_proto() have different logic depending on the programs'
+expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
+should not be allowed doing a tailcall into a program which calls bpf_bind()
+out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.
+
+In short, specifying expected_attach_type allows to open up additional
+functionality or restrictions beyond what the basic bpf_prog_type enables.
+The use of tailcalls must not violate these constraints. Fix it by enforcing
+expected_attach_type in __bpf_prog_map_compatible().
+
+Note that we only enforce this for tailcall maps, but not for BPF devmaps or
+cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
+cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
+these situations are not prone to this issue.
+
+Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
+Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
+Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/r/20250926171201.188490-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/core.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 83da9c81fa86a..0af6b2a5273ad 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -269,6 +269,7 @@ struct bpf_map_owner {
+ bool xdp_has_frags;
+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
+ const struct btf_type *attach_func_proto;
++ enum bpf_attach_type expected_attach_type;
+ };
+
+ struct bpf_map {
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index 3618be05fc352..a343248c35ded 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2279,6 +2279,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ map->owner->type = prog_type;
+ map->owner->jited = fp->jited;
+ map->owner->xdp_has_frags = aux->xdp_has_frags;
++ map->owner->expected_attach_type = fp->expected_attach_type;
+ map->owner->attach_func_proto = aux->attach_func_proto;
+ for_each_cgroup_storage_type(i) {
+ map->owner->storage_cookie[i] =
+@@ -2290,6 +2291,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
+ ret = map->owner->type == prog_type &&
+ map->owner->jited == fp->jited &&
+ map->owner->xdp_has_frags == aux->xdp_has_frags;
++ if (ret &&
++ map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
++ map->owner->expected_attach_type != fp->expected_attach_type)
++ ret = false;
+ for_each_cgroup_storage_type(i) {
+ if (!ret)
+ break;
+--
+2.51.0
+
--- /dev/null
+From 06bfc87357cf9536edc43e2b7456602f274a6a5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:08:00 +0200
+Subject: bpf: Explicitly check accesses to bpf_sock_addr
+
+From: Paul Chaignon <paul.chaignon@gmail.com>
+
+[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]
+
+Syzkaller found a kernel warning on the following sock_addr program:
+
+ 0: r0 = 0
+ 1: r2 = *(u32 *)(r1 +60)
+ 2: exit
+
+which triggers:
+
+ verifier bug: error during ctx access conversion (0)
+
+This is happening because offset 60 in bpf_sock_addr corresponds to an
+implicit padding of 4 bytes, right after msg_src_ip4. Access to this
+padding isn't rejected in sock_addr_is_valid_access and it thus later
+fails to convert the access.
+
+This patch fixes it by explicitly checking the various fields of
+bpf_sock_addr in sock_addr_is_valid_access.
+
+I checked the other ctx structures and is_valid_access functions and
+didn't find any other similar cases. Other cases of (properly handled)
+padding are covered in new tests in a subsequent patch.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
+Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
+Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 7afb7658c3883..b6dbcef649654 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -9156,13 +9156,17 @@ static bool sock_addr_is_valid_access(int off, int size,
+ return false;
+ info->reg_type = PTR_TO_SOCKET;
+ break;
+- default:
+- if (type == BPF_READ) {
+- if (size != size_default)
+- return false;
+- } else {
++ case bpf_ctx_range(struct bpf_sock_addr, user_family):
++ case bpf_ctx_range(struct bpf_sock_addr, family):
++ case bpf_ctx_range(struct bpf_sock_addr, type):
++ case bpf_ctx_range(struct bpf_sock_addr, protocol):
++ if (type != BPF_READ)
+ return false;
+- }
++ if (size != size_default)
++ return false;
++ break;
++ default:
++ return false;
+ }
+
+ return true;
+--
+2.51.0
+
--- /dev/null
+From 9b66c83b554e25911b1b4f755bdea195ac8dc4d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 23:04:33 +0800
+Subject: bpf: Reject negative offsets for ALU ops
+
+From: Yazhou Tang <tangyazhou518@outlook.com>
+
+[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]
+
+When verifying BPF programs, the check_alu_op() function validates
+instructions with ALU operations. The 'offset' field in these
+instructions is a signed 16-bit integer.
+
+The existing check 'insn->off > 1' was intended to ensure the offset is
+either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
+signed, this check incorrectly accepts all negative values (e.g., -1).
+
+This commit tightens the validation by changing the condition to
+'(insn->off != 0 && insn->off != 1)'. This ensures that any value
+other than the explicitly permitted 0 and 1 is rejected, hardening the
+verifier against malformed BPF programs.
+
+Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com>
+Co-developed-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Tianci Cao <ziye@zju.edu.cn>
+Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
+Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a6f825b7fbe6c..5e644b1b12aaa 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -13727,7 +13727,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ } else { /* all other ALU ops: and, sub, xor, add, ... */
+
+ if (BPF_SRC(insn->code) == BPF_X) {
+- if (insn->imm != 0 || insn->off > 1 ||
++ if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+@@ -13737,7 +13737,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ if (err)
+ return err;
+ } else {
+- if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
++ if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
+ (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
+ verbose(env, "BPF_ALU uses reserved fields\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 469aaa85b6e86629fdd6b189be7c34dea92dd63d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:14:29 +0800
+Subject: bpf: Remove migrate_disable in kprobe_multi_link_prog_run
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]
+
+Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
+called all the way from graph tracer, which disables preemption in
+function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
+need to use migrate_disable. As a result, some overhead may will be reduced.
+And add cant_sleep check for __this_cpu_inc_return.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814121430.2347454-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 8903db0b59602..a896b80252ae1 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -2726,18 +2726,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
+ struct bpf_run_ctx *old_run_ctx;
+ int err;
+
++ /*
++ * graph tracer framework ensures we won't migrate, so there is no need
++ * to use migrate_disable for bpf_prog_run again. The check here just for
++ * __this_cpu_inc_return.
++ */
++ cant_sleep();
++
+ if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
+ err = 0;
+ goto out;
+ }
+
+- migrate_disable();
+ rcu_read_lock();
+ old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
+ err = bpf_prog_run(link->link.prog, regs);
+ bpf_reset_run_ctx(old_run_ctx);
+ rcu_read_unlock();
+- migrate_enable();
+
+ out:
+ __this_cpu_dec(bpf_prog_active);
+--
+2.51.0
+
--- /dev/null
+From 13fe738b3e9e8ebb86a904630a5d183ba79cf19a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 12:12:14 +0000
+Subject: bpf/selftests: Fix test_tcpnotify_user
+
+From: Matt Bobrowski <mattbobrowski@google.com>
+
+[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]
+
+Based on a bisect, it appears that commit 7ee988770326 ("timers:
+Implement the hierarchical pull model") has somehow inadvertently
+broken BPF selftest test_tcpnotify_user. The error that is being
+generated by this test is as follows:
+
+ FAILED: Wrong stats Expected 10 calls, got 8
+
+It looks like the change allows timer functions to be run on CPUs
+different from the one they are armed on. The test had pinned itself
+to CPU 0, and in the past the retransmit attempts also occurred on CPU
+0. The test had set the max_entries attribute for
+BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
+bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
+likely to be in range. With the change to allow timers to run on other
+CPUs, the current CPU tasked with performing the retransmit might be
+bumped and in turn fall out of range, as the event will be filtered
+out via __bpf_perf_event_output() using:
+
+ if (unlikely(index >= array->map.max_entries))
+ return -E2BIG;
+
+A possible change would be to explicitly set the max_entries attribute
+for perf_event_map in test_tcpnotify_kern.c to a value that's at least
+as large as the number of CPUs. As it turns out however, if the field
+is left unset, then the libbpf will determine the number of CPUs available
+on the underlying system and update the max_entries attribute accordingly
+in map_set_def_max_entries().
+
+A further problem with the test is that it has a thread that continues
+running up until the program exits. The main thread cleans up some
+LIBBPF data structures, while the other thread continues to use them,
+which inevitably will trigger a SIGSEGV. This can be dealt with by
+telling the thread to run for as long as necessary and doing a
+pthread_join on it before exiting the program.
+
+Finally, I don't think binding the process to CPU 0 is meaningful for
+this test any more, so get rid of that.
+
+Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
+Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/aJ8kHhwgATmA3rLf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_tcpnotify_kern.c | 1 -
+ .../selftests/bpf/test_tcpnotify_user.c | 20 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+index 540181c115a85..ef00d38b0a8d2 100644
+--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+@@ -23,7 +23,6 @@ struct {
+
+ struct {
+ __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+- __uint(max_entries, 2);
+ __type(key, int);
+ __type(value, __u32);
+ } perf_event_map SEC(".maps");
+diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+index 595194453ff8f..35b4893ccdf8a 100644
+--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
++++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
+@@ -15,20 +15,18 @@
+ #include <bpf/libbpf.h>
+ #include <sys/ioctl.h>
+ #include <linux/rtnetlink.h>
+-#include <signal.h>
+ #include <linux/perf_event.h>
+-#include <linux/err.h>
+
+-#include "bpf_util.h"
+ #include "cgroup_helpers.h"
+
+ #include "test_tcpnotify.h"
+-#include "trace_helpers.h"
+ #include "testing_helpers.h"
+
+ #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+
+ pthread_t tid;
++static bool exit_thread;
++
+ int rx_callbacks;
+
+ static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
+@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
+ {
+ int err;
+
+- while (1) {
++ while (!exit_thread) {
+ err = perf_buffer__poll(pb, 100);
+ if (err < 0 && err != -EINTR) {
+ printf("failed perf_buffer__poll: %d\n", err);
+@@ -78,15 +76,10 @@ int main(int argc, char **argv)
+ int error = EXIT_FAILURE;
+ struct bpf_object *obj;
+ char test_script[80];
+- cpu_set_t cpuset;
+ __u32 key = 0;
+
+ libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
+
+- CPU_ZERO(&cpuset);
+- CPU_SET(0, &cpuset);
+- pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
+-
+ cg_fd = cgroup_setup_and_join(cg_path);
+ if (cg_fd < 0)
+ goto err;
+@@ -151,6 +144,13 @@ int main(int argc, char **argv)
+
+ sleep(10);
+
++ exit_thread = true;
++ int ret = pthread_join(tid, NULL);
++ if (ret) {
++ printf("FAILED: pthread_join\n");
++ goto err;
++ }
++
+ if (verify_result(&g)) {
+ printf("FAILED: Wrong stats Expected %d calls, got %d\n",
+ g.ncalls, rx_callbacks);
+--
+2.51.0
+
--- /dev/null
+From fb3059c5676d112c037eb9f1f1d7d003717a20c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 01:24:45 -0700
+Subject: coresight-etm4x: Conditionally access register TRCEXTINSELR
+
+From: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+
+[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]
+
+The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
+To avoid invalid accesses, introduce a check on numextinsel
+(derived from TRCIDR5[11:9]) before reading or writing to this register.
+
+Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
+Signed-off-by: Yuanfang Zhang <yuanfang.zhang@oss.qualcomm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250812-trcextinselr_issue-v2-1-e6eb121dfcf4@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 2 ++
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 05d9f87e35333..625582f7dc34c 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
+ etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
+@@ -1323,6 +1324,7 @@ static void etm4_init_arch_data(void *info)
+ etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
+ /* NUMEXTIN, bits[8:0] number of external inputs implemented */
+ drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
++ drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
+ /* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
+ drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
+ /* ATBTRIG, bit[22] implementation can support ATB triggers? */
+@@ -1750,7 +1752,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
+ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
+ }
+- state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
++
++ if (drvdata->numextinsel)
++ state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
+@@ -1882,7 +1886,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
+ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
+ }
+- etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
++ if (drvdata->numextinsel)
++ etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+
+ for (i = 0; i < drvdata->nr_cntr; i++) {
+ etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 6b6760e49ed35..d72f742b41054 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -162,6 +162,7 @@
+ #define TRCIDR4_NUMVMIDC_MASK GENMASK(31, 28)
+
+ #define TRCIDR5_NUMEXTIN_MASK GENMASK(8, 0)
++#define TRCIDR5_NUMEXTINSEL_MASK GENMASK(11, 9)
+ #define TRCIDR5_TRACEIDSIZE_MASK GENMASK(21, 16)
+ #define TRCIDR5_ATBTRIG BIT(22)
+ #define TRCIDR5_LPOVERRIDE BIT(23)
+@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
+ u8 nr_cntr;
+ u8 nr_ext_inp;
+ u8 numcidc;
++ u8 numextinsel;
+ u8 numvmidc;
+ u8 nrseqstate;
+ u8 nr_event;
+--
+2.51.0
+
--- /dev/null
+From 1b7abfd47af029b771eb72a5d6e25a348241490e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:39 +0100
+Subject: coresight: etm4x: Support atclk
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]
+
+The atclk is an optional clock for the CoreSight ETMv4, but the driver
+misses to initialize it.
+
+This change enables atclk in probe of the ETMv4 driver, and dynamically
+control the clock during suspend and resume.
+
+No need to check the driver data and clock pointer in the runtime
+suspend and resume, so remove checks. And add error handling in the
+resume function.
+
+Add a minor fix to the comment format when adding the atclk field.
+
+Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250731-arm_cs_fix_clock_v4-v6-3-1dfe10bb3f6f@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../coresight/coresight-etm4x-core.c | 20 ++++++++++++++-----
+ drivers/hwtracing/coresight/coresight-etm4x.h | 4 +++-
+ 2 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 625582f7dc34c..e4d8d446ea4d3 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -2118,6 +2118,10 @@ static int etm4_probe(struct device *dev)
+ if (WARN_ON(!drvdata))
+ return -ENOMEM;
+
++ drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
++ if (IS_ERR(drvdata->atclk))
++ return PTR_ERR(drvdata->atclk);
++
+ if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
+ pm_save_enable = coresight_loses_context_with_cpu(dev) ?
+ PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
+@@ -2369,8 +2373,8 @@ static int etm4_runtime_suspend(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_disable_unprepare(drvdata->pclk);
++ clk_disable_unprepare(drvdata->atclk);
++ clk_disable_unprepare(drvdata->pclk);
+
+ return 0;
+ }
+@@ -2378,11 +2382,17 @@ static int etm4_runtime_suspend(struct device *dev)
+ static int etm4_runtime_resume(struct device *dev)
+ {
+ struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_prepare_enable(drvdata->pclk);
++ if (ret)
++ return ret;
+
+- if (drvdata->pclk && !IS_ERR(drvdata->pclk))
+- clk_prepare_enable(drvdata->pclk);
++ ret = clk_prepare_enable(drvdata->atclk);
++ if (ret)
++ clk_disable_unprepare(drvdata->pclk);
+
+- return 0;
++ return ret;
+ }
+ #endif
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index d72f742b41054..d8b8102d790cc 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -920,7 +920,8 @@ struct etmv4_save_state {
+
+ /**
+ * struct etm4_drvdata - specifics associated to an ETM component
+- * @pclk APB clock if present, otherwise NULL
++ * @pclk: APB clock if present, otherwise NULL
++ * @atclk: Optional clock for the core parts of the ETMv4.
+ * @base: Memory mapped base address for this component.
+ * @csdev: Component vitals needed by the framework.
+ * @spinlock: Only one at a time pls.
+@@ -988,6 +989,7 @@ struct etmv4_save_state {
+ */
+ struct etmv4_drvdata {
+ struct clk *pclk;
++ struct clk *atclk;
+ void __iomem *base;
+ struct coresight_device *csdev;
+ spinlock_t spinlock;
+--
+2.51.0
+
--- /dev/null
+From bcd745a63660feddaa43bf5b9213a231fe782cda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 18:26:19 +0800
+Subject: coresight: Only register perf symlink for sinks with alloc_buffer
+
+From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+
+[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]
+
+Ensure that etm_perf_add_symlink_sink() is only called for devices
+that implement the alloc_buffer operation. This prevents invalid
+symlink creation for dummy sinks that do not implement alloc_buffer.
+
+Without this check, perf may attempt to use a dummy sink that lacks
+alloc_buffer operationsu to initialise perf's ring buffer, leading
+to runtime failures.
+
+Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
+Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250630-etm_perf_sink-v1-1-e4a7211f9ad7@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index 3b57851869eaa..a836952737209 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1638,8 +1638,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
+ goto out_unlock;
+ }
+
+- if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+- csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
++ if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
++ csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
++ sink_ops(csdev)->alloc_buffer) {
+ ret = etm_perf_add_symlink_sink(csdev);
+
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 0edf12eb5cc97bc3725da739e5490071669d681d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:38 +0100
+Subject: coresight: trbe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index e20c1c6acc731..7f91b1ffe66a5 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -21,7 +21,8 @@
+ #include "coresight-self-hosted-trace.h"
+ #include "coresight-trbe.h"
+
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /*
+ * A padding packet that will help the user space tools
+--
+2.51.0
+
--- /dev/null
+From de23c8dbf710e2850c53cd71ceb823492277e91f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:13:52 +0100
+Subject: coresight: trbe: Return NULL pointer for allocation failures
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]
+
+When the TRBE driver fails to allocate a buffer, it currently returns
+the error code "-ENOMEM". However, the caller etm_setup_aux() only
+checks for a NULL pointer, so it misses the error. As a result, the
+driver continues and eventually causes a kernel panic.
+
+Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
+allocation failures. This allows that the callers can properly handle
+the failure.
+
+Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250904-cs_etm_auxsetup_fix_error_handling-v2-1-a502d0bafb95@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
+index 7f91b1ffe66a5..a564bd5c8b62d 100644
+--- a/drivers/hwtracing/coresight/coresight-trbe.c
++++ b/drivers/hwtracing/coresight/coresight-trbe.c
+@@ -744,12 +744,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+
+ buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
+ if (!buf)
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+
+ pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
+ if (!pglist) {
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+
+ for (i = 0; i < nr_pages; i++)
+@@ -759,7 +759,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
+ if (!buf->trbe_base) {
+ kfree(pglist);
+ kfree(buf);
+- return ERR_PTR(-ENOMEM);
++ return NULL;
+ }
+ buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
+ buf->trbe_write = buf->trbe_base;
+--
+2.51.0
+
--- /dev/null
+From 07a80d42b745b91f921a7750279de4ec67f5d058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 08:50:48 -0700
+Subject: cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]
+
+Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
+a result, not all deployed systems have a Device Tree entry where SCMI
+protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
+CPU Device Tree node(s) referencing protocol 0x13 as their clock
+provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
+firmware: arm,scmi: Extend bindings for protocol@13") in 2023.
+
+For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
+to continue, and in the event of not having done an early return, we key
+off the documented compatible string and give them a pass to continue to
+use scmi-cpufreq.
+
+Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 6ff77003a96ea..68325ebd56fe3 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -15,6 +15,7 @@
+ #include <linux/energy_model.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+ #include <linux/scmi_protocol.h>
+@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
+ return true;
+ }
+
++ /*
++ * Older Broadcom STB chips had a "clocks" property for CPU node(s)
++ * that did not match the SCMI performance protocol node, if we got
++ * there, it means we had such an older Device Tree, therefore return
++ * true to preserve backwards compatibility.
++ */
++ if (of_machine_is_compatible("brcm,brcmstb"))
++ return true;
++
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9ce47c3f149c1424d3eeaa375fdaa5a6b20adae7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 17:22:12 +0200
+Subject: cpuidle: qcom-spm: fix device and OF node leaks at probe
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]
+
+Make sure to drop the reference to the saw device taken by
+of_find_device_by_node() after retrieving its driver data during
+probe().
+
+Also drop the reference to the CPU node sooner to avoid leaking it in
+case there is no saw node or device.
+
+Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
+index 1fc9968eae199..b6b06a510fd86 100644
+--- a/drivers/cpuidle/cpuidle-qcom-spm.c
++++ b/drivers/cpuidle/cpuidle-qcom-spm.c
+@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
+ return -ENODEV;
+
+ saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
++ of_node_put(cpu_node);
+ if (!saw_node)
+ return -ENODEV;
+
+ pdev = of_find_device_by_node(saw_node);
+ of_node_put(saw_node);
+- of_node_put(cpu_node);
+ if (!pdev)
+ return -ENODEV;
+
+ data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ put_device(&pdev->dev);
+ return -ENOMEM;
++ }
+
+ data->spm = dev_get_drvdata(&pdev->dev);
++ put_device(&pdev->dev);
+ if (!data->spm)
+ return -EINVAL;
+
+--
+2.51.0
+
--- /dev/null
+From 9ead01f467379bb0300b01e617dbcbf459c7cf3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:07 +0800
+Subject: crypto: hisilicon/qm - check whether the input function and PF are on
+ the same device
+
+From: Zhushuai Yin <yinzhushuai@huawei.com>
+
+[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]
+
+Function rate limiting is set through physical function driver.
+Users configure by providing function information and rate limit values.
+Before configuration, it is necessary to check whether the
+provided function and PF belong to the same device.
+
+Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
+Signed-off-by: Zhushuai Yin <yinzhushuai@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 183885619eb8b..203240e78f6ad 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3748,6 +3748,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
+ }
+
+ pdev = container_of(dev, struct pci_dev, dev);
++ if (pci_physfn(pdev) != qm->pdev) {
++ pci_err(qm->pdev, "the pdev input does not match the pf!\n");
++ return -EINVAL;
++ }
+
+ *fun_index = pdev->devfn;
+
+--
+2.51.0
+
--- /dev/null
+From e2bb482433b5afd0d91e7ca1edcf498cd22369ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:54 +0800
+Subject: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]
+
+When the initialization of qm->debug.acc_diff_reg fails,
+the probe process does not exit. However, after qm->debug.qm_diff_regs is
+freed, it is not set to NULL. This can lead to a double free when the
+remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
+should be set to NULL after it is freed.
+
+Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
+index bd205f1f2279e..573c0033a5afe 100644
+--- a/drivers/crypto/hisilicon/debugfs.c
++++ b/drivers/crypto/hisilicon/debugfs.c
+@@ -865,6 +865,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
+ dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
+ ret = PTR_ERR(qm->debug.acc_diff_regs);
+ qm->debug.acc_diff_regs = NULL;
++ qm->debug.qm_diff_regs = NULL;
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f4add90ba9f5566f7a8badc865541e0abd234078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:05 +0800
+Subject: crypto: hisilicon - re-enable address prefetch after device resuming
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]
+
+When the device resumes from a suspended state, it will revert to its
+initial state and requires re-enabling. Currently, the address prefetch
+function is not re-enabled after device resuming. Move the address prefetch
+enable to the initialization process. In this way, the address prefetch
+can be enabled when the device resumes by calling the initialization
+process.
+
+Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 3 +-
+ drivers/crypto/hisilicon/qm.c | 3 -
+ drivers/crypto/hisilicon/sec2/sec_main.c | 80 +++++++++++------------
+ drivers/crypto/hisilicon/zip/zip_main.c | 5 +-
+ 4 files changed, 43 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 762a2a54ca821..e3d113334d4e4 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -689,6 +689,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+
+ /* Config data buffer pasid needed by Kunpeng 920 */
+ hpre_config_pasid(qm);
++ hpre_open_sva_prefetch(qm);
+
+ hpre_enable_clock_gate(qm);
+
+@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
+ if (ret)
+ return ret;
+
+- hpre_open_sva_prefetch(qm);
+-
+ hisi_qm_dev_err_init(qm);
+ ret = hpre_show_last_regs_init(qm);
+ if (ret)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 7921409791fb0..183885619eb8b 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -4363,9 +4363,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
+ {
+ u32 value;
+
+- if (qm->err_ini->open_sva_prefetch)
+- qm->err_ini->open_sva_prefetch(qm);
+-
+ if (qm->ver >= QM_HW_V3)
+ return;
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 6aaaaf784ddc0..064fbc8db16fc 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -436,6 +436,45 @@ static void sec_set_endian(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
++static void sec_close_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val |= SEC_PREFETCH_DISABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
++ val, !(val & SEC_SVA_DISABLE_READY),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to close sva prefetch\n");
++}
++
++static void sec_open_sva_prefetch(struct hisi_qm *qm)
++{
++ u32 val;
++ int ret;
++
++ if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
++ return;
++
++ /* Enable prefetch */
++ val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
++ val &= SEC_PREFETCH_ENABLE;
++ writel(val, qm->io_base + SEC_PREFETCH_CFG);
++
++ ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
++ val, !(val & SEC_PREFETCH_DISABLE),
++ SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
++ if (ret)
++ pci_err(qm->pdev, "failed to open sva prefetch\n");
++}
++
+ static void sec_engine_sva_config(struct hisi_qm *qm)
+ {
+ u32 reg;
+@@ -469,45 +508,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
+ writel_relaxed(reg, qm->io_base +
+ SEC_INTERFACE_USER_CTRL1_REG);
+ }
+-}
+-
+-static void sec_open_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- /* Enable prefetch */
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val &= SEC_PREFETCH_ENABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+- val, !(val & SEC_PREFETCH_DISABLE),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to open sva prefetch\n");
+-}
+-
+-static void sec_close_sva_prefetch(struct hisi_qm *qm)
+-{
+- u32 val;
+- int ret;
+-
+- if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+- return;
+-
+- val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+- val |= SEC_PREFETCH_DISABLE;
+- writel(val, qm->io_base + SEC_PREFETCH_CFG);
+-
+- ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+- val, !(val & SEC_SVA_DISABLE_READY),
+- SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to close sva prefetch\n");
++ sec_open_sva_prefetch(qm);
+ }
+
+ static void sec_enable_clock_gate(struct hisi_qm *qm)
+@@ -1090,7 +1091,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ if (ret)
+ return ret;
+
+- sec_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ sec_debug_regs_clear(qm);
+ ret = sec_show_last_regs_init(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 6e419c5165cb4..b70aa6032874e 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -577,6 +577,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
+ writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
+ }
++ hisi_zip_open_sva_prefetch(qm);
+
+ /* let's open all compression/decompression cores */
+ dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
+@@ -588,6 +589,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
+ FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
+
++ hisi_zip_set_high_perf(qm);
+ hisi_zip_enable_clock_gate(qm);
+
+ return 0;
+@@ -1172,9 +1174,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- hisi_zip_set_high_perf(qm);
+-
+- hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+ hisi_zip_debug_regs_clear(qm);
+
+--
+2.51.0
+
--- /dev/null
+From b00084ba75980192319b6872347843b38d72875a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:04 +0800
+Subject: crypto: hisilicon/zip - remove unnecessary validation for
+ high-performance mode configurations
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]
+
+When configuring the high-performance mode register, there is no
+need to verify whether the register has been successfully
+enabled, as there is no possibility of a write failure for this
+register.
+
+Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 66e553115adfd..6e419c5165cb4 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -469,10 +469,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ return false;
+ }
+
+-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++static void hisi_zip_set_high_perf(struct hisi_qm *qm)
+ {
+ u32 val;
+- int ret;
+
+ val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
+ if (perf_mode == HZIP_HIGH_COMP_PERF)
+@@ -482,13 +481,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+
+ /* Set perf mode */
+ writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
+- ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
+- val, val == perf_mode, HZIP_DELAY_1_US,
+- HZIP_POLL_TIMEOUT_US);
+- if (ret)
+- pci_err(qm->pdev, "failed to set perf mode\n");
+-
+- return ret;
+ }
+
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+@@ -1180,9 +1172,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ if (ret)
+ return ret;
+
+- ret = hisi_zip_set_high_perf(qm);
+- if (ret)
+- return ret;
++ hisi_zip_set_high_perf(qm);
+
+ hisi_zip_open_sva_prefetch(qm);
+ hisi_qm_dev_err_init(qm);
+--
+2.51.0
+
--- /dev/null
+From 86538abc8344ae3f3bd4adfc097f11cfbdad9900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 14:03:30 +0200
+Subject: crypto: keembay - Add missing check after sg_nents_for_len()
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]
+
+sg_nents_for_len() returns an int which is negative in case of error.
+
+Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+index b732223035399..3b5d5b64e1414 100644
+--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
++++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ struct device *dev = rctx->hcu_dev->dev;
+ unsigned int remainder = 0;
+ unsigned int total;
+- size_t nents;
++ int nents;
+ size_t count;
+ int rc;
+ int i;
+@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
+ /* Determine the number of scatter gather list entries to process. */
+ nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
+
++ if (nents < 0)
++ return nents;
++
+ /* If there are entries to process, map them. */
+ if (nents) {
+ rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
+--
+2.51.0
+
--- /dev/null
+From 7fa4537ea740f0a4da86ea8af040a8f923e6f24e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 12:42:01 +0700
+Subject: Documentation: trace: historgram-design: Separate sched_waking
+ histogram section heading and the following diagram
+
+From: Bagas Sanjaya <bagasdotme@gmail.com>
+
+[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]
+
+Section heading for sched_waking histogram is shown as normal paragraph
+instead due to codeblock marker for the following diagram being in the
+same line as the section underline. Separate them.
+
+Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Message-ID: <20250916054202.582074-5-bagasdotme@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/trace/histogram-design.rst | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
+index 5765eb3e9efa7..a30f4bed11b4e 100644
+--- a/Documentation/trace/histogram-design.rst
++++ b/Documentation/trace/histogram-design.rst
+@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
+ trigger above.
+
+ sched_waking histogram
+-----------------------::
++----------------------
++
++.. code-block::
+
+ +------------------+
+ | hist_data |<-------------------------------------------------------+
+--
+2.51.0
+
--- /dev/null
+From 30899974d3da15845699a345d89ac38be5ac515e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 11:11:44 +0530
+Subject: drivers/base/node: fix double free in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
+
+When device_register() fails in register_node(), it calls
+put_device(&node->dev). This triggers node_device_release(), which calls
+kfree(to_node(dev)), thereby freeing the entire node structure.
+
+As a result, when register_node() returns an error, the node memory has
+already been freed. Calling kfree(node) again in register_one_node()
+leads to a double free.
+
+This patch removes the redundant kfree(node) from register_one_node() to
+prevent the double free.
+
+Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
+Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Oscar Salvador <osalvador@suse.de>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Chris Mason <clm@meta.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 7b2ff66c119ae..47960a34305d3 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -880,7 +880,6 @@ int __register_one_node(int nid)
+ error = register_node(node_devices[nid], nid);
+ if (error) {
+ node_devices[nid] = NULL;
+- kfree(node);
+ return error;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 619e2040ca1db4e53844c3a8afd549453dadb233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 14:18:45 +0530
+Subject: drivers/base/node: handle error properly in register_one_node()
+
+From: Donet Tom <donettom@linux.ibm.com>
+
+[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]
+
+If register_node() returns an error, it is not handled correctly.
+The function will proceed further and try to register CPUs under the
+node, which is not correct.
+
+So, in this patch, if register_node() returns an error, we return
+immediately from the function.
+
+Link: https://lkml.kernel.org/r/20250822084845.19219-1-donettom@linux.ibm.com
+Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
+Signed-off-by: Donet Tom <donettom@linux.ibm.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alison Schofield <alison.schofield@intel.com>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Donet Tom <donettom@linux.ibm.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
+Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
+Cc: Zi Yan <ziy@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/node.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 4d588f4658c85..7b2ff66c119ae 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -878,6 +878,11 @@ int __register_one_node(int nid)
+ node_devices[nid] = node;
+
+ error = register_node(node_devices[nid], nid);
++ if (error) {
++ node_devices[nid] = NULL;
++ kfree(node);
++ return error;
++ }
+
+ /* link cpu under this node */
+ for_each_present_cpu(cpu) {
+--
+2.51.0
+
--- /dev/null
+From 685f86081f28df5d1a56028e26ee322287a52ebe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:50:14 +0800
+Subject: drm/amd/display: Remove redundant semicolons
+
+From: Liao Yuanhong <liaoyuanhong@vivo.com>
+
+[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]
+
+Remove unnecessary semicolons.
+
+Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
+Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+index 9ba6cb67655f4..6c75aa82327ac 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
+ if (dual_plane) {
+ unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
+ num_pipes, pipe_idx);
+- ;
+ if (src->sw_mode == dm_sw_linear)
+ ASSERT(p1_pte_row_height_linear >= 8);
+
+--
+2.51.0
+
--- /dev/null
+From a917c77bdbfa99eb37e9b48519b5808ffa44ad5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:07 +0200
+Subject: drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]
+
+Based on some comments in dm_pp_display_configuration
+above the crtc_index and line_time fields, these values
+are programmed to the SMC to work around an SMC hang
+when it switches MCLK.
+
+According to Alex, the Windows driver programs them to:
+mclk_change_block_cp_min = 200 / line_time
+mclk_change_block_cp_max = 100 / line_time
+Let's use the same for the sake of consistency.
+
+Previously we used the watermark values, but it seemed buggy
+as the code was mixing up low/high and A/B watermarks, and
+was not saving a low watermark value on DCE 6, so
+mclk_change_block_cp_max would be always zero previously.
+
+Split this change off from the previous si_upload_smc_data
+to make it easier to bisect, in case it causes any issues.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index cff55daa68ab8..3ce9396900f7f 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ crtc_index = amdgpu_crtc->crtc_id;
+
+ if (amdgpu_crtc->line_time) {
+- mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+- mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2fa29d85081f5e2c1c58f5883b01927860773a53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:09 +0200
+Subject: drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]
+
+According to pp_pm_compute_clocks the non-DC display code
+has "issues with mclk switching with refresh rates over 120 hz".
+The workaround is to disable MCLK switching in this case.
+
+Do the same for legacy DPM.
+
+Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+index 42efe838fa85c..2d2d2d5e67634 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
+ (amdgpu_crtc->v_border * 2));
+
+ vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
++
++ /* we have issues with mclk switching with
++ * refresh rates over 120 hz on the non-DC code.
++ */
++ if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
++ vblank_time_us = 0;
++
+ break;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From bc80cda95da1d10f477f3b7fd88dc52fedac21dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:10 +0200
+Subject: drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks
+ (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]
+
+Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
+switching on Oland when two 4K 60Hz monitors are connected")
+
+This is an ad-hoc DPM fix, necessary because we don't have
+proper bandwidth calculation for DCE 6.
+
+We define "high pixelclock" for SI as higher than necessary
+for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
+this category.
+
+When two high pixel clock displays are connected to Oland,
+additionally disable shader clock switching, which results in
+a higher voltage, thereby addressing some visible flickering.
+
+v2:
+Add more comments.
+v3:
+Split into two commits for easier review.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 075d183bb1bb9..2863dc65ffc6f 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ {
+ struct si_ps *ps = si_get_ps(rps);
+ struct amdgpu_clock_and_voltage_limits *max_limits;
++ struct amdgpu_connector *conn;
+ bool disable_mclk_switching = false;
+ bool disable_sclk_switching = false;
+ u32 mclk, sclk;
+ u16 vddc, vddci, min_vce_voltage = 0;
+ u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
+ u32 max_sclk = 0, max_mclk = 0;
++ u32 high_pixelclock_count = 0;
+ int i;
+
+ if (adev->asic_type == CHIP_HAINAN) {
+@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
+ }
+ }
+
++ /* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
++ * For example, 4K 60Hz and 1080p 144Hz fall into this category.
++ * Find number of such displays connected.
++ */
++ for (i = 0; i < adev->mode_info.num_crtc; i++) {
++ if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
++ !adev->mode_info.crtcs[i]->enabled)
++ continue;
++
++ conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
++
++ if (conn->pixelclock_for_modeset > 297000)
++ high_pixelclock_count++;
++ }
++
++ /* These are some ad-hoc fixes to some issues observed with SI GPUs.
++ * They are necessary because we don't have something like dce_calcs
++ * for these GPUs to calculate bandwidth requirements.
++ */
++ if (high_pixelclock_count) {
++ /* On Oland, we observe some flickering when two 4K 60Hz
++ * displays are connected, possibly because voltage is too low.
++ * Raise the voltage by requiring a higher SCLK.
++ * (Voltage cannot be adjusted independently without also SCLK.)
++ */
++ if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
++ disable_sclk_switching = true;
++ }
++
+ if (rps->vce_active) {
+ rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
+ rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
+--
+2.51.0
+
--- /dev/null
+From 0d1ee908213709b59cf1e55cb849efef652e88d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:04 +0200
+Subject: drm/amd/pm: Disable ULV even if unsupported (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]
+
+Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
+is unsupported, to make sure it is properly turned off.
+
+v3:
+Simplify si_disable_ulv further.
+Always check the return value of amdgpu_si_send_msg_to_smc.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index e7b1fa2feb928..8be367c49367d 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
+
+ static int si_disable_ulv(struct amdgpu_device *adev)
+ {
+- struct si_power_info *si_pi = si_get_pi(adev);
+- struct si_ulv_param *ulv = &si_pi->ulv;
++ PPSMC_Result r;
+
+- if (ulv->supported)
+- return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
+- 0 : -EINVAL;
+-
+- return 0;
++ r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
++ return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
+ }
+
+ static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
+--
+2.51.0
+
--- /dev/null
+From aaa02e8e5818b7b51330a9cde5fc7f3d1e1a2d46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:06 +0200
+Subject: drm/amd/pm: Fix si_upload_smc_data (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]
+
+The si_upload_smc_data function uses si_write_smc_soft_register
+to set some register values in the SMC, and expects the result
+to be PPSMC_Result_OK which is 1.
+
+The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
+checking the result of a command sent to the SMC.
+However, the si_write_smc_soft_register actually doesn't send
+any commands to the SMC and returns zero on success,
+so this check was incorrect.
+
+Fix that by not checking the return value, just like other
+calls to si_write_smc_soft_register.
+
+v3:
+Additionally, when no display is plugged in, there is no need
+to restrict MCLK switching, so program the registers to zero.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 8be367c49367d..cff55daa68ab8 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -5793,9 +5793,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ {
+ struct amdgpu_crtc *amdgpu_crtc = NULL;
+ int i;
+-
+- if (adev->pm.dpm.new_active_crtc_count == 0)
+- return 0;
++ u32 crtc_index = 0;
++ u32 mclk_change_block_cp_min = 0;
++ u32 mclk_change_block_cp_max = 0;
+
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
+ if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
+@@ -5804,26 +5804,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
+ }
+ }
+
+- if (amdgpu_crtc == NULL)
+- return 0;
++ /* When a display is plugged in, program these so that the SMC
++ * performs MCLK switching when it doesn't cause flickering.
++ * When no display is plugged in, there is no need to restrict
++ * MCLK switching, so program them to zero.
++ */
++ if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
++ crtc_index = amdgpu_crtc->crtc_id;
+
+- if (amdgpu_crtc->line_time <= 0)
+- return 0;
++ if (amdgpu_crtc->line_time) {
++ mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
++ mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
++ }
++ }
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_crtc_index,
+- amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_crtc_index,
++ crtc_index);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+- amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
++ mclk_change_block_cp_min);
+
+- if (si_write_smc_soft_register(adev,
+- SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+- amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
+- return 0;
++ si_write_smc_soft_register(adev,
++ SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
++ mclk_change_block_cp_max);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 40a3292d747b72c6d4ad8f5e82dd3b6bcedc0aa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:08 +0200
+Subject: drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]
+
+Some parts of the code base expect that MCLK switching is turned
+off when the vblank time is set to zero.
+
+According to pp_pm_compute_clocks the non-DC code has issues
+with MCLK switching with refresh rates over 120 Hz.
+
+v3:
+Add code comment to explain this better.
+Add an if statement instead of changing the switch_limit.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index 3ce9396900f7f..075d183bb1bb9 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
+ /* we never hit the non-gddr5 limit so disable it */
+ u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
+
+- if (vblank_time < switch_limit)
++ /* Consider zero vblank time too short and disable MCLK switching.
++ * Note that the vblank time is set to maximum when no displays are attached,
++ * so we'll still enable MCLK switching in that case.
++ */
++ if (vblank_time == 0)
++ return true;
++ else if (vblank_time < switch_limit)
+ return true;
+ else
+ return false;
+--
+2.51.0
+
--- /dev/null
+From f01891b13a64141a0bc9ab319e5bf8552ad8c28a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:03 +0200
+Subject: drm/amdgpu: Power up UVD 3 for FW validation (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]
+
+Unlike later versions, UVD 3 has firmware validation.
+For this to work, the UVD should be powered up correctly.
+
+When DPM is enabled and the display clock is off,
+the SMU may choose a power state which doesn't power
+the UVD, which can result in failure to initialize UVD.
+
+v2:
+Add code comments to explain about the UVD power state
+and how UVD clock is turned on/off.
+
+Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
+ 1 file changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+index 5534c769b6550..1e0189f90fd6a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
+ *
+ * @handle: handle used to pass amdgpu_device pointer
+ *
+- * Initialize the hardware, boot up the VCPU and do some testing
++ * Initialize the hardware, boot up the VCPU and do some testing.
++ *
++ * On SI, the UVD is meant to be used in a specific power state,
++ * or alternatively the driver can manually enable its clock.
++ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
++ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
++ * for the SMU and afterwards enables the UVD clock.
++ * This is automatically done by amdgpu_uvd_ring_begin_use when work
++ * is submitted to the UVD ring. Here, we have to call it manually
++ * in order to power up UVD before firmware validation.
++ *
++ * Note that we must not disable the UVD clock here, as that would
++ * cause the ring test to fail. However, UVD is powered off
++ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
++ * the UVD idle work handler which will disable the UVD clock when
++ * all fences are signalled.
+ */
+ static int uvd_v3_1_hw_init(void *handle)
+ {
+@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)
+ int r;
+
+ uvd_v3_1_mc_resume(adev);
++ uvd_v3_1_enable_mgcg(adev, true);
++
++ /* Make sure UVD is powered during FW validation.
++ * It's going to be automatically powered off after the ring test.
++ */
++ if (adev->pm.dpm_enabled)
++ amdgpu_dpm_enable_uvd(adev, true);
++ else
++ amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+
+ r = uvd_v3_1_fw_validate(adev);
+ if (r) {
+@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)
+ return r;
+ }
+
+- uvd_v3_1_enable_mgcg(adev, true);
+- amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
+-
+ uvd_v3_1_start(adev);
+
+ r = amdgpu_ring_test_helper(ring);
+--
+2.51.0
+
--- /dev/null
+From ee10ab69bf77c71c9ebdf8b90ca0daae5e4788a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 20:36:46 +0800
+Subject: drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]
+
+Use negative error code -EINVAL instead of positive EINVAL in the default
+case of svm_ioctl() to conform to Linux kernel error code conventions.
+
+Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index b77b472332316..3168d6fb11e76 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -4142,7 +4142,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
+ r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
+ break;
+ default:
+- r = EINVAL;
++ r = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b9da0026316a6a3102a88529275cec446cd08a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:58:25 -0700
+Subject: drm/bridge: it6505: select REGMAP_I2C
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]
+
+Fix
+
+ aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
+ ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250610235825.3113075-1-olvaffe@gmail.com
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
+index 3e6a4e2044c0e..5a4d574b37b89 100644
+--- a/drivers/gpu/drm/bridge/Kconfig
++++ b/drivers/gpu/drm/bridge/Kconfig
+@@ -85,6 +85,7 @@ config DRM_ITE_IT6505
+ select EXTCON
+ select CRYPTO
+ select CRYPTO_HASH
++ select REGMAP_I2C
+ help
+ ITE IT6505 DisplayPort bridge chip driver.
+
+--
+2.51.0
+
--- /dev/null
+From 9b74ec3d0553309d244e3000922bcd72c1bf01cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:20:45 +0800
+Subject: drm/msm/dpu: fix incorrect type for ret
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]
+
+Change 'ret' from unsigned long to int, as storing negative error codes
+in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
+errors.
+
+Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/671100/
+Link: https://lore.kernel.org/r/20250826092047.224341-1-rongqianfeng@vivo.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+index 0a45c546b03f2..a5cd41c9224d7 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+@@ -433,7 +433,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
+ static int dpu_encoder_phys_wb_wait_for_commit_done(
+ struct dpu_encoder_phys *phys_enc)
+ {
+- unsigned long ret;
++ int ret;
+ struct dpu_encoder_wait_info wait_info;
+ struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
+
+--
+2.51.0
+
--- /dev/null
+From 73ec6be83a4a03616d40c379171aa0f85a8e63f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 21:23:41 -0600
+Subject: drm/panel: novatek-nt35560: Fix invalid return value
+
+From: Brigham Campbell <me@brighamcampbell.com>
+
+[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]
+
+Fix bug in nt35560_set_brightness() which causes the function to
+erroneously report an error. mipi_dsi_dcs_write() returns either a
+negative value when an error occurred or a positive number of bytes
+written when no error occurred. The buggy code reports an error under
+either condition.
+
+Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Brigham Campbell <me@brighamcampbell.com>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250731032343.1258366-2-me@brighamcampbell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+index 5bbea734123bc..ee04c55175bb8 100644
+--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
++++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
+ par = 0x00;
+ ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
+ &par, 1);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 78c12b7a7e3dd3f3d416c0aa9b8834932d8cd0f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:51:25 +0530
+Subject: drm/radeon/r600_cs: clean up of dead code in r600_cs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]
+
+GCC 16 enables -Werror=unused-but-set-variable= which results in build
+error with the following message.
+
+drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
+drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
+ 1411 | unsigned offset, i, level;
+ | ^~~~~
+cc1: all warnings being treated as errors
+make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1
+
+level although is set, but in never used in the function
+r600_texture_size. Thus resulting in dead code and this error getting
+triggered.
+
+Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index ac77d1246b945..811265648a582 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ unsigned block_align, unsigned height_align, unsigned base_align,
+ unsigned *l0_size, unsigned *mipmap_size)
+ {
+- unsigned offset, i, level;
++ unsigned offset, i;
+ unsigned width, height, depth, size;
+ unsigned blocksize;
+ unsigned nbx, nby;
+@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
+ w0 = r600_mip_minify(w0, 0);
+ h0 = r600_mip_minify(h0, 0);
+ d0 = r600_mip_minify(d0, 0);
+- for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
++ for (i = 0, offset = 0; i < nlevels; i++) {
+ width = r600_mip_minify(w0, i);
+ nbx = r600_fmt_get_nblocksx(format, width);
+
+--
+2.51.0
+
--- /dev/null
+From 0fb95991d67416105f0dd5785d943e7459f5bec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 14:57:07 +0800
+Subject: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]
+
+When loading the i10nm_edac driver on some Intel Granite Rapids servers,
+a call trace may appear as follows:
+
+ UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
+ shift exponent -66 is negative
+ ...
+ __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
+ skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
+ i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
+ skx_register_mci+0x159/0x220 [skx_edac_common]
+ i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
+ ...
+
+This occurs because some BIOS may disable a memory controller if there
+aren't any memory DIMMs populated on this memory controller. The DIMMMTR
+register of this disabled memory controller contains the invalid value
+~0, resulting in the call trace above.
+
+Fix this call trace by skipping DIMM enumeration on a disabled memory
+controller.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Reported-by: Jose Jesus Ambriz Meza <jose.jesus.ambriz.meza@intel.com>
+Reported-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Closes: https://lore.kernel.org/all/20250730063155.2612379-1-acelan.kao@canonical.com/
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Link: https://lore.kernel.org/r/20250806065707.3533345-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index 068597e8fce95..3c70d86074975 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -970,6 +970,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
+ return !!GET_BITFIELD(mcmtr, 2, 2);
+ }
+
++static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
++{
++ u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
++
++ edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
++
++ return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
++}
++
+ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ struct res_config *cfg)
+ {
+@@ -983,6 +992,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+ if (!imc->mbase)
+ continue;
+
++ if (i10nm_channel_disabled(imc, i)) {
++ edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
++ continue;
++ }
++
+ ndimms = 0;
+ amap = I10NM_GET_AMAP(imc, i);
+
+--
+2.51.0
+
--- /dev/null
+From 7d90d626a97bbc4a6d56508157a6bcf4bd39e23b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:03:38 +0800
+Subject: f2fs: fix condition in __allow_reserved_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]
+
+If reserve_root mount option is not assigned, __allow_reserved_blocks()
+will return false, it's not correct, fix it.
+
+Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 7329f706da83c..ab2ddd09d8131 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2296,8 +2296,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+ {
+ if (!inode)
+ return true;
+- if (!test_opt(sbi, RESERVE_ROOT))
+- return false;
+ if (IS_NOQUOTA(inode))
+ return true;
+ if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
+@@ -2318,7 +2316,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
+ avail_user_block_count = sbi->user_block_count -
+ sbi->current_reserved_blocks;
+
+- if (!__allow_reserved_blocks(sbi, inode, cap))
++ if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
+ avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
+--
+2.51.0
+
--- /dev/null
+From 89c74c5709493c187cc65f3c34c164a86cc5631a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 10:47:09 +0800
+Subject: f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]
+
+f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
+and page lookup, change as below to mitigate its overhead:
+- check new_size before grabbing invalidate_lock
+- lookup and invalidate pages only in range of [old_size, new_size]
+
+Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 20d102009f715..6267ba6ef1083 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -36,15 +36,23 @@
+ #include <trace/events/f2fs.h>
+ #include <uapi/linux/f2fs.h>
+
+-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
++static void f2fs_zero_post_eof_page(struct inode *inode,
++ loff_t new_size, bool lock)
+ {
+ loff_t old_size = i_size_read(inode);
+
+ if (old_size >= new_size)
+ return;
+
++ if (mapping_empty(inode->i_mapping))
++ return;
++
++ if (lock)
++ filemap_invalidate_lock(inode->i_mapping);
+ /* zero or drop pages only in range of [old_size, new_size] */
+- truncate_pagecache(inode, old_size);
++ truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
++ if (lock)
++ filemap_invalidate_unlock(inode->i_mapping);
+ }
+
+ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+@@ -115,9 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+
+ f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
+
+ file_update_time(vmf->vma->vm_file);
+ filemap_invalidate_lock_shared(inode->i_mapping);
+@@ -1077,7 +1083,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ filemap_invalidate_lock(inode->i_mapping);
+
+ if (attr->ia_size > old_size)
+- f2fs_zero_post_eof_page(inode, attr->ia_size);
++ f2fs_zero_post_eof_page(inode, attr->ia_size, false);
+ truncate_setsize(inode, attr->ia_size);
+
+ if (attr->ia_size <= old_size)
+@@ -1196,9 +1202,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1484,7 +1488,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(inode->i_mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+
+ f2fs_lock_op(sbi);
+ f2fs_drop_extent_tree(inode);
+@@ -1608,9 +1612,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
+ if (ret)
+ return ret;
+
+- filemap_invalidate_lock(mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
+ pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
+@@ -1744,7 +1746,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
+ f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ filemap_invalidate_lock(mapping);
+
+- f2fs_zero_post_eof_page(inode, offset + len);
++ f2fs_zero_post_eof_page(inode, offset + len, false);
+ truncate_pagecache(inode, offset);
+
+ while (!ret && idx > pg_start) {
+@@ -1800,9 +1802,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, offset + len);
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode, offset + len, true);
+
+ f2fs_balance_fs(sbi, true);
+
+@@ -4718,9 +4718,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
+ if (err)
+ return err;
+
+- filemap_invalidate_lock(inode->i_mapping);
+- f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
+- filemap_invalidate_unlock(inode->i_mapping);
++ f2fs_zero_post_eof_page(inode,
++ iocb->ki_pos + iov_iter_count(from), true);
+ return count;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a2b853613a2f8a51b13c645039395cbd13304b88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:40:24 +0800
+Subject: f2fs: fix to truncate first page in error path of f2fs_truncate()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]
+
+syzbot reports a bug as below:
+
+loop0: detected capacity change from 0 to 40427
+F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
+F2FS-fs (loop0): invalid crc value
+F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
+------------[ cut here ]------------
+kernel BUG at fs/inode.c:753!
+RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
+Call Trace:
+ <TASK>
+ evict+0x504/0x9c0 fs/inode.c:810
+ f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
+ get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
+ vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
+ do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
+ do_mount fs/namespace.c:4136 [inline]
+ __do_sys_mount fs/namespace.c:4347 [inline]
+ __se_sys_mount+0x317/0x410 fs/namespace.c:4324
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
+all page cache before destorying inode, that is because in below path, we
+will create page #0 in cache, but missed to drop it in error path, let's fix
+it.
+
+- evict
+ - f2fs_evict_inode
+ - f2fs_truncate
+ - f2fs_convert_inline_inode
+ - f2fs_grab_cache_folio
+ : create page #0 in cache
+ - f2fs_convert_inline_folio
+ : sanity check failed, return -EFSCORRUPTED
+ - clear_inode detects that inode->i_data.nrpages is not zero
+
+Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
+Reported-by: syzbot+90266696fe5daacebd35@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-f2fs-devel/68c09802.050a0220.3c6139.000e.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 031015823acb2..20d102009f715 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -844,8 +844,16 @@ int f2fs_truncate(struct inode *inode)
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+- if (err)
++ if (err) {
++ /*
++ * Always truncate page #0 to avoid page cache
++ * leak in evict() path.
++ */
++ truncate_inode_pages_range(inode->i_mapping,
++ F2FS_BLK_TO_BYTES(0),
++ F2FS_BLK_END_BYTES(0));
+ return err;
++ }
+ }
+
+ err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
+--
+2.51.0
+
--- /dev/null
+From 0dc0482272bb82291dbabbcdca6aeb1b3d778cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:12:50 +0800
+Subject: f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]
+
+Script to reproduce:
+mkfs.f2fs -O extra_attr,compression /dev/vdb -f
+mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
+cd /mnt/f2fs
+f2fs_io write 1 0 1024 rand dsync testfile
+xfs_io testfile -c "fsync"
+f2fs_io write 1 0 512 rand dsync testfile
+xfs_io testfile -c "fsync"
+cd /
+umount /mnt/f2fs
+mount /dev/vdb /mnt/f2fs
+f2fs_io precache_extents /mnt/f2fs/testfile
+umount /mnt/f2fs
+
+Tracepoint output:
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
+f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0
+
+During precache_extents, there is off-by-one issue, we should update
+map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
+valid and not contiguous to previous extent.
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index d37104aa847a7..0e119218ebf74 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1756,7 +1756,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+- *map->m_next_extent = pgofs + 1;
++ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+ }
+ f2fs_put_dnode(&dn);
+ unlock_out:
+--
+2.51.0
+
--- /dev/null
+From 3cf3b7f647f3ecddd5ec5e6f701007ee3ab56136 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:21 +0800
+Subject: f2fs: fix zero-sized extent for precache extents
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]
+
+Script to reproduce:
+f2fs_io write 1 0 1881 rand dsync testfile
+f2fs_io fallocate 0 7708672 4096 testfile
+f2fs_io write 1 1881 1 rand buffered testfile
+fsync testfile
+umount
+mount
+f2fs_io precache_extents testfile
+
+When the data layout is something like this:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+...
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+During precache_extents, we map the last block(valid blkaddr) in dnode1:
+map->m_flags |= F2FS_MAP_MAPPED;
+map->m_pblk = blkaddr(valid blkaddr);
+map->m_len = 1;
+then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
+map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:
+
+map->m_len = 1
+ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
+ei.fofs = start_pgofs = 1882
+ei.len = map->m_len - ofs = 1 - 1 = 0
+
+Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
+A,B,C is valid blkaddr
+case1:
+dnode1: dnode2:
+[0] A [0] NEW_ADDR
+[1] A+1 [1] 0x0
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case2:
+dnode1: dnode2:
+[0] A [0] C (C!=B+1)
+[1] A+1 [1] C+1
+... ....
+[1016] A+1016
+[1017] B (B!=A+1017) [1017] 0x0
+
+case3:
+dnode1: dnode2:
+[0] A [0] C (C!=B+2)
+[1] A+1 [1] C+1
+... ....
+[1015] A+1015
+[1016] B (B!=A+1016)
+[1017] B+1 [1017] 0x0
+
+[1] https://lore.kernel.org/linux-f2fs-devel/20250912081250.44383-1-chao@kernel.org/
+
+Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 0e119218ebf74..fe23ebfc88ea1 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1751,9 +1751,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
+ if (map->m_flags & F2FS_MAP_MAPPED) {
+ unsigned int ofs = start_pgofs - map->m_lblk;
+
+- f2fs_update_read_extent_cache_range(&dn,
+- start_pgofs, map->m_pblk + ofs,
+- map->m_len - ofs);
++ if (map->m_len > ofs)
++ f2fs_update_read_extent_cache_range(&dn,
++ start_pgofs, map->m_pblk + ofs,
++ map->m_len - ofs);
+ }
+ if (map->m_next_extent)
+ *map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
+--
+2.51.0
+
--- /dev/null
+From cbb2694a43c0c01fd573f1fd52601ab975ed19cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 11:23:33 -0400
+Subject: filelock: add FL_RECLAIM to show_fl_flags() macro
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]
+
+Show the FL_RECLAIM flag symbolically in tracepoints.
+
+Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Link: https://lore.kernel.org/20250903-filelock-v1-1-f2926902962d@kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/filelock.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
+index 1646dadd7f37c..3b1c8d93b2654 100644
+--- a/include/trace/events/filelock.h
++++ b/include/trace/events/filelock.h
+@@ -27,7 +27,8 @@
+ { FL_SLEEP, "FL_SLEEP" }, \
+ { FL_DOWNGRADE_PENDING, "FL_DOWNGRADE_PENDING" }, \
+ { FL_UNLOCK_PENDING, "FL_UNLOCK_PENDING" }, \
+- { FL_OFDLCK, "FL_OFDLCK" })
++ { FL_OFDLCK, "FL_OFDLCK" }, \
++ { FL_RECLAIM, "FL_RECLAIM"})
+
+ #define show_fl_type(val) \
+ __print_symbolic(val, \
+--
+2.51.0
+
--- /dev/null
+From 028d2d58a4b464685d984d58a28e928b97707046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 09:54:29 +0200
+Subject: firmware: firmware: meson-sm: fix compile-test default
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]
+
+Enabling compile testing should not enable every individual driver (we
+have "allyesconfig" for that).
+
+Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20250725075429.10056-1-johan@kernel.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
+index f2fdd37566482..179f5d46d8ddf 100644
+--- a/drivers/firmware/meson/Kconfig
++++ b/drivers/firmware/meson/Kconfig
+@@ -5,7 +5,7 @@
+ config MESON_SM
+ tristate "Amlogic Secure Monitor driver"
+ depends on ARCH_MESON || COMPILE_TEST
+- default y
++ default ARCH_MESON
+ depends on ARM64_4K_PAGES
+ help
+ Say y here to enable the Amlogic secure monitor driver
+--
+2.51.0
+
--- /dev/null
+From 0177a9822d7f982563085fbeb64f71b346ec9db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:08:55 +0300
+Subject: fs: ntfs3: Fix integer overflow in run_unpack()
+
+From: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+
+[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]
+
+The MFT record relative to the file being opened contains its runlist,
+an array containing information about the file's location on the physical
+disk. Analysis of all Call Stack paths showed that the values of the
+runlist array, from which LCNs are calculated, are not validated before
+run_unpack function.
+
+The run_unpack function decodes the compressed runlist data format
+from MFT attributes (for example, $DATA), converting them into a runs_tree
+structure, which describes the mapping of virtual clusters (VCN) to
+logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
+deleting files from MFT records - in this case, the RUN_DEALLOCATE
+command is sent to the run_unpack input, and the function logic
+provides that all data transferred to the runlist about file or
+directory is deleted without creating a runs_tree structure.
+
+Substituting the runlist in the $DATA attribute of the MFT record for an
+arbitrary file can lead either to access to arbitrary data on the disk
+bypassing access checks to them (since the inode access check
+occurs above) or to destruction of arbitrary data on the disk.
+
+Add overflow check for addition operation.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Vitaly Grigoryev <Vitaly.Grigoryev@kaspersky.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/run.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
+index 44e93ad491ba7..0139124578d9e 100644
+--- a/fs/ntfs3/run.c
++++ b/fs/ntfs3/run.c
+@@ -9,6 +9,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/fs.h>
+ #include <linux/log2.h>
++#include <linux/overflow.h>
+
+ #include "debug.h"
+ #include "ntfs.h"
+@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
+
+ if (!dlcn)
+ return -EINVAL;
+- lcn = prev_lcn + dlcn;
++
++ if (check_add_overflow(prev_lcn, dlcn, &lcn))
++ return -EINVAL;
+ prev_lcn = lcn;
+ } else
+ return -EINVAL;
+
+- next_vcn = vcn64 + len;
++ if (check_add_overflow(vcn64, len, &next_vcn))
++ return -EINVAL;
++
+ /* Check boundary. */
+ if (next_vcn > evcn + 1)
+ return -EINVAL;
+@@ -1151,7 +1156,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
+ return -EINVAL;
+
+ run_buf += size_size + offset_size;
+- vcn64 += len;
++ if (check_add_overflow(vcn64, len, &vcn64))
++ return -EINVAL;
+
+ #ifndef CONFIG_NTFS3_64BIT_CLUSTER
+ if (vcn64 > 0x100000000ull)
+--
+2.51.0
+
--- /dev/null
+From 741e43cb83fbae5829f180d4083b9f49416fafbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 10:40:16 -0700
+Subject: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks
+ exist
+
+From: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+
+[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]
+
+Index allocation requires at least one bit in the $BITMAP attribute to
+track usage of index entries. If the bitmap is empty while index blocks
+are already present, this reflects on-disk corruption.
+
+syzbot triggered this condition using a malformed NTFS image. During a
+rename() operation involving a long filename (which spans multiple
+index entries), the empty bitmap allowed the name to be added without
+valid tracking. Subsequent deletion of the original entry failed with
+-ENOENT, due to unexpected index state.
+
+Reject such cases by verifying that the bitmap is not empty when index
+blocks exist.
+
+Reported-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
+Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
+Tested-by: syzbot+b0373017f711c06ada64@syzkaller.appspotmail.com
+Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 191b91ffadbb2..f227db9f76c2b 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1510,6 +1510,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
+ bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
+ }
+
++ /*
++ * Index blocks exist, but $BITMAP has zero valid bits.
++ * This implies an on-disk corruption and must be rejected.
++ */
++ if (in->name == I30_NAME &&
++ unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
++ err = -EINVAL;
++ goto out1;
++ }
++
+ bit = bmp_size << 3;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 23e5bbd2f5bd51689b9d9ba7dd81ee1efc315939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 23:57:24 +0200
+Subject: gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]
+
+Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
+flag a second time after it has already been cleared. Fix that.
+
+Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Reviewed-by: Andrew Price <anprice@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 687670075d225..c4bc86c3535ba 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -811,8 +811,6 @@ __acquires(&gl->gl_lockref.lock)
+ clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+ gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
+ return;
+- } else {
+- clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 83e42592569a03ef06be720e78b5d08936610bd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 09:02:54 +0530
+Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ]
+
+hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate
+operations. As per the original design in commit 40549ba8f8e0 ("hugetlb:
+use new vma_lock for pmd sharing synchronization"), if the trylock fails
+or the VMA has no lock, it should skip that VMA. Any remaining mapped
+pages are handled by remove_inode_hugepages() which is called after
+hugetlb_vmdelete_list() and uses proper lock ordering to guarantee
+unmapping success.
+
+Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs
+without shareable locks, the code proceeds to call unmap_hugepage_range().
+This causes assertion failures in huge_pmd_unshare() →
+hugetlb_vma_assert_locked() because no lock is actually held:
+
+ WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted
+ Call Trace:
+ hugetlb_vma_assert_locked+0x1dd/0x250
+ huge_pmd_unshare+0x2c8/0x540
+ __unmap_hugepage_range+0x6e3/0x1aa0
+ unmap_hugepage_range+0x32e/0x410
+ hugetlb_vmdelete_list+0x189/0x1f0
+
+Fix by using goto to ensure locks acquired by trylock are always released,
+even when skipping VMAs without shareable locks.
+
+Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com
+Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization")
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7
+Suggested-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Oscar Salvador <osalvador@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hugetlbfs/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 914e850b9cbb7..a1ec55fc3a311 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -592,6 +592,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ if (!hugetlb_vma_trylock_write(vma))
+ continue;
+
++ /*
++ * Skip VMAs without shareable locks. Per the design in commit
++ * 40549ba8f8e0, these will be handled by remove_inode_hugepages()
++ * called after this function with proper locking.
++ */
++ if (!__vma_shareable_lock(vma))
++ goto skip;
++
+ v_start = vma_offset_start(vma, start);
+ v_end = vma_offset_end(vma, end);
+
+@@ -602,6 +610,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end,
+ * vmas. Therefore, lock is not held when calling
+ * unmap_hugepage_range for private vmas.
+ */
++skip:
+ hugetlb_vma_unlock_write(vma);
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From f1af8dfa3ca082b03742f40baebce4e6ec483918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:48:58 +0200
+Subject: hwmon: (mlxreg-fan) Separate methods of fan setting coming from
+ different subsystems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]
+
+Distinct between fan speed setting request coming for hwmon and
+thermal subsystems.
+
+There are fields 'last_hwmon_state' and 'last_thermal_state' in the
+structure 'mlxreg_fan_pwm', which respectively store the cooling state
+set by the 'hwmon' and 'thermal' subsystem.
+The purpose is to make arbitration of fan speed setting. For example, if
+fan speed required to be not lower than some limit, such setting is to
+be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
+not set fan below this limit.
+
+Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
+cooling state to never be set to a lower value.
+
+Eliminate update of 'last_thermal_state', when request is coming from
+'hwmon' subsystem.
+
+Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250113084859.27064-2-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index c25a54d5b39ad..0ba9195c9d713 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -113,8 +113,8 @@ struct mlxreg_fan {
+ int divider;
+ };
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state);
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal);
+
+ static int
+ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
+ * last thermal state.
+ */
+ if (pwm->last_hwmon_state >= pwm->last_thermal_state)
+- return mlxreg_fan_set_cur_state(pwm->cdev,
+- pwm->last_hwmon_state);
++ return _mlxreg_fan_set_cur_state(pwm->cdev,
++ pwm->last_hwmon_state,
++ false);
+ return 0;
+ }
+ return regmap_write(fan->regmap, pwm->reg, val);
+@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
+-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+- unsigned long state)
+-
++static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state, bool thermal)
+ {
+ struct mlxreg_fan_pwm *pwm = cdev->devdata;
+ struct mlxreg_fan *fan = pwm->fan;
+@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return -EINVAL;
+
+ /* Save thermal state. */
+- pwm->last_thermal_state = state;
++ if (thermal)
++ pwm->last_thermal_state = state;
+
+ state = max_t(unsigned long, state, pwm->last_hwmon_state);
+ err = regmap_write(fan->regmap, pwm->reg,
+@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+ return 0;
+ }
+
++static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
++ unsigned long state)
++
++{
++ return _mlxreg_fan_set_cur_state(cdev, state, true);
++}
++
+ static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
+ .get_max_state = mlxreg_fan_get_max_state,
+ .get_cur_state = mlxreg_fan_get_cur_state,
+--
+2.51.0
+
--- /dev/null
+From 1b82bbc3ca21371df209f5f7bc477c395fcdada3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 08:20:02 -0500
+Subject: hwrng: ks-sa - fix division by zero in ks_sa_rng_init
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]
+
+Fix division by zero in ks_sa_rng_init caused by missing clock
+pointer initialization. The clk_get_rate() call is performed on
+an uninitialized clk pointer, resulting in division by zero when
+calculating delay values.
+
+Add clock initialization code before using the clock.
+
+Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
+Signed-off-by: Nishanth Menon <nm@ti.com>
+
+ drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ks-sa-rng.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
+index 2f2f21f1b659e..d7b42888f25c2 100644
+--- a/drivers/char/hw_random/ks-sa-rng.c
++++ b/drivers/char/hw_random/ks-sa-rng.c
+@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
++ ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
++ if (IS_ERR(ks_sa_rng->clk))
++ return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
++
+ pm_runtime_enable(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret < 0) {
+--
+2.51.0
+
--- /dev/null
+From 864b4ddb864ddc9b6beb6dc5f14621b60d960ddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 17:28:00 +0200
+Subject: hwrng: nomadik - add ARM_AMBA dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]
+
+Compile-testing this driver is only possible when the AMBA bus driver is
+available in the kernel:
+
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
+nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
+x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
+nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
+x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'
+
+The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
+specified for the COMPILE_TEST case.
+
+Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
+index 8de74dcfa18cf..ece2d794174d4 100644
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG
+ config HW_RANDOM_NOMADIK
+ tristate "ST-Ericsson Nomadik Random Number Generator support"
+ depends on ARCH_NOMADIK || COMPILE_TEST
++ depends on ARM_AMBA
+ default HW_RANDOM
+ help
+ This driver provides kernel-side support for the Random Number
+--
+2.51.0
+
--- /dev/null
+From 25700074f6325715b91d936ae835930ed73cd95f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:11 +0900
+Subject: i2c: designware: Add disabling clocks when probe fails
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]
+
+After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
+called. However, this function doesn't disable clocks and the clock-enable
+count keeps increasing. Should disable these clocks explicitly.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index ca6e1991ad13f..e6fa6cb1011ab 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -394,6 +394,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
+
+ exit_probe:
+ dw_i2c_plat_pm_cleanup(dev);
++ i2c_dw_prepare_clk(dev, false);
+ exit_reset:
+ reset_control_assert(dev->rst);
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 26bed8638c1f486e194639f3d677bf046af33e5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:22:10 +0900
+Subject: i2c: designware: Fix clock issue when PM is disabled
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]
+
+When the driver is removed, the clocks are first enabled by
+calling pm_runtime_get_sync(), and then disabled with
+pm_runtime_put_sync().
+
+If CONFIG_PM=y, clocks for this controller are disabled when it's in
+the idle state. So the clocks are properly disabled when the driver
+exits.
+
+Othewise, the clocks are always enabled and the PM functions have
+no effect. Therefore, the driver exits without disabling the clocks.
+
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 18
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+ # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
+ # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
+ 20
+
+To ensure that the clocks can be disabled correctly even without
+CONFIG_PM=y, should add the following fixes:
+
+- Replace with pm_runtime_put_noidle(), which only decrements the runtime
+ PM usage count.
+- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.
+
+Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
+Co-developed-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kohei Ito <ito.kohei@socionext.com>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 1ebcf5673a06b..ca6e1991ad13f 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -411,9 +411,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
+ i2c_dw_disable(dev);
+
+ pm_runtime_dont_use_autosuspend(device);
+- pm_runtime_put_sync(device);
++ pm_runtime_put_noidle(device);
+ dw_i2c_plat_pm_cleanup(dev);
+
++ i2c_dw_prepare_clk(dev, false);
++
+ i2c_dw_remove_lock_support(dev);
+
+ reset_control_assert(dev->rst);
+--
+2.51.0
+
--- /dev/null
+From 194e5ef4f3a9528c65efaf74d7f4ef5c3ad09d67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:24:06 +0800
+Subject: i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leilk.Liu <leilk.liu@mediatek.com>
+
+[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]
+
+The old IC does not support the I2C_MASTER_WRRD (write-then-read)
+function, but the current code’s handling of i2c->auto_restart may
+potentially lead to entering the I2C_MASTER_WRRD software flow,
+resulting in unexpected bugs.
+
+Instead of repurposing the auto_restart flag, add a separate flag
+to signal I2C_MASTER_WRRD operations.
+
+Also fix handling of msgs. If the operation (i2c->op) is
+I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
+For all other operations, msgs is simply incremented by 1.
+
+Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
+Signed-off-by: Leilk.Liu <leilk.liu@mediatek.com>
+Suggested-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 1a9b5a068ef1b..6b788bca64d54 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ {
+ int ret;
+ int left_num = num;
++ bool write_then_read_en = false;
+ struct mtk_i2c *i2c = i2c_get_adapdata(adap);
+
+ ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
+@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
+ msgs[0].addr == msgs[1].addr) {
+ i2c->auto_restart = 0;
++ write_then_read_en = true;
+ }
+ }
+
+@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ else
+ i2c->op = I2C_MASTER_WR;
+
+- if (!i2c->auto_restart) {
+- if (num > 1) {
+- /* combined two messages into one transaction */
+- i2c->op = I2C_MASTER_WRRD;
+- left_num--;
+- }
++ if (write_then_read_en) {
++ /* combined two messages into one transaction */
++ i2c->op = I2C_MASTER_WRRD;
++ left_num--;
+ }
+
+ /* always use DMA mode. */
+@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
+ if (ret < 0)
+ goto err_exit;
+
+- msgs++;
++ if (i2c->op == I2C_MASTER_WRRD)
++ msgs += 2;
++ else
++ msgs++;
+ }
+ /* the return value is number of executed messages */
+ ret = num;
+--
+2.51.0
+
--- /dev/null
+From 889014650f0fb96ee9b114f8d79be61fa05213a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:09 +0800
+Subject: i3c: master: svc: Recycle unused IBI slot
+
+From: Stanley Chu <stanley.chuys@gmail.com>
+
+[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]
+
+In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
+to store the IBI payload. However, when an error condition is encountered,
+the function returns without recycling the IBI slot, resulting in an IBI
+slot leak.
+
+Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-3-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 1cfc8f480d15c..277884b5e1ca4 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -369,6 +369,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
+ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
+ if (ret) {
+ dev_err(master->dev, "Timeout when polling for COMPLETE\n");
++ i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2e22e49cd1d5a28b0370924d098276ebdbcbd518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 09:23:08 +0800
+Subject: i3c: master: svc: Use manual response for IBI events
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]
+
+Driver wants to nack the IBI request when the target is not in the
+known address list. In below code, svc_i3c_master_nack_ibi() will
+cause undefined behavior when using AUTOIBI with auto response rule,
+because hw always auto ack the IBI request.
+
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+ svc_i3c_master_nack_ibi(master);
+ ...
+ break;
+
+AutoIBI has another issue that the controller doesn't quit AutoIBI state
+after IBIWON polling timeout when there is a SDA glitch(high->low->high).
+1. SDA high->low: raising an interrupt to execute IBI ISR
+2. SDA low->high
+3. Driver writes an AutoIBI request
+4. AutoIBI process does not start because SDA is not low
+5. IBIWON polling times out
+6. Controller reamins in AutoIBI state and doesn't accept EmitStop request
+
+Emitting broadcast address with IBIRESP_MANUAL avoids both issues.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250829012309.3562585-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index d1630d47ef6fc..1cfc8f480d15c 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -430,9 +430,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ */
+ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
+
+- /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
+- writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
+- SVC_I3C_MCTRL_IBIRESP_AUTO,
++ /*
++ * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
++ * instend of using AUTO_IBI.
++ *
++ * Using AutoIBI request may cause controller to remain in AutoIBI state when
++ * there is a glitch on SDA line (high->low->high).
++ * 1. SDA high->low, raising an interrupt to execute IBI isr.
++ * 2. SDA low->high.
++ * 3. IBI isr writes an AutoIBI request.
++ * 4. The controller will not start AutoIBI process because SDA is not low.
++ * 5. IBIWON polling times out.
++ * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
++ */
++ writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
++ SVC_I3C_MCTRL_TYPE_I3C |
++ SVC_I3C_MCTRL_IBIRESP_MANUAL |
++ SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
++ SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
+ master->regs + SVC_I3C_MCTRL);
+
+ /* Wait for IBIWON, should take approximately 100us */
+@@ -452,10 +467,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
+ switch (ibitype) {
+ case SVC_I3C_MSTATUS_IBITYPE_IBI:
+ dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
+- if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
++ if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
+ svc_i3c_master_nack_ibi(master);
+- else
++ } else {
++ if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
++ svc_i3c_master_ack_ibi(master, true);
++ else
++ svc_i3c_master_ack_ibi(master, false);
+ svc_i3c_master_handle_ibi(master, dev);
++ }
+ break;
+ case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
+ if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
+--
+2.51.0
+
--- /dev/null
+From ec73035e9b8b3bc8162b794923d6e398ad18c068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 19:31:12 +0300
+Subject: IB/sa: Fix sa_local_svc_timeout_ms read race
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]
+
+When computing the delta, the sa_local_svc_timeout_ms is read without
+ib_nl_request_lock held. Though unlikely in practice, this can cause
+a race condition if multiple local service threads are managing the
+timeout.
+
+Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Mark Zhang <markzhang@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916163112.98414-1-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/sa_query.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
+index 8175dde60b0a8..9902bb96c7409 100644
+--- a/drivers/infiniband/core/sa_query.c
++++ b/drivers/infiniband/core/sa_query.c
+@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
+ timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
+
++ spin_lock_irqsave(&ib_nl_request_lock, flags);
++
+ delta = timeout - sa_local_svc_timeout_ms;
+ if (delta < 0)
+ abs_delta = -delta;
+@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ abs_delta = delta;
+
+ if (delta != 0) {
+- spin_lock_irqsave(&ib_nl_request_lock, flags);
+ sa_local_svc_timeout_ms = timeout;
+ list_for_each_entry(query, &ib_nl_request_list, list) {
+ if (delta < 0 && abs_delta > query->timeout)
+@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
+ if (delay)
+ mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
+ (unsigned long)delay);
+- spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+ }
+
++ spin_unlock_irqrestore(&ib_nl_request_lock, flags);
++
+ settimeout_out:
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 640b3cf6ed309cb96c33ad728f764ac7744ba943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:20 +0200
+Subject: iio: consumers: Fix handling of negative channel scale in
+ iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]
+
+There is an issue with the handling of negative channel scales
+in iio_convert_raw_to_processed_unlocked() when the channel-scale
+is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:
+
+Things work for channel-scale values > -1.0 and < 0.0 because of
+the use of signed values in:
+
+ *processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);
+
+Things will break however for scale values < -1.0. Lets for example say
+that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.
+
+The result should then be 2 * 10 * -1.5 = -30.
+
+channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
+now lets see what gets stored in processed:
+
+1. *processed = raw64 * scale_val * scale;
+2. *processed += raw64 * scale_val2 * scale / 1000000LL;
+
+1. Sets processed to 2 * -1 * 10 = -20
+2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed
+
+And the end result is processed = -20 + 10 = -10, which is not correct.
+
+Fix this by always using the abs value of both scale_val and scale_val2
+and if either is negative multiply the end-result by -1.
+
+Note there seems to be an unwritten rule about negative
+IIO_VAL_INT_PLUS_[MICRO|NANO] values that:
+
+i. values > -1.0 and < 0.0 are written as val=0 val2=-xxx
+ii. values <= -1.0 are written as val=-xxx val2=xxx
+
+But iio_format_value() will also correctly display a third option:
+
+iii. values <= -1.0 written as val=-xxx val2=-xxx
+
+Since iio_format_value() uses abs(val) when val2 < 0.
+
+This fix also makes iio_convert_raw_to_processed() properly handle
+channel-scales using this third option.
+
+Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
+Cc: Matteo Martelli <matteomartelli3@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-2-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 8255035ff124f..34abbf46916cc 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -9,6 +9,7 @@
+ #include <linux/mutex.h>
+ #include <linux/property.h>
+ #include <linux/slab.h>
++#include <linux/units.h>
+
+ #include <linux/iio/iio.h>
+ #include <linux/iio/iio-opaque.h>
+@@ -635,7 +636,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ {
+ int scale_type, scale_val, scale_val2;
+ int offset_type, offset_val, offset_val2;
+- s64 raw64 = raw;
++ s64 denominator, raw64 = raw;
+
+ offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
+ IIO_CHAN_INFO_OFFSET);
+@@ -679,20 +680,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ *processed = raw64 * scale_val * scale;
+ break;
+ case IIO_VAL_INT_PLUS_MICRO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000LL);
+- break;
+ case IIO_VAL_INT_PLUS_NANO:
+- if (scale_val2 < 0)
+- *processed = -raw64 * scale_val * scale;
+- else
+- *processed = raw64 * scale_val * scale;
+- *processed += div_s64(raw64 * (s64)scale_val2 * scale,
+- 1000000000LL);
++ switch (scale_type) {
++ case IIO_VAL_INT_PLUS_MICRO:
++ denominator = MICRO;
++ break;
++ case IIO_VAL_INT_PLUS_NANO:
++ denominator = NANO;
++ break;
++ }
++ *processed = raw64 * scale * abs(scale_val);
++ *processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
++ if (scale_val < 0 || scale_val2 < 0)
++ *processed *= -1;
+ break;
+ case IIO_VAL_FRACTIONAL:
+ *processed = div_s64(raw64 * (s64)scale_val * scale,
+--
+2.51.0
+
--- /dev/null
+From ebe028ce09e03d854ef05a9531dd79d0224d192b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 12:48:21 +0200
+Subject: iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]
+
+Fix iio_convert_raw_to_processed() offset handling for channels without
+a scale attribute.
+
+The offset has been applied to the raw64 value not to the original raw
+value. Use the raw64 value so that the offset is taken into account.
+
+Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
+Cc: Liam Beguin <liambeguin@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250831104825.15097-3-hansg@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index 34abbf46916cc..c7b2ab7870993 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -671,7 +671,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
+ * If no channel scaling is available apply consumer scale to
+ * raw value and return.
+ */
+- *processed = raw * scale;
++ *processed = raw64 * scale;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9b107250e6c49c871dcbbfa4770cae6ff661c47e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:30:51 +0000
+Subject: inet: ping: check sock_net() in ping_get_port() and ping_lookup()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]
+
+We need to check socket netns before considering them in ping_get_port().
+Otherwise, one malicious netns could 'consume' all ports.
+
+Add corresponding check in ping_lookup().
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250829153054.474201-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 4cb0c896caf97..5c848136bc266 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
+
+ int ping_get_port(struct sock *sk, unsigned short ident)
+ {
++ struct net *net = sock_net(sk);
+ struct inet_sock *isk, *isk2;
+ struct hlist_head *hlist;
+ struct sock *sk2 = NULL;
+@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ for (i = 0; i < (1L << 16); i++, result++) {
+ if (!result)
+ result++; /* avoid zero */
+- hlist = ping_hashslot(&ping_table, sock_net(sk),
+- result);
++ hlist = ping_hashslot(&ping_table, net, result);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ if (isk2->inet_num == result)
+@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ if (i >= (1L << 16))
+ goto fail;
+ } else {
+- hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
++ hlist = ping_hashslot(&ping_table, net, ident);
+ sk_for_each(sk2, hlist) {
++ if (!net_eq(sock_net(sk2), net))
++ continue;
+ isk2 = inet_sk(sk2);
+
+ /* BUG? Why is this reuse and not reuseaddr? ping.c
+@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
+ pr_debug("was not hashed\n");
+ sk_add_node_rcu(sk, hlist);
+ sock_set_flag(sk, SOCK_RCU_FREE);
+- sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++ sock_prot_inuse_add(net, sk->sk_prot, 1);
+ }
+ spin_unlock(&ping_table.lock);
+ return 0;
+@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
+ }
+
+ sk_for_each_rcu(sk, hslot) {
++ if (!net_eq(sock_net(sk), net))
++ continue;
+ isk = inet_sk(sk);
+
+ pr_debug("iterate\n");
+--
+2.51.0
+
--- /dev/null
+From 74703dcc00b4bf8db0e421bd1f1d28c52b349935 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:11:05 +0200
+Subject: init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]
+
+INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
+init/initramfs_test.c. Hence add a dependency on BLK_DEV_INITRD, to
+prevent asking the user about this feature when configuring a kernel
+without initramfs support.
+
+Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 8b630143c720f..461591503bf43 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1367,6 +1367,7 @@ config BOOT_CONFIG_EMBED_FILE
+
+ config INITRAMFS_PRESERVE_MTIME
+ bool "Preserve cpio archive mtimes in initramfs"
++ depends on BLK_DEV_INITRD
+ default y
+ help
+ Each entry in an initramfs cpio archive carries an mtime value. When
+--
+2.51.0
+
--- /dev/null
+From f490acde7184aa5bf1df552df1f5cb073d532e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 01:57:59 +0800
+Subject: ipvs: Defer ip_vs_ftp unregister during netns cleanup
+
+From: Slavin Liu <slavin452@gmail.com>
+
+[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]
+
+On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
+before connections with valid cp->app pointers are flushed, leading to a
+use-after-free.
+
+Fix this by introducing a global `exiting_module` flag, set to true in
+ip_vs_ftp_exit() before unregistering the pernet subsystem. In
+__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
+cleanup (when exiting_module is false) and defer it to
+__ip_vs_cleanup_batch(), which unregisters all apps after all connections
+are flushed. If called during module exit, unregister ip_vs_ftp
+immediately.
+
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Slavin Liu <slavin452@gmail.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index ef1f45e43b630..61d3797fb7995 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -53,6 +53,7 @@ enum {
+ IP_VS_FTP_EPSV,
+ };
+
++static bool exiting_module;
+ /*
+ * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
+ * First port is set to the default port.
+@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
+ {
+ struct netns_ipvs *ipvs = net_ipvs(net);
+
+- if (!ipvs)
++ if (!ipvs || !exiting_module)
+ return;
+
+ unregister_ip_vs_app(ipvs, &ip_vs_ftp);
+@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
+ */
+ static void __exit ip_vs_ftp_exit(void)
+ {
++ exiting_module = true;
+ unregister_pernet_subsys(&ip_vs_ftp_ops);
+ /* rcu_barrier() is called by netns */
+ }
+--
+2.51.0
+
--- /dev/null
+From c7a7794fdc64c973b22be631edc7b54ee9458cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 21:46:54 +0800
+Subject: ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
+
+From: Zhang Tengfei <zhtfdev@gmail.com>
+
+[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]
+
+KCSAN reported a data-race on the `ipvs->enable` flag, which is
+written in the control path and read concurrently from many other
+contexts.
+
+Following a suggestion by Julian, this patch fixes the race by
+converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
+This lightweight approach ensures atomic access and acts as a
+compiler barrier, preventing unsafe optimizations where the flag
+is checked in loops (e.g., in ip_vs_est.c).
+
+Additionally, the `enable` checks in the fast-path hooks
+(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
+removed. These are unnecessary since commit 857ca89711de
+("ipvs: register hooks only with services"). The `enable=0`
+condition they check for can only occur in two rare and non-fatal
+scenarios: 1) after hooks are registered but before the flag is set,
+and 2) after hooks are unregistered on cleanup_net. In the worst
+case, a single packet might be mishandled (e.g., dropped), which
+does not lead to a system crash or data corruption. Adding a check
+in the performance-critical fast-path to handle this harmless
+condition is not a worthwhile trade-off.
+
+Fixes: 857ca89711de ("ipvs: register hooks only with services")
+Reported-by: syzbot+1651b5234028c294c339@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
+Suggested-by: Julian Anastasov <ja@ssi.bg>
+Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/
+Signed-off-by: Zhang Tengfei <zhtfdev@gmail.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
+ net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
+ net/netfilter/ipvs/ip_vs_ctl.c | 6 +++---
+ net/netfilter/ipvs/ip_vs_est.c | 16 ++++++++--------
+ 4 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 8182833a35828..d9c3eefe8cbb0 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -884,7 +884,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
+ * conntrack cleanup for the net.
+ */
+ smp_rmb();
+- if (ipvs->enable)
++ if (READ_ONCE(ipvs->enable))
+ ip_vs_conn_drop_conntrack(cp);
+ }
+
+@@ -1432,7 +1432,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
+ cond_resched_rcu();
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ break;
+ }
+ rcu_read_unlock();
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 3230506ae3ffd..34c4648ba36ec 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
+ if (unlikely(!skb_dst(skb)))
+ return NF_ACCEPT;
+
+- if (!ipvs->enable)
+- return NF_ACCEPT;
+-
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (af == AF_INET6) {
+@@ -1936,7 +1933,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
+ return NF_ACCEPT;
+ }
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ ip_vs_fill_iph_skb(af, skb, false, &iph);
+@@ -2104,7 +2101,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
+ int r;
+
+ /* ipvs enabled in this netns ? */
+- if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
++ if (unlikely(sysctl_backup_only(ipvs)))
+ return NF_ACCEPT;
+
+ if (state->pf == NFPROTO_IPV4) {
+@@ -2291,7 +2288,7 @@ static int __net_init __ip_vs_init(struct net *net)
+ return -ENOMEM;
+
+ /* Hold the beast until a service is registered */
+- ipvs->enable = 0;
++ WRITE_ONCE(ipvs->enable, 0);
+ ipvs->net = net;
+ /* Counters used for creating unique names */
+ ipvs->gen = atomic_read(&ipvs_netns_cnt);
+@@ -2363,7 +2360,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
+ ipvs = net_ipvs(net);
+ ip_vs_unregister_hooks(ipvs, AF_INET);
+ ip_vs_unregister_hooks(ipvs, AF_INET6);
+- ipvs->enable = 0; /* Disable packet reception */
++ WRITE_ONCE(ipvs->enable, 0); /* Disable packet reception */
+ smp_wmb();
+ ip_vs_sync_net_cleanup(ipvs);
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index ae76542de3e98..c82dcbb4dabce 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
+ struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
+
+ /* netns clean up started, abort delayed work */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock;
+ if (!kd)
+ continue;
+@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
+
+ *svc_p = svc;
+
+- if (!ipvs->enable) {
++ if (!READ_ONCE(ipvs->enable)) {
+ /* Now there is a service - full throttle */
+- ipvs->enable = 1;
++ WRITE_ONCE(ipvs->enable, 1);
+
+ /* Start estimation for first time */
+ ip_vs_est_reload_start(ipvs);
+diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
+index c5970ba416aea..b48d3a09e2174 100644
+--- a/net/netfilter/ipvs/ip_vs_est.c
++++ b/net/netfilter/ipvs/ip_vs_est.c
+@@ -230,7 +230,7 @@ static int ip_vs_estimation_kthread(void *data)
+ void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
+ {
+ /* Ignore reloads before first service is added */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ return;
+ ip_vs_est_stopped_recalc(ipvs);
+ /* Bump the kthread configuration genid */
+@@ -304,7 +304,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ int i;
+
+ if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
+- ipvs->enable && ipvs->est_max_threads)
++ READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
+ return -EINVAL;
+
+ mutex_lock(&ipvs->est_mutex);
+@@ -341,7 +341,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
+ }
+
+ /* Start kthread tasks only when services are present */
+- if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
++ if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
+ ret = ip_vs_est_kthread_start(ipvs, kd);
+ if (ret < 0)
+ goto out;
+@@ -484,7 +484,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
+ struct ip_vs_estimator *est = &stats->est;
+ int ret;
+
+- if (!ipvs->est_max_threads && ipvs->enable)
++ if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
+ ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
+
+ est->ktid = -1;
+@@ -661,7 +661,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ /* Wait for cpufreq frequency transition */
+ wait_event_idle_timeout(wq, kthread_should_stop(),
+ HZ / 50);
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ }
+
+@@ -679,7 +679,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
+ rcu_read_unlock();
+ local_bh_enable();
+
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto stop;
+ cond_resched();
+
+@@ -755,7 +755,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ mutex_lock(&ipvs->est_mutex);
+ for (id = 1; id < ipvs->est_kt_count; id++) {
+ /* netns clean up started, abort */
+- if (!ipvs->enable)
++ if (!READ_ONCE(ipvs->enable))
+ goto unlock2;
+ kd = ipvs->est_kt_arr[id];
+ if (!kd)
+@@ -785,7 +785,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
+ id = ipvs->est_kt_count;
+
+ next_kt:
+- if (!ipvs->enable || kthread_should_stop())
++ if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
+ goto unlock;
+ id--;
+ if (id < 0)
+--
+2.51.0
+
--- /dev/null
+From 1c7196269f7ef10bc8d6b24cec394832837257c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 21:15:50 +0000
+Subject: KEYS: X.509: Fix Basic Constraints CA flag parsing
+
+From: Fan Wu <wufan@kernel.org>
+
+[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]
+
+Fix the X.509 Basic Constraints CA flag parsing to correctly handle
+the ASN.1 DER encoded structure. The parser was incorrectly treating
+the length field as the boolean value.
+
+Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
+According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:
+
+Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)
+
+The basicConstraints extension with CA:TRUE is encoded as:
+
+ SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
+ ^-- v[2] ^-- v[3] ^-- v[4]
+
+The parser was checking v[3] (the length field, always 0x01) instead
+of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).
+
+Also handle the case where the extension is an empty SEQUENCE (30 00),
+which is valid for CA:FALSE when the default value is omitted as
+required by DER encoding rules (X.690 section 11.5).
+
+Per ITU-T X.690-0207:
+- Section 11.5: Default values must be omitted in DER
+- Section 11.1: DER requires TRUE to be encoded as 0xFF
+
+Link: https://datatracker.ietf.org/doc/html/rfc5280
+Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
+Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
+Signed-off-by: Fan Wu <wufan@kernel.org>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index 0a7049b470c18..5201f47e31d8b 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -618,11 +618,14 @@ int x509_process_extension(void *context, size_t hdrlen,
+ /*
+ * Get hold of the basicConstraints
+ * v[1] is the encoding size
+- * (Expect 0x2 or greater, making it 1 or more bytes)
++ * (Expect 0x00 for empty SEQUENCE with CA:FALSE, or
++ * 0x03 or greater for non-empty SEQUENCE)
+ * v[2] is the encoding type
+ * (Expect an ASN1_BOOL for the CA)
+- * v[3] is the contents of the ASN1_BOOL
+- * (Expect 1 if the CA is TRUE)
++ * v[3] is the length of the ASN1_BOOL
++ * (Expect 1 for a single byte boolean)
++ * v[4] is the contents of the ASN1_BOOL
++ * (Expect 0xFF if the CA is TRUE)
+ * vlen should match the entire extension size
+ */
+ if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
+@@ -631,8 +634,13 @@ int x509_process_extension(void *context, size_t hdrlen,
+ return -EBADMSG;
+ if (v[1] != vlen - 2)
+ return -EBADMSG;
+- if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
++ /* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
++ if (v[1] == 0)
++ return 0;
++ if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
+ ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
++ else
++ return -EBADMSG;
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 741e32f78ccb3dcc84a5515277677db4771503dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 12:51:22 +0800
+Subject: leds: flash: leds-qcom-flash: Update torch current clamp setting
+
+From: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+
+[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]
+
+There is a register to clamp the flash current per LED channel when
+safety timer is disabled. It needs to be updated according to the
+maximum torch LED current setting to ensure the torch current won't
+be clamped unexpectedly.
+
+Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
+Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250729-fix-torch-clamp-issue-v2-1-9b83816437a3@oss.qualcomm.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
+index a619dbe015243..07ca3e32d4bec 100644
+--- a/drivers/leds/flash/leds-qcom-flash.c
++++ b/drivers/leds/flash/leds-qcom-flash.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+ #include <linux/bitfield.h>
+@@ -114,36 +114,39 @@ enum {
+ REG_THERM_THRSH1,
+ REG_THERM_THRSH2,
+ REG_THERM_THRSH3,
++ REG_TORCH_CLAMP,
+ REG_MAX_COUNT,
+ };
+
+ static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x08, 0, 7), /* status1 */
+- REG_FIELD(0x09, 0, 7), /* status2 */
+- REG_FIELD(0x0a, 0, 7), /* status3 */
+- REG_FIELD_ID(0x40, 0, 7, 3, 1), /* chan_timer */
+- REG_FIELD_ID(0x43, 0, 6, 3, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x47, 0, 5), /* iresolution */
+- REG_FIELD_ID(0x49, 0, 2, 3, 1), /* chan_strobe */
+- REG_FIELD(0x4c, 0, 2), /* chan_en */
+- REG_FIELD(0x56, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x57, 0, 2), /* therm_thrsh2 */
+- REG_FIELD(0x58, 0, 2), /* therm_thrsh3 */
++ [REG_STATUS1] = REG_FIELD(0x08, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x09, 0, 7),
++ [REG_STATUS3] = REG_FIELD(0x0a, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x40, 0, 7, 3, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x43, 0, 6, 3, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x47, 0, 5),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x49, 0, 2, 3, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4c, 0, 2),
++ [REG_THERM_THRSH1] = REG_FIELD(0x56, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x57, 0, 2),
++ [REG_THERM_THRSH3] = REG_FIELD(0x58, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xec, 0, 6),
+ };
+
+ static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
+- REG_FIELD(0x06, 0, 7), /* status1 */
+- REG_FIELD(0x07, 0, 6), /* status2 */
+- REG_FIELD(0x09, 0, 7), /* status3 */
+- REG_FIELD_ID(0x3e, 0, 7, 4, 1), /* chan_timer */
+- REG_FIELD_ID(0x42, 0, 6, 4, 1), /* itarget */
+- REG_FIELD(0x46, 7, 7), /* module_en */
+- REG_FIELD(0x49, 0, 3), /* iresolution */
+- REG_FIELD_ID(0x4a, 0, 6, 4, 1), /* chan_strobe */
+- REG_FIELD(0x4e, 0, 3), /* chan_en */
+- REG_FIELD(0x7a, 0, 2), /* therm_thrsh1 */
+- REG_FIELD(0x78, 0, 2), /* therm_thrsh2 */
++ [REG_STATUS1] = REG_FIELD(0x06, 0, 7),
++ [REG_STATUS2] = REG_FIELD(0x07, 0, 6),
++ [REG_STATUS3] = REG_FIELD(0x09, 0, 7),
++ [REG_CHAN_TIMER] = REG_FIELD_ID(0x3e, 0, 7, 4, 1),
++ [REG_ITARGET] = REG_FIELD_ID(0x42, 0, 6, 4, 1),
++ [REG_MODULE_EN] = REG_FIELD(0x46, 7, 7),
++ [REG_IRESOLUTION] = REG_FIELD(0x49, 0, 3),
++ [REG_CHAN_STROBE] = REG_FIELD_ID(0x4a, 0, 6, 4, 1),
++ [REG_CHAN_EN] = REG_FIELD(0x4e, 0, 3),
++ [REG_THERM_THRSH1] = REG_FIELD(0x7a, 0, 2),
++ [REG_THERM_THRSH2] = REG_FIELD(0x78, 0, 2),
++ [REG_TORCH_CLAMP] = REG_FIELD(0xed, 0, 6),
+ };
+
+ struct qcom_flash_data {
+@@ -156,6 +159,7 @@ struct qcom_flash_data {
+ u8 max_channels;
+ u8 chan_en_bits;
+ u8 revision;
++ u8 torch_clamp;
+ };
+
+ struct qcom_flash_led {
+@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
+ u32 current_ua, timeout_us;
+ u32 channels[4];
+ int i, rc, count;
++ u8 torch_clamp;
+
+ count = fwnode_property_count_u32(node, "led-sources");
+ if (count <= 0) {
+@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
+ current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
+ led->max_torch_current_ma = current_ua / UA_PER_MA;
+
++ torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
++ if (torch_clamp != 0)
++ torch_clamp--;
++
++ flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
++
+ if (fwnode_property_present(node, "flash-max-microamp")) {
+ flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
+
+@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
+ flash_data->leds_count++;
+ }
+
+- return 0;
+-
++ return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
+ release:
+ fwnode_handle_put(child);
+ while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
+--
+2.51.0
+
--- /dev/null
+From f164eb49421874daab86900d0895f60d39c20b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 20:01:12 +0200
+Subject: libbpf: Fix reuse of DEVMAP
+
+From: Yureka Lilian <yuka@yuka.dev>
+
+[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]
+
+Previously, re-using pinned DEVMAP maps would always fail, because
+get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
+but BPF_F_RDONLY_PROG being set on a map during creation is invalid.
+
+Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+get_map_info when checking for compatibility with an existing DEVMAP.
+
+The same problem is handled in a third-party ebpf library:
+- https://github.com/cilium/ebpf/issues/925
+- https://github.com/cilium/ebpf/pull/930
+
+Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
+Signed-off-by: Yureka Lilian <yuka@yuka.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20250814180113.1245565-3-yuka@yuka.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index aefbfa2df6207..95f2ffefff3ff 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -5013,6 +5013,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
+ return false;
+ }
+
++ /*
++ * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
++ * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
++ * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
++ * bpf_get_map_info_by_fd() when checking for compatibility with an
++ * existing DEVMAP.
++ */
++ if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
++ map_info.map_flags &= ~BPF_F_RDONLY_PROG;
++
+ return (map_info.type == map->def.type &&
+ map_info.key_size == map->def.key_size &&
+ map_info.value_size == map->def.value_size &&
+--
+2.51.0
+
--- /dev/null
+From d2e1c8c1165781dca2e1ea9034aba63a74acc58e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 16:27:24 +0800
+Subject: media: rj54n1cb0c: Fix memleak in rj54n1_probe()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]
+
+rj54n1_probe() won't clean all the allocated resources in fail
+path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
+prevent memleak.
+
+Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
+index b430046f9e2a9..09293e90025d5 100644
+--- a/drivers/media/i2c/rj54n1cb0c.c
++++ b/drivers/media/i2c/rj54n1cb0c.c
+@@ -1331,10 +1331,13 @@ static int rj54n1_probe(struct i2c_client *client)
+ V4L2_CID_GAIN, 0, 127, 1, 66);
+ v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
+ V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
+- rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+- if (rj54n1->hdl.error)
+- return rj54n1->hdl.error;
+
++ if (rj54n1->hdl.error) {
++ ret = rj54n1->hdl.error;
++ goto err_free_ctrl;
++ }
++
++ rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
+ rj54n1->clk_div = clk_div;
+ rj54n1->rect.left = RJ54N1_COLUMN_SKIP;
+ rj54n1->rect.top = RJ54N1_ROW_SKIP;
+--
+2.51.0
+
--- /dev/null
+From d2ef9796d86d3ecee1c99edba439bccb0cf9cdb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 11:31:56 +0200
+Subject: media: st-delta: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]
+
+Building with a reduced stack warning limit shows that delta_mjpeg_decode()
+copies a giant structure to the stack each time but only uses three of
+its members:
+
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
+drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]
+
+Open-code the passing of the structure members that are actually used here.
+
+Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/st/sti/delta/delta-mjpeg-dec.c | 20 ++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+index 0533d4a083d24..a078f1107300e 100644
+--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
++++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
+ return 0;
+ }
+
+-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
++static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
+ {
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+
+ memset(params, 0, sizeof(*params));
+
+- params->picture_start_addr_p = (u32)(au->paddr);
+- params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
++ params->picture_start_addr_p = pstart;
++ params->picture_end_addr_p = pend;
+
+ /*
+ * !WARNING!
+@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ struct delta_dev *delta = pctx->dev;
+ struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
+ int ret;
+- struct delta_au au = *pau;
++ void *au_vaddr = pau->vaddr;
++ dma_addr_t au_dma = pau->paddr;
++ size_t au_size = pau->size;
+ unsigned int data_offset = 0;
+ struct mjpeg_header *header = &ctx->header_struct;
+
+ if (!ctx->header) {
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
+ goto err;
+ }
+
+- ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
++ ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
+ ctx->header, &data_offset);
+ if (ret) {
+ pctx->stream_errors++;
+ goto err;
+ }
+
+- au.paddr += data_offset;
+- au.vaddr += data_offset;
++ au_dma += data_offset;
++ au_vaddr += data_offset;
+
+- ret = delta_mjpeg_ipc_decode(pctx, &au);
++ ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
+ if (ret)
+ goto err;
+
+--
+2.51.0
+
--- /dev/null
+From b6918e6ff17268c9f14b9bfc73b7ca6d4c8f5c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:30:15 +0300
+Subject: media: zoran: Remove zoran_fh structure
+
+From: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+
+[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]
+
+The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
+mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
+but the structure stayed by mistake. It is now used in a single
+location, assigned from a void pointer and then recast to a void
+pointer, without being every accessed. Drop it.
+
+Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
+Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/zoran/zoran.h | 6 ------
+ drivers/media/pci/zoran/zoran_driver.c | 3 +--
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
+index 56340553b2823..63592c4f9ed8c 100644
+--- a/drivers/media/pci/zoran/zoran.h
++++ b/drivers/media/pci/zoran/zoran.h
+@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
+
+ struct zoran;
+
+-/* zoran_fh contains per-open() settings */
+-struct zoran_fh {
+- struct v4l2_fh fh;
+- struct zoran *zr;
+-};
+-
+ struct card_info {
+ enum card_type type;
+ char name[32];
+diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
+index fa672cc8bc678..feb39854a989e 100644
+--- a/drivers/media/pci/zoran/zoran_driver.c
++++ b/drivers/media/pci/zoran/zoran_driver.c
+@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
+ struct v4l2_format *fmt)
+ {
+ struct zoran *zr = video_drvdata(file);
+- struct zoran_fh *fh = __fh;
+ int i;
+ int res = 0;
+
+ if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
+- return zoran_s_fmt_vid_out(file, fh, fmt);
++ return zoran_s_fmt_vid_out(file, __fh, fmt);
+
+ for (i = 0; i < NUM_FORMATS; i++)
+ if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
+--
+2.51.0
+
--- /dev/null
+From d24046dd9f70937cb3418a77be40c4f345361777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:37:12 +0100
+Subject: misc: genwqe: Fix incorrect cmd field being reported in error
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]
+
+There is a dev_err message that is reporting the value of
+cmd->asiv_length when it should be reporting cmd->asv_length
+instead. Fix this.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://lore.kernel.org/r/20250902113712.2624743-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_ddcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
+index 500b1feaf1f6f..fd7d5cd50d396 100644
+--- a/drivers/misc/genwqe/card_ddcb.c
++++ b/drivers/misc/genwqe/card_ddcb.c
+@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+ }
+ if (cmd->asv_length > DDCB_ASV_LENGTH) {
+ dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+- __func__, cmd->asiv_length);
++ __func__, cmd->asv_length);
+ return -EINVAL;
+ }
+ rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
+--
+2.51.0
+
--- /dev/null
+From 1c5ad6e6d21e6711cf05825326e8c30266801eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 14:07:27 +0300
+Subject: mtd: rawnand: atmel: Fix error handling path in
+ atmel_nand_controller_add_nands
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]
+
+In case of a jump to the err label due to atmel_nand_create() or
+atmel_nand_controller_add_nand() failure, the reference to nand_np
+need to be released
+
+Use for_each_child_of_node_scoped() to fix the issue.
+
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index c5aff27ec4a89..14a09285f1551 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
+
+ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+ {
+- struct device_node *np, *nand_np;
++ struct device_node *np;
+ struct device *dev = nc->dev;
+ int ret, reg_cells;
+ u32 val;
+@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
+
+ reg_cells += val;
+
+- for_each_child_of_node(np, nand_np) {
++ for_each_child_of_node_scoped(np, nand_np) {
+ struct atmel_nand *nand;
+
+ nand = atmel_nand_create(nc, nand_np, reg_cells);
+--
+2.51.0
+
--- /dev/null
+From c17e89939b2dd8662deb0078132d6bef5cf19160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:22:43 +0000
+Subject: nbd: restrict sockets to TCP and UDP
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]
+
+Recently, syzbot started to abuse NBD with all kinds of sockets.
+
+Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
+made sure the socket supported a shutdown() method.
+
+Explicitely accept TCP and UNIX stream sockets.
+
+Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
+Reported-by: syzbot+e1cd6bd8493060bd701d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5hbH_bFA@mail.gmail.com/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Richard W.M. Jones <rjones@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Yu Kuai <yukuai1@huaweicloud.com>
+Cc: linux-block@vger.kernel.org
+Cc: nbd@other.debian.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 3742ddf46c55a..27a05b1521f69 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
+ if (!sock)
+ return NULL;
+
++ if (!sk_is_tcp(sock->sk) &&
++ !sk_is_stream_unix(sock->sk)) {
++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
++ *err = -EINVAL;
++ sockfd_put(sock);
++ return NULL;
++ }
++
+ if (sock->ops->shutdown == sock_no_shutdown) {
+ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
+ *err = -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 102c9e208a029849d02a46949c548c735f657a7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 04:01:24 +0900
+Subject: net: dlink: handle copy_thresh allocation failure
+
+From: Yeounsu Moon <yyyynoom@gmail.com>
+
+[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]
+
+The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
+If the allocation failed, dereferencing `skb->protocol` could lead to
+a NULL pointer dereference.
+
+This patch tries to allocate `skb`. If the allocation fails, it falls
+back to the normal path.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Tested-on: D-Link DGE-550T Rev-A3
+Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index f1208591ed67e..1c3a5cf379cd0 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
++++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -954,15 +954,18 @@ receive_packet (struct net_device *dev)
+ } else {
+ struct sk_buff *skb;
+
++ skb = NULL;
+ /* Small skbuffs for short packets */
+- if (pkt_len > copy_thresh) {
++ if (pkt_len <= copy_thresh)
++ skb = netdev_alloc_skb_ip_align(dev, pkt_len);
++ if (!skb) {
+ dma_unmap_single(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+ DMA_FROM_DEVICE);
+ skb_put (skb = np->rx_skbuff[entry], pkt_len);
+ np->rx_skbuff[entry] = NULL;
+- } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
++ } else {
+ dma_sync_single_for_cpu(&np->pdev->dev,
+ desc_to_dma(desc),
+ np->rx_buf_sz,
+--
+2.51.0
+
--- /dev/null
+From 8bc3d7bb96466fb841d2f9ee48f1522332a25c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:02:22 +0900
+Subject: net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is
+ not configurable
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]
+
+In EC2 instances where the RSS hash key is not configurable, ethtool
+shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
+returns ENA_HASH_KEY_SIZE.
+
+Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
+supported") added proper handling for devices that don't support RSS
+hash key configuration, but ena_get_rxfh_key_size() has been unchanged.
+
+When the RSS hash key is not configurable, return 0 instead of
+ENA_HASH_KEY_SIZE to clarify getting the value is not supported.
+
+Tested on m5 instance families.
+
+Without patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00
+
+With patch:
+ # ethtool -x ens5 | grep -A 1 "RSS hash key"
+ RSS hash key:
+ Operation not supported
+
+Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929050247.51680-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index d901877544445..82a7c52fdb721 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -752,7 +752,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
+
+ static u32 ena_get_rxfh_key_size(struct net_device *netdev)
+ {
+- return ENA_HASH_KEY_SIZE;
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_rss *rss = &adapter->ena_dev->rss;
++
++ return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
+ }
+
+ static int ena_indirection_table_set(struct ena_adapter *adapter,
+--
+2.51.0
+
--- /dev/null
+From c78919b2fc145b6f65779e0082be429048d12325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:09 +0300
+Subject: net/mlx5: fw reset, add reset timeout work
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]
+
+Add sync reset timeout to stop poll_sync_reset in case there was no
+reset done or abort event within timeout. Otherwise poll sync reset will
+just continue and in case of fw fatal error no health reporting will be
+done.
+
+Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/fw_reset.c | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+index 1547704c89767..4d64d179b5dd7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
+ struct work_struct reset_reload_work;
+ struct work_struct reset_now_work;
+ struct work_struct reset_abort_work;
++ struct delayed_work reset_timeout_work;
+ unsigned long reset_flags;
+ u8 reset_method;
+ struct timer_list timer;
+@@ -257,6 +258,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
+ return -EALREADY;
+ }
+
++ if (current_work() != &fw_reset->reset_timeout_work.work)
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ mlx5_stop_sync_reset_poll(dev);
+ if (poll_health)
+ mlx5_start_health_poll(dev);
+@@ -327,6 +330,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
+ }
+ mlx5_stop_health_poll(dev, true);
+ mlx5_start_sync_reset_poll(dev);
++
++ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
++ &fw_reset->reset_flags))
++ schedule_delayed_work(&fw_reset->reset_timeout_work,
++ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
+ return 0;
+ }
+
+@@ -700,6 +708,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
+ }
+ }
+
++static void mlx5_sync_reset_timeout_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_fw_reset *fw_reset =
++ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
++ struct mlx5_core_dev *dev = fw_reset->dev;
++
++ if (mlx5_sync_reset_clear_reset_requested(dev, true))
++ return;
++ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
++}
++
+ static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
+@@ -783,6 +804,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
+ cancel_work_sync(&fw_reset->reset_reload_work);
+ cancel_work_sync(&fw_reset->reset_now_work);
+ cancel_work_sync(&fw_reset->reset_abort_work);
++ cancel_delayed_work(&fw_reset->reset_timeout_work);
+ }
+
+ static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
+@@ -826,6 +848,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
+ INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
+ INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
+ INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
++ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
++ mlx5_sync_reset_timeout_work);
+
+ init_completion(&fw_reset->done);
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From af819245cde0a6c666b7fba1392c6c03c3e8485d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:08 +0300
+Subject: net/mlx5: pagealloc: Fix reclaim race during command interface
+ teardown
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]
+
+The reclaim_pages_cmd() function sends a command to the firmware to
+reclaim pages if the command interface is active.
+
+A race condition can occur if the command interface goes down (e.g., due
+to a PCI error) while the mlx5_cmd_do() call is in flight. In this
+case, mlx5_cmd_do() will return an error. The original code would
+propagate this error immediately, bypassing the software-based page
+reclamation logic that is supposed to run when the command interface is
+down.
+
+Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
+that command interface is down. If this is the case, fall through to
+the software reclamation path. If the command failed for any another
+reason, or finished successfully, return as before.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index e0581c6f9cecd..5df1472fe2be2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ u32 func_id;
+ u32 npages;
+ u32 i = 0;
++ int err;
+
+- if (!mlx5_cmd_is_down(dev))
+- return mlx5_cmd_do(dev, in, in_size, out, out_size);
++ err = mlx5_cmd_do(dev, in, in_size, out, out_size);
++ /* If FW is gone (-ENXIO), proceed to forceful reclaim */
++ if (err != -ENXIO)
++ return err;
+
+ /* No hard feelings, we want our pages back! */
+ npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+--
+2.51.0
+
--- /dev/null
+From 65d2f00b0f4ccfdbe3c9f3242fd25cccd8fe38a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:02:07 +0300
+Subject: net/mlx5: Stop polling for command response if interface goes down
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]
+
+Stop polling on firmware response to command in polling mode if the
+command interface got down. This situation can occur, for example, if a
+firmware fatal error is detected during polling.
+
+This change halts the polling process when the command interface goes
+down, preventing unnecessary waits.
+
+Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Shay Drori <shayd@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index 5a2126679415c..336e0a54b3dc2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+ return;
+ }
+ cond_resched();
++ if (mlx5_cmd_is_down(dev)) {
++ ent->ret = -ENXIO;
++ return;
++ }
+ } while (time_before(jiffies, poll_end));
+
+ ent->ret = -ETIMEDOUT;
+@@ -1059,7 +1063,7 @@ static void cmd_work_handler(struct work_struct *work)
+ poll_timeout(ent);
+ /* make sure we read the descriptor after ownership is SW */
+ rmb();
+- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
++ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5b7b3b40c2f8c9b0354ffcdeccd47855f619bccc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 19:13:50 +0530
+Subject: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
+
+From: I Viswanath <viswanathiyyappan@gmail.com>
+
+[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]
+
+syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
+This is the sequence of events that leads to the warning:
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb);
+}
+
+rtl8150_set_multicast() {
+ netif_stop_queue();
+ netif_wake_queue(); <-- wakes up TX queue before URB is done
+}
+
+rtl8150_start_xmit() {
+ netif_stop_queue();
+ usb_submit_urb(dev->tx_urb); <-- double submission
+}
+
+rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
+calling netif_stop_queue and notif_start_queue as these handle
+TX queue synchronization.
+
+The net core function dev_set_rx_mode handles the synchronization
+for rtl8150_set_multicast making it safe to remove these locks.
+
+Reported-and-tested-by: syzbot+78cae3f37c62ad092caa@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: I Viswanath <viswanathiyyappan@gmail.com>
+Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rtl8150.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index ddff6f19ff98e..92add3daadbb1 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rtl8150_t *dev = netdev_priv(netdev);
+ u16 rx_creg = 0x9e;
+
+- netif_stop_queue(netdev);
+ if (netdev->flags & IFF_PROMISC) {
+ rx_creg |= 0x0001;
+ dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
+@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
+ rx_creg &= 0x00fc;
+ }
+ async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
+--
+2.51.0
+
--- /dev/null
+From 39aacb2d3b08438b72dc0b409dbe2c50a4f68c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:36:21 +0800
+Subject: netfilter: ipset: Remove unused htable_bits in macro ahash_region
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]
+
+Since the ahash_region() macro was redefined to calculate the region
+index solely from HTABLE_REGION_BITS, the htable_bits parameter became
+unused.
+
+Remove the unused htable_bits argument and its call sites, simplifying
+the code without changing semantics.
+
+Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Reviewed-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index c2d88b1b06b87..20b223e6e93b9 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -62,7 +62,7 @@ struct hbucket {
+ : jhash_size((htable_bits) - HTABLE_REGION_BITS))
+ #define ahash_sizeof_regions(htable_bits) \
+ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
+-#define ahash_region(n, htable_bits) \
++#define ahash_region(n) \
+ ((n) / jhash_size(HTABLE_REGION_BITS))
+ #define ahash_bucket_start(h, htable_bits) \
+ ((htable_bits) < HTABLE_REGION_BITS ? 0 \
+@@ -701,7 +701,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ #endif
+ key = HKEY(data, h->initval, htable_bits);
+ m = __ipset_dereference(hbucket(t, key));
+- nr = ahash_region(key, htable_bits);
++ nr = ahash_region(key);
+ if (!m) {
+ m = kzalloc(sizeof(*m) +
+ AHASH_INIT_SIZE * dsize,
+@@ -851,7 +851,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ elements = t->hregion[r].elements;
+ maxelem = t->maxelem;
+@@ -1049,7 +1049,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
+ rcu_read_lock_bh();
+ t = rcu_dereference_bh(h->table);
+ key = HKEY(value, h->initval, t->htable_bits);
+- r = ahash_region(key, t->htable_bits);
++ r = ahash_region(key);
+ atomic_inc(&t->uref);
+ rcu_read_unlock_bh();
+
+--
+2.51.0
+
--- /dev/null
+From be2328575ffa5d42fd3e55c62e199ff4603e62f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:42:15 +0900
+Subject: nfp: fix RSS hash key size when RSS is not supported
+
+From: Kohei Enju <enjuk@amazon.com>
+
+[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]
+
+The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
+devices don't support RSS, and callers treat the negative value as a
+large positive value since the return type is u32.
+
+Return 0 when devices don't support RSS, aligning with the ethtool
+interface .get_rxfh_key_size() that requires returning 0 in such cases.
+
+Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
+Signed-off-by: Kohei Enju <enjuk@amazon.com>
+Link: https://patch.msgid.link/20250929054230.68120-1-enjuk@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+index e75cbb287625f..87383f9d09ce3 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+@@ -1413,7 +1413,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
+ struct nfp_net *nn = netdev_priv(netdev);
+
+ if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
+- return -EOPNOTSUPP;
++ return 0;
+
+ return nfp_net_rss_key_sz(nn);
+ }
+--
+2.51.0
+
--- /dev/null
+From fa740de26c63bc8462123ec7d8c0b5234f88166c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:46 +0200
+Subject: NFSv4.1: fix backchannel max_resp_sz verification check
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]
+
+When the client max_resp_sz is larger than what the server encodes in
+its reply, the nfs4_verify_back_channel_attrs() check fails and this
+causes nfs4_proc_create_session() to fail, in cases where the client
+page size is larger than that of the server and the server does not want
+to negotiate upwards.
+
+While this is not a problem with the linux nfs server that will reflect
+the proposed value in its reply irrespective of the local page size,
+other nfs server implementations may insist on their own max_resp_sz
+value, which could be smaller.
+
+Fix this by accepting smaller max_resp_sz values from the server, as
+this does not violate the protocol. The server is allowed to decrease
+but not increase proposed the size, and as such values smaller than the
+client-proposed ones are valid.
+
+Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 124b9cee6fed7..94a1caf326699 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9226,7 +9226,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
+ goto out;
+ if (rcvd->max_rqst_sz > sent->max_rqst_sz)
+ return -EINVAL;
+- if (rcvd->max_resp_sz < sent->max_resp_sz)
++ if (rcvd->max_resp_sz > sent->max_resp_sz)
+ return -EINVAL;
+ if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From d40da6015e54d890a6e90449c3772b8c796a3eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:07:32 +0800
+Subject: null_blk: Fix the description of the cache_size module argument
+
+From: Genjian Zhang <zhanggenjian@kylinos.cn>
+
+[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]
+
+When executing modinfo null_blk, there is an error in the description
+of module parameter mbps, and the output information of cache_size is
+incomplete.The output of modinfo before and after applying this patch
+is as follows:
+
+Before:
+[...]
+parm: cache_size:ulong
+[...]
+parm: mbps:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (uint)
+[...]
+
+After:
+[...]
+parm: cache_size:Cache size in MiB for memory-backed device.
+ Default: 0 (none) (ulong)
+[...]
+parm: mbps:Limit maximum bandwidth (in MiB/s).
+ Default: 0 (no limit) (uint)
+[...]
+
+Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
+Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index 97ed3bd9707f4..2dd254c720f5f 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
+
+ static unsigned long g_cache_size;
+ module_param_named(cache_size, g_cache_size, ulong, 0444);
+-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
++MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+
+ static unsigned int g_mbps;
+ module_param_named(mbps, g_mbps, uint, 0444);
+--
+2.51.0
+
--- /dev/null
+From 57f2cd8a9cd5c1df577482683acfc9d8dc3bfc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:22:00 +0200
+Subject: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]
+
+It’s possible for more than one async command to be in flight from
+__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.
+
+In the current code, only one put work item is queued at a time, which
+results in a leaked reference.
+
+To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
+already tracks all resources related to the command.
+
+Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fc.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
+index 570c58d2b5a58..a15e764bae35b 100644
+--- a/drivers/nvme/target/fc.c
++++ b/drivers/nvme/target/fc.c
+@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
+ int ls_error;
+ struct list_head lsreq_list; /* tgtport->ls_req_list */
+ bool req_queued;
++
++ struct work_struct put_work;
+ };
+
+
+@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
+ struct nvmet_fc_port_entry *pe;
+ struct kref ref;
+ u32 max_sg_cnt;
+-
+- struct work_struct put_work;
+ };
+
+ struct nvmet_fc_port_entry {
+@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
+ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
+ static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
+ static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
+-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
++static void nvmet_fc_put_lsop_work(struct work_struct *work)
+ {
+- struct nvmet_fc_tgtport *tgtport =
+- container_of(work, struct nvmet_fc_tgtport, put_work);
++ struct nvmet_fc_ls_req_op *lsop =
++ container_of(work, struct nvmet_fc_ls_req_op, put_work);
+
+- nvmet_fc_tgtport_put(tgtport);
++ nvmet_fc_tgtport_put(lsop->tgtport);
++ kfree(lsop);
+ }
+ static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+ static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
+ DMA_BIDIRECTIONAL);
+
+ out_putwork:
+- queue_work(nvmet_wq, &tgtport->put_work);
++ queue_work(nvmet_wq, &lsop->put_work);
+ }
+
+ static int
+@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
+ lsreq->done = done;
+ lsop->req_queued = false;
+ INIT_LIST_HEAD(&lsop->lsreq_list);
++ INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
+
+ lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
+ lsreq->rqstlen + lsreq->rsplen,
+@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
+ __nvmet_fc_finish_ls_req(lsop);
+
+ /* fc-nvme target doesn't care about success or failure of cmd */
+-
+- kfree(lsop);
+ }
+
+ /*
+@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
+ kref_init(&newrec->ref);
+ ida_init(&newrec->assoc_cnt);
+ newrec->max_sg_cnt = template->max_sgl_segments;
+- INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
+
+ ret = nvmet_fc_alloc_ls_iodlist(newrec);
+ if (ret) {
+--
+2.51.0
+
--- /dev/null
+From 2e3a635c2bb032e88f4c61b618550a49cb0ced9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 14:26:07 +0300
+Subject: ocfs2: fix double free in user_cluster_connect()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]
+
+user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
+the error handling frees "lc" a second time. Set "lc" to NULL on this
+path to avoid a double free.
+
+Link: https://lkml.kernel.org/r/aNKDz_7JF7aycZ0k@stanley.mountain
+Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.de>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/stack_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
+index 9b76ee66aeb2f..38c0d6f64fce3 100644
+--- a/fs/ocfs2/stack_user.c
++++ b/fs/ocfs2/stack_user.c
+@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
+ printk(KERN_ERR "ocfs2: Could not determine"
+ " locking version\n");
+ user_cluster_disconnect(conn);
++ lc = NULL;
+ goto out;
+ }
+ wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
+--
+2.51.0
+
--- /dev/null
+From 368b74cb2486b2d3ebb2fb9a01dd6b639f031674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 19:29:10 +0800
+Subject: once: fix race by moving DO_ONCE to separate section
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]
+
+The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
+DO_ONCE's ___done variable to .data.once section, which conflicts with
+DO_ONCE_LITE() that also uses the same section.
+
+This creates a race condition when clear_warn_once is used:
+
+Thread 1 (DO_ONCE) Thread 2 (DO_ONCE)
+__do_once_start
+ read ___done (false)
+ acquire once_lock
+execute func
+__do_once_done
+ write ___done (true) __do_once_start
+ release once_lock // Thread 3 clear_warn_once reset ___done
+ read ___done (false)
+ acquire once_lock
+ execute func
+schedule once_work __do_once_done
+once_deferred: OK write ___done (true)
+static_branch_disable release once_lock
+ schedule once_work
+ once_deferred:
+ BUG_ON(!static_key_enabled)
+
+DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
+macros. Keep its ___done flag in the .data..once section and allow resetting
+by clear_warn_once, as originally intended.
+
+In contrast, DO_ONCE() is used for functions like get_random_once() and
+relies on its ___done flag for internal synchronization. We should not reset
+DO_ONCE() by clear_warn_once.
+
+Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
+shielding it from clear_warn_once.
+
+Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 1 +
+ include/linux/once.h | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index cf3f8b9bf43f0..010ac18c05916 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -351,6 +351,7 @@
+ __start_once = .; \
+ *(.data..once) \
+ __end_once = .; \
++ *(.data..do_once) \
+ STRUCT_ALIGN(); \
+ *(__tracepoints) \
+ /* implement dynamic printk debug */ \
+diff --git a/include/linux/once.h b/include/linux/once.h
+index 30346fcdc7995..449a0e34ad5ad 100644
+--- a/include/linux/once.h
++++ b/include/linux/once.h
+@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ unsigned long ___flags; \
+@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
+ #define DO_ONCE_SLEEPABLE(func, ...) \
+ ({ \
+ bool ___ret = false; \
+- static bool __section(".data..once") ___done = false; \
++ static bool __section(".data..do_once") ___done = false; \
+ static DEFINE_STATIC_KEY_TRUE(___once_key); \
+ if (static_branch_unlikely(&___once_key)) { \
+ ___ret = __do_once_sleepable_start(&___done); \
+--
+2.51.0
+
--- /dev/null
+From 8e73719bed253cbcfbed2e2176489503a884121a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 08:04:08 -0700
+Subject: PCI: tegra: Fix devm_kcalloc() argument order for port->phys
+ allocation
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]
+
+Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
+The original call used sizeof(phy) as the number of elements and
+port->lanes as the element size, which is reversed. While this happens to
+produce the correct total allocation size with current pointer size and
+lane counts, the argument order is wrong.
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250819150436.3105973-1-alok.a.tiwari@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 038d974a318ea..80d975dcb2ee2 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
+ unsigned int i;
+ int err;
+
+- port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
++ port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
+ if (!port->phys)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 5853edc3eeab9f53c9fd4d2d73788753d2479821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 11:30:22 +0200
+Subject: PCI: tegra194: Fix duplicate PLL disable in
+ pex_ep_event_pex_rst_assert()
+
+From: Nagarjuna Kristam <nkristam@nvidia.com>
+
+[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]
+
+During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
+called twice.
+
+pex_ep_event_pex_rst_assert() should do the opposite of
+pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
+tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
+tegra_pcie_bpmp_set_pll_state() call should instead be a call to
+tegra_pcie_bpmp_set_ctrl_state().
+
+With this, the uninitialization sequence also matches that of
+tegra_pcie_unconfig_controller().
+
+Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
+Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
+[cassel: improve commit log]
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250911093021.1454385-2-cassel@kernel.org
+[mani: added Fixes tag]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 416d6b45d1fe8..115a21cf869ae 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1734,9 +1734,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
+ ret);
+ }
+
+- ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
++ ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
+ if (ret)
+- dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
++ dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
+
+ pcie->ep_state = EP_STATE_DISABLED;
+ dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
+--
+2.51.0
+
--- /dev/null
+From 96d52ed1f6196078c3e3516c9088fd96c1547f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 18:41:39 +0100
+Subject: perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]
+
+Cast nr_pages to unsigned long to avoid overflow when handling large
+AUX buffer sizes (>= 2 GiB).
+
+Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_spe_pmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 2bec2e3af0bd6..affa78376b6a8 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -96,7 +96,8 @@ struct arm_spe_pmu {
+ #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
+
+ /* Convert a free-running index from perf into an SPE buffer offset */
+-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
++#define PERF_IDX2OFF(idx, buf) \
++ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
+
+ /* Keep track of our dynamic hotplug state */
+ static enum cpuhp_state arm_spe_pmu_online;
+--
+2.51.0
+
--- /dev/null
+From 4e08d35e41c43c44fe2c7e971c43c85bcccd19ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 07:23:22 +0000
+Subject: phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]
+
+The boot firmware may disable the U3 port early during boot and leave it
+up to the controller or PHY driver to re-enable U3 when needed.
+
+The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
+something the Rockchip Naneng Combo PHY driver never does for RK3568.
+This may result in USB 3.0 ports being limited to only using USB 2.0 or
+in special cases not working at all on RK3568.
+
+Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
+when a PHY with PHY_TYPE_USB3 mode is used.
+
+Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Link: https://lore.kernel.org/r/20250723072324.2246498-1-jonas@kwiboo.se
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+index 2354ce8b21594..9ef496092b7e6 100644
+--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg {
+ struct combphy_reg pipe_xpcs_phy_ready;
+ struct combphy_reg pipe_pcie1l0_sel;
+ struct combphy_reg pipe_pcie1l1_sel;
++ struct combphy_reg u3otg0_port_en;
++ struct combphy_reg u3otg1_port_en;
+ };
+
+ struct rockchip_combphy_cfg {
+@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
+ rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
++ switch (priv->id) {
++ case 0:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
++ break;
++ case 1:
++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
++ break;
++ }
+ break;
+
+ case PHY_TYPE_SATA:
+@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
+ /* pipe-grf */
+ .pipe_con0_for_sata = { 0x0000, 15, 0, 0x00, 0x2220 },
+ .pipe_xpcs_phy_ready = { 0x0040, 2, 2, 0x00, 0x01 },
++ .u3otg0_port_en = { 0x0104, 15, 0, 0x0181, 0x1100 },
++ .u3otg1_port_en = { 0x0144, 15, 0, 0x0181, 0x1100 },
+ };
+
+ static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
+--
+2.51.0
+
--- /dev/null
+From cf287ada592b45876f1ffaaae9a6803207b8d6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 19:33:34 -0400
+Subject: pinctrl: meson-gxl: add missing i2c_d pinmux
+
+From: Da Xue <da@libre.computer>
+
+[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]
+
+Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.
+
+Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Da Xue <da@libre.computer>
+Link: https://lore.kernel.org/20250821233335.1707559-1-da@libre.computer
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 51408996255bd..e2601e45935e6 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[] = { GPIODV_28 };
+ static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
+ static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
+
++static const unsigned int i2c_sck_d_pins[] = { GPIOX_11 };
++static const unsigned int i2c_sda_d_pins[] = { GPIOX_10 };
++
+ static const unsigned int eth_mdio_pins[] = { GPIOZ_0 };
+ static const unsigned int eth_mdc_pins[] = { GPIOZ_1 };
+ static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
+@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ GPIO_GROUP(GPIO_TEST_N),
+
+ /* Bank X */
++ GROUP(i2c_sda_d, 5, 5),
++ GROUP(i2c_sck_d, 5, 4),
+ GROUP(sdio_d0, 5, 31),
+ GROUP(sdio_d1, 5, 30),
+ GROUP(sdio_d2, 5, 29),
+@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
+ "i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
+ };
+
++static const char * const i2c_d_groups[] = {
++ "i2c_sck_d", "i2c_sda_d",
++};
++
+ static const char * const eth_groups[] = {
+ "eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
+ "eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
+@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
+ FUNCTION(i2c_a),
+ FUNCTION(i2c_b),
+ FUNCTION(i2c_c),
++ FUNCTION(i2c_d),
+ FUNCTION(eth),
+ FUNCTION(pwm_a),
+ FUNCTION(pwm_b),
+--
+2.51.0
+
--- /dev/null
+From a979b474c33f1876ca17d39087e5376f63536023 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Aug 2025 16:49:58 +0800
+Subject: pinctrl: renesas: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]
+
+Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
+int to int, as it needs to store either negative error codes or zero
+returned by sh_pfc_pinconf_set().
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250831084958.431913-4-rongqianfeng@vivo.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
+index 4d9d58fc1356f..852e179f9e383 100644
+--- a/drivers/pinctrl/renesas/pinctrl.c
++++ b/drivers/pinctrl/renesas/pinctrl.c
+@@ -730,7 +730,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+ struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
+ const unsigned int *pins;
+ unsigned int num_pins;
+- unsigned int i, ret;
++ unsigned int i;
++ int ret;
+
+ pins = pmx->pfc->info->groups[group].pins;
+ num_pins = pmx->pfc->info->groups[group].nr_pins;
+--
+2.51.0
+
--- /dev/null
+From 2c53490f0ce7a2cceebe20938f5ca2622a349189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:58:23 +0300
+Subject: PM / devfreq: mtk-cci: Fix potential error pointer dereference in
+ probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]
+
+The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
+would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check
+that the pointer is valid.
+
+Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Link: https://patchwork.kernel.org/project/linux-pm/patch/aJTNHz8kk8s6Q2os@stanley.mountain/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
+index 83a73f0ccd803..eff9b2c06aef4 100644
+--- a/drivers/devfreq/mtk-cci-devfreq.c
++++ b/drivers/devfreq/mtk-cci-devfreq.c
+@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
+ out_free_resources:
+ if (regulator_is_enabled(drv->proc_reg))
+ regulator_disable(drv->proc_reg);
+- if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
++ if (!IS_ERR_OR_NULL(drv->sram_reg) &&
++ regulator_is_enabled(drv->sram_reg))
+ regulator_disable(drv->sram_reg);
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 2d26aeed8a89f8c3debf501f6c4c0a117787ebf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:55:45 +0200
+Subject: PM: sleep: core: Clear power.must_resume in noirq suspend error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]
+
+If system suspend is aborted in the "noirq" phase (for instance, due to
+an error returned by one of the device callbacks), power.is_noirq_suspended
+will not be set for some devices and device_resume_noirq() will return
+early for them. Consequently, noirq resume callbacks will not run for
+them at all because the noirq suspend callbacks have not run for them
+yet.
+
+If any of them has power.must_resume set and late suspend has been
+skipped for it (due to power.smart_suspend), early resume should be
+skipped for it either, or its state may become inconsistent (for
+instance, if the early resume assumes that it will always follow
+noirq resume).
+
+Make that happen by clearing power.must_resume in device_resume_noirq()
+for devices with power.is_noirq_suspended clear that have been left in
+suspend by device_suspend_late(), which will subsequently cause
+device_resume_early() to leave the device in suspend and avoid
+changing its state.
+
+Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
+Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowland.harvard.edu/
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index baa31194cf20d..ef5157fc8dcc5 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a
+ if (dev->power.syscore || dev->power.direct_complete)
+ goto Out;
+
+- if (!dev->power.is_noirq_suspended)
++ if (!dev->power.is_noirq_suspended) {
++ /*
++ * This means that system suspend has been aborted in the noirq
++ * phase before invoking the noirq suspend callback for the
++ * device, so if device_suspend_late() has left it in suspend,
++ * device_resume_early() should leave it in suspend either in
++ * case the early resume of it depends on the noirq resume that
++ * has not run.
++ */
++ if (dev_pm_skip_suspend(dev))
++ dev->power.must_resume = false;
++
+ goto Out;
++ }
+
+ if (!dpm_wait_for_superior(dev, async))
+ goto Out;
+--
+2.51.0
+
--- /dev/null
+From f2ebb9bc0a0c3c2103550878be78847802e572c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 20:32:59 +0800
+Subject: power: supply: cw2015: Fix a alignment coding style issue
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]
+
+Fix the checkpatch warning:
+CHECK: Alignment should match open parenthesis
+
+Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index 99f3ccdc30a6a..434e3233c9f8c 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
+ if (!cw_bat->battery_workqueue)
+ return -ENOMEM;
+
+- devm_delayed_work_autocancel(&client->dev,
+- &cw_bat->battery_delay_work, cw_bat_work);
++ devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
+ queue_delayed_work(cw_bat->battery_workqueue,
+ &cw_bat->battery_delay_work, msecs_to_jiffies(10));
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 5376f410b2d2fb0b5326dea5c6534b36ede0046b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 15:50:23 +0800
+Subject: pps: fix warning in pps_register_cdev when register device fail
+
+From: Wang Liang <wangliang74@huawei.com>
+
+[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]
+
+Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
+handling in __video_register_device()"), the release hook should be set
+before device_register(). Otherwise, when device_register() return error
+and put_device() try to callback the release function, the below warning
+may happen.
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
+ RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
+ Call Trace:
+ <TASK>
+ kobject_cleanup+0x136/0x410 lib/kobject.c:689
+ kobject_release lib/kobject.c:720 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0xe9/0x130 lib/kobject.c:737
+ put_device+0x24/0x30 drivers/base/core.c:3797
+ pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
+ pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
+ pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
+ tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
+ tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
+ tiocsetd drivers/tty/tty_io.c:2429 [inline]
+ tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:598 [inline]
+ __se_sys_ioctl fs/ioctl.c:584 [inline]
+ __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
+pps_register_cdev() call device_create() to create pps->dev, which will
+init dev->release to device_create_release(). Now the comment is outdated,
+just remove it.
+
+Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
+in pps_register_source() to avoid a double free in the failure case.
+
+Link: https://lore.kernel.org/all/20250827065010.3208525-1-wangliang74@huawei.com/
+Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
+Signed-off-by: Wang Liang <wangliang74@huawei.com>
+Reviewed-By: Calvin Owens <calvin@wbinvd.org>
+Link: https://lore.kernel.org/r/20250830075023.3498174-1-wangliang74@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pps/kapi.c | 5 +----
+ drivers/pps/pps.c | 5 ++---
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
+index 92d1b62ea239d..e9389876229ea 100644
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
+ if (err < 0) {
+ pr_err("%s: unable to create char device\n",
+ info->name);
+- goto kfree_pps;
++ goto pps_register_source_exit;
+ }
+
+ dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
+
+ return pps;
+
+-kfree_pps:
+- kfree(pps);
+-
+ pps_register_source_exit:
+ pr_err("%s: unable to register source\n", info->name);
+
+diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
+index e1689957736d9..9539695b337a8 100644
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->info.name);
+ err = -EBUSY;
+ }
++ kfree(pps);
+ goto out_unlock;
+ }
+ pps->id = err;
+@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
+ pps->dev.devt = MKDEV(pps_major, pps->id);
+ dev_set_drvdata(&pps->dev, pps);
+ dev_set_name(&pps->dev, "pps%d", pps->id);
++ pps->dev.release = pps_device_destruct;
+ err = device_register(&pps->dev);
+ if (err)
+ goto free_idr;
+
+- /* Override the release function with our own */
+- pps->dev.release = pps_device_destruct;
+-
+ pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
+ pps->id);
+
+--
+2.51.0
+
--- /dev/null
+From cc809f2cff2340c8de11f36b6cd8cf90b858e1ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 18:01:02 +0200
+Subject: pwm: tiehrpwm: Fix corner case in clock divisor calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]
+
+The function set_prescale_div() is responsible for calculating the clock
+divisor settings such that the input clock rate is divided down such that
+the required period length is at most 0x10000 clock ticks. If period_cycles
+is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
+good enough. So round up in the calculation of the required divisor and
+compare it using >= instead of >.
+
+Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://lore.kernel.org/r/85488616d7bfcd9c32717651d0be7e330e761b9c.1754927682.git.u.kleine-koenig@baylibre.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-tiehrpwm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index ecbfd7e954ecb..d693b2d65cccf 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
+
+ *prescale_div = (1 << clkdiv) *
+ (hspclkdiv ? (hspclkdiv * 2) : 1);
+- if (*prescale_div > rqst_prescaler) {
++ if (*prescale_div >= rqst_prescaler) {
+ *tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
+ (hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
+ return 0;
+@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ pc->period_cycles[pwm->hwpwm] = period_cycles;
+
+ /* Configure clock prescaler to support Low frequency PWM wave */
+- if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
++ if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
+ &tb_divval)) {
+ dev_err(chip->dev, "Unsupported values\n");
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 540ac4a9936dcd0294827f9a5e83af1086db8e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 12:05:20 +0200
+Subject: RDMA/cm: Rate limit destroy CM ID timeout error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]
+
+When the destroy CM ID timeout kicks in, you typically get a storm of
+them which creates a log flooding. Hence, change pr_err() to
+pr_err_ratelimited() in cm_destroy_id_wait_timeout().
+
+Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Link: https://patch.msgid.link/20250912100525.531102-1-haakon.bugge@oracle.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index d45e3909dafe1..50bb3c43f40bf 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
+ struct cm_id_private *cm_id_priv;
+
+ cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+- pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+- cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
++ pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
++ cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+ }
+
+ static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
+--
+2.51.0
+
--- /dev/null
+From 52f4dbda2464731bfa9e215716211cc921d31117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:01 +0300
+Subject: RDMA/core: Resolve MAC of next-hop device without ARP support
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]
+
+Currently, if the next-hop netdevice does not support ARP resolution,
+the destination MAC address is silently set to zero without reporting
+an error. This leads to incorrect behavior and may result in packet
+transmission failures.
+
+Fix this by deferring MAC resolution to the IP stack via neighbour
+lookup, allowing proper resolution or error reporting as appropriate.
+
+Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-3-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/addr.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index f20dfe70fa0e4..8bf705921618c 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
+ {
+ int ret = 0;
+
+- if (ndev_flags & IFF_LOOPBACK) {
++ if (ndev_flags & IFF_LOOPBACK)
+ memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+- } else {
+- if (!(ndev_flags & IFF_NOARP)) {
+- /* If the device doesn't do ARP internally */
+- ret = fetch_ha(dst, addr, dst_in, seq);
+- }
+- }
++ else
++ ret = fetch_ha(dst, addr, dst_in, seq);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 940c1e857bb002579847d6a7e723eaf5a95b43a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:41:19 +0300
+Subject: RDMA/mlx5: Fix vport loopback forcing for MPV device
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]
+
+Previously loopback for MPV was supposed to be permanently enabled,
+however other driver flows were able to over-ride that configuration and
+disable it.
+
+Add force_lb parameter that indicates that loopback should always be
+enabled which prevents all other driver flows from disabling it.
+
+Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
+Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 19 +++++++++++++++----
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index e922fb8728654..0adb98b8dacc8 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1691,7 +1691,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
+ }
+
+ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ int err;
+
+@@ -1703,6 +1704,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ if (err)
+ goto out;
+
++ lb_state->force_enable = true;
+ return 0;
+
+ out:
+@@ -1711,16 +1713,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
+ }
+
+ static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
+- struct mlx5_core_dev *slave)
++ struct mlx5_core_dev *slave,
++ struct mlx5_ib_lb_state *lb_state)
+ {
+ mlx5_nic_vport_update_local_lb(slave, false);
+ mlx5_nic_vport_update_local_lb(master, false);
++
++ lb_state->force_enable = false;
+ }
+
+ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
+ int err = 0;
+
++ if (dev->lb.force_enable)
++ return 0;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td++;
+@@ -1742,6 +1750,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+
+ void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
+ {
++ if (dev->lb.force_enable)
++ return;
++
+ mutex_lock(&dev->lb.mutex);
+ if (td)
+ dev->lb.user_td--;
+@@ -3251,7 +3262,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
+
+ lockdep_assert_held(&mlx5_ib_multiport_mutex);
+
+- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
++ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+
+ mlx5_core_mp_event_replay(ibdev->mdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
+@@ -3348,7 +3359,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
+ MLX5_DRIVER_EVENT_AFFILIATION_DONE,
+ &key);
+
+- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
++ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
+ if (err)
+ goto unbind;
+
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 94678e5c59dd5..9b780f48a382b 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1065,6 +1065,7 @@ struct mlx5_ib_lb_state {
+ u32 user_td;
+ int qps;
+ bool enabled;
++ bool force_enable;
+ };
+
+ struct mlx5_ib_pf_eq {
+--
+2.51.0
+
--- /dev/null
+From 20b6d0c887c79bf3835319af4096e837d1130134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 02:52:12 +0000
+Subject: RDMA/rxe: Fix race in do_task() when draining
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]
+
+When do_task() exhausts its iteration budget (!ret), it sets the state
+to TASK_STATE_IDLE to reschedule, without a secondary check on the
+current task->state. This can overwrite the TASK_STATE_DRAINING state
+set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().
+
+While state changes are protected by a spinlock, both rxe_cleanup_task()
+and rxe_disable_task() release the lock while waiting for the task to
+finish draining in the while(!is_done(task)) loop. The race occurs if
+do_task() hits its iteration limit and acquires the lock in this window.
+The cleanup logic may then proceed while the task incorrectly
+reschedules itself, leading to a potential use-after-free.
+
+This bug was introduced during the migration from tasklets to workqueues,
+where the special handling for the draining case was lost.
+
+Fix this by restoring the original pre-migration behavior. If the state is
+TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
+force a new loop iteration. This allows the task to finish its work, so
+that a subsequent iteration can reach the switch statement and correctly
+transition the state to TASK_STATE_DRAINED, stopping the task as intended.
+
+Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Link: https://patch.msgid.link/20250919025212.1682087-1-hanguidong02@gmail.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 80332638d9e3a..be6cd8ce4d97e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
+ * yield the cpu and reschedule the task
+ */
+ if (!ret) {
+- task->state = TASK_STATE_IDLE;
+- resched = 1;
++ if (task->state != TASK_STATE_DRAINING) {
++ task->state = TASK_STATE_IDLE;
++ resched = 1;
++ } else {
++ cont = 1;
++ }
+ goto exit;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8b8d890e3659ba89f1a065a3ffe38e966b0eef5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 16:45:36 +0200
+Subject: RDMA/siw: Always report immediate post SQ errors
+
+From: Bernard Metzler <bernard.metzler@linux.dev>
+
+[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]
+
+In siw_post_send(), any immediate error encountered during processing of
+the work request list must be reported to the caller, even if previous
+work requests in that list were just accepted and added to the send queue.
+
+Not reporting those errors confuses the caller, which would wait
+indefinitely for the failing and potentially subsequently aborted work
+requests completion.
+
+This fixes a case where immediate errors were overwritten by subsequent
+code in siw_post_send().
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://patch.msgid.link/r/20250923144536.103825-1-bernard.metzler@linux.dev
+Suggested-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index fdbef3254e308..1768b8695c45a 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ struct siw_wqe *wqe = tx_wqe(qp);
+
+ unsigned long flags;
+- int rv = 0;
++ int rv = 0, imm_err = 0;
+
+ if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ * Send directly if SQ processing is not in progress.
+ * Eventual immediate errors (rv < 0) do not affect the involved
+ * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
+- * processing, if new work is already pending. But rv must be passed
+- * to caller.
++ * processing, if new work is already pending. But rv and pointer
++ * to failed work request must be passed to caller.
+ */
++ if (unlikely(rv < 0)) {
++ /*
++ * Immediate error
++ */
++ siw_dbg_qp(qp, "Immediate error %d\n", rv);
++ imm_err = rv;
++ *bad_wr = wr;
++ }
+ if (wqe->wr_status != SIW_WR_IDLE) {
+ spin_unlock_irqrestore(&qp->sq_lock, flags);
+ goto skip_direct_sending;
+@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+
+ up_read(&qp->state_lock);
+
+- if (rv >= 0)
+- return 0;
+- /*
+- * Immediate error
+- */
+- siw_dbg_qp(qp, "error %d\n", rv);
++ if (unlikely(imm_err))
++ return imm_err;
+
+- *bad_wr = wr;
+- return rv;
++ return (rv >= 0) ? 0 : rv;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From a7dc8a65060530cb4f4662aeee9247b1ffc2ad1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:07:18 +0200
+Subject: regmap: Remove superfluous check for !config in __regmap_init()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]
+
+The first thing __regmap_init() do is check if config is non-NULL,
+so there is no need to check for this again later.
+
+Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/a154d9db0f290dda96b48bd817eb743773e846e1.1755090330.git.geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 1209e01f8c7f9..9603c28a3ed82 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
+ map->read_flag_mask = bus->read_flag_mask;
+ }
+
+- if (config && config->read && config->write) {
++ if (config->read && config->write) {
+ map->reg_read = _regmap_bus_read;
+ if (config->reg_update_bits)
+ map->reg_update_bits = config->reg_update_bits;
+--
+2.51.0
+
--- /dev/null
+From 70d6f21663b342e1e89b16eeb187f05739f16bf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 18:14:11 +0800
+Subject: regulator: scmi: Use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]
+
+Change the 'ret' variable from u32 to int to store negative error codes or
+zero returned by of_property_read_u32().
+
+Storing the negative error codes in unsigned type, doesn't cause an issue
+at runtime but it's ugly as pants. Additionally, assigning negative error
+codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
+flag is enabled.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
+Link: https://patch.msgid.link/20250829101411.625214-1-rongqianfeng@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/scmi-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
+index 29ab217297d6d..432654fbd7a12 100644
+--- a/drivers/regulator/scmi-regulator.c
++++ b/drivers/regulator/scmi-regulator.c
+@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
+ struct device_node *np,
+ struct scmi_regulator_info *rinfo)
+ {
+- u32 dom, ret;
++ u32 dom;
++ int ret;
+
+ ret = of_property_read_u32(np, "reg", &dom);
+ if (ret)
+--
+2.51.0
+
--- /dev/null
+From 41d7008129f496442a7d56c7753112a786e99b39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:33 +0200
+Subject: remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]
+
+enable_irq() and disable_irq() are reference counted, so we must make sure
+that each enable_irq() is always paired with a single disable_irq(). If we
+call disable_irq() twice followed by just a single enable_irq(), the IRQ
+will remain disabled forever.
+
+For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
+will end up being called twice, because disable_irq() also happens in
+qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().
+
+Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
+qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
+sense to have the rollback handled always by qcom_q6v5_unprepare().
+
+Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-1-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 4ee5e67a9f03f..769c6d6d6a731 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
+ int ret;
+
+ ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
+- if (!ret)
+- disable_irq(q6v5->handover_irq);
+-
+ return !ret ? -ETIMEDOUT : 0;
+ }
+ EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
+--
+2.51.0
+
--- /dev/null
+From b0ae8aee8137941e83da39613b8762c6394880e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:15:29 -0700
+Subject: Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]
+
+This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.
+
+Commit in question breaks the mapping of PGs to pools for some SKUs.
+Specifically multi-host NICs seem to be shipped with a custom buffer
+configuration which maps the lossy PG to pool 4. But the bad commit
+overrides this with pool 0 which does not have sufficient buffer space
+reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
+OOB connection completely (100% packet loss).
+
+Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
+set Xon/Xoff upon port speed set""). The breakage is exactly the same,
+the only difference is that quoted commit would break the NIC immediately
+on boot, and the currently reverted commit only when MTU is changed.
+
+Note: "good" kernels do not restore the configuration, so downgrade isn't
+enough to recover machines. A NIC power cycle seems to be necessary to
+return to a healthy state (or overriding the relevant registers using
+a custom patch).
+
+Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250929181529.1848157-1-kuba@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/port_buffer.h | 12 ------------
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 17 +----------------
+ 2 files changed, 1 insertion(+), 28 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+index 66d276a1be836..f4a19ffbb641c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
+ };
+
+-#ifdef CONFIG_MLX5_CORE_EN_DCB
+ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+ u32 change, unsigned int mtu,
+ struct ieee_pfc *pfc,
+ u32 *buffer_size,
+ u8 *prio2buffer);
+-#else
+-static inline int
+-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
+- u32 change, unsigned int mtu,
+- void *pfc,
+- u32 *buffer_size,
+- u8 *prio2buffer)
+-{
+- return 0;
+-}
+-#endif
+
+ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
+ struct mlx5e_port_buffer *port_buffer);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 09ba60b2e744b..5c6f01abdcb91 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -44,7 +44,6 @@
+ #include "eswitch.h"
+ #include "en.h"
+ #include "en/txrx.h"
+-#include "en/port_buffer.h"
+ #include "en_tc.h"
+ #include "en_rep.h"
+ #include "en_accel/ipsec.h"
+@@ -2723,11 +2722,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ struct mlx5e_params *params = &priv->channels.params;
+ struct net_device *netdev = priv->netdev;
+ struct mlx5_core_dev *mdev = priv->mdev;
+- u16 mtu, prev_mtu;
++ u16 mtu;
+ int err;
+
+- mlx5e_query_mtu(mdev, params, &prev_mtu);
+-
+ err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
+ if (err)
+ return err;
+@@ -2737,18 +2734,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
+ netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
+ __func__, mtu, params->sw_mtu);
+
+- if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
+- err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
+- NULL, NULL, NULL);
+- if (err) {
+- netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
+- __func__, mtu, err, prev_mtu);
+-
+- mlx5e_set_mtu(mdev, params, prev_mtu);
+- return err;
+- }
+- }
+-
+ params->sw_mtu = mtu;
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From dbdbcc87489b6c7aa5e85fb8c6031b2fde37b634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:20 +0300
+Subject: Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint
+ seems Running"
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]
+
+This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.
+
+No actual HW bugs are known where Endpoint Context shows Running state
+but Stop Endpoint fails repeatedly with Context State Error and leaves
+the endpoint state unchanged. Stop Endpoint retries on Running EPs have
+been performed since early 2021 with no such issues reported so far.
+
+Trying to handle this hypothetical case brings a more realistic danger:
+if Stop Endpoint fails on an endpoint which hasn't yet started after a
+doorbell ring and enough latency occurs before this completion event is
+handled, the driver may time out and begin removing cancelled TDs from
+a running endpoint, even though one more retry would stop it reliably.
+
+Such high latency is rare but not impossible, and removing TDs from a
+running endpoint can cause more damage than not giving back a cancelled
+URB (which wasn't happening anyway). So err on the side of caution and
+revert to the old policy of always retrying if the EP appears running.
+
+[Remove stable tag as we are dealing with theoretical cases -Mathias]
+
+Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index a21ac9d80275f..6443e11eaac04 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1224,19 +1224,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
+ * Stopped state, but it will soon change to Running.
+ *
+ * Assume this bug on unexpected Stop Endpoint failures.
+- * Keep retrying until the EP starts and stops again.
++ * Keep retrying until the EP starts and stops again, on
++ * chips where this is known to help. Wait for 100ms.
+ */
++ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
++ break;
+ fallthrough;
+ case EP_STATE_RUNNING:
+ /* Race, HW handled stop ep cmd before ep was running */
+ xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
+ GET_EP_CTX_STATE(ep_ctx));
+- /*
+- * Don't retry forever if we guessed wrong or a defective HC never starts
+- * the EP or says 'Running' but fails the command. We must give back TDs.
+- */
+- if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+- break;
+
+ command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
+ if (!command) {
+--
+2.51.0
+
--- /dev/null
+From 74dfe6acd15cd6587d1244674e9452bd495b55d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:29 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]
+
+The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
+as follows:
+
+ entry()
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+ subprog_tail()
+ bpf_tail_call_static(0) -> entry + tail_call_start
+
+entry() copies its tail call counter to the subprog_tail()'s frame,
+which then increments it. However, the incremented result is discarded,
+leading to an astronomically large number of tail calls.
+
+Fix by writing the incremented counter back to the entry()'s frame.
+
+Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-3-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 2d8facfd4e425..31a4bbd2e7dc4 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1425,13 +1425,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ jit->seen |= SEEN_FUNC;
+ /*
+ * Copy the tail call counter to where the callee expects it.
+- *
+- * Note 1: The callee can increment the tail call counter, but
+- * we do not load it back, since the x86 JIT does not do this
+- * either.
+- *
+- * Note 2: We assume that the verifier does not let us call the
+- * main program, which clears the tail call counter on entry.
+ */
+ /* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
+ _EMIT6(0xd203f000 | STK_OFF_TCCNT,
+@@ -1457,6 +1450,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ call_r1(jit);
+ /* lgr %b0,%r2: load return value into %b0 */
+ EMIT4(0xb9040000, BPF_REG_0, REG_2);
++
++ /*
++ * Copy the potentially updated tail call counter back.
++ */
++
++ if (insn->src_reg == BPF_PSEUDO_CALL)
++ /*
++ * mvc frame_off+tail_call_cnt(%r15),
++ * tail_call_cnt(4,%r15)
++ */
++ _EMIT6(0xd203f000 | (jit->frame_off +
++ offsetof(struct prog_frame,
++ tail_call_cnt)),
++ 0xf000 | offsetof(struct prog_frame,
++ tail_call_cnt));
++
+ break;
+ }
+ case BPF_JMP | BPF_TAIL_CALL: {
+--
+2.51.0
+
--- /dev/null
+From 893445b9a191c634c2e59e7a3f7f182ea3e9076b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 14:06:30 +0200
+Subject: s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]
+
+The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
+graph is as follows:
+
+ entry()
+ subprog_tail()
+ trampoline()
+ fentry()
+ the rest of subprog_tail() # via BPF_TRAMP_F_CALL_ORIG
+ return to entry()
+
+The problem is that the rest of subprog_tail() increments the tail call
+counter, but the trampoline discards the incremented value. This
+results in an astronomically large number of tail calls.
+
+Fix by making the trampoline write the incremented tail call counter
+back.
+
+Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20250813121016.163375-4-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 31a4bbd2e7dc4..fe0354ad3bb96 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -2442,6 +2442,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
+ /* stg %r2,retval_off(%r15) */
+ EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
+ tjit->retval_off);
++ /* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
++ _EMIT6(0xd203f000 | tjit->tccnt_off,
++ 0xf000 | offsetof(struct prog_frame, tail_call_cnt));
+
+ im->ip_after_call = jit->prg_buf + jit->prg;
+
+--
+2.51.0
+
--- /dev/null
+From 75e05ab8edeca46e3c8f6c82603792678b5c9679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:10 +0530
+Subject: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]
+
+During mpt3sas_transport_port_remove(), messages were logged with
+dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
+transport device may already be partially unregistered or freed, leading
+to a crash when accessing its struct device.
+
+Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
+guaranteed to remain valid until driver removal.
+
+[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
+[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary)
+[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
+[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
+[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
+[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
+[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
+[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
+[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
+[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
+[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
+[83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
+[83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
+[83428.295844] PKRU: 55555554
+[83428.295846] Call Trace:
+[83428.295848] <TASK>
+[83428.295850] _dev_printk+0x5c/0x80
+[83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
+[83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas]
+[83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
+[83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
+[83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
+[83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
+[83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas]
+[83428.295957] pci_device_remove+0x3b/0xb0
+[83428.295962] device_release_driver_internal+0x193/0x200
+[83428.295968] driver_detach+0x44/0x90
+[83428.295971] bus_remove_driver+0x69/0xf0
+[83428.295975] pci_unregister_driver+0x2a/0xb0
+[83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas]
+[83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310
+[83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296000] ? __x64_sys_getdents64+0x9a/0x110
+[83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296009] ? syscall_trace_enter+0xf6/0x1b0
+[83428.296014] do_syscall_64+0x7b/0x2c0
+[83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5
+[83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index e8a4750f6ec47..7d6e4fe31ceed 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
+ list_for_each_entry_safe(mpt3sas_phy, next_phy,
+ &mpt3sas_port->phy_list, port_siblings) {
+ if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
+- dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
+- "remove: sas_addr(0x%016llx), phy(%d)\n",
+- (unsigned long long)
+- mpt3sas_port->remote_identify.sas_address,
+- mpt3sas_phy->phy_id);
++ ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
++ (unsigned long long) mpt3sas_port->remote_identify.sas_address,
++ mpt3sas_phy->phy_id);
+ mpt3sas_phy->phy_belongs_to_port = 0;
+ if (!ioc->remove_host)
+ sas_port_delete_phy(mpt3sas_port->port,
+--
+2.51.0
+
--- /dev/null
+From 14c87c928faef3a2fed6703250ded7940b713e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 10:31:06 +0200
+Subject: scsi: myrs: Fix dma_alloc_coherent() error check
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]
+
+Check for NULL return value with dma_alloc_coherent(), because DMA
+address is not always set by dma_alloc_coherent() on failure.
+
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://lore.kernel.org/r/20250725083112.43975-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/myrs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
+index e824be9d9bbb9..9075836ccc3e2 100644
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ /* Temporary dma mapping, used only in the scope of this function */
+ mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
+ &mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, mbox_addr))
++ if (!mbox)
+ return false;
+
+ /* These are the base addresses for the command memory mailbox array */
+ cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
+ cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
+ &cs->cmd_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
++ if (!cmd_mbox) {
+ dev_err(&pdev->dev, "Failed to map command mailbox\n");
+ goto out_free;
+ }
+@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
+ stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
+ &cs->stat_mbox_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
++ if (!stat_mbox) {
+ dev_err(&pdev->dev, "Failed to map status mailbox\n");
+ goto out_free;
+ }
+@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
+ cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
+ sizeof(struct myrs_fwstat),
+ &cs->fwstat_addr, GFP_KERNEL);
+- if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
++ if (!cs->fwstat_buf) {
+ dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
+ cs->fwstat_buf = NULL;
+ goto out_free;
+--
+2.51.0
+
--- /dev/null
+From 397f064752ce8b4ea8444eb5572595b255adafb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 19:32:17 +0200
+Subject: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]
+
+Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
+device is gone") UBSAN reports:
+
+ UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
+ index 28 is out of range for type 'pm8001_phy [16]'
+
+on rmmod when using an expander.
+
+For a direct attached device, attached_phy contains the local phy id.
+For a device behind an expander, attached_phy contains the remote phy
+id, not the local phy id.
+
+I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
+device behind an expander, attached_phy can be much larger than
+pm8001_ha->chip->n_phy (depending on the amount of phys of the
+expander).
+
+E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the
+ports has an expander connected. The expander has 31 phys with phy ids
+0-30.
+
+The pm8001_ha->phy array only contains the phys of the HBA. It does not
+contain the phys of the expander. Thus, it is wrong to use attached_phy
+to index the pm8001_ha->phy array for a device behind an expander.
+
+Thus, we can only clear phy_attached for devices that are directly
+attached.
+
+Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
+Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Link: https://lore.kernel.org/r/20250814173215.1765055-14-cassel@kernel.org
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Tested-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index a9d6dac413346..4daab8b6d6752 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ unsigned long flags = 0;
+ struct pm8001_hba_info *pm8001_ha;
+ struct pm8001_device *pm8001_dev = dev->lldd_dev;
++ struct domain_device *parent_dev = dev->parent;
+
+ pm8001_ha = pm8001_find_ha_by_dev(dev);
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ }
+ PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+- pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
++
++ /*
++ * The phy array only contains local phys. Thus, we cannot clear
++ * phy_attached for a device behind an expander.
++ */
++ if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
++ pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+ pm8001_free_dev(pm8001_dev);
+ } else {
+ pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
+--
+2.51.0
+
--- /dev/null
+From 56c3f4d3dae9f04810fa8563c6ab6e696147292d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:43 +0800
+Subject: scsi: qla2xxx: edif: Fix incorrect sign of error code
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]
+
+Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
+qla_edif_process_els() to align with qla2x00_start_sp() returning
+negative error codes or QLA_SUCCESS, preventing logical errors.
+
+Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-2-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
+index dcde55c8ee5de..be20e2c457b8e 100644
+--- a/drivers/scsi/qla2xxx/qla_edif.c
++++ b/drivers/scsi/qla2xxx/qla_edif.c
+@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
+ p->e.extra_rx_xchg_address, p->e.extra_control_flags,
+ sp->handle, sp->remap.req.len, bsg_job);
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(EDIF_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < EDIF_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 7832c381d2eb1a6e42482edf452e6af211f90e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:45 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ qla_nvme_xmt_ls_rsp()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]
+
+Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
+align with qla2x00_start_sp() returning negative error codes or
+QLA_SUCCESS, preventing logical errors.
+
+Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-4-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 8f4cc136a9c9c..080670cb2aa51 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -420,7 +420,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
+ switch (rval) {
+ case QLA_SUCCESS:
+ break;
+- case EAGAIN:
++ case -EAGAIN:
+ msleep(PURLS_MSLEEP_INTERVAL);
+ cnt++;
+ if (cnt < PURLS_RETRY_COUNT)
+--
+2.51.0
+
--- /dev/null
+From 113aec37df5e24c0af9cad70fbd470fd8d948b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:54:44 +0800
+Subject: scsi: qla2xxx: Fix incorrect sign of error code in
+ START_SP_W_RETRIES()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]
+
+Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
+with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
+preventing logical errors. Additionally, the '_rval' variable should
+store negative error codes to conform to Linux kernel error code
+conventions.
+
+Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Message-ID: <20250905075446.381139-3-rongqianfeng@vivo.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 5fa2727c1bea7..e881d704b45d1 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
+ int cnt = 5; \
+ do { \
+ if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
+- _rval = EINVAL; \
++ _rval = -EINVAL; \
+ break; \
+ } \
+ _rval = qla2x00_start_sp(_sp); \
+- if (_rval == EAGAIN) \
++ if (_rval == -EAGAIN) \
+ msleep(1); \
+ else \
+ break; \
+--
+2.51.0
+
--- /dev/null
+From 696bf4fc1ef382cf9b13522cf63669bc5aa9f002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 18:31:18 +0200
+Subject: seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
+ fast
+
+From: Johannes Nixdorf <johannes@nixdorf.dev>
+
+[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]
+
+Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
+event to the tracer, and starts to wait interruptibly. With
+SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
+message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
+and is subsequently interrupted, the tracee begins to wait again
+uninterruptibly (but killable).
+
+This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
+is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
+condition to begin waiting again. In this case the tracee is interrupted
+even though the tracer already acted on its behalf. This breaks the
+assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
+namely that the tracer can be sure the syscall is not interrupted or
+restarted on the tracee after it is received on the tracer. Fix this
+by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
+switch to uninterruptible waiting.
+
+With the condition changed the loop in seccomp_do_user_notification()
+would exit immediately after deciding that noninterruptible waiting
+is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
+skipping the code that processes pending addfd commands first. Prevent
+this by executing the remaining loop body one last time in this case.
+
+Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
+Reported-by: Ali Polatel <alip@chesswob.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
+Signed-off-by: Johannes Nixdorf <johannes@nixdorf.dev>
+Link: https://lore.kernel.org/r/20250725-seccomp-races-v2-1-cf8b9d139596@nixdorf.dev
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index 255999ba9190a..1d26a0e978f26 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1099,7 +1099,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
+ static bool should_sleep_killable(struct seccomp_filter *match,
+ struct seccomp_knotif *n)
+ {
+- return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
++ return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
+ }
+
+ static int seccomp_do_user_notification(int this_syscall,
+@@ -1146,13 +1146,11 @@ static int seccomp_do_user_notification(int this_syscall,
+
+ if (err != 0) {
+ /*
+- * Check to see if the notifcation got picked up and
+- * whether we should switch to wait killable.
++ * Check to see whether we should switch to wait
++ * killable. Only return the interrupted error if not.
+ */
+- if (!wait_killable && should_sleep_killable(match, &n))
+- continue;
+-
+- goto interrupted;
++ if (!(!wait_killable && should_sleep_killable(match, &n)))
++ goto interrupted;
+ }
+
+ addfd = list_first_entry_or_null(&n.addfd,
+--
+2.51.0
+
--- /dev/null
+From 49e11754cc7bca29b9bc4636ea349e4d6e48fe5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:38:30 +0530
+Subject: selftests: arm64: Check fread return value in exec_target
+
+From: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+
+[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]
+
+Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
+by checking fread's return value and handling errors, preventing
+potential failures when reading from stdin.
+
+Fixes compiler warning:
+warning: ignoring return value of 'fread' declared with attribute
+'warn_unused_result' [-Wunused-result]
+
+Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")
+
+Signed-off-by: Bala-Vignesh-Reddy <reddybalavignesh9979@gmail.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
+index 4435600ca400d..e597861b26d6b 100644
+--- a/tools/testing/selftests/arm64/pauth/exec_target.c
++++ b/tools/testing/selftests/arm64/pauth/exec_target.c
+@@ -13,7 +13,12 @@ int main(void)
+ unsigned long hwcaps;
+ size_t val;
+
+- fread(&val, sizeof(size_t), 1, stdin);
++ size_t size = fread(&val, sizeof(size_t), 1, stdin);
++
++ if (size != 1) {
++ fprintf(stderr, "Could not read input from stdin\n");
++ return EXIT_FAILURE;
++ }
+
+ /* don't try to execute illegal (unimplemented) instructions) caller
+ * should have checked this and keep worker simple
+--
+2.51.0
+
--- /dev/null
+From 92124c4c428da63bfdf5ecc5f69b6e358536d95d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 22:12:22 +0200
+Subject: selftests/nolibc: fix EXPECT_NZ macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]
+
+The expect non-zero macro was incorrect and never used. Fix its
+definition.
+
+Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20250731201225.323254-2-benjamin@sipsolutions.net
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
+index 4aaafbfc2f973..a019de995e5df 100644
+--- a/tools/testing/selftests/nolibc/nolibc-test.c
++++ b/tools/testing/selftests/nolibc/nolibc-test.c
+@@ -176,8 +176,8 @@ int expect_zr(int expr, int llen)
+ }
+
+
+-#define EXPECT_NZ(cond, expr, val) \
+- do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
++#define EXPECT_NZ(cond, expr) \
++ do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
+
+ static __attribute__((unused))
+ int expect_nz(int expr, int llen)
+--
+2.51.0
+
--- /dev/null
+From 5c60d99199563b740403b20a0c86ea6338ec787b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Sep 2025 20:58:41 +0530
+Subject: selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not
+ supported
+
+From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+
+[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]
+
+Check if watchdog device supports WDIOF_KEEPALIVEPING option before
+entering keep_alive() ping test loop. Fix watchdog-test silently looping
+if ioctl based ping is not supported by the device. Exit from test in
+such case instead of getting stuck in loop executing failing keep_alive()
+
+watchdog_info:
+ identity: m41t93 rtc Watchdog
+ firmware_version: 0
+Support/Status: Set timeout (in seconds)
+Support/Status: Watchdog triggers a management or other external alarm not a reboot
+
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+WDIOC_KEEPALIVE not supported by this device
+
+without this change
+Watchdog card disabled.
+Watchdog timeout set to 5 seconds.
+Watchdog ping rate set to 2 seconds.
+Watchdog card enabled.
+Watchdog Ticking Away!
+(Where test stuck here forver silently)
+
+Updated change log at commit time:
+Shuah Khan <skhan@linuxfoundation.org>
+
+Link: https://lore.kernel.org/r/20250914152840.GA3047348@bhairav-test.ee.iitb.ac.in
+Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
+Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index a1f506ba55786..4f09c5db0c7f3 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
+ if (oneshot)
+ goto end;
+
++ /* Check if WDIOF_KEEPALIVEPING is supported */
++ if (!(info.options & WDIOF_KEEPALIVEPING)) {
++ printf("WDIOC_KEEPALIVE not supported by this device\n");
++ goto end;
++ }
++
+ printf("Watchdog Ticking Away!\n");
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 3bc326a5b7ecc17e3693ae3abe60bb6dbc2a9e3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:54:37 +0300
+Subject: serial: max310x: Add error checking in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]
+
+Check if devm_i2c_new_dummy_device() fails.
+
+Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMPZiKqeXSE-KM@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index e339abff926d3..e10dcdeeda2d3 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1659,6 +1659,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
+ port_client = devm_i2c_new_dummy_device(&client->dev,
+ client->adapter,
+ port_addr);
++ if (IS_ERR(port_client))
++ return PTR_ERR(port_client);
+
+ regmaps[i] = devm_regmap_init_i2c(port_client, ®cfg_i2c);
+ }
+--
+2.51.0
+
--- /dev/null
+filelock-add-fl_reclaim-to-show_fl_flags-macro.patch
+init-initramfs_preserve_mtime-should-depend-on-blk_d.patch
+seccomp-fix-a-race-with-wait_killable_recv-if-the-tr.patch
+selftests-arm64-check-fread-return-value-in-exec_tar.patch
+gfs2-fix-glf_invalidate_in_progress-flag-clearing-in.patch
+coresight-trbe-prevent-overflow-in-perf_idx2off.patch
+perf-arm_spe-prevent-overflow-in-perf_idx2off.patch
+smb-server-fix-ird-ord-negotiation-with-the-client.patch
+edac-i10nm-skip-dimm-enumeration-on-a-disabled-memor.patch
+x86-vdso-fix-output-operand-size-of-rdpid.patch
+arm64-dts-renesas-rzg2lc-smarc-disable-can-fd-channe.patch
+regmap-remove-superfluous-check-for-config-in-__regm.patch
+bpf-selftests-fix-test_tcpnotify_user.patch
+bpf-remove-migrate_disable-in-kprobe_multi_link_prog.patch
+libbpf-fix-reuse-of-devmap.patch
+arm-dts-renesas-porter-fix-can-pin-group.patch
+leds-flash-leds-qcom-flash-update-torch-current-clam.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_pseudo.patch
+s390-bpf-write-back-tail-call-counter-for-bpf_tramp_.patch
+cpufreq-scmi-account-for-malformed-dt-in-scmi_dev_us.patch
+acpi-processor-idle-fix-memory-leak-when-register-cp.patch
+soc-qcom-rpmh-rsc-unconditionally-clear-_trigger-bit.patch
+pinctrl-meson-gxl-add-missing-i2c_d-pinmux.patch
+blk-mq-check-kobject-state_in_sysfs-before-deleting-.patch
+arm-at91-pm-fix-mckx-restore-routine.patch
+arm64-dts-apple-t8103-j457-fix-pcie-ethernet-iommu-m.patch
+regulator-scmi-use-int-type-to-store-negative-error-.patch
+selftests-nolibc-fix-expect_nz-macro.patch
+block-use-int-to-store-blk_stack_limits-return-value.patch
+pm-sleep-core-clear-power.must_resume-in-noirq-suspe.patch
+arm-dts-ti-omap-am335x-baltos-fix-ti-en-ck32k-xtal-p.patch
+arm-dts-ti-omap-omap3-devkit8000-lcd-fix-ti-keep-vre.patch
+arm-dts-omap-am335x-cm-t335-remove-unused-mcasp-num-.patch
+pm-devfreq-mtk-cci-fix-potential-error-pointer-deref.patch
+power-supply-cw2015-fix-a-alignment-coding-style-iss.patch
+pinctrl-renesas-use-int-type-to-store-negative-error.patch
+null_blk-fix-the-description-of-the-cache_size-modul.patch
+arm64-dts-mediatek-mt8195-remove-suspend-breaking-re.patch
+nbd-restrict-sockets-to-tcp-and-udp.patch
+firmware-firmware-meson-sm-fix-compile-test-default.patch
+cpuidle-qcom-spm-fix-device-and-of-node-leaks-at-pro.patch
+arm64-dts-mediatek-mt6331-fix-pmic-regulators-rtc-ke.patch
+arm64-dts-mediatek-mt6795-xperia-m5-fix-mmc0-latch-c.patch
+arm64-dts-mediatek-mt8516-pumpkin-fix-machine-compat.patch
+pwm-tiehrpwm-fix-corner-case-in-clock-divisor-calcul.patch
+acpica-fix-largest-possible-resource-descriptor-inde.patch
+nvmet-fc-move-lsop-put-work-to-nvmet_fc_ls_req_op.patch
+i3c-master-svc-use-manual-response-for-ibi-events.patch
+i3c-master-svc-recycle-unused-ibi-slot.patch
+selftests-watchdog-skip-ping-loop-if-wdiof_keepalive.patch
+bpf-explicitly-check-accesses-to-bpf_sock_addr.patch
+smp-fix-up-and-expand-the-smp_call_function_many-ker.patch
+tools-nolibc-make-time_t-robust-if-__kernel_old_time.patch
+once-fix-race-by-moving-do_once-to-separate-section.patch
+hwmon-mlxreg-fan-separate-methods-of-fan-setting-com.patch
+thermal-drivers-qcom-make-lmh-select-qcom_scm.patch
+thermal-drivers-qcom-lmh-add-missing-irq-includes.patch
+i2c-mediatek-fix-potential-incorrect-use-of-i2c_mast.patch
+i2c-designware-fix-clock-issue-when-pm-is-disabled.patch
+i2c-designware-add-disabling-clocks-when-probe-fails.patch
+bpf-enforce-expected_attach_type-for-tailcall-compat.patch
+drm-panel-novatek-nt35560-fix-invalid-return-value.patch
+drm-radeon-r600_cs-clean-up-of-dead-code-in-r600_cs.patch
+f2fs-fix-condition-in-__allow_reserved_blocks.patch
+drm-bridge-it6505-select-regmap_i2c.patch
+media-zoran-remove-zoran_fh-structure.patch
+phy-rockchip-naneng-combphy-enable-u3-otg-port-for-r.patch
+usb-host-max3421-hcd-fix-error-pointer-dereference-i.patch
+usb-misc-qcom_eud-access-eud_mode_manager2-through-s.patch
+serial-max310x-add-error-checking-in-probe.patch
+drm-amd-display-remove-redundant-semicolons.patch
+crypto-keembay-add-missing-check-after-sg_nents_for_.patch
+hwrng-nomadik-add-arm_amba-dependency.patch
+scsi-pm80xx-fix-array-index-out-of-of-bounds-on-rmmo.patch
+scsi-myrs-fix-dma_alloc_coherent-error-check.patch
+media-rj54n1cb0c-fix-memleak-in-rj54n1_probe.patch
+rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch
+alsa-lx_core-use-int-type-to-store-negative-error-co.patch
+media-st-delta-avoid-excessive-stack-usage.patch
+crypto-hisilicon-zip-remove-unnecessary-validation-f.patch
+crypto-hisilicon-re-enable-address-prefetch-after-de.patch
+crypto-hisilicon-qm-check-whether-the-input-function.patch
+inet-ping-check-sock_net-in-ping_get_port-and-ping_l.patch
+coresight-only-register-perf-symlink-for-sinks-with-.patch
+drm-amdgpu-power-up-uvd-3-for-fw-validation-v2.patch
+drm-amd-pm-disable-ulv-even-if-unsupported-v3.patch
+drm-amd-pm-fix-si_upload_smc_data-v3.patch
+drm-amd-pm-adjust-si_upload_smc_data-register-progra.patch
+drm-amd-pm-treat-zero-vblank-time-as-too-short-in-si.patch
+drm-amd-pm-disable-mclk-switching-with-non-dc-at-120.patch
+drm-amd-pm-disable-sclk-switching-on-oland-with-high.patch
+wifi-mwifiex-send-world-regulatory-domain-to-driver.patch
+pci-tegra-fix-devm_kcalloc-argument-order-for-port-p.patch
+tcp-fix-__tcp_close-to-only-send-rst-when-required.patch
+drm-amdkfd-fix-error-code-sign-for-einval-in-svm_ioc.patch
+usb-phy-twl6030-fix-incorrect-type-for-ret.patch
+usb-gadget-configfs-correctly-set-use_os_string-at-b.patch
+tty-n_gsm-don-t-block-input-queue-by-waiting-msc.patch
+misc-genwqe-fix-incorrect-cmd-field-being-reported-i.patch
+pps-fix-warning-in-pps_register_cdev-when-register-d.patch
+asoc-intel-bytcht_es8316-fix-invalid-quirk-input-map.patch
+asoc-intel-bytcr_rt5640-fix-invalid-quirk-input-mapp.patch
+asoc-intel-bytcr_rt5651-fix-invalid-quirk-input-mapp.patch
+drm-msm-dpu-fix-incorrect-type-for-ret.patch
+fs-ntfs3-fix-integer-overflow-in-run_unpack.patch
+fs-ntfs3-reject-index-allocation-if-bitmap-is-empty-.patch
+iio-consumers-fix-handling-of-negative-channel-scale.patch
+iio-consumers-fix-offset-handling-in-iio_convert_raw.patch
+netfilter-ipset-remove-unused-htable_bits-in-macro-a.patch
+ipvs-use-read_once-write_once-for-ipvs-enable.patch
+watchdog-mpc8xxx_wdt-reload-the-watchdog-timer-when-.patch
+drivers-base-node-handle-error-properly-in-register_.patch
+rdma-cm-rate-limit-destroy-cm-id-timeout-error-messa.patch
+wifi-mt76-fix-potential-memory-leak-in-mt76_wmac_pro.patch
+f2fs-fix-to-update-map-m_next_extent-correctly-in-f2.patch
+f2fs-fix-to-truncate-first-page-in-error-path-of-f2f.patch
+f2fs-fix-to-mitigate-overhead-of-f2fs_zero_post_eof_.patch
+acpi-nfit-fix-incorrect-ndr_desc-being-reportedin-de.patch
+scsi-qla2xxx-edif-fix-incorrect-sign-of-error-code.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-sta.patch
+scsi-qla2xxx-fix-incorrect-sign-of-error-code-in-qla.patch
+f2fs-fix-zero-sized-extent-for-precache-extents.patch
+revert-usb-xhci-avoid-stop-endpoint-retry-loop-if-th.patch
+rdma-core-resolve-mac-of-next-hop-device-without-arp.patch
+ib-sa-fix-sa_local_svc_timeout_ms-read-race.patch
+documentation-trace-historgram-design-separate-sched.patch
+wifi-ath10k-avoid-unnecessary-wait-for-service-ready.patch
+wifi-mac80211-fix-rx-packet-handling-when-pubsta-inf.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-21124
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-12726
+sparc-fix-accurate-exception-reporting-in-copy_to_us.patch
+sparc-fix-accurate-exception-reporting-in-copy_-from.patch-7638
+vfio-pds-replace-bitmap_free-with-vfree.patch
+crypto-hisilicon-qm-set-null-to-qm-debug.qm_diff_reg.patch
+rdma-rxe-fix-race-in-do_task-when-draining.patch
+wifi-rtw89-avoid-circular-locking-dependency-in-ser_.patch
+pci-tegra194-fix-duplicate-pll-disable-in-pex_ep_eve.patch
+remoteproc-qcom-q6v5-avoid-disabling-handover-irq-tw.patch
+coresight-etm4x-conditionally-access-register-trcext.patch
+coresight-etm4x-support-atclk.patch
+coresight-trbe-return-null-pointer-for-allocation-fa.patch
+nfsv4.1-fix-backchannel-max_resp_sz-verification-che.patch
+ipvs-defer-ip_vs_ftp-unregister-during-netns-cleanup.patch
+scsi-mpt3sas-fix-crash-in-transport-port-remove-by-u.patch
+usb-vhci-hcd-prevent-suspending-virtually-attached-d.patch
+rdma-siw-always-report-immediate-post-sq-errors.patch
+net-usb-remove-disruptive-netif_wake_queue-in-rtl815.patch
+vhost-vringh-fix-copy_to_iter-return-value-check.patch
+bluetooth-mgmt-fix-not-exposing-debug-uuid-on-mgmt_o.patch
+bluetooth-iso-fix-possible-uaf-on-iso_conn_free.patch
+bluetooth-iso-don-t-leak-skb-in-iso_cont-rx.patch
+bluetooth-hci_sync-fix-using-random-address-for-big-.patch
+keys-x.509-fix-basic-constraints-ca-flag-parsing.patch
+hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch
+ocfs2-fix-double-free-in-user_cluster_connect.patch
+drivers-base-node-fix-double-free-in-register_one_no.patch
+hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch
+mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch
+nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch
+net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch
+net-dlink-handle-copy_thresh-allocation-failure.patch
+net-mlx5-stop-polling-for-command-response-if-interf.patch
+net-mlx5-pagealloc-fix-reclaim-race-during-command-i.patch
+net-mlx5-fw-reset-add-reset-timeout-work.patch
+smb-client-fix-crypto-buffers-in-non-linear-memory.patch
+revert-net-mlx5e-update-and-set-xon-xoff-upon-mtu-se.patch
+vhost-vringh-modify-the-return-value-check.patch
+bpf-reject-negative-offsets-for-alu-ops.patch
--- /dev/null
+From e992334e94895b7ae727ecaf4d6f33edfbefb68b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 12:10:33 -0300
+Subject: smb: client: fix crypto buffers in non-linear memory
+
+From: Enzo Matsumiya <ematsumiya@suse.de>
+
+[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]
+
+The crypto API, through the scatterlist API, expects input buffers to be
+in linear memory. We handle this with the cifs_sg_set_buf() helper
+that converts vmalloc'd memory to their corresponding pages.
+
+However, when we allocate our aead_request buffer (@creq in
+smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
+puts aead_request->__ctx in vmalloc area.
+
+AEAD algorithm then uses ->__ctx for its private/internal data and
+operations, and uses sg_set_buf() for such data on a few places.
+
+This works fine as long as @creq falls into kmalloc zone (small
+requests) or vmalloc'd memory is still within linear range.
+
+Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
+many tasks will increment the base stacks' addresses to a point where
+virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
+happens.
+
+In practice: too many parallel reads and writes on an encrypted mount
+will trigger this bug.
+
+To fix this, always alloc @creq with kmalloc() instead.
+Also drop the @sensitive_size variable/arguments since
+kfree_sensitive() doesn't need it.
+
+Backtrace:
+
+[ 945.272081] ------------[ cut here ]------------
+[ 945.272774] kernel BUG at include/linux/scatterlist.h:209!
+[ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
+[ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
+[ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
+[ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
+[ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
+[ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
+[ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
+[ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
+[ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
+[ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
+[ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
+[ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
+[ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
+[ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
+[ 945.286683] Call Trace:
+[ 945.286952] <TASK>
+[ 945.287184] ? crypt_message+0x33f/0xad0 [cifs]
+[ 945.287719] crypto_gcm_encrypt+0x36/0xe0
+[ 945.288152] crypt_message+0x54a/0xad0 [cifs]
+[ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs]
+[ 945.289300] smb_send_rqst+0xa3/0x160 [cifs]
+[ 945.289944] cifs_call_async+0x178/0x340 [cifs]
+[ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
+[ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs]
+[ 945.291759] ? find_held_lock+0x32/0x90
+[ 945.292212] ? netfs_advance_write+0xf2/0x310
+[ 945.292723] netfs_advance_write+0xf2/0x310
+[ 945.293210] netfs_write_folio+0x346/0xcc0
+[ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10
+[ 945.294250] netfs_writepages+0x117/0x460
+[ 945.294724] do_writepages+0xbe/0x170
+[ 945.295152] ? find_held_lock+0x32/0x90
+[ 945.295600] ? kvm_sched_clock_read+0x11/0x20
+[ 945.296103] __writeback_single_inode+0x56/0x4b0
+[ 945.296643] writeback_sb_inodes+0x229/0x550
+[ 945.297140] __writeback_inodes_wb+0x4c/0xe0
+[ 945.297642] wb_writeback+0x2f1/0x3f0
+[ 945.298069] wb_workfn+0x300/0x490
+[ 945.298472] process_one_work+0x1fe/0x590
+[ 945.298949] worker_thread+0x1ce/0x3c0
+[ 945.299397] ? __pfx_worker_thread+0x10/0x10
+[ 945.299900] kthread+0x119/0x210
+[ 945.300285] ? __pfx_kthread+0x10/0x10
+[ 945.300729] ret_from_fork+0x119/0x1b0
+[ 945.301163] ? __pfx_kthread+0x10/0x10
+[ 945.301601] ret_from_fork_asm+0x1a/0x30
+[ 945.302055] </TASK>
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index b74f769047394..ee6a6ba13f89c 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4152,7 +4152,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+ struct aead_request **req, struct sg_table *sgt,
+- unsigned int *num_sgs, size_t *sensitive_size)
++ unsigned int *num_sgs)
+ {
+ unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
+ unsigned int iv_size = crypto_aead_ivsize(tfm);
+@@ -4169,9 +4169,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+ len += req_size;
+ len = ALIGN(len, __alignof__(struct scatterlist));
+ len += array_size(*num_sgs, sizeof(struct scatterlist));
+- *sensitive_size = len;
+
+- p = kvzalloc(len, GFP_NOFS);
++ p = kzalloc(len, GFP_NOFS);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -4185,16 +4184,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
+
+ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
+ int num_rqst, const u8 *sig, u8 **iv,
+- struct aead_request **req, struct scatterlist **sgl,
+- size_t *sensitive_size)
++ struct aead_request **req, struct scatterlist **sgl)
+ {
+ struct sg_table sgtable = {};
+ unsigned int skip, num_sgs, i, j;
+ ssize_t rc;
+ void *p;
+
+- p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
+- &num_sgs, sensitive_size);
++ p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
+ if (IS_ERR(p))
+ return ERR_CAST(p);
+
+@@ -4283,7 +4280,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ DECLARE_CRYPTO_WAIT(wait);
+ unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
+ void *creq;
+- size_t sensitive_size;
+
+ rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
+ if (rc) {
+@@ -4309,8 +4305,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ return rc;
+ }
+
+- creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
+- &sensitive_size);
++ creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
+ if (IS_ERR(creq))
+ return PTR_ERR(creq);
+
+@@ -4340,7 +4335,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ if (!rc && enc)
+ memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
+
+- kvfree_sensitive(creq, sensitive_size);
++ kfree_sensitive(creq);
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b9514d3459298d14948c42c50967d069ed8939e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:34:58 +0200
+Subject: smb: server: fix IRD/ORD negotiation with the client
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]
+
+Already do real negotiation in smb_direct_handle_connect_request()
+where we see the requested initiator_depth and responder_resources
+from the client.
+
+We should detect legacy iwarp clients using MPA v1
+with the custom IRD/ORD negotiation.
+
+We need to send the custom IRD/ORD in big endian,
+but we need to try to let clients with broken requests
+using little endian (older cifs.ko) to work.
+
+Note the reason why this uses u8 for
+initiator_depth and responder_resources is
+that the rdma layer also uses it.
+
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Cc: linux-rdma@vger.kernel.org
+Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
+ 1 file changed, 85 insertions(+), 14 deletions(-)
+
+diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
+index 504e2a1cf33b8..31c1ac256e1be 100644
+--- a/fs/smb/server/transport_rdma.c
++++ b/fs/smb/server/transport_rdma.c
+@@ -152,6 +152,10 @@ struct smb_direct_transport {
+ struct work_struct disconnect_work;
+
+ bool negotiation_requested;
++
++ bool legacy_iwarp;
++ u8 initiator_depth;
++ u8 responder_resources;
+ };
+
+ #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
+@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
+ t->cm_id = cm_id;
+ cm_id->context = t;
+
++ t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
++ t->responder_resources = 1;
++
+ t->status = SMB_DIRECT_CS_NEW;
+ init_waitqueue_head(&t->wait_status);
+
+@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
+ static int smb_direct_accept_client(struct smb_direct_transport *t)
+ {
+ struct rdma_conn_param conn_param;
+- struct ib_port_immutable port_immutable;
+- u32 ird_ord_hdr[2];
++ __be32 ird_ord_hdr[2];
+ int ret;
+
++ /*
++ * smb_direct_handle_connect_request()
++ * already negotiated t->initiator_depth
++ * and t->responder_resources
++ */
+ memset(&conn_param, 0, sizeof(conn_param));
+- conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
+- SMB_DIRECT_CM_INITIATOR_DEPTH);
+- conn_param.responder_resources = 0;
+-
+- t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
+- t->cm_id->port_num,
+- &port_immutable);
+- if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
+- ird_ord_hdr[0] = conn_param.responder_resources;
+- ird_ord_hdr[1] = 1;
++ conn_param.initiator_depth = t->initiator_depth;
++ conn_param.responder_resources = t->responder_resources;
++
++ if (t->legacy_iwarp) {
++ ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
++ ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
+ conn_param.private_data = ird_ord_hdr;
+ conn_param.private_data_len = sizeof(ird_ord_hdr);
+ } else {
+@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
+ return true;
+ }
+
+-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
++static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
++ struct rdma_cm_event *event)
+ {
+ struct smb_direct_transport *t;
+ struct task_struct *handler;
++ u8 peer_initiator_depth;
++ u8 peer_responder_resources;
+ int ret;
+
+ if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
+@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+ if (!t)
+ return -ENOMEM;
+
++ peer_initiator_depth = event->param.conn.initiator_depth;
++ peer_responder_resources = event->param.conn.responder_resources;
++ if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
++ event->param.conn.private_data_len == 8) {
++ /*
++ * Legacy clients with only iWarp MPA v1 support
++ * need a private blob in order to negotiate
++ * the IRD/ORD values.
++ */
++ const __be32 *ird_ord_hdr = event->param.conn.private_data;
++ u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
++ u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
++
++ /*
++ * cifs.ko sends the legacy IRD/ORD negotiation
++ * event if iWarp MPA v2 was used.
++ *
++ * Here we check that the values match and only
++ * mark the client as legacy if they don't match.
++ */
++ if ((u32)event->param.conn.initiator_depth != ird32 ||
++ (u32)event->param.conn.responder_resources != ord32) {
++ /*
++ * There are broken clients (old cifs.ko)
++ * using little endian and also
++ * struct rdma_conn_param only uses u8
++ * for initiator_depth and responder_resources,
++ * so we truncate the value to U8_MAX.
++ *
++ * smb_direct_accept_client() will then
++ * do the real negotiation in order to
++ * select the minimum between client and
++ * server.
++ */
++ ird32 = min_t(u32, ird32, U8_MAX);
++ ord32 = min_t(u32, ord32, U8_MAX);
++
++ t->legacy_iwarp = true;
++ peer_initiator_depth = (u8)ird32;
++ peer_responder_resources = (u8)ord32;
++ }
++ }
++
++ /*
++ * First set what the we as server are able to support
++ */
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ new_cm_id->device->attrs.max_qp_rd_atom);
++
++ /*
++ * negotiate the value by using the minimum
++ * between client and server if the client provided
++ * non 0 values.
++ */
++ if (peer_initiator_depth != 0)
++ t->initiator_depth = min_t(u8, t->initiator_depth,
++ peer_initiator_depth);
++ if (peer_responder_resources != 0)
++ t->responder_resources = min_t(u8, t->responder_resources,
++ peer_responder_resources);
++
+ ret = smb_direct_connect(t);
+ if (ret)
+ goto out_err;
+@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
+ {
+ switch (event->event) {
+ case RDMA_CM_EVENT_CONNECT_REQUEST: {
+- int ret = smb_direct_handle_connect_request(cm_id);
++ int ret = smb_direct_handle_connect_request(cm_id, event);
+
+ if (ret) {
+ pr_err("Can't create transport: %d\n", ret);
+--
+2.51.0
+
--- /dev/null
+From bafc1b2e185390dd4605311ae85bc96058936f3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 13:44:14 +0200
+Subject: smp: Fix up and expand the smp_call_function_many() kerneldoc
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]
+
+The smp_call_function_many() kerneldoc comment got out of sync with the
+function definition (bool parameter "wait" is incorrectly described as a
+bitmask in it), so fix it up by copying the "wait" description from the
+smp_call_function() kerneldoc and add information regarding the handling
+of the local CPU to it.
+
+Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 3eeffeaf5450c..13b376c7296a5 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -862,16 +862,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
+ * @mask: The set of cpus to run on (only runs on online subset).
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
+- * (atomically) until function has completed on other CPUs. If
+- * %SCF_RUN_LOCAL is set, the function will also be run locally
+- * if the local CPU is set in the @cpumask.
+- *
+- * If @wait is true, then returns once @func has returned.
++ * @wait: If true, wait (atomically) until function has completed
++ * on other CPUs.
+ *
+ * You must not call this function with disabled interrupts or from a
+ * hardware interrupt handler or from a bottom half handler. Preemption
+ * must be disabled when calling this function.
++ *
++ * @func is not called on the local CPU even if @mask contains it. Consider
++ * using on_each_cpu_cond_mask() instead if this is not desirable.
+ */
+ void smp_call_function_many(const struct cpumask *mask,
+ smp_call_func_t func, void *info, bool wait)
+--
+2.51.0
+
--- /dev/null
+From b255a3a68158b5ce852187097584873314521b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 11:53:50 +0530
+Subject: soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
+
+From: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+
+[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]
+
+Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
+transaction completes. Previously this bit was only cleared when
+a wake TCS was borrowed as an AMC TCS but not for dedicated
+AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
+power modes can generate a false completion IRQ.
+
+Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
+bit upon receiving a completion IRQ.
+
+Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
+Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250825-rpmh_rsc_change-v1-1-138202c31bf6@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index 163a58eb02e0a..d0ec42ec0d041 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
+
+ trace_rpmh_tx_done(drv, i, req);
+
+- /*
+- * If wake tcs was re-purposed for sending active
+- * votes, clear AMC trigger & enable modes and
++ /* Clear AMC trigger & enable modes and
+ * disable interrupt for this TCS
+ */
+- if (!drv->tcs[ACTIVE_TCS].num_tcs)
+- __tcs_set_trigger(drv, i, false);
++ __tcs_set_trigger(drv, i, false);
+ skip:
+ /* Reclaim the TCS */
+ write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
+--
+2.51.0
+
--- /dev/null
+From d9d5c7f3f5cbeb2ee78e5522c1949eb20976c391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:30 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on QEMU 10.0.3
+Tested-by: René Rebe <rene@exactcode.com> # on Ultra 5 UltraSparc IIi
+Tested-by: Jonathan 'theJPster' Pallant <kernel@thejpster.org.uk> # on Sun Netra T1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
+index 635398ec7540e..154fbd35400ca 100644
+--- a/arch/sparc/lib/U1memcpy.S
++++ b/arch/sparc/lib/U1memcpy.S
+@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
+ retl
+ add %o0, %o2, %o0
+ ENDPROC(U1_gs_40_fp)
+-ENTRY(U1_g3_0_fp)
+- VISExitHalf
+- retl
+- add %g3, %o2, %o0
+-ENDPROC(U1_g3_0_fp)
+ ENTRY(U1_g3_8_fp)
+ VISExitHalf
+ add %g3, 8, %g3
+ retl
+ add %g3, %o2, %o0
+ ENDPROC(U1_g3_8_fp)
++ENTRY(U1_g3_16_fp)
++ VISExitHalf
++ add %g3, 16, %g3
++ retl
++ add %g3, %o2, %o0
++ENDPROC(U1_g3_16_fp)
+ ENTRY(U1_o2_0_fp)
+ VISExitHalf
+ retl
+@@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ 62: FINISH_VISCHUNK(o0, f44, f46)
+ 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0)
+
+-93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
++93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f0, %f2, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bl,pn %xcc, 95f
+ add %o0, 8, %o0
+- EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
++ EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
+ add %o1, 8, %o1
+ subcc %g3, 8, %g3
+ faligndata %f2, %f0, %f8
+- EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
++ EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
+ bge,pt %xcc, 93b
+ add %o0, 8, %o0
+
+--
+2.51.0
+
--- /dev/null
+From c33f8d78183ec7c315a598c6b0354a3ec4cf7cdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:32 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ Niagara
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations and a broken epilogue in the exception handlers. This will
+prevent crashes and ensure correct return values of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on SPARC T4 with modified kernel to use Niagara 1 code
+Tested-by: Magnus Lindholm <linmag7@gmail.com> # on Sun Fire T2000
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Tested-by: Ethan Hawke <ehawk@ember.systems> # on Sun Fire T2000
+Tested-by: Ken Link <iissmart@numberzero.org> # on Sun Fire T1000
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-3-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
+index ee51c12306894..bbd3ea0a64822 100644
+--- a/arch/sparc/lib/NGmemcpy.S
++++ b/arch/sparc/lib/NGmemcpy.S
+@@ -79,8 +79,8 @@
+ #ifndef EX_RETVAL
+ #define EX_RETVAL(x) x
+ __restore_asi:
+- ret
+ wr %g0, ASI_AIUS, %asi
++ ret
+ restore
+ ENTRY(NG_ret_i2_plus_i4_plus_1)
+ ba,pt %xcc, __restore_asi
+@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
+ ba,pt %xcc, __restore_asi
+ add %i2, %g1, %i0
+ ENDPROC(NG_ret_i2_plus_g1_minus_56)
+-ENTRY(NG_ret_i2_plus_i4)
++ENTRY(NG_ret_i2_plus_i4_plus_16)
++ add %i4, 16, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4)
+-ENTRY(NG_ret_i2_plus_i4_minus_8)
+- sub %i4, 8, %i4
++ENDPROC(NG_ret_i2_plus_i4_plus_16)
++ENTRY(NG_ret_i2_plus_i4_plus_8)
++ add %i4, 8, %i4
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+-ENDPROC(NG_ret_i2_plus_i4_minus_8)
++ENDPROC(NG_ret_i2_plus_i4_plus_8)
+ ENTRY(NG_ret_i2_plus_8)
+ ba,pt %xcc, __restore_asi
+ add %i2, 8, %i0
+@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
+ ba,pt %xcc, __restore_asi
+ add %i2, %i4, %i0
+ ENDPROC(NG_ret_i2_and_7_plus_i4)
++ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
++ and %i2, 7, %i2
++ add %i4, 8, %i4
++ ba,pt %xcc, __restore_asi
++ add %i2, %i4, %i0
++ENDPROC(NG_ret_i2_and_7_plus_i4)
+ #endif
+
+ .align 64
+@@ -405,13 +412,13 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ andn %i2, 0xf, %i4
+ and %i2, 0xf, %i2
+ 1: subcc %i4, 0x10, %i4
+- EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x08, %i1
+- EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
++ EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
+ sub %i1, 0x08, %i1
+- EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
++ EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
+ add %i1, 0x8, %i1
+- EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
++ EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
+ bgu,pt %XCC, 1b
+ add %i1, 0x8, %i1
+ 73: andcc %i2, 0x8, %g0
+@@ -468,7 +475,7 @@ FUNC_NAME: /* %i0=dst, %i1=src, %i2=len */
+ subcc %i4, 0x8, %i4
+ srlx %g3, %i3, %i5
+ or %i5, %g2, %i5
+- EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
++ EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
+ add %o0, 0x8, %o0
+ bgu,pt %icc, 1b
+ sllx %g3, %g1, %g2
+--
+2.51.0
+
--- /dev/null
+From 060009688d2fefd46b348779d3bbf350aafda471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:31 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from_to}_user for
+ UltraSPARC III
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]
+
+Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
+enabled resulted from copy_from_user() returning impossibly large values
+greater than the size to be copied. This lead to __copy_from_iter()
+returning impossible values instead of the actual number of bytes it was
+able to copy.
+
+The BUG_ON has been reported in
+https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. The exception handlers expect that
+%o2 has already been masked during the bulk copy loop, but the masking was
+performed after that loop. This will fix the return value of copy_from_user
+and copy_to_user in the faulting case. The behaviour of memcpy stays
+unchanged.
+
+Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
+Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/U3memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 9248d59c734ce..bace3a18f836f 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -267,6 +267,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ faligndata %f10, %f12, %f26
+ EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
+
++ and %o2, 0x3f, %o2
+ subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE
+ add %o1, 0x40, %o1
+ bgu,pt %XCC, 1f
+@@ -336,7 +337,6 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ * Also notice how this code is careful not to perform a
+ * load past the end of the src buffer.
+ */
+- and %o2, 0x3f, %o2
+ andcc %o2, 0x38, %g2
+ be,pn %XCC, 2f
+ subcc %g2, 0x8, %g2
+--
+2.51.0
+
--- /dev/null
+From 1c5eb3223215fe9a23a13bb91da13363083a0acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:34 +0200
+Subject: sparc: fix accurate exception reporting in copy_{from,to}_user for M7
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a couple of bad
+calculations. This will fix the return value of copy_from_user and
+copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
+
+Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC S7
+Tested-by: Tony Rodriguez <unixpro1970@gmail.com> # S7, see https://lore.kernel.org/r/98564e2e68df2dda0e00c67a75c7f7dfedb33c7e.camel@physik.fu-berlin.de
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-5-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/M7memcpy.S | 20 ++++++++++----------
+ arch/sparc/lib/Memcpy_utils.S | 9 +++++++++
+ 2 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
+index cbd42ea7c3f7c..99357bfa8e82a 100644
+--- a/arch/sparc/lib/M7memcpy.S
++++ b/arch/sparc/lib/M7memcpy.S
+@@ -696,16 +696,16 @@ FUNC_NAME:
+ EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
+ faligndata %f24, %f26, %f10
+ EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
+- EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
+ faligndata %f26, %f28, %f12
+- EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
+ add %o4, 64, %o4
+- EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
++ EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
+ faligndata %f28, %f30, %f14
+- EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
+- EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
+ add %o0, 64, %o0
+- EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
++ EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f30, %f14
+ bgu,pt %xcc, .Lunalign_sloop
+ prefetch [%o4 + (8 * BLOCK_SIZE)], 20
+@@ -728,7 +728,7 @@ FUNC_NAME:
+ add %o4, 8, %o4
+ faligndata %f0, %f2, %f16
+ subcc %o5, 8, %o5
+- EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
++ EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
+ fsrc2 %f2, %f0
+ bgu,pt %xcc, .Lunalign_by8
+ add %o0, 8, %o0
+@@ -772,7 +772,7 @@ FUNC_NAME:
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %xcc, 1b
+ add %o0, 0x20, %o0
+@@ -804,12 +804,12 @@ FUNC_NAME:
+ brz,pt %o3, 2f
+ sub %o2, %o3, %o2
+
+-1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
++1: EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
+ add %o1, 1, %o1
+ subcc %o3, 1, %o3
+ add %o0, 1, %o0
+ bne,pt %xcc, 1b
+- EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
++ EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
+ 2:
+ and %o1, 0x7, %o3
+ brz,pn %o3, .Lmedium_noprefetch_cp
+diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
+index 64fbac28b3db1..207343367bb2d 100644
+--- a/arch/sparc/lib/Memcpy_utils.S
++++ b/arch/sparc/lib/Memcpy_utils.S
+@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
+ ba,pt %xcc, __restore_asi
+ add %o2, 8, %o0
+ ENDPROC(memcpy_retl_o2_plus_63_8)
++ENTRY(memcpy_retl_o2_plus_o3)
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3)
++ENTRY(memcpy_retl_o2_plus_o3_plus_1)
++ add %o3, 1, %o3
++ ba,pt %xcc, __restore_asi
++ add %o2, %o3, %o0
++ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
+ ENTRY(memcpy_retl_o2_plus_o5)
+ ba,pt %xcc, __restore_asi
+ add %o2, %o5, %o0
+--
+2.51.0
+
--- /dev/null
+From 860fcc580776bb868a06f4d5b24b6e1cab48b57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 00:03:33 +0200
+Subject: sparc: fix accurate exception reporting in copy_to_user for Niagara 4
+
+From: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+
+[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]
+
+The referenced commit introduced exception handlers on user-space memory
+references in copy_from_user and copy_to_user. These handlers return from
+the respective function and calculate the remaining bytes left to copy
+using the current register contents. This commit fixes a bad calculation.
+This will fix the return value of copy_to_user in a specific faulting case.
+The behaviour of memcpy stays unchanged.
+
+Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Oracle SPARC T4-1
+Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-4-1ca72dda195b@mkarcher.dialup.fu-berlin.de
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/NG4memcpy.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 7ad58ebe0d009..df0ec1bd19489 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -281,7 +281,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ subcc %o5, 0x20, %o5
+ EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
+ EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
+- EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
++ EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
+ EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
+ bne,pt %icc, 1b
+ add %o0, 0x20, %o0
+--
+2.51.0
+
--- /dev/null
+From ed49ccc39c3e84e9492d45dceebae7d4c04593a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:47:18 +0000
+Subject: tcp: fix __tcp_close() to only send RST when required
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]
+
+If the receive queue contains payload that was already
+received, __tcp_close() can send an unexpected RST.
+
+Refine the code to take tp->copied_seq into account,
+as we already do in tcp recvmsg().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 40a2f172be2cb..7d824578f217a 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2786,8 +2786,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
+
+ void __tcp_close(struct sock *sk, long timeout)
+ {
++ bool data_was_unread = false;
+ struct sk_buff *skb;
+- int data_was_unread = 0;
+ int state;
+
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
+@@ -2806,11 +2806,12 @@ void __tcp_close(struct sock *sk, long timeout)
+ * reader process may not have drained the data yet!
+ */
+ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+- u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
++ u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+- len--;
+- data_was_unread += len;
++ end_seq--;
++ if (after(end_seq, tcp_sk(sk)->copied_seq))
++ data_was_unread = true;
+ __kfree_skb(skb);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 19e2725412aa133012b1f8401e2cb45664e094e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:24 +0300
+Subject: thermal/drivers/qcom/lmh: Add missing IRQ includes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]
+
+As reported by LKP, the Qualcomm LMH driver needs to include several
+IRQ-related headers, which decrlare necessary IRQ functionality.
+Currently driver builds on ARM64 platforms, where the headers are pulled
+in implicitly by other headers, but fails to build on other platforms.
+
+Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202507270042.KdK0KKht-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-2-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/lmh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
+index d2d49264cf83a..7c299184c59b1 100644
+--- a/drivers/thermal/qcom/lmh.c
++++ b/drivers/thermal/qcom/lmh.c
+@@ -5,6 +5,8 @@
+ */
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
+ #include <linux/irqdomain.h>
+ #include <linux/err.h>
+ #include <linux/platform_device.h>
+--
+2.51.0
+
--- /dev/null
+From a260239ad59f7b95b491f66b7c8be3480b6363f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 15:18:23 +0300
+Subject: thermal/drivers/qcom: Make LMH select QCOM_SCM
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]
+
+The QCOM_SCM symbol is not user-visible, so it makes little sense to
+depend on it. Make LMH driver select QCOM_SCM as all other drivers do
+and, as the dependecy is now correctly handled, enable || COMPILE_TEST
+in order to include the driver into broader set of build tests.
+
+Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20250728-lmh-scm-v2-1-33bc58388ca5@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
+index 2c7f3f9a26ebb..a6bb01082ec69 100644
+--- a/drivers/thermal/qcom/Kconfig
++++ b/drivers/thermal/qcom/Kconfig
+@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
+
+ config QCOM_LMH
+ tristate "Qualcomm Limits Management Hardware"
+- depends on ARCH_QCOM && QCOM_SCM
++ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ help
+ This enables initialization of Qualcomm limits management
+ hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
+--
+2.51.0
+
--- /dev/null
+From 12bb56562c462f5da4da733bae11af3d9e20419a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 01:46:43 +0000
+Subject: tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
+ host headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]
+
+Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
+__kernel_old_time_t") made nolibc use the kernel's time type so that
+`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).
+
+But since __kernel_old_time_t is fairly new, notably from 2020 in commit
+94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
+nolibc builds that rely on host headers may fail.
+
+Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
+has existed for longer.
+
+Tested in PPC VM of Open Source Lab of Oregon State University
+(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)
+
+Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[Thomas: Reformat commit and its message a bit]
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/nolibc/std.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
+index a9d8b5b51f37f..f24953f8b949c 100644
+--- a/tools/include/nolibc/std.h
++++ b/tools/include/nolibc/std.h
+@@ -33,6 +33,6 @@ typedef unsigned long nlink_t;
+ typedef signed long off_t;
+ typedef signed long blksize_t;
+ typedef signed long blkcnt_t;
+-typedef __kernel_old_time_t time_t;
++typedef __kernel_time_t time_t;
+
+ #endif /* _NOLIBC_STD_H */
+--
+2.51.0
+
--- /dev/null
+From da69780da5cc7aba9b8644794e122f3f92f36717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 15:26:56 +0300
+Subject: tty: n_gsm: Don't block input queue by waiting MSC
+
+From: Seppo Takalo <seppo.takalo@nordicsemi.no>
+
+[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]
+
+Currently gsm_queue() processes incoming frames and when opening
+a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
+If basic mode is used it calls gsm_modem_upd_via_msc() and it
+cannot block the input queue by waiting the response to come
+into the same input queue.
+
+Instead allow sending Modem Status Command without waiting for remote
+end to respond. Define a new function gsm_modem_send_initial_msc()
+for this purpose. As MSC is only valid for basic encoding, it does
+not do anything for advanced or when convergence layer type 2 is used.
+
+Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
+Signed-off-by: Seppo Takalo <seppo.takalo@nordicsemi.no>
+Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.no
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 8559ba1361c64..901f5c8311fbf 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
+ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
+ static void gsmld_write_trigger(struct gsm_mux *gsm);
+ static void gsmld_write_task(struct work_struct *work);
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
+
+ /**
+ * gsm_fcs_add - update FCS
+@@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
+ pr_debug("DLCI %d goes open.\n", dlci->addr);
+ /* Send current modem state */
+ if (dlci->addr) {
+- gsm_modem_update(dlci, 0);
++ gsm_modem_send_initial_msc(dlci);
+ } else {
+ /* Start keep-alive control */
+ gsm->ka_num = 0;
+@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
+ return gsm_control_wait(dlci->gsm, ctrl);
+ }
+
++/**
++ * gsm_modem_send_initial_msc - Send initial modem status message
++ *
++ * @dlci channel
++ *
++ * Send an initial MSC message after DLCI open to set the initial
++ * modem status lines. This is only done for basic mode.
++ * Does not wait for a response as we cannot block the input queue
++ * processing.
++ */
++static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
++{
++ u8 modembits[2];
++
++ if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
++ return 0;
++
++ modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
++ modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
++ return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
++}
++
+ /**
+ * gsm_modem_update - send modem status line state
+ * @dlci: channel
+--
+2.51.0
+
--- /dev/null
+From ca4564167024d7be1e242cfb0ec436b95d5e7f1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 11:36:09 +0800
+Subject: usb: gadget: configfs: Correctly set use_os_string at bind
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]
+
+Once the use_os_string flag is set to true for some functions
+(e.g. adb/mtp) which need to response the OS string, and then
+if we re-bind the ConfigFS gadget to use the other functions
+(e.g. hid) which should not to response the OS string, however,
+because the use_os_string flag is still true, so the usb gadget
+response the OS string descriptor incorrectly, this can cause
+the USB device to be unrecognizable on the Windows system.
+
+An example of this as follows:
+
+echo 1 > os_desc/use
+ln -s functions/ffs.adb configs/b.1/function0
+start adbd
+echo "<udc device>" > UDC #succeed
+
+stop adbd
+rm configs/b.1/function0
+echo 0 > os_desc/use
+ln -s functions/hid.gs0 configs/b.1/function0
+echo "<udc device>" > UDC #fail to connect on Windows
+
+This patch sets the use_os_string flag to false at bind if
+the functions not support OS Descriptors.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
+Link: https://lore.kernel.org/r/1755833769-25434-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/configfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
+index 4c89f7629d530..9e8af571448bf 100644
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1747,6 +1747,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
+ cdev->use_os_string = true;
+ cdev->b_vendor_code = gi->b_vendor_code;
+ memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
++ } else {
++ cdev->use_os_string = false;
+ }
+
+ if (gadget_is_otg(gadget) && !otg_desc[0]) {
+--
+2.51.0
+
--- /dev/null
+From 9ec8e773f546f1254194aad1cfe628d2913db283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:55:00 +0300
+Subject: usb: host: max3421-hcd: Fix error pointer dereference in probe
+ cleanup
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]
+
+The kthread_run() function returns error pointers so the
+max3421_hcd->spi_thread pointer can be either error pointers or NULL.
+Check for both before dereferencing it.
+
+Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/aJTMVAPtRe5H6jug@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index cc1f579f02de1..2d792ab271e2a 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
+ if (hcd) {
+ kfree(max3421_hcd->tx);
+ kfree(max3421_hcd->rx);
+- if (max3421_hcd->spi_thread)
++ if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
+ kthread_stop(max3421_hcd->spi_thread);
+ usb_put_hcd(hcd);
+ }
+--
+2.51.0
+
--- /dev/null
+From 61810c5fbbde9e2d6f203fa44729426338b5457c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 14:31:32 +0530
+Subject: usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
+
+From: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+
+[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]
+
+EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
+as read-only for operating system running at EL1, enforcing access
+restrictions that prohibit direct memory-mapped writes via writel().
+
+Attempts to write to this region from HLOS can result in silent failures
+or memory access violations, particularly when toggling EUD (Embedded
+USB Debugger) state. To ensure secure register access, modify the driver
+to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
+Secure Channel Monitor (SCM). SCM has the necessary permissions to access
+protected memory regions, enabling reliable control over EUD state.
+
+SC7280, the only user of EUD is also affected, indicating that this could
+never have worked on a properly fused device.
+
+Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
+Signed-off-by: Melody Olvera <quic_molvera@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Souradeep Chowdhury <quic_schowdhu@quicinc.com>
+Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250731-eud_mode_manager_secure_access-v8-1-4a5dcbb79f41@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/Kconfig | 1 +
+ drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
+ 2 files changed, 25 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
+index 99b15b77dfd57..fe1b5fec1dfca 100644
+--- a/drivers/usb/misc/Kconfig
++++ b/drivers/usb/misc/Kconfig
+@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
+ config USB_QCOM_EUD
+ tristate "QCOM Embedded USB Debugger(EUD) Driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select QCOM_SCM
+ select USB_ROLE_SWITCH
+ help
+ This module enables support for Qualcomm Technologies, Inc.
+diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
+index 7f371ea1248c3..cfb195a0f6ce2 100644
+--- a/drivers/usb/misc/qcom_eud.c
++++ b/drivers/usb/misc/qcom_eud.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/sysfs.h>
+ #include <linux/usb/role.h>
++#include <linux/firmware/qcom/qcom_scm.h>
+
+ #define EUD_REG_INT1_EN_MASK 0x0024
+ #define EUD_REG_INT_STATUS_1 0x0044
+@@ -34,7 +35,7 @@ struct eud_chip {
+ struct device *dev;
+ struct usb_role_switch *role_sw;
+ void __iomem *base;
+- void __iomem *mode_mgr;
++ phys_addr_t mode_mgr;
+ unsigned int int_status;
+ int irq;
+ bool enabled;
+@@ -43,18 +44,29 @@ struct eud_chip {
+
+ static int enable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
++ if (ret)
++ return ret;
++
+ writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
+ writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
+ priv->base + EUD_REG_INT1_EN_MASK);
+- writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
+
+ return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
+ }
+
+-static void disable_eud(struct eud_chip *priv)
++static int disable_eud(struct eud_chip *priv)
+ {
++ int ret;
++
++ ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
++ if (ret)
++ return ret;
++
+ writel(0, priv->base + EUD_REG_CSR_EUD_EN);
+- writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
++ return 0;
+ }
+
+ static ssize_t enable_show(struct device *dev,
+@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
+ chip->enabled = enable;
+ else
+ disable_eud(chip);
++
+ } else {
+- disable_eud(chip);
++ ret = disable_eud(chip);
+ }
+
+- return count;
++ return ret < 0 ? ret : count;
+ }
+
+ static DEVICE_ATTR_RW(enable);
+@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
+ static int eud_probe(struct platform_device *pdev)
+ {
+ struct eud_chip *chip;
++ struct resource *res;
+ int ret;
+
+ chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
+@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
+ if (IS_ERR(chip->base))
+ return PTR_ERR(chip->base);
+
+- chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
+- if (IS_ERR(chip->mode_mgr))
+- return PTR_ERR(chip->mode_mgr);
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
++ if (!res)
++ return -ENODEV;
++ chip->mode_mgr = res->start;
+
+ chip->irq = platform_get_irq(pdev, 0);
+ ret = devm_request_threaded_irq(&pdev->dev, chip->irq, handle_eud_irq,
+--
+2.51.0
+
--- /dev/null
+From d994621ab8226ae5d9d1320217b982a755b8c650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 17:22:24 +0800
+Subject: usb: phy: twl6030: Fix incorrect type for ret
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]
+
+In the twl6030_usb_probe(), the variable ret is declared as
+a u32 type. However, since ret may receive -ENODEV when accepting
+the return value of omap_usb2_set_comparator().Therefore, its type
+should be changed to int.
+
+Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Link: https://lore.kernel.org/r/20250822092224.30645-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index c3ce6b1054f1c..292c32ccae050 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
+
+ static int twl6030_usb_probe(struct platform_device *pdev)
+ {
+- u32 ret;
+ struct twl6030_usb *twl;
+- int status, err;
++ int status, err, ret;
+ struct device_node *np = pdev->dev.of_node;
+ struct device *dev = &pdev->dev;
+
+--
+2.51.0
+
--- /dev/null
+From d5b14ab9543d77be932aab5fea2efddcc859a2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:15:46 +0300
+Subject: usb: vhci-hcd: Prevent suspending virtually attached devices
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]
+
+The VHCI platform driver aims to forbid entering system suspend when at
+least one of the virtual USB ports are bound to an active USB/IP
+connection.
+
+However, in some cases, the detection logic doesn't work reliably, i.e.
+when all devices attached to the virtual root hub have been already
+suspended, leading to a broken suspend state, with unrecoverable resume.
+
+Ensure the virtually attached devices do not enter suspend by setting
+the syscore PM flag. Note this is currently limited to the client side
+only, since the server side doesn't implement system suspend prevention.
+
+Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250902-vhci-hcd-suspend-fix-v3-1-864e4e833559@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 14a5f55f24fc8..b22e0881bfaf3 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ ctrlreq->wValue, vdev->rhport);
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * NOTE: A similar operation has been done via
++ * USB_REQ_GET_DESCRIPTOR handler below, which is
++ * supposed to always precede USB_REQ_SET_ADDRESS.
++ *
++ * It's not entirely clear if operating on a different
++ * usb_device instance here is a real possibility,
++ * otherwise this call and vdev->udev assignment above
++ * should be dropped.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+
+ spin_lock(&vdev->ud.lock);
+@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ "Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
+
+ vdev->udev = usb_get_dev(urb->dev);
++ /*
++ * Set syscore PM flag for the virtually attached
++ * devices to ensure they will not enter suspend on
++ * the client side.
++ *
++ * Note this doesn't have any impact on the physical
++ * devices attached to the host system on the server
++ * side, hence there is no need to undo the operation
++ * on disconnect.
++ */
++ dev_pm_syscore_device(&vdev->udev->dev, true);
+ usb_put_dev(old);
+ goto out;
+
+--
+2.51.0
+
--- /dev/null
+From a3eaa70f3bb3873a19847a7816492509c4353eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 15:31:54 +0000
+Subject: vfio/pds: replace bitmap_free with vfree
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]
+
+host_seq_bmp is allocated with vzalloc but is currently freed with
+bitmap_free, which uses kfree internally. This mismach prevents the
+resource from being released properly and may result in memory leaks
+or other issues.
+
+Fix this by freeing host_seq_bmp with vfree to match the vzalloc
+allocation.
+
+Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/pds/dirty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
+index 27607d7b9030a..6adc5f1ae2eb9 100644
+--- a/drivers/vfio/pci/pds/dirty.c
++++ b/drivers/vfio/pci/pds/dirty.c
+@@ -81,7 +81,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_dirty *dirty,
+
+ host_ack_bmp = vzalloc(bytes);
+ if (!host_ack_bmp) {
+- bitmap_free(host_seq_bmp);
++ vfree(host_seq_bmp);
+ return -ENOMEM;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f8288bdd92bd35c331935c4238a9dcd7fc2abae6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:04:08 -0400
+Subject: vhost: vringh: Fix copy_to_iter return value check
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]
+
+The return value of copy_to_iter can't be negative, check whether the
+copied length is equal to the requested length instead of checking for
+negative values.
+
+Cc: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/all/20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Link: https://patch.msgid.link/cd637504a6e3967954a9e80fc1b75e8c0978087b.1758723310.git.mst@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 7b8fd977f71cc..60961c65fd472 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
+ len - total_translated, &translated,
+@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_to_iter(src, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_to_iter(src, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From f99b65e5b7c271f9691b017029e94c95424c7dad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 17:17:38 +0800
+Subject: vhost: vringh: Modify the return value check
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]
+
+The return value of copy_from_iter and copy_to_iter can't be negative,
+check whether the copied lengths are equal.
+
+Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
+Cc: "Stefano Garzarella" <sgarzare@redhat.com>
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Message-Id: <20250910091739.2999-1-zhangjiao2@cmss.chinamobile.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 60961c65fd472..134cc10af776b 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ struct iov_iter iter;
+ u64 translated;
+ int ret;
++ size_t size;
+
+ ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
+ len - total_translated, &translated,
+@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
+ translated);
+ }
+
+- ret = copy_from_iter(dst, translated, &iter);
+- if (ret < 0)
+- return ret;
++ size = copy_from_iter(dst, translated, &iter);
++ if (size != translated)
++ return -EFAULT;
+
+ src += translated;
+ dst += translated;
+--
+2.51.0
+
--- /dev/null
+From 275631b0f7cd954ba8bfbe5679d31fa77564ec86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 14:51:26 +0200
+Subject: watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
+ watchdog
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]
+
+When the watchdog gets enabled with this driver, it leaves enough time
+for the core watchdog subsystem to start pinging it. But when the
+watchdog is already started by hardware or by the boot loader, little
+time remains before it fires and it happens that the core watchdog
+subsystem doesn't have time to start pinging it.
+
+Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
+function") pinging was managed by the driver itself and the watchdog
+was immediately pinged by setting the timer expiry to 0.
+
+So restore similar behaviour by pinging it when enabling it so that
+if it was already enabled the watchdog timer counter is reloaded.
+
+Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mpc8xxx_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
+index 867f9f3113797..a4b497ecfa205 100644
+--- a/drivers/watchdog/mpc8xxx_wdt.c
++++ b/drivers/watchdog/mpc8xxx_wdt.c
+@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
+ ddata->swtc = tmp >> 16;
+ set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
+
++ mpc8xxx_wdt_keepalive(ddata);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6be2b91c5dc0d46de417ddf5ea8684bf7efa8298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 17:26:45 +0800
+Subject: wifi: ath10k: avoid unnecessary wait for service ready message
+
+From: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+
+[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]
+
+Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
+failing") works around the failure in waiting for the service ready
+message by active polling. Note the polling is triggered after initial
+wait timeout, which means that the wait-till-timeout can not be avoided
+even the message is ready.
+
+A possible fix is to do polling once before wait as well, however this
+can not handle the race that the message arrives right after polling.
+So the solution is to do periodic polling until timeout.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/all/97a15967-5518-4731-a8ff-d43ff7f437b0@molgen.mpg.de
+Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250811-ath10k-avoid-unnecessary-wait-v1-1-db2deb87c39b@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
+ 1 file changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 818aea99f85eb..340502c47a10d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1763,33 +1763,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
+
+ int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
+ {
++ unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
+ unsigned long time_left, i;
+
+- time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- /* Sometimes the PCI HIF doesn't receive interrupt
+- * for the service ready message even if the buffer
+- * was completed. PCIe sniffer shows that it's
+- * because the corresponding CE ring doesn't fires
+- * it. Workaround here by polling CE rings once.
+- */
+- ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+-
++ /* Sometimes the PCI HIF doesn't receive interrupt
++ * for the service ready message even if the buffer
++ * was completed. PCIe sniffer shows that it's
++ * because the corresponding CE ring doesn't fires
++ * it. Workaround here by polling CE rings. Since
++ * the message could arrive at any time, continue
++ * polling until timeout.
++ */
++ do {
+ for (i = 0; i < CE_COUNT; i++)
+ ath10k_hif_send_complete_check(ar, i, 1);
+
++ /* The 100 ms granularity is a tradeoff considering scheduler
++ * overhead and response latency
++ */
+ time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+- WMI_SERVICE_READY_TIMEOUT_HZ);
+- if (!time_left) {
+- ath10k_warn(ar, "polling timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+- ath10k_warn(ar, "service ready completion received, continuing normally\n");
+- }
++ msecs_to_jiffies(100));
++ if (time_left)
++ return 0;
++ } while (time_before(jiffies, timeout));
+
+- return 0;
++ ath10k_warn(ar, "failed to receive service ready completion\n");
++ return -ETIMEDOUT;
+ }
+
+ int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
+--
+2.51.0
+
--- /dev/null
+From dcfe2bd020ed96f01ea424656420174535f641a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 12:42:03 +0530
+Subject: wifi: mac80211: fix Rx packet handling when pubsta information is not
+ available
+
+From: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+
+[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]
+
+In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
+information, an attempt is made to find the station using the address 2
+(source address) field in the header. Since pubsta is missing, link
+information such as link_valid and link_id is also unavailable. Now if such
+a situation comes, and if a matching ML station entry is found based on
+the source address, currently the packet is dropped due to missing link ID
+in the status field which is not correct.
+
+Hence, to fix this issue, if link_valid is not set and the station is an
+ML station, make an attempt to find a link station entry using the source
+address. If a valid link station is found, derive the link ID and proceed
+with packet processing. Otherwise, drop the packet as per the existing
+flow.
+
+Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
+Suggested-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250917-fix_data_packet_rx_with_mlo_and_no_pubsta-v1-1-8cf971a958ac@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 210337ef23cf5..164c6e8049826 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -5219,12 +5219,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ }
+
+ rx.sdata = prev_sta->sdata;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ continue;
++
++ link_id = link_sta->link_id;
++ }
++
+ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
+- continue;
+-
+ ieee80211_prepare_and_rx_handle(&rx, skb, false);
+
+ prev_sta = sta;
+@@ -5232,10 +5240,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+
+ if (prev_sta) {
+ rx.sdata = prev_sta->sdata;
+- if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+- goto out;
++ if (!status->link_valid && prev_sta->sta.mlo) {
++ struct link_sta_info *link_sta;
++
++ link_sta = link_sta_info_get_bss(rx.sdata,
++ hdr->addr2);
++ if (!link_sta)
++ goto out;
+
+- if (!status->link_valid && prev_sta->sta.mlo)
++ link_id = link_sta->link_id;
++ }
++
++ if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
+ goto out;
+
+ if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
+--
+2.51.0
+
--- /dev/null
+From 08971e28d1d4c5714d5827d3fd84b379c030dcf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 20:25:30 +0530
+Subject: wifi: mt76: fix potential memory leak in mt76_wmac_probe()
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]
+
+In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
+is allocated for both struct ieee80211_hw and a workqueue. However, on
+the error path, the workqueue is not freed. Fix that by calling
+mt76_free_device() on the error path.
+
+Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://patch.msgid.link/20250709145532.41246-1-abdun.nihaal@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+index ba927033bbe8c..1206769cdc7fd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
+
+ return 0;
+ error:
+- ieee80211_free_hw(mt76_hw(dev));
++ mt76_free_device(mdev);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0fd9f9cc1bc52a7cc59c3f917d5c24ae8bbd5814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 16:16:59 +0200
+Subject: wifi: mwifiex: send world regulatory domain to driver
+
+From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+
+[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]
+
+The world regulatory domain is a restrictive subset of channel
+configurations which allows legal operation of the adapter all over the
+world. Changing to this domain should not be prevented.
+
+Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
+Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
+Reviewed-by: Jeff Chen <jeff.chen_1@nxp.con>
+Link: https://patch.msgid.link/20250804-fix-mwifiex-regulatory-domain-v1-1-e4715c770c4d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 69eea0628e670..df6e4a112ec48 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
+ return;
+ }
+
+- /* Don't send world or same regdom info to firmware */
+- if (strncmp(request->alpha2, "00", 2) &&
+- strncmp(request->alpha2, adapter->country_code,
+- sizeof(request->alpha2))) {
++ /* Don't send same regdom info to firmware */
++ if (strncmp(request->alpha2, adapter->country_code,
++ sizeof(request->alpha2)) != 0) {
+ memcpy(adapter->country_code, request->alpha2,
+ sizeof(request->alpha2));
+ mwifiex_send_domain_info_cmd_fw(wiphy);
+--
+2.51.0
+
--- /dev/null
+From e027c0029865d27be7eccfb7643655fe224bf7d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 00:08:50 +0300
+Subject: wifi: rtw89: avoid circular locking dependency in ser_state_run()
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]
+
+Lockdep gives a splat [1] when ser_hdl_work item is executed. It is
+scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
+wiphy lock inside. However, this workqueue can be flushed when e.g.
+closing the interface and wiphy lock is already taken in that case.
+
+Choosing wiphy_work_queue() for SER is likely not suitable. Back on to
+the global workqueue.
+
+[1]:
+
+ WARNING: possible circular locking dependency detected
+ 6.17.0-rc2 #17 Not tainted
+ ------------------------------------------------------
+ kworker/u32:1/61 is trying to acquire lock:
+ ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]
+
+ but task is already holding lock:
+ ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
+ process_one_work+0x7c6/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
+ touch_wq_lockdep_map+0x8e/0x180
+ __flush_workqueue+0x129/0x10d0
+ ieee80211_stop_device+0xa8/0x110
+ ieee80211_do_stop+0x14ce/0x2880
+ ieee80211_stop+0x13a/0x2c0
+ __dev_close_many+0x18f/0x510
+ __dev_change_flags+0x25f/0x670
+ netif_change_flags+0x7b/0x160
+ do_setlink.isra.0+0x1640/0x35d0
+ rtnl_newlink+0xd8c/0x1d30
+ rtnetlink_rcv_msg+0x700/0xb80
+ netlink_rcv_skb+0x11d/0x350
+ netlink_unicast+0x49a/0x7a0
+ netlink_sendmsg+0x759/0xc20
+ ____sys_sendmsg+0x812/0xa00
+ ___sys_sendmsg+0xf7/0x180
+ __sys_sendmsg+0x11f/0x1b0
+ do_syscall_64+0xbb/0x360
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+ -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock((wq_completion)phy0);
+ lock((work_completion)(&ser->ser_hdl_work));
+ lock(&rdev->wiphy.mtx);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u32:1/61:
+ #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
+ #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450
+
+ stack backtrace:
+ CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
+ Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5d/0x80
+ print_circular_bug.cold+0x178/0x1be
+ check_noncircular+0x14c/0x170
+ __lock_acquire+0x124c/0x1d20
+ lock_acquire+0x154/0x2e0
+ __mutex_lock+0x17b/0x12f0
+ ser_state_run+0x5e/0x180 [rtw89_core]
+ rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
+ process_one_work+0x82d/0x1450
+ worker_thread+0x49e/0xd00
+ kthread+0x313/0x640
+ ret_from_fork+0x221/0x300
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250919210852.823912-5-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
+index 45165cf3e824e..ae3e02efcc5d7 100644
+--- a/drivers/net/wireless/realtek/rtw89/ser.c
++++ b/drivers/net/wireless/realtek/rtw89/ser.c
+@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
+
+ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ {
+- struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
+ struct ser_msg *msg = NULL;
+
+ if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
+@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
+ list_add(&msg->list, &ser->msg_q);
+ spin_unlock_irq(&ser->msg_q_lock);
+
+- ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
++ schedule_work(&ser->ser_hdl_work);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b07c1e1442b362814735fae448be3bc39f2fc3d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:52:57 +0200
+Subject: x86/vdso: Fix output operand size of RDPID
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]
+
+RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
+32-bit on x86_32). Use an unsigned long variable to store the correct size.
+
+LSL outputs to 32-bit register, use %k operand prefix to always print the
+32-bit name of the register.
+
+Use RDPID insn mnemonic while at it as the minimum binutils version of
+2.30 supports it.
+
+ [ bp: Merge two patches touching the same function into a single one. ]
+
+Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/20250616095315.230620-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/segment.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
+index 9d6411c659205..00cefbb59fa98 100644
+--- a/arch/x86/include/asm/segment.h
++++ b/arch/x86/include/asm/segment.h
+@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
+
+ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ {
+- unsigned int p;
++ unsigned long p;
+
+ /*
+ * Load CPU and node number from the GDT. LSL is faster than RDTSCP
+@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
+ *
+ * If RDPID is available, use it.
+ */
+- alternative_io ("lsl %[seg],%[p]",
+- ".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
++ alternative_io ("lsl %[seg],%k[p]",
++ "rdpid %[p]",
+ X86_FEATURE_RDPID,
+- [p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
++ [p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
+
+ if (cpu)
+ *cpu = (p & VDSO_CPUNODE_MASK);
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
