--- /dev/null
+From 99806b60f5b3fa495bdcff55227e46f68b386cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2026 14:28:01 +0000
+Subject: dma-buf: remove unused dma-fence-unwrap.c (stable/linux-5.15.y only)
+
+From: Tudor Ambarus <tudor.ambarus@linaro.org>
+
+The file drivers/dma-buf/dma-fence-unwrap.c was incorrectly added to
+the 5.15.y stable branch in commit 4e82b9c11d3c ("dma-buf: add
+dma_fence_timestamp helper") as a new file, but it was never enabled in
+the Makefile, and its header include/linux/dma-fence-unwrap.h was not
+present, making it uncompilable.
+
+A full revert of commit 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp
+helper") is not desirable because that commit also introduced the valid
+dma_fence_timestamp() helper and fixed legitimate timestamp race
+windows in drivers/dma-buf/sync_file.c and
+drivers/gpu/drm/scheduler/sched_main.c.
+
+Since there are no users of dma-fence-unwrap in the 5.15.y branch,
+remove the unused file to clean up the tree and avoid confusion.
+
+Fixes: 4e82b9c11d3c ("dma-buf: add dma_fence_timestamp helper")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/dma-fence-unwrap.c | 176 -----------------------------
+ 1 file changed, 176 deletions(-)
+ delete mode 100644 drivers/dma-buf/dma-fence-unwrap.c
+
+diff --git a/drivers/dma-buf/dma-fence-unwrap.c b/drivers/dma-buf/dma-fence-unwrap.c
+deleted file mode 100644
+index 628af51c81af3d..00000000000000
+--- a/drivers/dma-buf/dma-fence-unwrap.c
++++ /dev/null
+@@ -1,176 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * dma-fence-util: misc functions for dma_fence objects
+- *
+- * Copyright (C) 2022 Advanced Micro Devices, Inc.
+- * Authors:
+- * Christian König <christian.koenig@amd.com>
+- */
+-
+-#include <linux/dma-fence.h>
+-#include <linux/dma-fence-array.h>
+-#include <linux/dma-fence-chain.h>
+-#include <linux/dma-fence-unwrap.h>
+-#include <linux/slab.h>
+-
+-/* Internal helper to start new array iteration, don't use directly */
+-static struct dma_fence *
+-__dma_fence_unwrap_array(struct dma_fence_unwrap *cursor)
+-{
+- cursor->array = dma_fence_chain_contained(cursor->chain);
+- cursor->index = 0;
+- return dma_fence_array_first(cursor->array);
+-}
+-
+-/**
+- * dma_fence_unwrap_first - return the first fence from fence containers
+- * @head: the entrypoint into the containers
+- * @cursor: current position inside the containers
+- *
+- * Unwraps potential dma_fence_chain/dma_fence_array containers and return the
+- * first fence.
+- */
+-struct dma_fence *dma_fence_unwrap_first(struct dma_fence *head,
+- struct dma_fence_unwrap *cursor)
+-{
+- cursor->chain = dma_fence_get(head);
+- return __dma_fence_unwrap_array(cursor);
+-}
+-EXPORT_SYMBOL_GPL(dma_fence_unwrap_first);
+-
+-/**
+- * dma_fence_unwrap_next - return the next fence from a fence containers
+- * @cursor: current position inside the containers
+- *
+- * Continue unwrapping the dma_fence_chain/dma_fence_array containers and return
+- * the next fence from them.
+- */
+-struct dma_fence *dma_fence_unwrap_next(struct dma_fence_unwrap *cursor)
+-{
+- struct dma_fence *tmp;
+-
+- ++cursor->index;
+- tmp = dma_fence_array_next(cursor->array, cursor->index);
+- if (tmp)
+- return tmp;
+-
+- cursor->chain = dma_fence_chain_walk(cursor->chain);
+- return __dma_fence_unwrap_array(cursor);
+-}
+-EXPORT_SYMBOL_GPL(dma_fence_unwrap_next);
+-
+-/* Implementation for the dma_fence_merge() marco, don't use directly */
+-struct dma_fence *__dma_fence_unwrap_merge(unsigned int num_fences,
+- struct dma_fence **fences,
+- struct dma_fence_unwrap *iter)
+-{
+- struct dma_fence_array *result;
+- struct dma_fence *tmp, **array;
+- ktime_t timestamp;
+- unsigned int i;
+- size_t count;
+-
+- count = 0;
+- timestamp = ns_to_ktime(0);
+- for (i = 0; i < num_fences; ++i) {
+- dma_fence_unwrap_for_each(tmp, &iter[i], fences[i]) {
+- if (!dma_fence_is_signaled(tmp)) {
+- ++count;
+- } else {
+- ktime_t t = dma_fence_timestamp(tmp);
+-
+- if (ktime_after(t, timestamp))
+- timestamp = t;
+- }
+- }
+- }
+-
+- /*
+- * If we couldn't find a pending fence just return a private signaled
+- * fence with the timestamp of the last signaled one.
+- */
+- if (count == 0)
+- return dma_fence_allocate_private_stub(timestamp);
+-
+- array = kmalloc_array(count, sizeof(*array), GFP_KERNEL);
+- if (!array)
+- return NULL;
+-
+- /*
+- * This trashes the input fence array and uses it as position for the
+- * following merge loop. This works because the dma_fence_merge()
+- * wrapper macro is creating this temporary array on the stack together
+- * with the iterators.
+- */
+- for (i = 0; i < num_fences; ++i)
+- fences[i] = dma_fence_unwrap_first(fences[i], &iter[i]);
+-
+- count = 0;
+- do {
+- unsigned int sel;
+-
+-restart:
+- tmp = NULL;
+- for (i = 0; i < num_fences; ++i) {
+- struct dma_fence *next;
+-
+- while (fences[i] && dma_fence_is_signaled(fences[i]))
+- fences[i] = dma_fence_unwrap_next(&iter[i]);
+-
+- next = fences[i];
+- if (!next)
+- continue;
+-
+- /*
+- * We can't guarantee that inpute fences are ordered by
+- * context, but it is still quite likely when this
+- * function is used multiple times. So attempt to order
+- * the fences by context as we pass over them and merge
+- * fences with the same context.
+- */
+- if (!tmp || tmp->context > next->context) {
+- tmp = next;
+- sel = i;
+-
+- } else if (tmp->context < next->context) {
+- continue;
+-
+- } else if (dma_fence_is_later(tmp, next)) {
+- fences[i] = dma_fence_unwrap_next(&iter[i]);
+- goto restart;
+- } else {
+- fences[sel] = dma_fence_unwrap_next(&iter[sel]);
+- goto restart;
+- }
+- }
+-
+- if (tmp) {
+- array[count++] = dma_fence_get(tmp);
+- fences[sel] = dma_fence_unwrap_next(&iter[sel]);
+- }
+- } while (tmp);
+-
+- if (count == 0) {
+- tmp = dma_fence_allocate_private_stub(ktime_get());
+- goto return_tmp;
+- }
+-
+- if (count == 1) {
+- tmp = array[0];
+- goto return_tmp;
+- }
+-
+- result = dma_fence_array_create(count, array,
+- dma_fence_context_alloc(1),
+- 1, false);
+- if (!result) {
+- tmp = NULL;
+- goto return_tmp;
+- }
+- return &result->base;
+-
+-return_tmp:
+- kfree(array);
+- return tmp;
+-}
+-EXPORT_SYMBOL_GPL(__dma_fence_unwrap_merge);
+--
+2.53.0
+
--- /dev/null
+From db44424031c349a0fccab9c5bd00f81621d7d08f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 18:25:13 -0300
+Subject: net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys
+
+From: Pedro Tammela <pctammela@mojatatu.com>
+
+[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ]
+
+Transform two checks in the 'ex' key parsing into netlink policies
+removing extra if checks.
+
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index efcbca97bf2eda..a987f60d202826 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ };
+
+ static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = {
+- [TCA_PEDIT_KEY_EX_HTYPE] = { .type = NLA_U16 },
+- [TCA_PEDIT_KEY_EX_CMD] = { .type = NLA_U16 },
++ [TCA_PEDIT_KEY_EX_HTYPE] =
++ NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX),
++ [TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX),
+ };
+
+ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
+@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
+ k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]);
+ k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]);
+
+- if (k->htype > TCA_PEDIT_HDR_TYPE_MAX ||
+- k->cmd > TCA_PEDIT_CMD_MAX) {
+- err = -EINVAL;
+- goto err_out;
+- }
+-
+ k++;
+ }
+
+--
+2.53.0
+
nfsd-reset-write-verifier-on-deferred-writeback-erro.patch
userfaultfd-gate-must_wait-writability-check-on-pte_.patch
clk-imx-add-check-for-kcalloc.patch
+net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch
+dma-buf-remove-unused-dma-fence-unwrap.c-stable-linu.patch
+slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch
+slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch
+slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch
+slimbus-convert-to-platform-remove-callback-returnin.patch
+slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch
--- /dev/null
+From fff8a842d756e185c2f62355deccc97ab4a8d50c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 10:16:56 +0100
+Subject: slimbus: Convert to platform remove callback returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is ignored (apart
+from emitting a warning) and this typically results in resource leaks.
+
+To improve here there is a quest to make the remove callback return
+void. In the first step of this quest all drivers are converted to
+.remove_new(), which already returns void. Eventually after all drivers
+are converted, .remove_new() will be renamed to .remove().
+
+Trivially convert the slimbus drivers from always returning zero in the
+remove callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ctrl.c | 5 ++---
+ drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++-------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
+index ec58091fc948a2..5866014f0e2327 100644
+--- a/drivers/slimbus/qcom-ctrl.c
++++ b/drivers/slimbus/qcom-ctrl.c
+@@ -630,7 +630,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_remove(struct platform_device *pdev)
++static void qcom_slim_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -639,7 +639,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
+ clk_disable_unprepare(ctrl->rclk);
+ clk_disable_unprepare(ctrl->hclk);
+ destroy_workqueue(ctrl->rxwq);
+- return 0;
+ }
+
+ /*
+@@ -726,7 +725,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
+
+ static struct platform_driver qcom_slim_driver = {
+ .probe = qcom_slim_probe,
+- .remove = qcom_slim_remove,
++ .remove_new = qcom_slim_remove,
+ .driver = {
+ .name = "qcom_slim_ctrl",
+ .of_match_table = qcom_slim_dt_match,
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 91e9a39c6dcf03..eb9d9d3d2948cc 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1597,7 +1597,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1605,11 +1605,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ qcom_slim_ngd_unregister(ctrl);
+-
+- return 0;
+ }
+
+-static int qcom_slim_ngd_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1622,7 +1620,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+
+ kfree(ctrl->ngd);
+ ctrl->ngd = NULL;
+- return 0;
+ }
+
+ static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
+@@ -1665,7 +1662,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
+
+ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+ .probe = qcom_slim_ngd_ctrl_probe,
+- .remove = qcom_slim_ngd_ctrl_remove,
++ .remove_new = qcom_slim_ngd_ctrl_remove,
+ .driver = {
+ .name = "qcom,slim-ngd-ctrl",
+ .of_match_table = qcom_slim_ngd_dt_match,
+@@ -1674,7 +1671,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+
+ static struct platform_driver qcom_slim_ngd_driver = {
+ .probe = qcom_slim_ngd_probe,
+- .remove = qcom_slim_ngd_remove,
++ .remove_new = qcom_slim_ngd_remove,
+ .driver = {
+ .name = QCOM_SLIM_NGD_DRV_NAME,
+ .pm = &qcom_slim_ngd_dev_pm_ops,
+--
+2.53.0
+
--- /dev/null
+From 93fcce87174eb2127db224776c5e4f1d5fd0e98a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:17 +0100
+Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]
+
+PDR and SSR callbacks are registred from the controller probe function,
+but currently released from the child device's remove function.
+
+The remove() function should only be unwinding what was done in the
+same device's probe() function.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 0ee537576b8204..91e9a39c6dcf03 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1601,6 +1601,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
++ pdr_handle_release(ctrl->pdr);
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
++
+ qcom_slim_ngd_unregister(ctrl);
+
+ return 0;
+@@ -1611,8 +1614,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+ pm_runtime_disable(&pdev->dev);
+- pdr_handle_release(ctrl->pdr);
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+ qcom_slim_ngd_enable(ctrl, false);
+ qcom_slim_ngd_exit_dma(ctrl);
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+--
+2.53.0
+
--- /dev/null
+From cfbb74cdd4595a63b666e32b8e6a189fc406e524 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:16 +0100
+Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]
+
+qcom_slim_ngd_ctrl_probe() first registers the SSR callback then
+allocates the PDR context, as such the error path needs to come in
+opposite order to allow us to unroll each step.
+
+Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 346cd7c8127065..0ee537576b8204 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1577,23 +1577,22 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->pdr)) {
+ dev_err(dev, "Failed to init PDR handle\n");
+ ret = PTR_ERR(ctrl->pdr);
+- goto err_pdr_alloc;
++ goto err_unregister_ssr;
+ }
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+ ret = PTR_ERR(pds);
+ dev_err(dev, "pdr add lookup failed: %d\n", ret);
+- goto err_pdr_lookup;
++ goto err_pdr_release;
+ }
+
+ return of_qcom_slim_ngd_register(dev, ctrl);
+
+-err_pdr_alloc:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+-
+-err_pdr_lookup:
++err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
++err_unregister_ssr:
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From f6126c79efb8a708f0115a21b5e817dab2fe7bf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:15 +0100
+Subject: slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ]
+
+Device drivers should not invoke platform_driver_register()/unregister()
+in their probe and remove paths. They should further not rely on
+platform_driver_unregister() as their only means of "deleting" their
+child devices.
+
+Introduce a helper to unregister the child device and move the
+platform_driver_register()/unregister() to module_init()/exit().
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-3-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index defd22edcb414d..346cd7c8127065 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1471,6 +1471,13 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ return -ENODEV;
+ }
+
++static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl)
++{
++ struct qcom_slim_ngd *ngd = ctrl->ngd;
++
++ platform_device_del(ngd->pdev);
++}
++
+ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -1580,7 +1587,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ goto err_pdr_lookup;
+ }
+
+- platform_driver_register(&qcom_slim_ngd_driver);
+ return of_qcom_slim_ngd_register(dev, ctrl);
+
+ err_pdr_alloc:
+@@ -1594,7 +1600,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+
+ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+- platform_driver_unregister(&qcom_slim_ngd_driver);
++ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
++
++ qcom_slim_ngd_unregister(ctrl);
+
+ return 0;
+ }
+@@ -1673,6 +1681,28 @@ static struct platform_driver qcom_slim_ngd_driver = {
+ },
+ };
+
+-module_platform_driver(qcom_slim_ngd_ctrl_driver);
++static int qcom_slim_ngd_init(void)
++{
++ int ret;
++
++ ret = platform_driver_register(&qcom_slim_ngd_driver);
++ if (ret)
++ return ret;
++
++ ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver);
++ if (ret)
++ platform_driver_unregister(&qcom_slim_ngd_driver);
++
++ return ret;
++}
++
++static void qcom_slim_ngd_exit(void)
++{
++ platform_driver_unregister(&qcom_slim_ngd_ctrl_driver);
++ platform_driver_unregister(&qcom_slim_ngd_driver);
++}
++
++module_init(qcom_slim_ngd_init);
++module_exit(qcom_slim_ngd_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller");
+--
+2.53.0
+
--- /dev/null
+From ddb18b3538e93bc30bf539a60cb5b06b22ed6514 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:18 +0100
+Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]
+
+When the remoteproc starts in parallel with the NGD driver being probed,
+or the remoteproc is already up when the PDR lookup is being registered,
+or in the theoretical event that we get an interrupt from the hardware,
+these callbacks will operate on uninitialized data. This result in
+issues to boot the affected boards.
+
+One such example can be seen in the following fault, where
+qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
+
+[ 21.858578] ------------[ cut here ]------------
+[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
+...
+[ 21.859251] Call trace:
+[ 21.859255] __queue_work+0x5e0/0x790 (P)
+[ 21.859265] queue_work_on+0x6c/0xf0
+[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
+[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
+[ 21.859318] notifier_call_chain+0xa4/0x230
+[ 21.859329] srcu_notifier_call_chain+0x64/0xb8
+[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common]
+[ 21.859355] rproc_start+0x130/0x230
+[ 21.859367] rproc_boot+0x3d4/0x518
+...
+
+Move the enablement of interrupts, and the registration of SSR and PDR
+until after the NGD device has been registered.
+
+This could be further refined by moving initialization to the control
+driver probe and by removing the platform driver model from the picture.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 56 +++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index eb9d9d3d2948cc..da57e44624caa3 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1521,6 +1521,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct qcom_slim_ngd_ctrl *ctrl;
+ struct resource *res;
++ int irq;
+ int ret;
+ struct pdr_service *pds;
+
+@@ -1535,23 +1536,15 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->base))
+ return PTR_ERR(ctrl->base);
+
+- res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res) {
+- dev_err(&pdev->dev, "no slimbus IRQ resource\n");
+- return -ENODEV;
+- }
+-
+- ret = devm_request_irq(dev, res->start, qcom_slim_ngd_interrupt,
+- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
+- if (ret) {
+- dev_err(&pdev->dev, "request IRQ failed\n");
+- return ret;
+- }
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+
+- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+- if (IS_ERR(ctrl->notifier))
+- return PTR_ERR(ctrl->notifier);
++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
++ "slim-ngd", ctrl);
++ if (ret)
++ return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
+
+ ctrl->dev = dev;
+ ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;
+@@ -1574,25 +1567,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ init_completion(&ctrl->qmi_up);
+
+ ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
+- if (IS_ERR(ctrl->pdr)) {
+- dev_err(dev, "Failed to init PDR handle\n");
+- ret = PTR_ERR(ctrl->pdr);
+- goto err_unregister_ssr;
+- }
++ if (IS_ERR(ctrl->pdr))
++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
++
++ ret = of_qcom_slim_ngd_register(dev, ctrl);
++ if (ret)
++ goto err_pdr_release;
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+- ret = PTR_ERR(pds);
+- dev_err(dev, "pdr add lookup failed: %d\n", ret);
+- goto err_pdr_release;
++ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
++ goto err_unregister_ngd;
++ }
++
++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
++ if (IS_ERR(ctrl->notifier)) {
++ ret = PTR_ERR(ctrl->notifier);
++ goto err_unregister_ngd;
+ }
+
+- return of_qcom_slim_ngd_register(dev, ctrl);
++ enable_irq(irq);
++
++ return 0;
+
++err_unregister_ngd:
++ qcom_slim_ngd_unregister(ctrl);
+ err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
+-err_unregister_ssr:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From 609d84d69abb3d0c4b13ebb4b1c445af817ebdb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 18:25:13 -0300
+Subject: net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys
+
+From: Pedro Tammela <pctammela@mojatatu.com>
+
+[ Upstream commit 5036034572b79daa6d6600338e8e8229e2a44b09 ]
+
+Transform two checks in the 'ex' key parsing into netlink policies
+removing extra if checks.
+
+Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_pedit.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
+index 09310b56b45beb..1d06873da8f12d 100644
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -35,8 +35,9 @@ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+ };
+
+ static const struct nla_policy pedit_key_ex_policy[TCA_PEDIT_KEY_EX_MAX + 1] = {
+- [TCA_PEDIT_KEY_EX_HTYPE] = { .type = NLA_U16 },
+- [TCA_PEDIT_KEY_EX_CMD] = { .type = NLA_U16 },
++ [TCA_PEDIT_KEY_EX_HTYPE] =
++ NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_HDR_TYPE_MAX),
++ [TCA_PEDIT_KEY_EX_CMD] = NLA_POLICY_MAX(NLA_U16, TCA_PEDIT_CMD_MAX),
+ };
+
+ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
+@@ -86,12 +87,6 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
+ k->htype = nla_get_u16(tb[TCA_PEDIT_KEY_EX_HTYPE]);
+ k->cmd = nla_get_u16(tb[TCA_PEDIT_KEY_EX_CMD]);
+
+- if (k->htype > TCA_PEDIT_HDR_TYPE_MAX ||
+- k->cmd > TCA_PEDIT_CMD_MAX) {
+- err = -EINVAL;
+- goto err_out;
+- }
+-
+ k++;
+ }
+
+--
+2.53.0
+
nfsd-reset-write-verifier-on-deferred-writeback-erro.patch
loongarch-report-dying-cpu-to-rcu-in-stop_this_cpu.patch
userfaultfd-gate-must_wait-writability-check-on-pte_.patch
+net-sched-act_pedit-use-nla_policy-for-parsing-ex-ke.patch
+slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registr.patch
+slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch
+slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch
+slimbus-convert-to-platform-remove-callback-returnin.patch
+slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch
--- /dev/null
+From 1f5444caab3affc9065b63de2d13b3fe1bcea67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 10:16:56 +0100
+Subject: slimbus: Convert to platform remove callback returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is ignored (apart
+from emitting a warning) and this typically results in resource leaks.
+
+To improve here there is a quest to make the remove callback return
+void. In the first step of this quest all drivers are converted to
+.remove_new(), which already returns void. Eventually after all drivers
+are converted, .remove_new() will be renamed to .remove().
+
+Trivially convert the slimbus drivers from always returning zero in the
+remove callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ctrl.c | 5 ++---
+ drivers/slimbus/qcom-ngd-ctrl.c | 15 +++++----------
+ 2 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
+index c0c4f895d76e20..31f46000ca030f 100644
+--- a/drivers/slimbus/qcom-ctrl.c
++++ b/drivers/slimbus/qcom-ctrl.c
+@@ -628,7 +628,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_remove(struct platform_device *pdev)
++static void qcom_slim_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -637,7 +637,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
+ clk_disable_unprepare(ctrl->rclk);
+ clk_disable_unprepare(ctrl->hclk);
+ destroy_workqueue(ctrl->rxwq);
+- return 0;
+ }
+
+ /*
+@@ -724,7 +723,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
+
+ static struct platform_driver qcom_slim_driver = {
+ .probe = qcom_slim_probe,
+- .remove = qcom_slim_remove,
++ .remove_new = qcom_slim_remove,
+ .driver = {
+ .name = "qcom_slim_ctrl",
+ .of_match_table = qcom_slim_dt_match,
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 6003f6f99e1db3..bf2007dc3cd043 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1537,7 +1537,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct qcom_slim_ngd_ctrl *ctrl;
+- struct resource *res;
+ int ret;
+ struct pdr_service *pds;
+
+@@ -1547,8 +1546,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+
+ dev_set_drvdata(dev, ctrl);
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- ctrl->base = devm_ioremap_resource(dev, res);
++ ctrl->base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
+ if (IS_ERR(ctrl->base))
+ return PTR_ERR(ctrl->base);
+
+@@ -1609,7 +1607,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1617,11 +1615,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ qcom_slim_ngd_unregister(ctrl);
+-
+- return 0;
+ }
+
+-static int qcom_slim_ngd_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1634,7 +1630,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+
+ kfree(ctrl->ngd);
+ ctrl->ngd = NULL;
+- return 0;
+ }
+
+ static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
+@@ -1677,7 +1672,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
+
+ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+ .probe = qcom_slim_ngd_ctrl_probe,
+- .remove = qcom_slim_ngd_ctrl_remove,
++ .remove_new = qcom_slim_ngd_ctrl_remove,
+ .driver = {
+ .name = "qcom,slim-ngd-ctrl",
+ .of_match_table = qcom_slim_ngd_dt_match,
+@@ -1686,7 +1681,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+
+ static struct platform_driver qcom_slim_ngd_driver = {
+ .probe = qcom_slim_ngd_probe,
+- .remove = qcom_slim_ngd_remove,
++ .remove_new = qcom_slim_ngd_remove,
+ .driver = {
+ .name = QCOM_SLIM_NGD_DRV_NAME,
+ .pm = &qcom_slim_ngd_dev_pm_ops,
+--
+2.53.0
+
--- /dev/null
+From f24a304170fbdc134aab3a794a4f86b2105c8d17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:17 +0100
+Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]
+
+PDR and SSR callbacks are registred from the controller probe function,
+but currently released from the child device's remove function.
+
+The remove() function should only be unwinding what was done in the
+same device's probe() function.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 62b0615a62c68f..6003f6f99e1db3 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1613,6 +1613,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
++ pdr_handle_release(ctrl->pdr);
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
++
+ qcom_slim_ngd_unregister(ctrl);
+
+ return 0;
+@@ -1623,8 +1626,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+ pm_runtime_disable(&pdev->dev);
+- pdr_handle_release(ctrl->pdr);
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+ qcom_slim_ngd_enable(ctrl, false);
+ qcom_slim_ngd_exit_dma(ctrl);
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+--
+2.53.0
+
--- /dev/null
+From e2ba62022c09b261777d801efd4311c21bc5d233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:16 +0100
+Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]
+
+qcom_slim_ngd_ctrl_probe() first registers the SSR callback then
+allocates the PDR context, as such the error path needs to come in
+opposite order to allow us to unroll each step.
+
+Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index a43daa48484f1e..62b0615a62c68f 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1590,22 +1590,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->pdr)) {
+ ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
+ "Failed to init PDR handle\n");
+- goto err_pdr_alloc;
++ goto err_unregister_ssr;
+ }
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
+- goto err_pdr_lookup;
++ goto err_pdr_release;
+ }
+
+ return of_qcom_slim_ngd_register(dev, ctrl);
+
+-err_pdr_alloc:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+-
+-err_pdr_lookup:
++err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
++err_unregister_ssr:
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From 16c87c44cc56f8b72bbb026a0566982484caf04f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:15 +0100
+Subject: slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 8663e8334d7b6007f5d8a4e5dd270246f35107a6 ]
+
+Device drivers should not invoke platform_driver_register()/unregister()
+in their probe and remove paths. They should further not rely on
+platform_driver_unregister() as their only means of "deleting" their
+child devices.
+
+Introduce a helper to unregister the child device and move the
+platform_driver_register()/unregister() to module_init()/exit().
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-3-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 36 ++++++++++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index d294965e49972c..a43daa48484f1e 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1488,6 +1488,13 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ return -ENODEV;
+ }
+
++static void qcom_slim_ngd_unregister(struct qcom_slim_ngd_ctrl *ctrl)
++{
++ struct qcom_slim_ngd *ngd = ctrl->ngd;
++
++ platform_device_del(ngd->pdev);
++}
++
+ static int qcom_slim_ngd_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -1592,7 +1599,6 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ goto err_pdr_lookup;
+ }
+
+- platform_driver_register(&qcom_slim_ngd_driver);
+ return of_qcom_slim_ngd_register(dev, ctrl);
+
+ err_pdr_alloc:
+@@ -1606,7 +1612,9 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+
+ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+- platform_driver_unregister(&qcom_slim_ngd_driver);
++ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
++
++ qcom_slim_ngd_unregister(ctrl);
+
+ return 0;
+ }
+@@ -1685,6 +1693,28 @@ static struct platform_driver qcom_slim_ngd_driver = {
+ },
+ };
+
+-module_platform_driver(qcom_slim_ngd_ctrl_driver);
++static int qcom_slim_ngd_init(void)
++{
++ int ret;
++
++ ret = platform_driver_register(&qcom_slim_ngd_driver);
++ if (ret)
++ return ret;
++
++ ret = platform_driver_register(&qcom_slim_ngd_ctrl_driver);
++ if (ret)
++ platform_driver_unregister(&qcom_slim_ngd_driver);
++
++ return ret;
++}
++
++static void qcom_slim_ngd_exit(void)
++{
++ platform_driver_unregister(&qcom_slim_ngd_ctrl_driver);
++ platform_driver_unregister(&qcom_slim_ngd_driver);
++}
++
++module_init(qcom_slim_ngd_init);
++module_exit(qcom_slim_ngd_exit);
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Qualcomm SLIMBus NGD controller");
+--
+2.53.0
+
--- /dev/null
+From 9327041a6f78da5d43e55fe9819c4adbea3b569c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:18 +0100
+Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]
+
+When the remoteproc starts in parallel with the NGD driver being probed,
+or the remoteproc is already up when the PDR lookup is being registered,
+or in the theoretical event that we get an interrupt from the hardware,
+these callbacks will operate on uninitialized data. This result in
+issues to boot the affected boards.
+
+One such example can be seen in the following fault, where
+qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
+
+[ 21.858578] ------------[ cut here ]------------
+[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
+...
+[ 21.859251] Call trace:
+[ 21.859255] __queue_work+0x5e0/0x790 (P)
+[ 21.859265] queue_work_on+0x6c/0xf0
+[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
+[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
+[ 21.859318] notifier_call_chain+0xa4/0x230
+[ 21.859329] srcu_notifier_call_chain+0x64/0xb8
+[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common]
+[ 21.859355] rproc_start+0x130/0x230
+[ 21.859367] rproc_boot+0x3d4/0x518
+...
+
+Move the enablement of interrupts, and the registration of SSR and PDR
+until after the NGD device has been registered.
+
+This could be further refined by moving initialization to the control
+driver probe and by removing the platform driver model from the picture.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++--------------
+ 1 file changed, 26 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index bf2007dc3cd043..76cd7d187dd2e2 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1537,6 +1537,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct qcom_slim_ngd_ctrl *ctrl;
++ int irq;
+ int ret;
+ struct pdr_service *pds;
+
+@@ -1550,20 +1551,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->base))
+ return PTR_ERR(ctrl->base);
+
+- ret = platform_get_irq(pdev, 0);
+- if (ret < 0)
+- return ret;
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+
+- ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt,
+- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
++ "slim-ngd", ctrl);
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
+
+- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+- if (IS_ERR(ctrl->notifier))
+- return PTR_ERR(ctrl->notifier);
+-
+ ctrl->dev = dev;
+ ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;
+ ctrl->framer.superfreq =
+@@ -1585,24 +1582,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ init_completion(&ctrl->qmi_up);
+
+ ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
+- if (IS_ERR(ctrl->pdr)) {
+- ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
+- "Failed to init PDR handle\n");
+- goto err_unregister_ssr;
+- }
++ if (IS_ERR(ctrl->pdr))
++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
++
++ ret = of_qcom_slim_ngd_register(dev, ctrl);
++ if (ret)
++ goto err_pdr_release;
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
+- goto err_pdr_release;
++ goto err_unregister_ngd;
++ }
++
++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
++ if (IS_ERR(ctrl->notifier)) {
++ ret = PTR_ERR(ctrl->notifier);
++ goto err_unregister_ngd;
+ }
+
+- return of_qcom_slim_ngd_register(dev, ctrl);
++ enable_irq(irq);
+
++ return 0;
++
++err_unregister_ngd:
++ qcom_slim_ngd_unregister(ctrl);
+ err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
+-err_unregister_ssr:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From ff9be1416910b55d40528aa8f97292842741a137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:41:52 +0200
+Subject: rust: str: clean unused import for Rust >= 1.98
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 3fff4271809b57182c4011811e96556bdd4cb2f9 ]
+
+Starting with Rust 1.98.0 (expected 2026-08-20), the compiler has changed
+how the resolution algorithm works [1] in upstream commit c4d84db5f184
+("Resolver: Batched import resolution."), and it now spots:
+
+ error: unused import: `flags::*`
+ --> rust/kernel/str.rs:7:9
+ |
+ 7 | flags::*,
+ | ^^^^^^^^
+ |
+ = note: `-D unused-imports` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(unused_imports)]`
+
+It happens to not be needed because the `prelude::*` already provides
+the flags.
+
+Thus clean it up.
+
+Cc: stable@vger.kernel.org # Needed in 6.18.y and later (prelude added to `str`).
+Link: https://github.com/rust-lang/rust/pull/145108 [1]
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260609104152.261145-2-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/str.rs | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
+index 3a276bc32962d9..22cefbc9852360 100644
+--- a/rust/kernel/str.rs
++++ b/rust/kernel/str.rs
+@@ -4,7 +4,6 @@
+
+ use crate::{
+ alloc::{
+- flags::*,
+ AllocError,
+ KVec, //
+ },
+--
+2.53.0
+
--- /dev/null
+From bdd11ea01c3f5e9daf7289fed6d2c4a2e9c20792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:41:51 +0200
+Subject: rust: str: use the "kernel vertical" imports style
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 724a93a9f6033800b02a3530dbcb464638448e7f ]
+
+Convert the imports to use the "kernel vertical" imports style [1].
+
+No functional changes intended.
+
+Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1]
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://patch.msgid.link/20260609104152.261145-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Stable-dep-of: 3fff4271809b ("rust: str: clean unused import for Rust >= 1.98")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/str.rs | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
+index 8992fedabaf0f7..3a276bc32962d9 100644
+--- a/rust/kernel/str.rs
++++ b/rust/kernel/str.rs
+@@ -3,14 +3,29 @@
+ //! String representations.
+
+ use crate::{
+- alloc::{flags::*, AllocError, KVec},
+- error::{to_result, Result},
+- fmt::{self, Write},
+- prelude::*,
++ alloc::{
++ flags::*,
++ AllocError,
++ KVec, //
++ },
++ error::{
++ to_result,
++ Result, //
++ },
++ fmt::{
++ self,
++ Write, //
++ },
++ prelude::*, //
+ };
+ use core::{
+ marker::PhantomData,
+- ops::{self, Deref, DerefMut, Index},
++ ops::{
++ self,
++ Deref,
++ DerefMut,
++ Index, //
++ }, //
+ };
+
+ /// Byte string without UTF-8 validity guarantee.
+--
+2.53.0
+
rust-str-use-the-kernel-vertical-imports-style.patch
rust-str-clean-unused-import-for-rust-1.98.patch
userfaultfd-gate-must_wait-writability-check-on-pte_.patch
+rust-str-use-the-kernel-vertical-imports-style.patch-6121
+rust-str-clean-unused-import-for-rust-1.98.patch-22556
userfaultfd-gate-must_wait-writability-check-on-pte_.patch
perf-fix-dangling-cgroup-pointer-in-cpuctx-backport.patch
bluetooth-btmtk-fix-btmtk.c-undefined-reference-buil.patch
+slimbus-qcom-ngd-ctrl-fix-probe-error-path-ordering.patch
+slimbus-qcom-ngd-ctrl-correct-pdr-and-ssr-cleanup-ow.patch
+slimbus-convert-to-platform-remove-callback-returnin.patch
+slimbus-qcom-ngd-ctrl-register-callbacks-after-creat.patch
--- /dev/null
+From aa8cc20ff8e5a004f96f86f75b98bd7f954e2088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 10:16:56 +0100
+Subject: slimbus: Convert to platform remove callback returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 880b33b0580c8ac9d0202b6e592cb116c99d1b65 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is ignored (apart
+from emitting a warning) and this typically results in resource leaks.
+
+To improve here there is a quest to make the remove callback return
+void. In the first step of this quest all drivers are converted to
+.remove_new(), which already returns void. Eventually after all drivers
+are converted, .remove_new() will be renamed to .remove().
+
+Trivially convert the slimbus drivers from always returning zero in the
+remove callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20240430091657.35428-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 2a9d50e9ea40 ("slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ctrl.c | 5 ++---
+ drivers/slimbus/qcom-ngd-ctrl.c | 11 ++++-------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
+index 400b7b385a443e..7d632fad13005f 100644
+--- a/drivers/slimbus/qcom-ctrl.c
++++ b/drivers/slimbus/qcom-ctrl.c
+@@ -626,7 +626,7 @@ static int qcom_slim_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_remove(struct platform_device *pdev)
++static void qcom_slim_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -635,7 +635,6 @@ static int qcom_slim_remove(struct platform_device *pdev)
+ clk_disable_unprepare(ctrl->rclk);
+ clk_disable_unprepare(ctrl->hclk);
+ destroy_workqueue(ctrl->rxwq);
+- return 0;
+ }
+
+ /*
+@@ -721,7 +720,7 @@ static const struct of_device_id qcom_slim_dt_match[] = {
+
+ static struct platform_driver qcom_slim_driver = {
+ .probe = qcom_slim_probe,
+- .remove = qcom_slim_remove,
++ .remove_new = qcom_slim_remove,
+ .driver = {
+ .name = "qcom_slim_ctrl",
+ .of_match_table = qcom_slim_dt_match,
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 12643aaf164268..43bb5107259b71 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1682,7 +1682,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1690,11 +1690,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ qcom_slim_ngd_unregister(ctrl);
+-
+- return 0;
+ }
+
+-static int qcom_slim_ngd_remove(struct platform_device *pdev)
++static void qcom_slim_ngd_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
+@@ -1708,7 +1706,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+
+ kfree(ctrl->ngd);
+ ctrl->ngd = NULL;
+- return 0;
+ }
+
+ static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
+@@ -1751,7 +1748,7 @@ static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
+
+ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+ .probe = qcom_slim_ngd_ctrl_probe,
+- .remove = qcom_slim_ngd_ctrl_remove,
++ .remove_new = qcom_slim_ngd_ctrl_remove,
+ .driver = {
+ .name = "qcom,slim-ngd-ctrl",
+ .of_match_table = qcom_slim_ngd_dt_match,
+@@ -1760,7 +1757,7 @@ static struct platform_driver qcom_slim_ngd_ctrl_driver = {
+
+ static struct platform_driver qcom_slim_ngd_driver = {
+ .probe = qcom_slim_ngd_probe,
+- .remove = qcom_slim_ngd_remove,
++ .remove_new = qcom_slim_ngd_remove,
+ .driver = {
+ .name = QCOM_SLIM_NGD_DRV_NAME,
+ .pm = &qcom_slim_ngd_dev_pm_ops,
+--
+2.53.0
+
--- /dev/null
+From fbc8c875f3aedbd96c41a9551f5cdff7467ebe9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:17 +0100
+Subject: slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 960b53a3f76fa214c2fc493734ae7b3c5e713bbf ]
+
+PDR and SSR callbacks are registred from the controller probe function,
+but currently released from the child device's remove function.
+
+The remove() function should only be unwinding what was done in the
+same device's probe() function.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-5-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 6a3c1cf06b81a3..12643aaf164268 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1686,6 +1686,9 @@ static int qcom_slim_ngd_ctrl_remove(struct platform_device *pdev)
+ {
+ struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
+
++ pdr_handle_release(ctrl->pdr);
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
++
+ qcom_slim_ngd_unregister(ctrl);
+
+ return 0;
+@@ -1697,8 +1700,6 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
+
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+- pdr_handle_release(ctrl->pdr);
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+ qcom_slim_ngd_enable(ctrl, false);
+ qcom_slim_ngd_exit_dma(ctrl);
+ qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
+--
+2.53.0
+
--- /dev/null
+From 711b6b823264967fe77c7ba4d6c28022f567e16c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:16 +0100
+Subject: slimbus: qcom-ngd-ctrl: Fix probe error path ordering
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2c22ff152d380ec3d3af099fa05d0ac5ca9b4c1e ]
+
+qcom_slim_ngd_ctrl_probe() first registers the SSR callback then
+allocates the PDR context, as such the error path needs to come in
+opposite order to allow us to unroll each step.
+
+Fixes: 16f14551d0df ("slimbus: qcom-ngd: cleanup in probe error path")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-4-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index de1834d52cb831..6a3c1cf06b81a3 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1663,22 +1663,21 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->pdr)) {
+ ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
+ "Failed to init PDR handle\n");
+- goto err_pdr_alloc;
++ goto err_unregister_ssr;
+ }
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
+- goto err_pdr_lookup;
++ goto err_pdr_release;
+ }
+
+ return of_qcom_slim_ngd_register(dev, ctrl);
+
+-err_pdr_alloc:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+-
+-err_pdr_lookup:
++err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
++err_unregister_ssr:
++ qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From 88e04dd569fc8ef16781f1bdee5cebf81b46fd88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2026 21:44:18 +0100
+Subject: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
+
+From: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+
+[ Upstream commit 2a9d50e9ea406e0c8735938484adc20515ef1b47 ]
+
+When the remoteproc starts in parallel with the NGD driver being probed,
+or the remoteproc is already up when the PDR lookup is being registered,
+or in the theoretical event that we get an interrupt from the hardware,
+these callbacks will operate on uninitialized data. This result in
+issues to boot the affected boards.
+
+One such example can be seen in the following fault, where
+qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work.
+
+[ 21.858578] ------------[ cut here ]------------
+[ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116
+...
+[ 21.859251] Call trace:
+[ 21.859255] __queue_work+0x5e0/0x790 (P)
+[ 21.859265] queue_work_on+0x6c/0xf0
+[ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl]
+[ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl]
+[ 21.859318] notifier_call_chain+0xa4/0x230
+[ 21.859329] srcu_notifier_call_chain+0x64/0xb8
+[ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common]
+[ 21.859355] rproc_start+0x130/0x230
+[ 21.859367] rproc_boot+0x3d4/0x518
+...
+
+Move the enablement of interrupts, and the registration of SSR and PDR
+until after the NGD device has been registered.
+
+This could be further refined by moving initialization to the control
+driver probe and by removing the platform driver model from the picture.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
+Link: https://patch.msgid.link/20260530204421.116824-6-srini@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 45 +++++++++++++++++++--------------
+ 1 file changed, 26 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 43bb5107259b71..3a09f244ee8b5a 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1612,6 +1612,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct qcom_slim_ngd_ctrl *ctrl;
++ int irq;
+ int ret;
+ struct pdr_service *pds;
+
+@@ -1625,20 +1626,16 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ if (IS_ERR(ctrl->base))
+ return PTR_ERR(ctrl->base);
+
+- ret = platform_get_irq(pdev, 0);
+- if (ret < 0)
+- return ret;
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+
+- ret = devm_request_irq(dev, ret, qcom_slim_ngd_interrupt,
+- IRQF_TRIGGER_HIGH, "slim-ngd", ctrl);
++ ret = devm_request_irq(dev, irq, qcom_slim_ngd_interrupt,
++ IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN,
++ "slim-ngd", ctrl);
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "request IRQ failed\n");
+
+- ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
+- ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
+- if (IS_ERR(ctrl->notifier))
+- return PTR_ERR(ctrl->notifier);
+-
+ ctrl->dev = dev;
+ ctrl->framer.rootfreq = SLIM_ROOT_FREQ >> 3;
+ ctrl->framer.superfreq =
+@@ -1660,24 +1657,34 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
+ init_completion(&ctrl->qmi_up);
+
+ ctrl->pdr = pdr_handle_alloc(slim_pd_status, ctrl);
+- if (IS_ERR(ctrl->pdr)) {
+- ret = dev_err_probe(dev, PTR_ERR(ctrl->pdr),
+- "Failed to init PDR handle\n");
+- goto err_unregister_ssr;
+- }
++ if (IS_ERR(ctrl->pdr))
++ return dev_err_probe(dev, PTR_ERR(ctrl->pdr), "Failed to init PDR handle\n");
++
++ ret = of_qcom_slim_ngd_register(dev, ctrl);
++ if (ret)
++ goto err_pdr_release;
+
+ pds = pdr_add_lookup(ctrl->pdr, "avs/audio", "msm/adsp/audio_pd");
+ if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
+ ret = dev_err_probe(dev, PTR_ERR(pds), "pdr add lookup failed\n");
+- goto err_pdr_release;
++ goto err_unregister_ngd;
++ }
++
++ ctrl->nb.notifier_call = qcom_slim_ngd_ssr_notify;
++ ctrl->notifier = qcom_register_ssr_notifier("lpass", &ctrl->nb);
++ if (IS_ERR(ctrl->notifier)) {
++ ret = PTR_ERR(ctrl->notifier);
++ goto err_unregister_ngd;
+ }
+
+- return of_qcom_slim_ngd_register(dev, ctrl);
++ enable_irq(irq);
+
++ return 0;
++
++err_unregister_ngd:
++ qcom_slim_ngd_unregister(ctrl);
+ err_pdr_release:
+ pdr_handle_release(ctrl->pdr);
+-err_unregister_ssr:
+- qcom_unregister_ssr_notifier(ctrl->notifier, &ctrl->nb);
+
+ return ret;
+ }
+--
+2.53.0
+
--- /dev/null
+From 474b39b3ad8b17909795e92c5a7e78574ffe11ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:41:52 +0200
+Subject: rust: str: clean unused import for Rust >= 1.98
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 3fff4271809b57182c4011811e96556bdd4cb2f9 ]
+
+Starting with Rust 1.98.0 (expected 2026-08-20), the compiler has changed
+how the resolution algorithm works [1] in upstream commit c4d84db5f184
+("Resolver: Batched import resolution."), and it now spots:
+
+ error: unused import: `flags::*`
+ --> rust/kernel/str.rs:7:9
+ |
+ 7 | flags::*,
+ | ^^^^^^^^
+ |
+ = note: `-D unused-imports` implied by `-D warnings`
+ = help: to override `-D warnings` add `#[allow(unused_imports)]`
+
+It happens to not be needed because the `prelude::*` already provides
+the flags.
+
+Thus clean it up.
+
+Cc: stable@vger.kernel.org # Needed in 6.18.y and later (prelude added to `str`).
+Link: https://github.com/rust-lang/rust/pull/145108 [1]
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260609104152.261145-2-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/str.rs | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
+index a7fccd4c4f3b18..4517c1bc547afb 100644
+--- a/rust/kernel/str.rs
++++ b/rust/kernel/str.rs
+@@ -4,7 +4,6 @@
+
+ use crate::{
+ alloc::{
+- flags::*,
+ AllocError,
+ KVec, //
+ },
+--
+2.53.0
+
--- /dev/null
+From 529f6ae7ec8428057c7220dfa69ebccd02b46fab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2026 12:41:51 +0200
+Subject: rust: str: use the "kernel vertical" imports style
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 724a93a9f6033800b02a3530dbcb464638448e7f ]
+
+Convert the imports to use the "kernel vertical" imports style [1].
+
+No functional changes intended.
+
+Link: https://docs.kernel.org/rust/coding-guidelines.html#imports [1]
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://patch.msgid.link/20260609104152.261145-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Stable-dep-of: 3fff4271809b ("rust: str: clean unused import for Rust >= 1.98")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/str.rs | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
+index 8311d91549e15e..a7fccd4c4f3b18 100644
+--- a/rust/kernel/str.rs
++++ b/rust/kernel/str.rs
+@@ -3,14 +3,28 @@
+ //! String representations.
+
+ use crate::{
+- alloc::{flags::*, AllocError, KVec},
+- error::{to_result, Result},
+- fmt::{self, Write},
+- prelude::*,
++ alloc::{
++ flags::*,
++ AllocError,
++ KVec, //
++ },
++ error::{
++ to_result,
++ Result, //
++ },
++ fmt::{
++ self,
++ Write, //
++ },
++ prelude::*, //
+ };
+ use core::{
+ marker::PhantomData,
+- ops::{Deref, DerefMut, Index},
++ ops::{
++ Deref,
++ DerefMut,
++ Index, //
++ }, //
+ };
+
+ pub use crate::prelude::CStr;
+--
+2.53.0
+
rust-str-use-the-kernel-vertical-imports-style.patch
rust-str-clean-unused-import-for-rust-1.98.patch
userfaultfd-gate-must_wait-writability-check-on-pte_.patch
+rust-str-use-the-kernel-vertical-imports-style.patch-28199
+rust-str-clean-unused-import-for-rust-1.98.patch-12096
projects / thirdparty / kernel / stable-queue.git / commitdiff
