--- /dev/null
+From 718f16af6f32476a2cb42d08688e25fd82c5e957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:38 +0200
+Subject: ARM: dts: rockchip: drop grf reference from rk3036 hdmi
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 1580ccb6ed9dc76b8ff3e2d8912e8215c8b0fa6d ]
+
+Neither the binding nor the driver implementation specify/use the grf
+reference provided in the rk3036. And neither does the newer rk3128
+user of the hdmi controller. So drop the rockchip,grf property.
+
+Fixes: b7217cf19c63 ("ARM: dts: rockchip: add hdmi device node for rk3036")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-13-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rockchip/rk3036.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+index e6bb1d7a2b4ec..4e208528eebf2 100644
+--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi
++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+@@ -398,7 +398,6 @@
+ interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru PCLK_HDMI>;
+ clock-names = "pclk";
+- rockchip,grf = <&grf>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&hdmi_ctl>;
+ status = "disabled";
+--
+2.43.0
+
--- /dev/null
+From 6a5fa83c4bb66631fafd35a274e6fce96cd128b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:37 +0200
+Subject: ARM: dts: rockchip: fix rk3036 acodec node
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit c7206853cd7d31c52575fb1dc7616b4398f3bc8f ]
+
+The acodec node is not conformant to the binding.
+
+Set the correct nodename, use the correct compatible, add the needed
+#sound-dai-cells and sort the rockchip,grf below clocks properties
+as expected.
+
+Fixes: faea098e1808 ("ARM: dts: rockchip: add core rk3036 dtsi")
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-12-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rockchip/rk3036.dtsi | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+index c420c7c642cb0..e6bb1d7a2b4ec 100644
+--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi
++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+@@ -382,12 +382,13 @@
+ };
+ };
+
+- acodec: acodec-ana@20030000 {
+- compatible = "rk3036-codec";
++ acodec: audio-codec@20030000 {
++ compatible = "rockchip,rk3036-codec";
+ reg = <0x20030000 0x4000>;
+- rockchip,grf = <&grf>;
+ clock-names = "acodec_pclk";
+ clocks = <&cru PCLK_ACODEC>;
++ rockchip,grf = <&grf>;
++ #sound-dai-cells = <0>;
+ status = "disabled";
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 4049b9414f93cbbde1cc80a176b383884dd7c31e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:40 +0200
+Subject: ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 77a9a7f2d3b94d29d13d71b851114d593a2147cf ]
+
+Both the node name as well as the compatible were not named
+according to the binding expectations, fix that.
+
+Fixes: 47bf3a5c9e2a ("ARM: dts: rockchip: add the sound setup for rk3036-kylin board")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-15-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rockchip/rk3036-kylin.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts
+index 67e1e04139e73..43926d0962bbd 100644
+--- a/arch/arm/boot/dts/rockchip/rk3036-kylin.dts
++++ b/arch/arm/boot/dts/rockchip/rk3036-kylin.dts
+@@ -304,8 +304,8 @@
+ &i2c2 {
+ status = "okay";
+
+- rt5616: rt5616@1b {
+- compatible = "rt5616";
++ rt5616: audio-codec@1b {
++ compatible = "realtek,rt5616";
+ reg = <0x1b>;
+ clocks = <&cru SCLK_I2S_OUT>;
+ clock-names = "mclk";
+--
+2.43.0
+
--- /dev/null
+From 881ef9d59111fe911dc1141368b3e2f741cb5ecc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:39 +0200
+Subject: ARM: dts: rockchip: Fix the spi controller on rk3036
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 8bade1ad1f0821aef31f6a8fb1027ae292566d85 ]
+
+Compatible and clock names did not match the existing binding.
+So set the correct values and re-order+rename the clocks.
+
+It looks like no rk3036 board did use the spi controller so far,
+so this was never detected on a running device yet.
+
+Fixes: f629fcfab2cd ("ARM: dts: rockchip: support the spi for rk3036")
+Cc: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-14-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rockchip/rk3036.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rockchip/rk3036.dtsi b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+index 4e208528eebf2..5bdbadd879fe8 100644
+--- a/arch/arm/boot/dts/rockchip/rk3036.dtsi
++++ b/arch/arm/boot/dts/rockchip/rk3036.dtsi
+@@ -550,11 +550,11 @@
+ };
+
+ spi: spi@20074000 {
+- compatible = "rockchip,rockchip-spi";
++ compatible = "rockchip,rk3036-spi";
+ reg = <0x20074000 0x1000>;
+ interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&cru PCLK_SPI>, <&cru SCLK_SPI>;
+- clock-names = "apb-pclk","spi_pclk";
++ clocks = <&cru SCLK_SPI>, <&cru PCLK_SPI>;
++ clock-names = "spiclk", "apb_pclk";
+ dmas = <&pdma 8>, <&pdma 9>;
+ dma-names = "tx", "rx";
+ pinctrl-names = "default";
+--
+2.43.0
+
--- /dev/null
+From 50cb7fbeb295b0de87be36ff57a7bec657fe3470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 13:41:03 +0200
+Subject: arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit eed2d8e8d0051a6551e4dffba99e16eb88c676ac ]
+
+imx8-ss-vpu only contained imx8qxp IRQ numbers, only mu2_m0 uses the
+correct imx8qm IRQ number, as imx8qxp lacks this MU.
+Fix this by providing imx8qm IRQ numbers in the main imx8-ss-vpu.dtsi
+and override the IRQ numbers in SoC-specific imx8qxp-ss-vpu.dtsi, similar
+to reg property for VPU core devices.
+
+Fixes: 0d9968d98467d ("arm64: dts: freescale: imx8q: add imx vpu codec entries")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi | 4 ++--
+ arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 8 ++++++++
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi
+index c6540768bdb92..87211c18d65a9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8-ss-vpu.dtsi
+@@ -15,7 +15,7 @@ vpu: vpu@2c000000 {
+ mu_m0: mailbox@2d000000 {
+ compatible = "fsl,imx6sx-mu";
+ reg = <0x2d000000 0x20000>;
+- interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>;
+ #mbox-cells = <2>;
+ power-domains = <&pd IMX_SC_R_VPU_MU_0>;
+ status = "disabled";
+@@ -24,7 +24,7 @@ vpu: vpu@2c000000 {
+ mu1_m0: mailbox@2d020000 {
+ compatible = "fsl,imx6sx-mu";
+ reg = <0x2d020000 0x20000>;
+- interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>;
+ #mbox-cells = <2>;
+ power-domains = <&pd IMX_SC_R_VPU_MU_1>;
+ status = "disabled";
+diff --git a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+index 7894a3ab26d6b..f81937b5fb720 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+@@ -5,6 +5,14 @@
+ * Author: Alexander Stein
+ */
+
++&mu_m0 {
++ interrupts = <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
++};
++
++&mu1_m0 {
++ interrupts = <GIC_SPI 470 IRQ_TYPE_LEVEL_HIGH>;
++};
++
+ &vpu_core0 {
+ reg = <0x2d040000 0x10000>;
+ };
+--
+2.43.0
+
--- /dev/null
+From 2e47601f7d95882ea3ad447a4d29a1d65fa8cbf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 10:52:21 +0800
+Subject: arm64: dts: imx8mp: correct sdhc ipg clk
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit eab6ba2aa3bbaf598a66e31f709bf84b7bb7dc8a ]
+
+The ipg clk for sdhc sources from IPG_CLK_ROOT per i.MX 8M Plus
+Applications Processor Reference Manual, Table 5-2. System Clocks.
+
+Fixes: 6d9b8d20431f ("arm64: dts: freescale: Add i.MX8MP dtsi support")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index d1488ebfef3f0..69b213ed7a594 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -1257,7 +1257,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b40000 0x10000>;
+ interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC1_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+@@ -1271,7 +1271,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b50000 0x10000>;
+ interrupts = <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC2_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+@@ -1285,7 +1285,7 @@
+ compatible = "fsl,imx8mp-usdhc", "fsl,imx8mm-usdhc", "fsl,imx7d-usdhc";
+ reg = <0x30b60000 0x10000>;
+ interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MP_CLK_DUMMY>,
++ clocks = <&clk IMX8MP_CLK_IPG_ROOT>,
+ <&clk IMX8MP_CLK_NAND_USDHC_BUS>,
+ <&clk IMX8MP_CLK_USDHC3_ROOT>;
+ clock-names = "ipg", "ahb", "per";
+--
+2.43.0
+
--- /dev/null
+From dd9e02bc963602778a8feca882ddd74666833aa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 14:20:00 +0100
+Subject: arm64: dts: imx8qxp: Add VPU subsystem file
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 6bcd8b2fa2a9826fb6a849a9bfd7bdef145cabb6 ]
+
+imx8qxp re-uses imx8qm VPU subsystem file, but it has different base
+addresses. Also imx8qxp has only two VPU cores, delete vpu_vore2 and
+mu2_m0 accordingly.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: eed2d8e8d005 ("arm64: dts: imx8-ss-vpu: Fix imx8qm VPU IRQs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx8qxp-ss-vpu.dtsi | 17 +++++++++++++++++
+ arch/arm64/boot/dts/freescale/imx8qxp.dtsi | 2 +-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+new file mode 100644
+index 0000000000000..7894a3ab26d6b
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8qxp-ss-vpu.dtsi
+@@ -0,0 +1,17 @@
++// SPDX-License-Identifier: (GPL-2.0-or-later OR X11)
++/*
++ * Copyright 2023 TQ-Systems GmbH <linux@ew.tq-group.com>,
++ * D-82229 Seefeld, Germany.
++ * Author: Alexander Stein
++ */
++
++&vpu_core0 {
++ reg = <0x2d040000 0x10000>;
++};
++
++&vpu_core1 {
++ reg = <0x2d050000 0x10000>;
++};
++
++/delete-node/ &mu2_m0;
++/delete-node/ &vpu_core2;
+diff --git a/arch/arm64/boot/dts/freescale/imx8qxp.dtsi b/arch/arm64/boot/dts/freescale/imx8qxp.dtsi
+index c80c85a4b4059..b155180cc249b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qxp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qxp.dtsi
+@@ -48,7 +48,6 @@
+ serial3 = &lpuart3;
+ vpu-core0 = &vpu_core0;
+ vpu-core1 = &vpu_core1;
+- vpu-core2 = &vpu_core2;
+ };
+
+ cpus {
+@@ -317,6 +316,7 @@
+ };
+
+ #include "imx8qxp-ss-img.dtsi"
++#include "imx8qxp-ss-vpu.dtsi"
+ #include "imx8qxp-ss-adma.dtsi"
+ #include "imx8qxp-ss-conn.dtsi"
+ #include "imx8qxp-ss-lsio.dtsi"
+--
+2.43.0
+
--- /dev/null
+From 76b9b2acd6aa6e9bb0ed1bcd746eae89d5bf1c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2024 17:00:46 +0000
+Subject: arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus
+
+From: Sergey Bostandzhyan <jin@mediatomb.cc>
+
+[ Upstream commit b8c02878292200ebb5b4a8cfc9dbf227327908bd ]
+
+The R2S Plus is basically an R2S with additional eMMC.
+
+The eMMC configuration for the DTS has been extracted and copied from
+rk3328-nanopi-r2.dts, v2017.09 branch from the friendlyarm/uboot-rockchip
+repository.
+
+Signed-off-by: Sergey Bostandzhyan <jin@mediatomb.cc>
+Link: https://lore.kernel.org/r/20240814170048.23816-2-jin@mediatomb.cc
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Stable-dep-of: 1b670212ee3d ("arm64: dts: rockchip: Remove undocumented supports-emmc property")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/Makefile | 1 +
+ .../dts/rockchip/rk3328-nanopi-r2s-plus.dts | 32 +++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+
+diff --git a/arch/arm64/boot/dts/rockchip/Makefile b/arch/arm64/boot/dts/rockchip/Makefile
+index e7728007fd1bd..259e59594bf20 100644
+--- a/arch/arm64/boot/dts/rockchip/Makefile
++++ b/arch/arm64/boot/dts/rockchip/Makefile
+@@ -17,6 +17,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-evb.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2c-plus.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s.dtb
++dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-nanopi-r2s-plus.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-orangepi-r1-plus-lts.dtb
+ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3328-rock64.dtb
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+new file mode 100644
+index 0000000000000..cb81ba3f23ffd
+--- /dev/null
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+@@ -0,0 +1,32 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * (C) Copyright 2018 FriendlyElec Computer Tech. Co., Ltd.
++ * (http://www.friendlyarm.com)
++ *
++ * (C) Copyright 2016 Rockchip Electronics Co., Ltd
++ */
++
++/dts-v1/;
++#include "rk3328-nanopi-r2s.dts"
++
++/ {
++ compatible = "friendlyarm,nanopi-r2s-plus", "rockchip,rk3328";
++ model = "FriendlyElec NanoPi R2S Plus";
++
++ aliases {
++ mmc1 = &emmc;
++ };
++};
++
++&emmc {
++ bus-width = <8>;
++ cap-mmc-highspeed;
++ disable-wp;
++ mmc-hs200-1_8v;
++ non-removable;
++ num-slots = <1>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>;
++ supports-emmc;
++ status = "okay";
++};
+--
+2.43.0
+
--- /dev/null
+From c753aabcdc9b17fd90b9e1c76600266faad4b82e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 16:45:50 +0200
+Subject: arm64: dts: rockchip: Correct GPIO polarity on brcm BT nodes
+
+From: Diederik de Haas <didi.debian@cknow.org>
+
+[ Upstream commit 08846522d9a7bccf18d4f97c3f39d03c7a193970 ]
+
+Paragraph "3.4 Power up Timing Sequence" of the AzureWave-CM256SM
+datasheet mentions the following about the BT_REG_ON pin, which is
+connected to GPIO0_C4_d:
+
+ When this pin is low and WL_REG_ON is high,
+ the BT section is in reset.
+
+Therefor set that pin to GPIO_ACTIVE_HIGH so that it can be pulled low
+for a reset.
+If set to GPIO_ACTIVE_LOW, the following errors are observed:
+
+ Bluetooth: hci0: command 0x0c03 tx timeout
+ Bluetooth: hci0: BCM: Reset failed (-110)
+
+So fix the GPIO polarity by setting it to ACTIVE_HIGH.
+This also matches what other devices with the same BT device have.
+
+Fixes: 2b6a3f857550 ("arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes")
+Signed-off-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/20241018145053.11928-2-didi.debian@cknow.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+index 27d89f48c42bd..9944c9d4ca9fe 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+@@ -687,7 +687,7 @@
+ host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
+ pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>;
+ pinctrl-names = "default";
+- shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>;
++ shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_HIGH>;
+ vbat-supply = <&vcc_wl>;
+ vddio-supply = <&vcca_1v8_pmu>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
+index e9fa9bee995ae..1e36f73840dad 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
+@@ -404,7 +404,7 @@
+ host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>;
+- shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>;
++ shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
+ vbat-supply = <&vcc_3v3>;
+ vddio-supply = <&vcc_1v8>;
+ };
+--
+2.43.0
+
--- /dev/null
+From 44b01a52858b33e5bc4a30fdf213576fa3a42e75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:29 +0200
+Subject: arm64: dts: rockchip: Fix bluetooth properties on rk3566 box demo
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 2fa98dcc8d3ea2ebbd9e6be778f8bb19231c28be ]
+
+The expected clock-name is different, and extclk also is deprecated
+in favor of txco for clocks that are not crystals.
+
+The wakeup gpio properties are named differently too, when changing
+from vendor-tree to mainline. So fix those to match the binding.
+
+Fixes: 2e0537b16b25 ("arm64: dts: rockchip: Add dts for rockchip rk3566 box demo board")
+Cc: Andy Yan <andyshrk@163.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-4-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts
+index 0c18406e4c597..7d46809338239 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts
+@@ -449,9 +449,9 @@
+ bluetooth {
+ compatible = "brcm,bcm43438-bt";
+ clocks = <&pmucru CLK_RTC_32K>;
+- clock-names = "ext_clock";
+- device-wake-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>;
+- host-wake-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
++ clock-names = "txco";
++ device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>;
++ host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>;
+ shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>;
+--
+2.43.0
+
--- /dev/null
+From 254a53e8d870b05e251676878d305adac842d8ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:30 +0200
+Subject: arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit ea74528aaea5a1dfc8e3de09ef2af37530eca526 ]
+
+The expected clock-name is different, and extclk also is deprecated
+in favor of txco for clocks that are not crystals.
+
+So fix it to match the binding.
+
+Fixes: c72235c288c8 ("arm64: dts: rockchip: Add on-board WiFi/BT support for Rock960 boards")
+Cc: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-5-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+index c920ddf44bafd..55ac7145c0850 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock960.dtsi
+@@ -577,7 +577,7 @@
+ bluetooth {
+ compatible = "brcm,bcm43438-bt";
+ clocks = <&rk808 1>;
+- clock-names = "ext_clock";
++ clock-names = "txco";
+ device-wakeup-gpios = <&gpio2 RK_PD3 GPIO_ACTIVE_HIGH>;
+ host-wakeup-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_HIGH>;
+ shutdown-gpios = <&gpio0 RK_PB1 GPIO_ACTIVE_HIGH>;
+--
+2.43.0
+
--- /dev/null
+From caa90774c843c09d90c3879fa18139c1fe88b9d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:27 +0200
+Subject: arm64: dts: rockchip: fix i2c2 pinctrl-names property on
+ anbernic-rg353p/v
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit f94b934336e30cebae75d4fbe04a2109a3c8fdec ]
+
+We want to control pins, not beer mugs, so rename pintctrl-names to the
+expected pinctrl-names.
+
+This was not affecting functionality, because the i2c2 controller
+already had a set of pinctrl properties.
+
+Fixes: 523adb553573 ("arm64: dts: rockchip: add Anbernic RG353P and RG503")
+Fixes: 1e141cf12726 ("arm64: dts: rockchip: add Anbernic RG353V and RG353VS")
+Cc: Chris Morgan <macromorgan@hotmail.com>
+Acked-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-2-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts
+index 8aa93c646becf..5f1b12166231f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353p.dts
+@@ -92,7 +92,7 @@
+ };
+
+ &i2c2 {
+- pintctrl-names = "default";
++ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2m1_xfer>;
+ status = "okay";
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts
+index f49ce29ba5977..2957529a27486 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-anbernic-rg353v.dts
+@@ -79,7 +79,7 @@
+ };
+
+ &i2c2 {
+- pintctrl-names = "default";
++ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2m1_xfer>;
+ status = "okay";
+
+--
+2.43.0
+
--- /dev/null
+From 06e28eba0bdc53e9514e72f1e11b997400c43c96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:33 +0200
+Subject: arm64: dts: rockchip: Fix LED triggers on rk3308-roc-cc
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 3a53a7187f41ec3db12cf4c2cb0db4ba87c2f3a1 ]
+
+There are two LEDs on the board, power and user events.
+Currently both are assigned undocumented IR(-remote)
+triggers that are probably only part of the vendor-kernel.
+
+To make dtbs check happier, assign the power-led to a generic
+default-on trigger and the user led to the documented rc-feedback
+trigger that should mostly match its current usage.
+
+Fixes: 4403e1237be3 ("arm64: dts: rockchip: Add devicetree for board roc-rk3308-cc")
+Cc: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-8-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+index 9232357f4fec9..d9e191ad1d77e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+@@ -36,14 +36,14 @@
+
+ power_led: led-0 {
+ label = "firefly:red:power";
+- linux,default-trigger = "ir-power-click";
++ linux,default-trigger = "default-on";
+ default-state = "on";
+ gpios = <&gpio0 RK_PA6 GPIO_ACTIVE_HIGH>;
+ };
+
+ user_led: led-1 {
+ label = "firefly:blue:user";
+- linux,default-trigger = "ir-user-click";
++ linux,default-trigger = "rc-feedback";
+ default-state = "off";
+ gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_HIGH>;
+ };
+--
+2.43.0
+
--- /dev/null
+From 8b29c8df5f890c44c9a59f461e9b1e7d7d36d122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 13:15:39 +0200
+Subject: arm64: dts: rockchip: Fix reset-gpios property on brcm BT nodes
+
+From: Diederik de Haas <didi.debian@cknow.org>
+
+[ Upstream commit 2b6a3f857550e52b1cd4872ebb13cb3e3cf12f5f ]
+
+For most compatibles, the "brcm,bluetooth.yaml" binding doesn't allow
+the 'reset-gpios' property, but there is a 'shutdown-gpios' property.
+
+Page 12 of the AzureWave-CM256SM datasheet (v1.9) has the following wrt
+pin 34 'BT_REG_ON' (connected to GPIO0_C4_d on the PineNote):
+
+ Used by PMU to power up or power down the internal regulators used
+ by the Bluetooth section. Also, when deasserted, this pin holds the
+ Bluetooth section in reset. This pin has an internal 200k ohm pull
+ down resistor that is enabled by default.
+
+So it is safe to replace 'reset-gpios' with 'shutdown-gpios'.
+
+Fixes: d449121e5e8a ("arm64: dts: rockchip: Add Pine64 PineNote board")
+Signed-off-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/20241008113344.23957-5-didi.debian@cknow.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+index 42f9507c01da1..27d89f48c42bd 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+@@ -685,9 +685,9 @@
+ clock-names = "lpo";
+ device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>;
+ host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
+- reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>;
+ pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>;
+ pinctrl-names = "default";
++ shutdown-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>;
+ vbat-supply = <&vcc_wl>;
+ vddio-supply = <&vcca_1v8_pmu>;
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
+index 45de2630bb503..e9fa9bee995ae 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-radxa-cm3.dtsi
+@@ -402,9 +402,9 @@
+ clock-names = "lpo";
+ device-wakeup-gpios = <&gpio2 RK_PB2 GPIO_ACTIVE_HIGH>;
+ host-wakeup-gpios = <&gpio2 RK_PB1 GPIO_ACTIVE_HIGH>;
+- reset-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&bt_host_wake_h &bt_reg_on_h &bt_wake_host_h>;
++ shutdown-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_LOW>;
+ vbat-supply = <&vcc_3v3>;
+ vddio-supply = <&vcc_1v8>;
+ };
+--
+2.43.0
+
--- /dev/null
+From 4293063767bfa352697e08049f8afced5cafce37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:48:40 +0200
+Subject: arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-eaidk-610
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2f39bba3b4f037d6c3c9174eed5befcef1c79abb ]
+
+There are no DT bindings and driver support for a "rockchip,rt5651"
+codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the
+"simple-audio-card,name" property in the "rt5651-sound" node.
+
+Fixes: 904f983256fdd24b ("arm64: dts: rockchip: Add dts for a rk3399 based board EAIDK-610")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/a9877b8b1bd0de279d2ec8294d5be14587203a82.1727358193.git.geert+renesas@glider.be
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts
+index 6464ef4d113dd..6c1043d678dda 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts
+@@ -541,7 +541,7 @@
+ status = "okay";
+
+ rt5651: audio-codec@1a {
+- compatible = "rockchip,rt5651";
++ compatible = "realtek,rt5651";
+ reg = <0x1a>;
+ clocks = <&cru SCLK_I2S_8CH_OUT>;
+ clock-names = "mclk";
+--
+2.43.0
+
--- /dev/null
+From 85da57db84aec5588080f2b69f13d51dcff26d35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:48:41 +0200
+Subject: arm64: dts: rockchip: Fix rt5651 compatible value on
+ rk3399-sapphire-excavator
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 577b5761679da90e691acc939ebbe7879fff5f31 ]
+
+There are no DT bindings and driver support for a "rockchip,rt5651"
+codec. Replace "rockchip,rt5651" by "realtek,rt5651", which matches the
+"simple-audio-card,name" property in the "rt5651-sound" node.
+
+Fixes: 0a3c78e251b3a266 ("arm64: dts: rockchip: Add support for rk3399 excavator main board")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/abc6c89811b3911785601d6d590483eacb145102.1727358193.git.geert+renesas@glider.be
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+index dbec2b7173a0b..31ea3d0182c06 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+@@ -163,7 +163,7 @@
+ status = "okay";
+
+ rt5651: rt5651@1a {
+- compatible = "rockchip,rt5651";
++ compatible = "realtek,rt5651";
+ reg = <0x1a>;
+ clocks = <&cru SCLK_I2S_8CH_OUT>;
+ clock-names = "mclk";
+--
+2.43.0
+
--- /dev/null
+From 37bed7e4b3155afa9ee56047f76e3e38ae87a658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 13:15:38 +0200
+Subject: arm64: dts: rockchip: Fix wakeup prop names on PineNote BT node
+
+From: Diederik de Haas <didi.debian@cknow.org>
+
+[ Upstream commit 87299d6ee95a37d2d576dd8077ea6860f77ad8e2 ]
+
+The "brcm,bluetooth.yaml" binding has 'device-wakeup-gpios' and
+'host-wakeup-gpios' property names, not '*-wake-gpios'.
+Fix the incorrect property names.
+
+Note that the "realtek,bluetooth.yaml" binding does use the
+'*-wake-gpios' property names.
+
+Fixes: d449121e5e8a ("arm64: dts: rockchip: Add Pine64 PineNote board")
+Signed-off-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/20241008113344.23957-4-didi.debian@cknow.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+index d899087bf0b55..42f9507c01da1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+@@ -683,8 +683,8 @@
+ compatible = "brcm,bcm43438-bt";
+ clocks = <&rk817 1>;
+ clock-names = "lpo";
+- device-wake-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>;
+- host-wake-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
++ device-wakeup-gpios = <&gpio0 RK_PC2 GPIO_ACTIVE_HIGH>;
++ host-wakeup-gpios = <&gpio0 RK_PC3 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&gpio0 RK_PC4 GPIO_ACTIVE_LOW>;
+ pinctrl-0 = <&bt_enable_h>, <&bt_host_wake_l>, <&bt_wake_h>;
+ pinctrl-names = "default";
+--
+2.43.0
+
--- /dev/null
+From 51d352a130300837e7fa6a15ef856fec080974e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:32 +0200
+Subject: arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma
+ lion
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 5ed96580568c4f79a0aff11a67f10b3e9229ba86 ]
+
+All Theobroma boards use a ti,amc6821 as fan controller.
+It normally runs in an automatically controlled way and while it may be
+possible to use it as part of a dt-based thermal management, this is
+not yet specified in the binding, nor implemented in any kernel.
+
+Newer boards already don't contain that #cooling-cells property, but
+older ones do. So remove them for now, they can be re-added if thermal
+integration gets implemented in the future.
+
+There are two further occurences in v6.12-rc in px30-ringneck and
+rk3399-puma, but those already get removed by the i2c-mux conversion
+scheduled for 6.13 . As the undocumented property is in the kernel so
+long, I opted for not causing extra merge conflicts between 6.12 and 6.13
+
+Fixes: d99a02bcfa81 ("arm64: dts: rockchip: add RK3368-uQ7 (Lion) SoM")
+Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Cc: Klaus Goger <klaus.goger@theobroma-systems.com>
+Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-7-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+index 5753e57fd7161..e8859cfd2d39b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi
+@@ -60,7 +60,6 @@
+ fan: fan@18 {
+ compatible = "ti,amc6821";
+ reg = <0x18>;
+- #cooling-cells = <2>;
+ };
+
+ rtc_twi: rtc@6f {
+--
+2.43.0
+
--- /dev/null
+From d55e9753da54590fce07193c545b195e3d4346ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 13:15:37 +0200
+Subject: arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
+
+From: Diederik de Haas <didi.debian@cknow.org>
+
+[ Upstream commit de50a7e3681771c6b990238af82bf1dea9b11b21 ]
+
+The "synopsys,dw-hdmi.yaml" binding specifies that the interrupts
+property of the hdmi node has 'maxItems: 1', so the hdmi node in
+rk3328.dtsi having 2 is incorrect.
+
+Paragraph 1.3 ("System Interrupt connection") of the RK3328 TRM v1.1
+page 16 and 17 define the following hdmi related interrupts:
+- 67 hdmi_intr
+- 103 hdmi_intr_wakeup
+
+The difference of 32 is due to a different base used in the TRM.
+
+The RK3399 (which uses the same binding) has '23: hdmi_irq' and
+'24: hdmi_wakeup_irq' according to its TRM (page 19).
+The RK3568 (also same binding) has '76: hdmi_wakeup' and '77: hdmi'
+according to page 17 of its TRM.
+In both cases the non-wakeup IRQ was used, so use that too for rk3328.
+
+Helped-by: Heiko Stuebner <heiko@sntech.de>
+Fixes: 725e351c265a ("arm64: dts: rockchip: add rk3328 display nodes")
+Signed-off-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/20241008113344.23957-3-didi.debian@cknow.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 126165ba1ea26..5d47acbf4a249 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -726,8 +726,7 @@
+ compatible = "rockchip,rk3328-dw-hdmi";
+ reg = <0x0 0xff3c0000 0x0 0x20000>;
+ reg-io-width = <4>;
+- interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru PCLK_HDMI>,
+ <&cru SCLK_HDMI_SFC>,
+ <&cru SCLK_RTC32K>;
+--
+2.43.0
+
--- /dev/null
+From 3c5574eb08498c845efea34cdae8d7ba24c16599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:34 +0200
+Subject: arm64: dts: rockchip: remove num-slots property from
+ rk3328-nanopi-r2s-plus
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit b1f8d3b81d9289e171141a7120093ddefe7bd2f4 ]
+
+num-slots was not part of the dw-mmc binding and the last slipage of
+one of them seeping in from the vendor kernel was removed way back in
+2017. Somehow the nanopi-r2s-plus managed to smuggle another on in the
+kernel, so remove that as well.
+
+Fixes: b8c028782922 ("arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus")
+Cc: Sergey Bostandzhyan <jin@mediatomb.cc>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-9-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+index 3093f607f282e..4b9ced67742d2 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+@@ -24,7 +24,6 @@
+ disable-wp;
+ mmc-hs200-1_8v;
+ non-removable;
+- num-slots = <1>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>;
+ status = "okay";
+--
+2.43.0
+
--- /dev/null
+From 8ae03a46dd96a192686b9bbe648c197fb392248f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:36 +0200
+Subject: arm64: dts: rockchip: remove orphaned pinctrl-names from pinephone
+ pro
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 3577d5e2bc1ff78808cbe2f233ae1837ee2ce84c ]
+
+The patch adding display support for the pinephone pro introduced two
+regulators that contain pinctrl-names props but no pinctrl-assignments.
+
+Looks like someone forgot the pinctrl settings, so remove the orphans
+for now, until that changes.
+
+Fixes: 3e987e1f22b9 ("arm64: dts: rockchip: Add internal display support to rk3399-pinephone-pro")
+Cc: Martijn Braam <martijn@brixit.nl>
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Ondrej Jirman <megi@xff.cz>
+Reviewed-by: Ondrej Jirman <megi@xff.cz>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-11-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+index 61f3fec5a8b1d..f4829b28c71e4 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+@@ -138,7 +138,6 @@
+ regulator-max-microvolt = <1800000>;
+ vin-supply = <&vcc3v3_sys>;
+ gpio = <&gpio3 RK_PA5 GPIO_ACTIVE_HIGH>;
+- pinctrl-names = "default";
+ };
+
+ /* MIPI DSI panel 2.8v supply */
+@@ -150,7 +149,6 @@
+ regulator-max-microvolt = <2800000>;
+ vin-supply = <&vcc3v3_sys>;
+ gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_HIGH>;
+- pinctrl-names = "default";
+ };
+ };
+
+--
+2.43.0
+
--- /dev/null
+From a339dc5083aa84ffb2f37b8a98513f2f5e5c5e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 22:39:31 +0200
+Subject: arm64: dts: rockchip: Remove undocumented supports-emmc property
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 1b670212ee3dd9d14c6d39a042dfe4ae79b49b4e ]
+
+supports-emmc is an undocumented property that slipped into the mainline
+kernel devicetree for some boards. Drop it.
+
+Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard")
+Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Fixes: b8c028782922 ("arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus")
+Cc: Sergey Bostandzhyan <jin@mediatomb.cc>
+Fixes: 8d94da58de53 ("arm64: dts: rockchip: Add EmbedFire LubanCat 1")
+Cc: Wenhao Cui <lasstp5011@gmail.com>
+Fixes: cdf46cdbabfc ("arm64: dts: rockchip: Add dts for EmbedFire rk3568 LubanCat 2")
+Cc: Andy Yan <andyshrk@163.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20241008203940.2573684-6-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 1 -
+ arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts | 1 -
+ arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 -
+ arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts | 1 -
+ 4 files changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+index 12397755830bd..5fcc5f32be2d7 100644
+--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+@@ -66,7 +66,6 @@
+ bus-width = <8>;
+ cap-mmc-highspeed;
+ mmc-hs200-1_8v;
+- supports-emmc;
+ mmc-pwrseq = <&emmc_pwrseq>;
+ non-removable;
+ vmmc-supply = <&vcc_3v3>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+index cb81ba3f23ffd..3093f607f282e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dts
+@@ -27,6 +27,5 @@
+ num-slots = <1>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_clk &emmc_cmd &emmc_bus8>;
+- supports-emmc;
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+index 6ecdf5d283390..c1e611c040a2c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+@@ -508,7 +508,6 @@
+ non-removable;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
+- supports-emmc;
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts
+index a8a4cc190eb32..abc33be2e74dc 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-lubancat-2.dts
+@@ -590,7 +590,6 @@
+ non-removable;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
+- supports-emmc;
+ status = "okay";
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 0c0190651a9e2514cdb6e319e47b0f2ced04d4a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 15:53:13 +0200
+Subject: can: c_can: fix {rx,tx}_errors statistics
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 4d6d26537940f3b3e17138987ed9e4a334780bf7 ]
+
+The c_can_handle_bus_err() function was incorrectly incrementing only the
+receive error counter, even in cases of bit or acknowledgment errors that
+occur during transmission. The patch fixes the issue by incrementing the
+appropriate counter based on the type of error.
+
+Fixes: 881ff67ad450 ("can: c_can: Added support for Bosch C_CAN controller")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Link: https://patch.msgid.link/20241014135319.2009782-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can_main.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/c_can/c_can_main.c b/drivers/net/can/c_can/c_can_main.c
+index c63f7fc1e6917..511615dc33419 100644
+--- a/drivers/net/can/c_can/c_can_main.c
++++ b/drivers/net/can/c_can/c_can_main.c
+@@ -1011,7 +1011,6 @@ static int c_can_handle_bus_err(struct net_device *dev,
+
+ /* common for all type of bus errors */
+ priv->can.can_stats.bus_error++;
+- stats->rx_errors++;
+
+ /* propagate the error condition to the CAN stack */
+ skb = alloc_can_err_skb(dev, &cf);
+@@ -1027,26 +1026,32 @@ static int c_can_handle_bus_err(struct net_device *dev,
+ case LEC_STUFF_ERROR:
+ netdev_dbg(dev, "stuff error\n");
+ cf->data[2] |= CAN_ERR_PROT_STUFF;
++ stats->rx_errors++;
+ break;
+ case LEC_FORM_ERROR:
+ netdev_dbg(dev, "form error\n");
+ cf->data[2] |= CAN_ERR_PROT_FORM;
++ stats->rx_errors++;
+ break;
+ case LEC_ACK_ERROR:
+ netdev_dbg(dev, "ack error\n");
+ cf->data[3] = CAN_ERR_PROT_LOC_ACK;
++ stats->tx_errors++;
+ break;
+ case LEC_BIT1_ERROR:
+ netdev_dbg(dev, "bit1 error\n");
+ cf->data[2] |= CAN_ERR_PROT_BIT1;
++ stats->tx_errors++;
+ break;
+ case LEC_BIT0_ERROR:
+ netdev_dbg(dev, "bit0 error\n");
+ cf->data[2] |= CAN_ERR_PROT_BIT0;
++ stats->tx_errors++;
+ break;
+ case LEC_CRC_ERROR:
+ netdev_dbg(dev, "CRC error\n");
+ cf->data[3] = CAN_ERR_PROT_LOC_CRC_SEQ;
++ stats->rx_errors++;
+ break;
+ default:
+ break;
+--
+2.43.0
+
--- /dev/null
+From 8f7a133fd316704b300b92e639034d5ac086c396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:17:56 +0800
+Subject: drivers: net: ionic: add missed debugfs cleanup to ionic_probe()
+ error path
+
+From: Wentao Liang <Wentao_liang_g@163.com>
+
+[ Upstream commit 71712cf519faeed529549a79559c06c7fc250a15 ]
+
+The ionic_setup_one() creates a debugfs entry for ionic upon
+successful execution. However, the ionic_probe() does not
+release the dentry before returning, resulting in a memory
+leak.
+
+To fix this bug, we add the ionic_debugfs_del_dev() to release
+the resources in a timely manner before returning.
+
+Fixes: 0de38d9f1dba ("ionic: extract common bits from ionic_probe")
+Signed-off-by: Wentao Liang <Wentao_liang_g@163.com>
+Acked-by: Shannon Nelson <shannon.nelson@amd.com>
+Link: https://patch.msgid.link/20241107021756.1677-1-liangwentao@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+index 35099ad5eccc8..f49b697ab00f8 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+@@ -385,6 +385,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ err_out_pci:
+ ionic_dev_teardown(ionic);
+ ionic_clear_pci(ionic);
++ ionic_debugfs_del_dev(ionic);
+ err_out:
+ mutex_destroy(&ionic->dev_cmd_lock);
+ ionic_devlink_free(ionic);
+--
+2.43.0
+
--- /dev/null
+From 07a5116180390c17785b522e22b31d45fc578b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 14:42:14 +0530
+Subject: dt-bindings: net: xlnx,axi-ethernet: Correct phy-mode property value
+
+From: Suraj Gupta <suraj.gupta2@amd.com>
+
+[ Upstream commit b2183187c5fd30659b9caccb92f7e5e680301769 ]
+
+Correct phy-mode property value to 1000base-x.
+
+Fixes: cbb1ca6d5f9a ("dt-bindings: net: xlnx,axi-ethernet: convert bindings document to yaml")
+Signed-off-by: Suraj Gupta <suraj.gupta2@amd.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Link: https://patch.msgid.link/20241028091214.2078726-1-suraj.gupta2@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml
+index 652d696bc9e90..f0d98c4705856 100644
+--- a/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml
++++ b/Documentation/devicetree/bindings/net/xlnx,axi-ethernet.yaml
+@@ -61,7 +61,7 @@ properties:
+ - gmii
+ - rgmii
+ - sgmii
+- - 1000BaseX
++ - 1000base-x
+
+ xlnx,phy-type:
+ description:
+--
+2.43.0
+
--- /dev/null
+From a69d2a0eede83f175bbdf3ec0c0a111db18f411d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 20:08:48 +0300
+Subject: e1000e: Remove Meteor Lake SMBUS workarounds
+
+From: Vitaly Lifshits <vitaly.lifshits@intel.com>
+
+[ Upstream commit b8473723272e346e22aa487b9046fd324b73a0a5 ]
+
+This is a partial revert to commit 76a0a3f9cc2f ("e1000e: fix force smbus
+during suspend flow"). That commit fixed a sporadic PHY access issue but
+introduced a regression in runtime suspend flows.
+The original issue on Meteor Lake systems was rare in terms of the
+reproduction rate and the number of the systems affected.
+
+After the integration of commit 0a6ad4d9e169 ("e1000e: avoid failing the
+system during pm_suspend"), PHY access loss can no longer cause a
+system-level suspend failure. As it only occurs when the LAN cable is
+disconnected, and is recovered during system resume flow. Therefore, its
+functional impact is low, and the priority is given to stabilizing
+runtime suspend.
+
+Fixes: 76a0a3f9cc2f ("e1000e: fix force smbus during suspend flow")
+Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index ce227b56cf724..2f9655cf5dd9e 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1205,12 +1205,10 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx)
+ if (ret_val)
+ goto out;
+
+- if (hw->mac.type != e1000_pch_mtp) {
+- ret_val = e1000e_force_smbus(hw);
+- if (ret_val) {
+- e_dbg("Failed to force SMBUS: %d\n", ret_val);
+- goto release;
+- }
++ ret_val = e1000e_force_smbus(hw);
++ if (ret_val) {
++ e_dbg("Failed to force SMBUS: %d\n", ret_val);
++ goto release;
+ }
+
+ /* Si workaround for ULP entry flow on i127/rev6 h/w. Enable
+@@ -1273,13 +1271,6 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx)
+ }
+
+ release:
+- if (hw->mac.type == e1000_pch_mtp) {
+- ret_val = e1000e_force_smbus(hw);
+- if (ret_val)
+- e_dbg("Failed to force SMBUS over MTL system: %d\n",
+- ret_val);
+- }
+-
+ hw->phy.ops.release(hw);
+ out:
+ if (ret_val)
+--
+2.43.0
+
--- /dev/null
+From 4c3d293548af33b4878fdbeca17403f320157fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 14:13:38 +0800
+Subject: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
+
+From: Xinqi Zhang <quic_xinqzhan@quicinc.com>
+
+[ Upstream commit 295416091e44806760ccf753aeafdafc0ae268f3 ]
+
+The scmi_dev->name is released prematurely in __scmi_device_destroy(),
+which causes slab-use-after-free when accessing scmi_dev->name in
+scmi_bus_notifier(). So move the release of scmi_dev->name to
+scmi_device_release() to avoid slab-use-after-free.
+
+ | BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
+ | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
+ |
+ | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
+ | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
+ | Call trace:
+ | dump_backtrace+0x94/0x114
+ | show_stack+0x18/0x24
+ | dump_stack_lvl+0x48/0x60
+ | print_report+0xf4/0x5b0
+ | kasan_report+0xa4/0xec
+ | __asan_report_load1_noabort+0x20/0x2c
+ | strncmp+0xe4/0xec
+ | scmi_bus_notifier+0x5c/0x54c
+ | notifier_call_chain+0xb4/0x31c
+ | blocking_notifier_call_chain+0x68/0x9c
+ | bus_notify+0x54/0x78
+ | device_del+0x1bc/0x840
+ | device_unregister+0x20/0xb4
+ | __scmi_device_destroy+0xac/0x280
+ | scmi_device_destroy+0x94/0xd0
+ | scmi_chan_setup+0x524/0x750
+ | scmi_probe+0x7fc/0x1508
+ | platform_probe+0xc4/0x19c
+ | really_probe+0x32c/0x99c
+ | __driver_probe_device+0x15c/0x3c4
+ | driver_probe_device+0x5c/0x170
+ | __driver_attach+0x1c8/0x440
+ | bus_for_each_dev+0xf4/0x178
+ | driver_attach+0x3c/0x58
+ | bus_add_driver+0x234/0x4d4
+ | driver_register+0xf4/0x3c0
+ | __platform_driver_register+0x60/0x88
+ | scmi_driver_init+0xb0/0x104
+ | do_one_initcall+0xb4/0x664
+ | kernel_init_freeable+0x3c8/0x894
+ | kernel_init+0x24/0x1e8
+ | ret_from_fork+0x10/0x20
+ |
+ | Allocated by task 1:
+ | kasan_save_stack+0x2c/0x54
+ | kasan_set_track+0x2c/0x40
+ | kasan_save_alloc_info+0x24/0x34
+ | __kasan_kmalloc+0xa0/0xb8
+ | __kmalloc_node_track_caller+0x6c/0x104
+ | kstrdup+0x48/0x84
+ | kstrdup_const+0x34/0x40
+ | __scmi_device_create.part.0+0x8c/0x408
+ | scmi_device_create+0x104/0x370
+ | scmi_chan_setup+0x2a0/0x750
+ | scmi_probe+0x7fc/0x1508
+ | platform_probe+0xc4/0x19c
+ | really_probe+0x32c/0x99c
+ | __driver_probe_device+0x15c/0x3c4
+ | driver_probe_device+0x5c/0x170
+ | __driver_attach+0x1c8/0x440
+ | bus_for_each_dev+0xf4/0x178
+ | driver_attach+0x3c/0x58
+ | bus_add_driver+0x234/0x4d4
+ | driver_register+0xf4/0x3c0
+ | __platform_driver_register+0x60/0x88
+ | scmi_driver_init+0xb0/0x104
+ | do_one_initcall+0xb4/0x664
+ | kernel_init_freeable+0x3c8/0x894
+ | kernel_init+0x24/0x1e8
+ | ret_from_fork+0x10/0x20
+ |
+ | Freed by task 1:
+ | kasan_save_stack+0x2c/0x54
+ | kasan_set_track+0x2c/0x40
+ | kasan_save_free_info+0x38/0x5c
+ | __kasan_slab_free+0xe8/0x164
+ | __kmem_cache_free+0x11c/0x230
+ | kfree+0x70/0x130
+ | kfree_const+0x20/0x40
+ | __scmi_device_destroy+0x70/0x280
+ | scmi_device_destroy+0x94/0xd0
+ | scmi_chan_setup+0x524/0x750
+ | scmi_probe+0x7fc/0x1508
+ | platform_probe+0xc4/0x19c
+ | really_probe+0x32c/0x99c
+ | __driver_probe_device+0x15c/0x3c4
+ | driver_probe_device+0x5c/0x170
+ | __driver_attach+0x1c8/0x440
+ | bus_for_each_dev+0xf4/0x178
+ | driver_attach+0x3c/0x58
+ | bus_add_driver+0x234/0x4d4
+ | driver_register+0xf4/0x3c0
+ | __platform_driver_register+0x60/0x88
+ | scmi_driver_init+0xb0/0x104
+ | do_one_initcall+0xb4/0x664
+ | kernel_init_freeable+0x3c8/0x894
+ | kernel_init+0x24/0x1e8
+ | ret_from_fork+0x10/0x20
+
+Fixes: ee7a9c9f67c5 ("firmware: arm_scmi: Add support for multiple device per protocol")
+Signed-off-by: Xinqi Zhang <quic_xinqzhan@quicinc.com>
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Message-Id: <20241016-fix-arm-scmi-slab-use-after-free-v2-1-1783685ef90d@quicinc.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/bus.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
+index c15928b8c5cc9..dcf774d3edfe4 100644
+--- a/drivers/firmware/arm_scmi/bus.c
++++ b/drivers/firmware/arm_scmi/bus.c
+@@ -305,7 +305,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
+
+ static void scmi_device_release(struct device *dev)
+ {
+- kfree(to_scmi_dev(dev));
++ struct scmi_device *scmi_dev = to_scmi_dev(dev);
++
++ kfree_const(scmi_dev->name);
++ kfree(scmi_dev);
+ }
+
+ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
+@@ -318,7 +321,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
+ if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
+ atomic_set(&scmi_syspower_registered, 0);
+
+- kfree_const(scmi_dev->name);
+ ida_free(&scmi_bus_id, scmi_dev->id);
+ device_unregister(&scmi_dev->dev);
+ }
+@@ -390,7 +392,6 @@ __scmi_device_create(struct device_node *np, struct device *parent,
+
+ return scmi_dev;
+ put_dev:
+- kfree_const(scmi_dev->name);
+ put_device(&scmi_dev->dev);
+ ida_free(&scmi_bus_id, id);
+ return NULL;
+--
+2.43.0
+
--- /dev/null
+From c773b4210f9cab9435babd8e1daa04b608d4418a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 15:44:35 +0100
+Subject: HID: core: zero-initialize the report buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit 177f25d1292c7e16e1199b39c85480f7f8815552 ]
+
+Since the report buffer is used by all kinds of drivers in various ways, let's
+zero-initialize it during allocation to make sure that it can't be ever used
+to leak kernel memory via specially-crafted report.
+
+Fixes: 27ce405039bf ("HID: fix data access in implement()")
+Reported-by: Benoît Sevens <bsevens@google.com>
+Acked-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 85ddeb13a3fae..1467c5a732db4 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1875,7 +1875,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
+
+ u32 len = hid_report_len(report) + 7;
+
+- return kmalloc(len, flags);
++ return kzalloc(len, flags);
+ }
+ EXPORT_SYMBOL_GPL(hid_alloc_report_buf);
+
+--
+2.43.0
+
--- /dev/null
+From 1386815b5fdfb1bbb9f6aef5bf8e53903c953413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:30:11 +0200
+Subject: i40e: fix race condition by adding filter's intermediate sync state
+
+From: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+
+[ Upstream commit f30490e9695ef7da3d0899c6a0293cc7cd373567 ]
+
+Fix a race condition in the i40e driver that leads to MAC/VLAN filters
+becoming corrupted and leaking. Address the issue that occurs under
+heavy load when multiple threads are concurrently modifying MAC/VLAN
+filters by setting mac and port VLAN.
+
+1. Thread T0 allocates a filter in i40e_add_filter() within
+ i40e_ndo_set_vf_port_vlan().
+2. Thread T1 concurrently frees the filter in __i40e_del_filter() within
+ i40e_ndo_set_vf_mac().
+3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which
+ refers to the already freed filter memory, causing corruption.
+
+Reproduction steps:
+1. Spawn multiple VFs.
+2. Apply a concurrent heavy load by running parallel operations to change
+ MAC addresses on the VFs and change port VLANs on the host.
+3. Observe errors in dmesg:
+"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX,
+ please set promiscuous on manually for VF XX".
+
+Exact code for stable reproduction Intel can't open-source now.
+
+The fix involves implementing a new intermediate filter state,
+I40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list.
+These filters cannot be deleted from the hash list directly but
+must be removed using the full process.
+
+Fixes: 278e7d0b9d68 ("i40e: store MAC/VLAN filters in a hash with the MAC Address as key")
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Tested-by: Michal Schmidt <mschmidt@redhat.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 12 ++++++++++--
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 3e6839ac1f0f1..68f403dd2f526 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -763,6 +763,7 @@ enum i40e_filter_state {
+ I40E_FILTER_ACTIVE, /* Added to switch by FW */
+ I40E_FILTER_FAILED, /* Rejected by FW */
+ I40E_FILTER_REMOVE, /* To be removed */
++ I40E_FILTER_NEW_SYNC, /* New, not sent yet, is in i40e_sync_vsi_filters() */
+ /* There is no 'removed' state; the filter struct is freed */
+ };
+ struct i40e_mac_filter {
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+index 999c9708def53..a2fca58a91c33 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+@@ -106,6 +106,7 @@ static char *i40e_filter_state_string[] = {
+ "ACTIVE",
+ "FAILED",
+ "REMOVE",
++ "NEW_SYNC",
+ };
+
+ /**
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 80472aa1deba4..806cec458a072 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1265,6 +1265,7 @@ int i40e_count_filters(struct i40e_vsi *vsi)
+
+ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) {
+ if (f->state == I40E_FILTER_NEW ||
++ f->state == I40E_FILTER_NEW_SYNC ||
+ f->state == I40E_FILTER_ACTIVE)
+ ++cnt;
+ }
+@@ -1451,6 +1452,8 @@ static int i40e_correct_mac_vlan_filters(struct i40e_vsi *vsi,
+
+ new->f = add_head;
+ new->state = add_head->state;
++ if (add_head->state == I40E_FILTER_NEW)
++ add_head->state = I40E_FILTER_NEW_SYNC;
+
+ /* Add the new filter to the tmp list */
+ hlist_add_head(&new->hlist, tmp_add_list);
+@@ -1560,6 +1563,8 @@ static int i40e_correct_vf_mac_vlan_filters(struct i40e_vsi *vsi,
+ return -ENOMEM;
+ new_mac->f = add_head;
+ new_mac->state = add_head->state;
++ if (add_head->state == I40E_FILTER_NEW)
++ add_head->state = I40E_FILTER_NEW_SYNC;
+
+ /* Add the new filter to the tmp list */
+ hlist_add_head(&new_mac->hlist, tmp_add_list);
+@@ -2445,7 +2450,8 @@ static int
+ i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name,
+ struct i40e_mac_filter *f)
+ {
+- bool enable = f->state == I40E_FILTER_NEW;
++ bool enable = f->state == I40E_FILTER_NEW ||
++ f->state == I40E_FILTER_NEW_SYNC;
+ struct i40e_hw *hw = &vsi->back->hw;
+ int aq_ret;
+
+@@ -2619,6 +2625,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+
+ /* Add it to the hash list */
+ hlist_add_head(&new->hlist, &tmp_add_list);
++ f->state = I40E_FILTER_NEW_SYNC;
+ }
+
+ /* Count the number of active (current and new) VLAN
+@@ -2770,7 +2777,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+ hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) {
+ /* Only update the state if we're still NEW */
+- if (new->f->state == I40E_FILTER_NEW)
++ if (new->f->state == I40E_FILTER_NEW ||
++ new->f->state == I40E_FILTER_NEW_SYNC)
+ new->f->state = new->state;
+ hlist_del(&new->hlist);
+ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
+--
+2.43.0
+
--- /dev/null
+From 665bb20ac96b53616f26a378c922a44406dae5b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 12:59:22 -0400
+Subject: ice: change q_index variable type to s16 to store -1 value
+
+From: Mateusz Polchlopek <mateusz.polchlopek@intel.com>
+
+[ Upstream commit 64502dac974a5d9951d16015fa2e16a14e5f2bb2 ]
+
+Fix Flow Director not allowing to re-map traffic to 0th queue when action
+is configured to drop (and vice versa).
+
+The current implementation of ethtool callback in the ice driver forbids
+change Flow Director action from 0 to -1 and from -1 to 0 with an error,
+e.g:
+
+ # ethtool -U eth2 flow-type tcp4 src-ip 1.1.1.1 loc 1 action 0
+ # ethtool -U eth2 flow-type tcp4 src-ip 1.1.1.1 loc 1 action -1
+ rmgr: Cannot insert RX class rule: Invalid argument
+
+We set the value of `u16 q_index = 0` at the beginning of the function
+ice_set_fdir_input_set(). In case of "drop traffic" action (which is
+equal to -1 in ethtool) we store the 0 value. Later, when want to change
+traffic rule to redirect to queue with index 0 it returns an error
+caused by duplicate found.
+
+Fix this behaviour by change of the type of field `q_index` from u16 to s16
+in `struct ice_fdir_fltr`. This allows to store -1 in the field in case
+of "drop traffic" action. What is more, change the variable type in the
+function ice_set_fdir_input_set() and assign at the beginning the new
+`#define ICE_FDIR_NO_QUEUE_IDX` which is -1. Later, if the action is set
+to another value (point specific queue index) the variable value is
+overwritten in the function.
+
+Fixes: cac2a27cd9ab ("ice: Support IPv4 Flow Director filters")
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 3 ++-
+ drivers/net/ethernet/intel/ice/ice_fdir.h | 4 +++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+index 1839a37139dc1..b6bbf2376ef5c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+@@ -1694,11 +1694,12 @@ static int
+ ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp,
+ struct ice_fdir_fltr *input)
+ {
+- u16 dest_vsi, q_index = 0;
++ s16 q_index = ICE_FDIR_NO_QUEUE_IDX;
+ u16 orig_q_index = 0;
+ struct ice_pf *pf;
+ struct ice_hw *hw;
+ int flow_type;
++ u16 dest_vsi;
+ u8 dest_ctl;
+
+ if (!vsi || !fsp || !input)
+diff --git a/drivers/net/ethernet/intel/ice/ice_fdir.h b/drivers/net/ethernet/intel/ice/ice_fdir.h
+index b384d2a4ab198..063ea3d516532 100644
+--- a/drivers/net/ethernet/intel/ice/ice_fdir.h
++++ b/drivers/net/ethernet/intel/ice/ice_fdir.h
+@@ -50,6 +50,8 @@
+ */
+ #define ICE_FDIR_IPV4_PKT_FLAG_MF 0x20
+
++#define ICE_FDIR_NO_QUEUE_IDX -1
++
+ enum ice_fltr_prgm_desc_dest {
+ ICE_FLTR_PRGM_DESC_DEST_DROP_PKT,
+ ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX,
+@@ -181,7 +183,7 @@ struct ice_fdir_fltr {
+ u16 flex_fltr;
+
+ /* filter control */
+- u16 q_index;
++ s16 q_index;
+ u16 orig_q_index;
+ u16 dest_vsi;
+ u8 dest_ctl;
+--
+2.43.0
+
--- /dev/null
+From ddc4c6e709c6a68ab0ae2574df7bec5714e97554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 21:01:38 +0800
+Subject: net: arc: fix the device for dma_map_single/dma_unmap_single
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 71803c1dfa29e0d13b99e48fda11107cc8caebc7 ]
+
+The ndev->dev and pdev->dev aren't the same device, use ndev->dev.parent
+which has dma_mask, ndev->dev.parent is just pdev->dev.
+Or it would cause the following issue:
+
+[ 39.933526] ------------[ cut here ]------------
+[ 39.938414] WARNING: CPU: 1 PID: 501 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x90/0x1f8
+
+Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
+Signed-off-by: David Wu <david.wu@rock-chips.com>
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/arc/emac_main.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
+index 31ee477dd131e..8283aeee35fb6 100644
+--- a/drivers/net/ethernet/arc/emac_main.c
++++ b/drivers/net/ethernet/arc/emac_main.c
+@@ -111,6 +111,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < TX_BD_NUM; i++) {
+@@ -140,7 +141,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ stats->tx_bytes += skb->len;
+ }
+
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(tx_buff, addr),
++ dma_unmap_single(dev, dma_unmap_addr(tx_buff, addr),
+ dma_unmap_len(tx_buff, len), DMA_TO_DEVICE);
+
+ /* return the sk_buff to system */
+@@ -174,6 +175,7 @@ static void arc_emac_tx_clean(struct net_device *ndev)
+ static int arc_emac_rx(struct net_device *ndev, int budget)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int work_done;
+
+ for (work_done = 0; work_done < budget; work_done++) {
+@@ -223,9 +225,9 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
+ continue;
+ }
+
+- addr = dma_map_single(&ndev->dev, (void *)skb->data,
++ addr = dma_map_single(dev, (void *)skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, addr)) {
++ if (dma_mapping_error(dev, addr)) {
+ if (net_ratelimit())
+ netdev_err(ndev, "cannot map dma buffer\n");
+ dev_kfree_skb(skb);
+@@ -237,7 +239,7 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
+ }
+
+ /* unmap previosly mapped skb */
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
++ dma_unmap_single(dev, dma_unmap_addr(rx_buff, addr),
+ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+ pktlen = info & LEN_MASK;
+@@ -423,6 +425,7 @@ static int arc_emac_open(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
+ struct phy_device *phy_dev = ndev->phydev;
++ struct device *dev = ndev->dev.parent;
+ int i;
+
+ phy_dev->autoneg = AUTONEG_ENABLE;
+@@ -445,9 +448,9 @@ static int arc_emac_open(struct net_device *ndev)
+ if (unlikely(!rx_buff->skb))
+ return -ENOMEM;
+
+- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
++ addr = dma_map_single(dev, (void *)rx_buff->skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, addr)) {
++ if (dma_mapping_error(dev, addr)) {
+ netdev_err(ndev, "cannot dma map\n");
+ dev_kfree_skb(rx_buff->skb);
+ return -ENOMEM;
+@@ -548,6 +551,7 @@ static void arc_emac_set_rx_mode(struct net_device *ndev)
+ static void arc_free_tx_queue(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < TX_BD_NUM; i++) {
+@@ -555,7 +559,7 @@ static void arc_free_tx_queue(struct net_device *ndev)
+ struct buffer_state *tx_buff = &priv->tx_buff[i];
+
+ if (tx_buff->skb) {
+- dma_unmap_single(&ndev->dev,
++ dma_unmap_single(dev,
+ dma_unmap_addr(tx_buff, addr),
+ dma_unmap_len(tx_buff, len),
+ DMA_TO_DEVICE);
+@@ -579,6 +583,7 @@ static void arc_free_tx_queue(struct net_device *ndev)
+ static void arc_free_rx_queue(struct net_device *ndev)
+ {
+ struct arc_emac_priv *priv = netdev_priv(ndev);
++ struct device *dev = ndev->dev.parent;
+ unsigned int i;
+
+ for (i = 0; i < RX_BD_NUM; i++) {
+@@ -586,7 +591,7 @@ static void arc_free_rx_queue(struct net_device *ndev)
+ struct buffer_state *rx_buff = &priv->rx_buff[i];
+
+ if (rx_buff->skb) {
+- dma_unmap_single(&ndev->dev,
++ dma_unmap_single(dev,
+ dma_unmap_addr(rx_buff, addr),
+ dma_unmap_len(rx_buff, len),
+ DMA_FROM_DEVICE);
+@@ -679,6 +684,7 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
+ unsigned int len, *txbd_curr = &priv->txbd_curr;
+ struct net_device_stats *stats = &ndev->stats;
+ __le32 *info = &priv->txbd[*txbd_curr].info;
++ struct device *dev = ndev->dev.parent;
+ dma_addr_t addr;
+
+ if (skb_padto(skb, ETH_ZLEN))
+@@ -692,10 +698,9 @@ static netdev_tx_t arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
+ return NETDEV_TX_BUSY;
+ }
+
+- addr = dma_map_single(&ndev->dev, (void *)skb->data, len,
+- DMA_TO_DEVICE);
++ addr = dma_map_single(dev, (void *)skb->data, len, DMA_TO_DEVICE);
+
+- if (unlikely(dma_mapping_error(&ndev->dev, addr))) {
++ if (unlikely(dma_mapping_error(dev, addr))) {
+ stats->tx_dropped++;
+ stats->tx_errors++;
+ dev_kfree_skb_any(skb);
+--
+2.43.0
+
--- /dev/null
+From 231738fe6cd68c6fe5ac98eb9347099a450d30a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 21:01:39 +0800
+Subject: net: arc: rockchip: fix emac mdio node support
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 0a1c7a7b0adbf595ce7f218609db53749e966573 ]
+
+The binding emac_rockchip.txt is converted to YAML.
+Changed against the original binding is an added MDIO subnode.
+This make the driver failed to find the PHY, and given the 'mdio
+has invalid PHY address' it is probably looking in the wrong node.
+Fix emac_mdio.c so that it can handle both old and new
+device trees.
+
+Fixes: 1dabb74971b3 ("ARM: dts: rockchip: restyle emac nodes")
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Tested-by: Andy Yan <andyshrk@163.com>
+Link: https://lore.kernel.org/r/20220603163539.537-3-jbx6244@gmail.com
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/arc/emac_mdio.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c
+index 87f40c2ba9040..078b1a72c1613 100644
+--- a/drivers/net/ethernet/arc/emac_mdio.c
++++ b/drivers/net/ethernet/arc/emac_mdio.c
+@@ -133,6 +133,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
+ struct arc_emac_mdio_bus_data *data = &priv->bus_data;
+ struct device_node *np = priv->dev->of_node;
+ const char *name = "Synopsys MII Bus";
++ struct device_node *mdio_node;
+ struct mii_bus *bus;
+ int error;
+
+@@ -164,7 +165,13 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
+
+ snprintf(bus->id, MII_BUS_ID_SIZE, "%s", bus->name);
+
+- error = of_mdiobus_register(bus, priv->dev->of_node);
++ /* Backwards compatibility for EMAC nodes without MDIO subnode. */
++ mdio_node = of_get_child_by_name(np, "mdio");
++ if (!mdio_node)
++ mdio_node = of_node_get(np);
++
++ error = of_mdiobus_register(bus, mdio_node);
++ of_node_put(mdio_node);
+ if (error) {
+ mdiobus_free(bus);
+ return dev_err_probe(priv->dev, error,
+--
+2.43.0
+
--- /dev/null
+From a49a93f5d420ae0887c54b70d5767fb59960c32f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 14:02:46 +0800
+Subject: net: enetc: allocate vf_state during PF probes
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit e15c5506dd39885cd047f811a64240e2e8ab401b ]
+
+In the previous implementation, vf_state is allocated memory only when VF
+is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before
+VF is enabled to configure the MAC address of VF. If this is the case,
+enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null
+pointer. The simplified error log is as follows.
+
+root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89
+[ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
+[ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy
+[ 173.641973] lr : do_setlink+0x4a8/0xec8
+[ 173.732292] Call trace:
+[ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80
+[ 173.738847] __rtnl_newlink+0x530/0x89c
+[ 173.742692] rtnl_newlink+0x50/0x7c
+[ 173.746189] rtnetlink_rcv_msg+0x128/0x390
+[ 173.750298] netlink_rcv_skb+0x60/0x130
+[ 173.754145] rtnetlink_rcv+0x18/0x24
+[ 173.757731] netlink_unicast+0x318/0x380
+[ 173.761665] netlink_sendmsg+0x17c/0x3c8
+
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20241031060247.1290941-2-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/enetc/enetc_pf.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index c153dc083aff0..a856047f1dfd6 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -665,19 +665,11 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs)
+
+ if (!num_vfs) {
+ enetc_msg_psi_free(pf);
+- kfree(pf->vf_state);
+ pf->num_vfs = 0;
+ pci_disable_sriov(pdev);
+ } else {
+ pf->num_vfs = num_vfs;
+
+- pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state),
+- GFP_KERNEL);
+- if (!pf->vf_state) {
+- pf->num_vfs = 0;
+- return -ENOMEM;
+- }
+-
+ err = enetc_msg_psi_init(pf);
+ if (err) {
+ dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err);
+@@ -696,7 +688,6 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs)
+ err_en_sriov:
+ enetc_msg_psi_free(pf);
+ err_msg_psi:
+- kfree(pf->vf_state);
+ pf->num_vfs = 0;
+
+ return err;
+@@ -1283,6 +1274,12 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ pf = enetc_si_priv(si);
+ pf->si = si;
+ pf->total_vfs = pci_sriov_get_totalvfs(pdev);
++ if (pf->total_vfs) {
++ pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state),
++ GFP_KERNEL);
++ if (!pf->vf_state)
++ goto err_alloc_vf_state;
++ }
+
+ err = enetc_setup_mac_addresses(node, pf);
+ if (err)
+@@ -1360,6 +1357,8 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ free_netdev(ndev);
+ err_alloc_netdev:
+ err_setup_mac_addresses:
++ kfree(pf->vf_state);
++err_alloc_vf_state:
+ enetc_psi_destroy(pdev);
+ err_psi_create:
+ return err;
+@@ -1386,6 +1385,7 @@ static void enetc_pf_remove(struct pci_dev *pdev)
+ enetc_free_si_resources(priv);
+
+ free_netdev(si->ndev);
++ kfree(pf->vf_state);
+
+ enetc_psi_destroy(pdev);
+ }
+--
+2.43.0
+
--- /dev/null
+From 7820fc3b168441ee78a8608347b0bbb680a011db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 17:04:06 +0800
+Subject: net: enetc: set MAC address to the VF net_device
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit badccd49b93bb945bf4e5cc8707db67cdc5e27e5 ]
+
+The MAC address of VF can be configured through the mailbox mechanism of
+ENETC, but the previous implementation forgot to set the MAC address in
+net_device, resulting in the SMAC of the sent frames still being the old
+MAC address. Since the MAC address in the hardware has been changed, Rx
+cannot receive frames with the DMAC address as the new MAC address. The
+most obvious phenomenon is that after changing the MAC address, we can
+see that the MAC address of eno0vf0 has not changed through the "ifconfig
+eno0vf0" command and the IP address cannot be obtained .
+
+root@ls1028ardb:~# ifconfig eno0vf0 down
+root@ls1028ardb:~# ifconfig eno0vf0 hw ether 00:04:9f:3a:4d:56 up
+root@ls1028ardb:~# ifconfig eno0vf0
+eno0vf0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
+ ether 66:36:2c:3b:87:76 txqueuelen 1000 (Ethernet)
+ RX packets 794 bytes 69239 (69.2 KB)
+ RX errors 0 dropped 0 overruns 0 frame 0
+ TX packets 11 bytes 2226 (2.2 KB)
+ TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
+
+Fixes: beb74ac878c8 ("enetc: Add vf to pf messaging support")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Link: https://patch.msgid.link/20241029090406.841836-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_vf.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+index dfcaac302e245..b15db70769e5e 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c
+@@ -78,11 +78,18 @@ static int enetc_vf_set_mac_addr(struct net_device *ndev, void *addr)
+ {
+ struct enetc_ndev_priv *priv = netdev_priv(ndev);
+ struct sockaddr *saddr = addr;
++ int err;
+
+ if (!is_valid_ether_addr(saddr->sa_data))
+ return -EADDRNOTAVAIL;
+
+- return enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
++ err = enetc_msg_vsi_set_primary_mac_addr(priv, saddr);
++ if (err)
++ return err;
++
++ eth_hw_addr_set(ndev, saddr->sa_data);
++
++ return 0;
+ }
+
+ static int enetc_vf_set_features(struct net_device *ndev,
+--
+2.43.0
+
--- /dev/null
+From d658ae6bd70fdbccbf2a3913a1fe87281f68d827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 17:15:07 +0800
+Subject: net: hns3: fix kernel crash when uninstalling driver
+
+From: Peiyang Wang <wangpeiyang1@huawei.com>
+
+[ Upstream commit df3dff8ab6d79edc942464999d06fbaedf8cdd18 ]
+
+When the driver is uninstalled and the VF is disabled concurrently, a
+kernel crash occurs. The reason is that the two actions call function
+pci_disable_sriov(). The num_VFs is checked to determine whether to
+release the corresponding resources. During the second calling, num_VFs
+is not 0 and the resource release function is called. However, the
+corresponding resource has been released during the first invoking.
+Therefore, the problem occurs:
+
+[15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
+...
+[15278.131557][T50670] Call trace:
+[15278.134686][T50670] klist_put+0x28/0x12c
+[15278.138682][T50670] klist_del+0x14/0x20
+[15278.142592][T50670] device_del+0xbc/0x3c0
+[15278.146676][T50670] pci_remove_bus_device+0x84/0x120
+[15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80
+[15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c
+[15278.162485][T50670] sriov_disable+0x50/0x11c
+[15278.166829][T50670] pci_disable_sriov+0x24/0x30
+[15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3]
+[15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge]
+[15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230
+[15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30
+[15278.193848][T50670] invoke_syscall+0x50/0x11c
+[15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164
+[15278.203837][T50670] do_el0_svc+0x34/0xcc
+[15278.207834][T50670] el0_svc+0x20/0x30
+
+For details, see the following figure.
+
+ rmmod hclge disable VFs
+----------------------------------------------------
+hclge_exit() sriov_numvfs_store()
+ ... device_lock()
+ pci_disable_sriov() hns3_pci_sriov_configure()
+ pci_disable_sriov()
+ sriov_disable()
+ sriov_disable() if !num_VFs :
+ if !num_VFs : return;
+ return; sriov_del_vfs()
+ sriov_del_vfs() ...
+ ... klist_put()
+ klist_put() ...
+ ... num_VFs = 0;
+ num_VFs = 0; device_unlock();
+
+In this patch, when driver is removing, we get the device_lock()
+to protect num_VFs, just like sriov_numvfs_store().
+
+Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
+Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20241101091507.3644584-1-shaojijie@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 67b0bf310daaa..9a63fbc694083 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -25,8 +25,11 @@ void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
+ pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
+ if (!pci_id)
+ continue;
+- if (IS_ENABLED(CONFIG_PCI_IOV))
++ if (IS_ENABLED(CONFIG_PCI_IOV)) {
++ device_lock(&ae_dev->pdev->dev);
+ pci_disable_sriov(ae_dev->pdev);
++ device_unlock(&ae_dev->pdev->dev);
++ }
+ }
+ }
+ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
+--
+2.43.0
+
--- /dev/null
+From 05f2f918dad5cd809d725c269ed16678285ffba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2024 16:15:05 +0100
+Subject: net: phy: ti: add PHY_RST_AFTER_CLK_EN flag
+
+From: Diogo Silva <diogompaissilva@gmail.com>
+
+[ Upstream commit 256748d5480bb3c4b731236c6d6fc86a8e2815d8 ]
+
+DP83848 datasheet (section 4.7.2) indicates that the reset pin should be
+toggled after the clocks are running. Add the PHY_RST_AFTER_CLK_EN to
+make sure that this indication is respected.
+
+In my experience not having this flag enabled would lead to, on some
+boots, the wrong MII mode being selected if the PHY was initialized on
+the bootloader and was receiving data during Linux boot.
+
+Signed-off-by: Diogo Silva <diogompaissilva@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: 34e45ad9378c ("net: phy: dp83848: Add TI DP83848 Ethernet PHY")
+Link: https://patch.msgid.link/20241102151504.811306-1-paissilva@ld-100007.ds1.internal
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83848.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
+index 937061acfc613..351411f0aa6f4 100644
+--- a/drivers/net/phy/dp83848.c
++++ b/drivers/net/phy/dp83848.c
+@@ -147,6 +147,8 @@ MODULE_DEVICE_TABLE(mdio, dp83848_tbl);
+ /* IRQ related */ \
+ .config_intr = dp83848_config_intr, \
+ .handle_interrupt = dp83848_handle_interrupt, \
++ \
++ .flags = PHY_RST_AFTER_CLK_EN, \
+ }
+
+ static struct phy_driver dp83848_driver[] = {
+--
+2.43.0
+
--- /dev/null
+From 21b8f1057393f9dd32a6648e57edf42644cd8278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 17:17:29 -0400
+Subject: net: stmmac: Fix unbalanced IRQ wake disable warning on single irq
+ case
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 25d70702142ac2115e75e01a0a985c6ea1d78033 ]
+
+Commit a23aa0404218 ("net: stmmac: ethtool: Fixed calltrace caused by
+unbalanced disable_irq_wake calls") introduced checks to prevent
+unbalanced enable and disable IRQ wake calls. However it only
+initialized the auxiliary variable on one of the paths,
+stmmac_request_irq_multi_msi(), missing the other,
+stmmac_request_irq_single().
+
+Add the same initialization on stmmac_request_irq_single() to prevent
+"Unbalanced IRQ <x> wake disable" warnings from being printed the first
+time disable_irq_wake() is called on platforms that run on that code
+path.
+
+Fixes: a23aa0404218 ("net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20241101-stmmac-unbalanced-wake-single-fix-v1-1-5952524c97f0@collabora.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index a116423adb30a..853851d5f3620 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3678,6 +3678,7 @@ static int stmmac_request_irq_single(struct net_device *dev)
+ /* Request the Wake IRQ in case of another line
+ * is used for WoL
+ */
++ priv->wol_irq_disabled = true;
+ if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) {
+ ret = request_irq(priv->wol_irq, stmmac_interrupt,
+ IRQF_SHARED, dev->name, dev);
+--
+2.43.0
+
--- /dev/null
+From 4bdc5257df6bf5319491b34b48020647e408052a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Dec 2023 17:42:42 +0800
+Subject: netfilter: nf_tables: cleanup documentation
+
+From: George Guo <guodongtai@kylinos.cn>
+
+[ Upstream commit b253d87fd78bf8d3e7efc5d149147765f044e89d ]
+
+- Correct comments for nlpid, family, udlen and udata in struct nft_table,
+ and afinfo is no longer a member of enum nft_set_class.
+
+- Add comment for data in struct nft_set_elem.
+
+- Add comment for flags in struct nft_ctx.
+
+- Add comments for timeout in struct nft_set_iter, and flags is not a
+ member of struct nft_set_iter, remove the comment for it.
+
+- Add comments for commit, abort, estimate and gc_init in struct
+ nft_set_ops.
+
+- Add comments for pending_update, num_exprs, exprs and catchall_list
+ in struct nft_set.
+
+- Add comment for ext_len in struct nft_set_ext_tmpl.
+
+- Add comment for inner_ops in struct nft_expr_type.
+
+- Add comments for clone, destroy_clone, reduce, gc, offload,
+ offload_action, offload_stats in struct nft_expr_ops.
+
+- Add comments for blob_gen_0, blob_gen_1, bound, genmask, udlen, udata,
+ blob_next in struct nft_chain.
+
+- Add comment for flags in struct nft_base_chain.
+
+- Add comments for udlen, udata in struct nft_object.
+
+- Add comment for type in struct nft_object_ops.
+
+- Add comment for hook_list in struct nft_flowtable, and remove comments
+ for dev_name and ops which are not members of struct nft_flowtable.
+
+Signed-off-by: George Guo <guodongtai@kylinos.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: c03d278fdf35 ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 49 ++++++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 1b95c34a4e3d1..af62804b27ec7 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -205,6 +205,7 @@ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
+ * @nla: netlink attributes
+ * @portid: netlink portID of the original message
+ * @seq: netlink sequence number
++ * @flags: modifiers to new request
+ * @family: protocol family
+ * @level: depth of the chains
+ * @report: notify via unicast netlink message
+@@ -279,6 +280,7 @@ struct nft_userdata {
+ *
+ * @key: element key
+ * @key_end: closing element key
++ * @data: element data
+ * @priv: element private data and extensions
+ */
+ struct nft_set_elem {
+@@ -330,10 +332,10 @@ struct nft_set_iter {
+ * @dtype: data type
+ * @dlen: data length
+ * @objtype: object type
+- * @flags: flags
+ * @size: number of set elements
+ * @policy: set policy
+ * @gc_int: garbage collector interval
++ * @timeout: element timeout
+ * @field_len: length of each field in concatenation, bytes
+ * @field_count: number of concatenated fields in element
+ * @expr: set must support for expressions
+@@ -356,9 +358,9 @@ struct nft_set_desc {
+ /**
+ * enum nft_set_class - performance class
+ *
+- * @NFT_LOOKUP_O_1: constant, O(1)
+- * @NFT_LOOKUP_O_LOG_N: logarithmic, O(log N)
+- * @NFT_LOOKUP_O_N: linear, O(N)
++ * @NFT_SET_CLASS_O_1: constant, O(1)
++ * @NFT_SET_CLASS_O_LOG_N: logarithmic, O(log N)
++ * @NFT_SET_CLASS_O_N: linear, O(N)
+ */
+ enum nft_set_class {
+ NFT_SET_CLASS_O_1,
+@@ -427,9 +429,13 @@ struct nft_set_ext;
+ * @remove: remove element from set
+ * @walk: iterate over all set elements
+ * @get: get set elements
++ * @commit: commit set elements
++ * @abort: abort set elements
+ * @privsize: function to return size of set private data
++ * @estimate: estimate the required memory size and the lookup complexity class
+ * @init: initialize private data of new set instance
+ * @destroy: destroy private data of set instance
++ * @gc_init: initialize garbage collection
+ * @elemsize: element private size
+ *
+ * Operations lookup, update and delete have simpler interfaces, are faster
+@@ -544,13 +550,16 @@ struct nft_set_elem_expr {
+ * @policy: set parameterization (see enum nft_set_policies)
+ * @udlen: user data length
+ * @udata: user data
+- * @expr: stateful expression
++ * @pending_update: list of pending update set element
+ * @ops: set ops
+ * @flags: set flags
+ * @dead: set will be freed, never cleared
+ * @genmask: generation mask
+ * @klen: key length
+ * @dlen: data length
++ * @num_exprs: numbers of exprs
++ * @exprs: stateful expression
++ * @catchall_list: list of catch-all set element
+ * @data: private set data
+ */
+ struct nft_set {
+@@ -701,6 +710,7 @@ extern const struct nft_set_ext_type nft_set_ext_types[];
+ *
+ * @len: length of extension area
+ * @offset: offsets of individual extension types
++ * @ext_len: length of the expected extension(used to sanity check)
+ */
+ struct nft_set_ext_tmpl {
+ u16 len;
+@@ -846,6 +856,7 @@ struct nft_expr_ops;
+ * @select_ops: function to select nft_expr_ops
+ * @release_ops: release nft_expr_ops
+ * @ops: default ops, used when no select_ops functions is present
++ * @inner_ops: inner ops, used for inner packet operation
+ * @list: used internally
+ * @name: Identifier
+ * @owner: module reference
+@@ -887,14 +898,22 @@ struct nft_offload_ctx;
+ * struct nft_expr_ops - nf_tables expression operations
+ *
+ * @eval: Expression evaluation function
++ * @clone: Expression clone function
+ * @size: full expression size, including private data size
+ * @init: initialization function
+ * @activate: activate expression in the next generation
+ * @deactivate: deactivate expression in next generation
+ * @destroy: destruction function, called after synchronize_rcu
++ * @destroy_clone: destruction clone function
+ * @dump: function to dump parameters
+- * @type: expression type
+ * @validate: validate expression, called during loop detection
++ * @reduce: reduce expression
++ * @gc: garbage collection expression
++ * @offload: hardware offload expression
++ * @offload_action: function to report true/false to allocate one slot or not in the flow
++ * offload array
++ * @offload_stats: function to synchronize hardware stats via updating the counter expression
++ * @type: expression type
+ * @data: extra data to attach to this expression operation
+ */
+ struct nft_expr_ops {
+@@ -1047,14 +1066,21 @@ struct nft_rule_blob {
+ /**
+ * struct nft_chain - nf_tables chain
+ *
++ * @blob_gen_0: rule blob pointer to the current generation
++ * @blob_gen_1: rule blob pointer to the future generation
+ * @rules: list of rules in the chain
+ * @list: used internally
+ * @rhlhead: used internally
+ * @table: table that this chain belongs to
+ * @handle: chain handle
+ * @use: number of jump references to this chain
+- * @flags: bitmask of enum nft_chain_flags
++ * @flags: bitmask of enum NFTA_CHAIN_FLAGS
++ * @bound: bind or not
++ * @genmask: generation mask
+ * @name: name of the chain
++ * @udlen: user data length
++ * @udata: user data in the chain
++ * @blob_next: rule blob pointer to the next in the chain
+ */
+ struct nft_chain {
+ struct nft_rule_blob __rcu *blob_gen_0;
+@@ -1152,6 +1178,7 @@ struct nft_hook {
+ * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family)
+ * @type: chain type
+ * @policy: default policy
++ * @flags: indicate the base chain disabled or not
+ * @stats: per-cpu chain stats
+ * @chain: the chain
+ * @flow_block: flow block (for hardware offload)
+@@ -1277,11 +1304,13 @@ struct nft_object_hash_key {
+ * struct nft_object - nf_tables stateful object
+ *
+ * @list: table stateful object list node
+- * @key: keys that identify this object
+ * @rhlhead: nft_objname_ht node
++ * @key: keys that identify this object
+ * @genmask: generation mask
+ * @use: number of references to this stateful object
+ * @handle: unique object handle
++ * @udlen: length of user data
++ * @udata: user data
+ * @ops: object operations
+ * @data: object data, layout depends on type
+ */
+@@ -1349,6 +1378,7 @@ struct nft_object_type {
+ * @destroy: release existing stateful object
+ * @dump: netlink dump stateful object
+ * @update: update stateful object
++ * @type: pointer to object type
+ */
+ struct nft_object_ops {
+ void (*eval)(struct nft_object *obj,
+@@ -1384,9 +1414,8 @@ void nft_unregister_obj(struct nft_object_type *obj_type);
+ * @genmask: generation mask
+ * @use: number of references to this flow table
+ * @handle: unique object handle
+- * @dev_name: array of device names
++ * @hook_list: hook list for hooks per net_device in flowtables
+ * @data: rhashtable and garbage collector
+- * @ops: array of hooks
+ */
+ struct nft_flowtable {
+ struct list_head list;
+--
+2.43.0
+
--- /dev/null
+From 963a74b1ea0d48db1872c657d82d654f317c7972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 15:00:45 +0200
+Subject: netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 8965d42bcf54d42cbc72fe34a9d0ec3f8527debd ]
+
+It would be better to not store nft_ctx inside nft_trans object,
+the netlink ctx strucutre is huge and most of its information is
+never needed in places that use trans->ctx.
+
+Avoid/reduce its usage if possible, no runtime behaviour change
+intended.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: c03d278fdf35 ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 2 +-
+ net/netfilter/nf_tables_api.c | 17 ++++++++---------
+ net/netfilter/nft_immediate.c | 2 +-
+ 3 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index af62804b27ec7..b5f9ee5810a34 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1157,7 +1157,7 @@ static inline bool nft_chain_is_bound(struct nft_chain *chain)
+
+ int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
+ void nft_chain_del(struct nft_chain *chain);
+-void nf_tables_chain_destroy(struct nft_ctx *ctx);
++void nf_tables_chain_destroy(struct nft_chain *chain);
+
+ struct nft_stats {
+ u64 bytes;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index aacb0d7f82e9f..eff94dcb49090 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2068,9 +2068,9 @@ static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
+ kvfree(chain->blob_next);
+ }
+
+-void nf_tables_chain_destroy(struct nft_ctx *ctx)
++void nf_tables_chain_destroy(struct nft_chain *chain)
+ {
+- struct nft_chain *chain = ctx->chain;
++ const struct nft_table *table = chain->table;
+ struct nft_hook *hook, *next;
+
+ if (WARN_ON(chain->use > 0))
+@@ -2082,7 +2082,7 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx)
+ if (nft_is_base_chain(chain)) {
+ struct nft_base_chain *basechain = nft_base_chain(chain);
+
+- if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
++ if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
+ list_for_each_entry_safe(hook, next,
+ &basechain->hook_list, list) {
+ list_del_rcu(&hook->list);
+@@ -2571,7 +2571,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
+ err_trans:
+ nft_use_dec_restore(&table->use);
+ err_destroy_chain:
+- nf_tables_chain_destroy(ctx);
++ nf_tables_chain_destroy(chain);
+
+ return err;
+ }
+@@ -9415,7 +9415,7 @@ static void nft_commit_release(struct nft_trans *trans)
+ if (nft_trans_chain_update(trans))
+ nft_hooks_destroy(&nft_trans_chain_hooks(trans));
+ else
+- nf_tables_chain_destroy(&trans->ctx);
++ nf_tables_chain_destroy(nft_trans_chain(trans));
+ break;
+ case NFT_MSG_DELRULE:
+ case NFT_MSG_DESTROYRULE:
+@@ -10406,7 +10406,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
+ if (nft_trans_chain_update(trans))
+ nft_hooks_destroy(&nft_trans_chain_hooks(trans));
+ else
+- nf_tables_chain_destroy(&trans->ctx);
++ nf_tables_chain_destroy(nft_trans_chain(trans));
+ break;
+ case NFT_MSG_NEWRULE:
+ nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
+@@ -11144,7 +11144,7 @@ int __nft_release_basechain(struct nft_ctx *ctx)
+ }
+ nft_chain_del(ctx->chain);
+ nft_use_dec(&ctx->table->use);
+- nf_tables_chain_destroy(ctx);
++ nf_tables_chain_destroy(ctx->chain);
+
+ return 0;
+ }
+@@ -11219,10 +11219,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
+ nft_obj_destroy(&ctx, obj);
+ }
+ list_for_each_entry_safe(chain, nc, &table->chains, list) {
+- ctx.chain = chain;
+ nft_chain_del(chain);
+ nft_use_dec(&table->use);
+- nf_tables_chain_destroy(&ctx);
++ nf_tables_chain_destroy(chain);
+ }
+ nf_tables_table_destroy(&ctx);
+ }
+diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
+index 6475c7abc1fe3..ac2422c215e54 100644
+--- a/net/netfilter/nft_immediate.c
++++ b/net/netfilter/nft_immediate.c
+@@ -221,7 +221,7 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
+ list_del(&rule->list);
+ nf_tables_rule_destroy(&chain_ctx, rule);
+ }
+- nf_tables_chain_destroy(&chain_ctx);
++ nf_tables_chain_destroy(chain);
+ break;
+ default:
+ break;
+--
+2.43.0
+
--- /dev/null
+From 5c4572721940c4c9c5d540fbc7c7a5b4661cbcb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 12:07:22 +0100
+Subject: netfilter: nf_tables: wait for rcu grace period on net_device removal
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit c03d278fdf35e73dd0ec543b9b556876b9d9a8dc ]
+
+8c873e219970 ("netfilter: core: free hooks with call_rcu") removed
+synchronize_net() call when unregistering basechain hook, however,
+net_device removal event handler for the NFPROTO_NETDEV was not updated
+to wait for RCU grace period.
+
+Note that 835b803377f5 ("netfilter: nf_tables_netdev: unregister hooks
+on net_device removal") does not remove basechain rules on device
+removal, I was hinted to remove rules on net_device removal later, see
+5ebe0b0eec9d ("netfilter: nf_tables: destroy basechain and rules on
+netdevice removal").
+
+Although NETDEV_UNREGISTER event is guaranteed to be handled after
+synchronize_net() call, this path needs to wait for rcu grace period via
+rcu callback to release basechain hooks if netns is alive because an
+ongoing netlink dump could be in progress (sockets hold a reference on
+the netns).
+
+Note that nf_tables_pre_exit_net() unregisters and releases basechain
+hooks but it is possible to see NETDEV_UNREGISTER at a later stage in
+the netns exit path, eg. veth peer device in another netns:
+
+ cleanup_net()
+ default_device_exit_batch()
+ unregister_netdevice_many_notify()
+ notifier_call_chain()
+ nf_tables_netdev_event()
+ __nft_release_basechain()
+
+In this particular case, same rule of thumb applies: if netns is alive,
+then wait for rcu grace period because netlink dump in the other netns
+could be in progress. Otherwise, if the other netns is going away then
+no netlink dump can be in progress and basechain hooks can be released
+inmediately.
+
+While at it, turn WARN_ON() into WARN_ON_ONCE() for the basechain
+validation, which should not ever happen.
+
+Fixes: 835b803377f5 ("netfilter: nf_tables_netdev: unregister hooks on net_device removal")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 4 +++
+ net/netfilter/nf_tables_api.c | 41 +++++++++++++++++++++++++------
+ 2 files changed, 38 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index b5f9ee5810a34..804dcd3a7d8f7 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1080,6 +1080,7 @@ struct nft_rule_blob {
+ * @name: name of the chain
+ * @udlen: user data length
+ * @udata: user data in the chain
++ * @rcu_head: rcu head for deferred release
+ * @blob_next: rule blob pointer to the next in the chain
+ */
+ struct nft_chain {
+@@ -1097,6 +1098,7 @@ struct nft_chain {
+ char *name;
+ u16 udlen;
+ u8 *udata;
++ struct rcu_head rcu_head;
+
+ /* Only used during control plane commit phase: */
+ struct nft_rule_blob *blob_next;
+@@ -1240,6 +1242,7 @@ static inline void nft_use_inc_restore(u32 *use)
+ * @sets: sets in the table
+ * @objects: stateful objects in the table
+ * @flowtables: flow tables in the table
++ * @net: netnamespace this table belongs to
+ * @hgenerator: handle generator state
+ * @handle: table handle
+ * @use: number of chain references to this table
+@@ -1256,6 +1259,7 @@ struct nft_table {
+ struct list_head sets;
+ struct list_head objects;
+ struct list_head flowtables;
++ possible_net_t net;
+ u64 hgenerator;
+ u64 handle;
+ u32 use;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index eff94dcb49090..8a583e8f3c136 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1431,6 +1431,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
+ INIT_LIST_HEAD(&table->sets);
+ INIT_LIST_HEAD(&table->objects);
+ INIT_LIST_HEAD(&table->flowtables);
++ write_pnet(&table->net, net);
+ table->family = family;
+ table->flags = flags;
+ table->handle = ++nft_net->table_handle;
+@@ -11129,22 +11130,48 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
+ }
+ EXPORT_SYMBOL_GPL(nft_data_dump);
+
+-int __nft_release_basechain(struct nft_ctx *ctx)
++static void __nft_release_basechain_now(struct nft_ctx *ctx)
+ {
+ struct nft_rule *rule, *nr;
+
+- if (WARN_ON(!nft_is_base_chain(ctx->chain)))
+- return 0;
+-
+- nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
+ list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
+ list_del(&rule->list);
+- nft_use_dec(&ctx->chain->use);
+ nf_tables_rule_release(ctx, rule);
+ }
++ nf_tables_chain_destroy(ctx->chain);
++}
++
++static void nft_release_basechain_rcu(struct rcu_head *head)
++{
++ struct nft_chain *chain = container_of(head, struct nft_chain, rcu_head);
++ struct nft_ctx ctx = {
++ .family = chain->table->family,
++ .chain = chain,
++ .net = read_pnet(&chain->table->net),
++ };
++
++ __nft_release_basechain_now(&ctx);
++ put_net(ctx.net);
++}
++
++int __nft_release_basechain(struct nft_ctx *ctx)
++{
++ struct nft_rule *rule;
++
++ if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain)))
++ return 0;
++
++ nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
++ list_for_each_entry(rule, &ctx->chain->rules, list)
++ nft_use_dec(&ctx->chain->use);
++
+ nft_chain_del(ctx->chain);
+ nft_use_dec(&ctx->table->use);
+- nf_tables_chain_destroy(ctx->chain);
++
++ if (maybe_get_net(ctx->net))
++ call_rcu(&ctx->chain->rcu_head, nft_release_basechain_rcu);
++ else
++ __nft_release_basechain_now(ctx);
+
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From c311f528523d14d81d85fff1bb09ff10a8a6166d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 17:15:41 -0400
+Subject: nfs: avoid i_lock contention in nfs_clear_invalid_mapping
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 867da60d463bb2a3e28c9235c487e56e96cffa00 ]
+
+Multi-threaded buffered reads to the same file exposed significant
+inode spinlock contention in nfs_clear_invalid_mapping().
+
+Eliminate this spinlock contention by checking flags without locking,
+instead using smp_rmb and smp_load_acquire accordingly, but then take
+spinlock and double-check these inode flags.
+
+Also refactor nfs_set_cache_invalid() slightly to use
+smp_store_release() to pair with nfs_clear_invalid_mapping()'s
+smp_load_acquire().
+
+While this fix is beneficial for all multi-threaded buffered reads
+issued by an NFS client, this issue was identified in the context of
+surprisingly low LOCALIO performance with 4K multi-threaded buffered
+read IO. This fix dramatically speeds up LOCALIO performance:
+
+before: read: IOPS=1583k, BW=6182MiB/s (6482MB/s)(121GiB/20002msec)
+after: read: IOPS=3046k, BW=11.6GiB/s (12.5GB/s)(232GiB/20001msec)
+
+Fixes: 17dfeb911339 ("NFS: Fix races in nfs_revalidate_mapping")
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/inode.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index ca76b0b51b779..d0fc3e80cd64c 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -206,12 +206,15 @@ void nfs_set_cache_invalid(struct inode *inode, unsigned long flags)
+ nfs_fscache_invalidate(inode, 0);
+ flags &= ~NFS_INO_REVAL_FORCED;
+
+- nfsi->cache_validity |= flags;
++ flags |= nfsi->cache_validity;
++ if (inode->i_mapping->nrpages == 0)
++ flags &= ~NFS_INO_INVALID_DATA;
+
+- if (inode->i_mapping->nrpages == 0) {
+- nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
+- nfs_ooo_clear(nfsi);
+- } else if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
++ /* pairs with nfs_clear_invalid_mapping()'s smp_load_acquire() */
++ smp_store_release(&nfsi->cache_validity, flags);
++
++ if (inode->i_mapping->nrpages == 0 ||
++ nfsi->cache_validity & NFS_INO_INVALID_DATA) {
+ nfs_ooo_clear(nfsi);
+ }
+ trace_nfs_set_cache_invalid(inode, 0);
+@@ -1340,6 +1343,13 @@ int nfs_clear_invalid_mapping(struct address_space *mapping)
+ TASK_KILLABLE|TASK_FREEZABLE_UNSAFE);
+ if (ret)
+ goto out;
++ smp_rmb(); /* pairs with smp_wmb() below */
++ if (test_bit(NFS_INO_INVALIDATING, bitlock))
++ continue;
++ /* pairs with nfs_set_cache_invalid()'s smp_store_release() */
++ if (!(smp_load_acquire(&nfsi->cache_validity) & NFS_INO_INVALID_DATA))
++ goto out;
++ /* Slow-path that double-checks with spinlock held */
+ spin_lock(&inode->i_lock);
+ if (test_bit(NFS_INO_INVALIDATING, bitlock)) {
+ spin_unlock(&inode->i_lock);
+--
+2.43.0
+
--- /dev/null
+From 0f47d04271bbe828da47dc62879bc46249760666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 11:07:23 +1000
+Subject: NFSv3: only use NFS timeout for MOUNT when protocols are compatible
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 6e2a10343ecb71c4457bc16be05758f9c7aae7d9 ]
+
+If a timeout is specified in the mount options, it currently applies to
+both the NFS protocol and (with v3) the MOUNT protocol. This is
+sensible when they both use the same underlying protocol, or those
+protocols are compatible w.r.t timeouts as RDMA and TCP are.
+
+However if, for example, NFS is using TCP and MOUNT is using UDP then
+using the same timeout doesn't make much sense.
+
+If you
+ mount -o vers=3,proto=tcp,mountproto=udp,timeo=600,retrans=5 \
+ server:/path /mountpoint
+
+then the timeo=600 which was intended for the NFS/TCP request will
+apply to the MOUNT/UDP requests with the result that there will only be
+one request sent (because UDP has a maximum timeout of 60 seconds).
+This is not what a reasonable person might expect.
+
+This patch disables the sharing of timeout information in cases where
+the underlying protocols are not compatible.
+
+Fixes: c9301cb35b59 ("nfs: hornor timeo and retrans option when mounting NFSv3")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index f63513e477c50..e1bcad5906ae7 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -869,7 +869,15 @@ static int nfs_request_mount(struct fs_context *fc,
+ * Now ask the mount server to map our export path
+ * to a file handle.
+ */
+- status = nfs_mount(&request, ctx->timeo, ctx->retrans);
++ if ((request.protocol == XPRT_TRANSPORT_UDP) ==
++ !(ctx->flags & NFS_MOUNT_TCP))
++ /*
++ * NFS protocol and mount protocol are both UDP or neither UDP
++ * so timeouts are compatible. Use NFS timeouts for MOUNT
++ */
++ status = nfs_mount(&request, ctx->timeo, ctx->retrans);
++ else
++ status = nfs_mount(&request, NFS_UNSPEC_TIMEO, NFS_UNSPEC_RETRANS);
+ if (status != 0) {
+ dfprintk(MOUNT, "NFS: unable to mount server %s, error %d\n",
+ request.hostname, status);
+--
+2.43.0
+
--- /dev/null
+From ac53fbfef37e252307530e8de325091726c8592c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 11:02:41 -0700
+Subject: platform/x86/amd/pmc: Detect when STB is not available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Corey Hickey <bugfood-c@fatooh.org>
+
+[ Upstream commit bceec87a73804bb4c33b9a6c96e2d27cd893a801 ]
+
+Loading the amd_pmc module as:
+
+ amd_pmc enable_stb=1
+
+...can result in the following messages in the kernel ring buffer:
+
+ amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff
+ ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff
+ WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340
+
+Further debugging reveals that this occurs when the requests for
+S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0,
+indicating that the STB is inaccessible. To prevent the ioremap
+warning and provide clarity to the user, handle the invalid address
+and display an error message.
+
+Link: https://lore.kernel.org/platform-driver-x86/c588ff5d-3e04-4549-9a86-284b9b4419ba@amd.com
+Fixes: 3d7d407dfb05 ("platform/x86: amd-pmc: Add support for AMD Spill to DRAM STB feature")
+Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Signed-off-by: Corey Hickey <bugfood-c@fatooh.org>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20241028180241.1341624-1-bugfood-ml@fatooh.org
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
+index 96caf2221d877..f49b1bb258c73 100644
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -931,6 +931,11 @@ static int amd_pmc_s2d_init(struct amd_pmc_dev *dev)
+ amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_LOW, &phys_addr_low, dev->s2d_msg_id, true);
+ amd_pmc_send_cmd(dev, S2D_PHYS_ADDR_HIGH, &phys_addr_hi, dev->s2d_msg_id, true);
+
++ if (!phys_addr_hi && !phys_addr_low) {
++ dev_err(dev->dev, "STB is not enabled on the system; disable enable_stb or contact system vendor\n");
++ return -EINVAL;
++ }
++
+ stb_phys_addr = ((u64)phys_addr_hi << 32 | phys_addr_low);
+
+ /* Clear msg_port for other SMU operation */
+--
+2.43.0
+
--- /dev/null
+From 58ca0e32285aa6a7b15467a65fbc641c2e238c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 13:59:18 +0800
+Subject: regulator: rtq2208: Fix uninitialized use of regulator_config
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+[ Upstream commit 2feb023110843acce790e9089e72e9a9503d9fa5 ]
+
+Fix rtq2208 driver uninitialized use to cause kernel error.
+
+Fixes: 85a11f55621a ("regulator: rtq2208: Add Richtek RTQ2208 SubPMIC")
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Link: https://patch.msgid.link/00d691cfcc0eae9ce80a37b62e99851e8fdcffe2.1729829243.git.cy_huang@richtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rtq2208-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/rtq2208-regulator.c b/drivers/regulator/rtq2208-regulator.c
+index 2d54844c4226b..e05531c8c0298 100644
+--- a/drivers/regulator/rtq2208-regulator.c
++++ b/drivers/regulator/rtq2208-regulator.c
+@@ -513,7 +513,7 @@ static int rtq2208_probe(struct i2c_client *i2c)
+ struct regmap *regmap;
+ struct rtq2208_regulator_desc *rdesc[RTQ2208_LDO_MAX];
+ struct regulator_dev *rdev;
+- struct regulator_config cfg;
++ struct regulator_config cfg = {};
+ struct rtq2208_rdev_map *rdev_map;
+ int i, ret = 0, idx, n_regulator = 0;
+ unsigned int regulator_idx_table[RTQ2208_LDO_MAX],
+--
+2.43.0
+
--- /dev/null
+From 47b4582f4288e77e900c30afaf0393573a4e8f55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 13:03:22 +0000
+Subject: rxrpc: Fix missing locking causing hanging calls
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit fc9de52de38f656399d2ce40f7349a6b5f86e787 ]
+
+If a call gets aborted (e.g. because kafs saw a signal) between it being
+queued for connection and the I/O thread picking up the call, the abort
+will be prioritised over the connection and it will be removed from
+local->new_client_calls by rxrpc_disconnect_client_call() without a lock
+being held. This may cause other calls on the list to disappear if a race
+occurs.
+
+Fix this by taking the client_call_lock when removing a call from whatever
+list its ->wait_link happens to be on.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: linux-afs@lists.infradead.org
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Fixes: 9d35d880e0e4 ("rxrpc: Move client call connection to the I/O thread")
+Link: https://patch.msgid.link/726660.1730898202@warthog.procyon.org.uk
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rxrpc.h | 1 +
+ net/rxrpc/conn_client.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index 3322fb93a260b..ed36f5f577a9d 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -283,6 +283,7 @@
+ EM(rxrpc_call_see_input, "SEE input ") \
+ EM(rxrpc_call_see_release, "SEE release ") \
+ EM(rxrpc_call_see_userid_exists, "SEE u-exists") \
++ EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \
+ E_(rxrpc_call_see_zap, "SEE zap ")
+
+ #define rxrpc_txqueue_traces \
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index 1d95f8bc769fa..a0231b64fb6ef 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -507,6 +507,7 @@ void rxrpc_connect_client_calls(struct rxrpc_local *local)
+
+ spin_lock(&local->client_call_lock);
+ list_move_tail(&call->wait_link, &bundle->waiting_calls);
++ rxrpc_see_call(call, rxrpc_call_see_waiting_call);
+ spin_unlock(&local->client_call_lock);
+
+ if (rxrpc_bundle_has_space(bundle))
+@@ -577,7 +578,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_bundle *bundle, struct rxrpc_call
+ _debug("call is waiting");
+ ASSERTCMP(call->call_id, ==, 0);
+ ASSERT(!test_bit(RXRPC_CALL_EXPOSED, &call->flags));
++ /* May still be on ->new_client_calls. */
++ spin_lock(&local->client_call_lock);
+ list_del_init(&call->wait_link);
++ spin_unlock(&local->client_call_lock);
+ return;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 3e3f11d20aac10bd0cdcdaeb2d32ecf05a30af88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 13:46:21 -0400
+Subject: sctp: properly validate chunk size in sctp_sf_ootb()
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0ead60804b64f5bd6999eec88e503c6a1a242d41 ]
+
+A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add
+size validation when walking chunks") is also required in sctp_sf_ootb()
+to address a crash reported by syzbot:
+
+ BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
+ sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
+ sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166
+ sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407
+ sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88
+ sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243
+ sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159
+ ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205
+ ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233
+
+Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 3649a4e1eb9de..808863e047e0c 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3750,7 +3750,7 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
+ }
+
+ ch = (struct sctp_chunkhdr *)ch_end;
+- } while (ch_end < skb_tail_pointer(skb));
++ } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));
+
+ if (ootb_shut_ack)
+ return sctp_sf_shut_8_4_5(net, ep, asoc, type, arg, commands);
+--
+2.43.0
+
--- /dev/null
+From 6de1f733ac91b96983b6612ea4a4bd5597da40c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 12:46:39 +0000
+Subject: security/keys: fix slab-out-of-bounds in key_task_permission
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 4a74da044ec9ec8679e6beccc4306b936b62873f ]
+
+KASAN reports an out of bounds read:
+BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36
+BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline]
+BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410
+security/keys/permission.c:54
+Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362
+
+CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15
+Call Trace:
+ __dump_stack lib/dump_stack.c:82 [inline]
+ dump_stack+0x107/0x167 lib/dump_stack.c:123
+ print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400
+ __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560
+ kasan_report+0x3a/0x50 mm/kasan/report.c:585
+ __kuid_val include/linux/uidgid.h:36 [inline]
+ uid_eq include/linux/uidgid.h:63 [inline]
+ key_task_permission+0x394/0x410 security/keys/permission.c:54
+ search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793
+
+This issue was also reported by syzbot.
+
+It can be reproduced by following these steps(more details [1]):
+1. Obtain more than 32 inputs that have similar hashes, which ends with the
+ pattern '0xxxxxxxe6'.
+2. Reboot and add the keys obtained in step 1.
+
+The reproducer demonstrates how this issue happened:
+1. In the search_nested_keyrings function, when it iterates through the
+ slots in a node(below tag ascend_to_node), if the slot pointer is meta
+ and node->back_pointer != NULL(it means a root), it will proceed to
+ descend_to_node. However, there is an exception. If node is the root,
+ and one of the slots points to a shortcut, it will be treated as a
+ keyring.
+2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function.
+ However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as
+ ASSOC_ARRAY_PTR_SUBTYPE_MASK.
+3. When 32 keys with the similar hashes are added to the tree, the ROOT
+ has keys with hashes that are not similar (e.g. slot 0) and it splits
+ NODE A without using a shortcut. When NODE A is filled with keys that
+ all hashes are xxe6, the keys are similar, NODE A will split with a
+ shortcut. Finally, it forms the tree as shown below, where slot 6 points
+ to a shortcut.
+
+ NODE A
+ +------>+---+
+ ROOT | | 0 | xxe6
+ +---+ | +---+
+ xxxx | 0 | shortcut : : xxe6
+ +---+ | +---+
+ xxe6 : : | | | xxe6
+ +---+ | +---+
+ | 6 |---+ : : xxe6
+ +---+ +---+
+ xxe6 : : | f | xxe6
+ +---+ +---+
+ xxe6 | f |
+ +---+
+
+4. As mentioned above, If a slot(slot 6) of the root points to a shortcut,
+ it may be mistakenly transferred to a key*, leading to a read
+ out-of-bounds read.
+
+To fix this issue, one should jump to descend_to_node if the ptr is a
+shortcut, regardless of whether the node is root or not.
+
+[1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@huaweicloud.com/
+
+[jarkko: tweaked the commit message a bit to have an appropriate closes
+ tag.]
+Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
+Reported-by: syzbot+5b415c07907a2990d1a3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/keyring.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 4448758f643a5..f331725d5a370 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring,
+ for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
+ ptr = READ_ONCE(node->slots[slot]);
+
+- if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
+- goto descend_to_node;
++ if (assoc_array_ptr_is_meta(ptr)) {
++ if (node->back_pointer ||
++ assoc_array_ptr_is_shortcut(ptr))
++ goto descend_to_node;
++ }
+
+ if (!keyring_ptr_is_keyring(ptr))
+ continue;
+--
+2.43.0
+
+arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch
+arm64-dts-rockchip-fix-rt5651-compatible-value-on-rk.patch-23459
+arm64-dts-rockchip-remove-hdmi-s-2nd-interrupt-on-rk.patch
+arm64-dts-rockchip-fix-wakeup-prop-names-on-pinenote.patch
+arm64-dts-rockchip-fix-reset-gpios-property-on-brcm-.patch
+arm64-dts-rockchip-fix-i2c2-pinctrl-names-property-o.patch
+arm64-dts-rockchip-fix-bluetooth-properties-on-rk356.patch
+arm64-dts-rockchip-fix-bluetooth-properties-on-rock9.patch
+arm64-dts-rockchip-add-dts-for-friendlyarm-nanopi-r2.patch
+arm64-dts-rockchip-remove-undocumented-supports-emmc.patch
+arm64-dts-rockchip-remove-cooling-cells-from-fan-on-.patch
+arm64-dts-rockchip-fix-led-triggers-on-rk3308-roc-cc.patch
+arm64-dts-rockchip-remove-num-slots-property-from-rk.patch
+arm64-dts-imx8qxp-add-vpu-subsystem-file.patch
+arm64-dts-imx8-ss-vpu-fix-imx8qm-vpu-irqs.patch
+arm64-dts-imx8mp-correct-sdhc-ipg-clk.patch
+firmware-arm_scmi-fix-slab-use-after-free-in-scmi_bu.patch
+arm64-dts-rockchip-remove-orphaned-pinctrl-names-fro.patch
+arm-dts-rockchip-fix-rk3036-acodec-node.patch
+arm-dts-rockchip-drop-grf-reference-from-rk3036-hdmi.patch
+arm-dts-rockchip-fix-the-spi-controller-on-rk3036.patch
+arm-dts-rockchip-fix-the-realtek-audio-codec-on-rk30.patch
+arm64-dts-rockchip-correct-gpio-polarity-on-brcm-bt-.patch
+hid-core-zero-initialize-the-report-buffer.patch
+platform-x86-amd-pmc-detect-when-stb-is-not-availabl.patch
+sunrpc-handle-enotconn-in-xs_tcp_setup_socket.patch
+nfsv3-only-use-nfs-timeout-for-mount-when-protocols-.patch
+nfs-avoid-i_lock-contention-in-nfs_clear_invalid_map.patch
+security-keys-fix-slab-out-of-bounds-in-key_task_per.patch
+regulator-rtq2208-fix-uninitialized-use-of-regulator.patch
+net-enetc-set-mac-address-to-the-vf-net_device.patch
+dt-bindings-net-xlnx-axi-ethernet-correct-phy-mode-p.patch
+sctp-properly-validate-chunk-size-in-sctp_sf_ootb.patch
+net-enetc-allocate-vf_state-during-pf-probes.patch
+can-c_can-fix-rx-tx-_errors-statistics.patch
+ice-change-q_index-variable-type-to-s16-to-store-1-v.patch
+i40e-fix-race-condition-by-adding-filter-s-intermedi.patch
+e1000e-remove-meteor-lake-smbus-workarounds.patch
+net-hns3-fix-kernel-crash-when-uninstalling-driver.patch
+net-phy-ti-add-phy_rst_after_clk_en-flag.patch
+net-stmmac-fix-unbalanced-irq-wake-disable-warning-o.patch
+netfilter-nf_tables-cleanup-documentation.patch
+netfilter-nf_tables-pass-nft_chain-to-destroy-functi.patch
+netfilter-nf_tables-wait-for-rcu-grace-period-on-net.patch
+virtio_net-add-hash_key_length-check.patch
+net-arc-fix-the-device-for-dma_map_single-dma_unmap_.patch
+net-arc-rockchip-fix-emac-mdio-node-support.patch
+rxrpc-fix-missing-locking-causing-hanging-calls.patch
+drivers-net-ionic-add-missed-debugfs-cleanup-to-ioni.patch
--- /dev/null
+From 4d0b01a3eb7539efe057a6515b70fc141e48a79a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 16:28:06 +1100
+Subject: sunrpc: handle -ENOTCONN in xs_tcp_setup_socket()
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 10f0740234f0b157b41bdc7e9c3555a9b86c1599 ]
+
+xs_tcp_finish_connecting() can return -ENOTCONN but the switch statement
+in xs_tcp_setup_socket() treats that as an unhandled error.
+
+If we treat it as a known error it would propagate back to
+call_connect_status() which does handle that error code. This appears
+to be the intention of the commit (given below) which added -ENOTCONN as
+a return status for xs_tcp_finish_connecting().
+
+So add -ENOTCONN to the switch statement as an error to pass through to
+the caller.
+
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1231050
+Link: https://access.redhat.com/discussions/3434091
+Fixes: 01d37c428ae0 ("SUNRPC: xprt_connect() don't abort the task if the transport isn't bound")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index c1fe2a6ea7976..50490b1e8a0d0 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2440,6 +2440,7 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ case -EHOSTUNREACH:
+ case -EADDRINUSE:
+ case -ENOBUFS:
++ case -ENOTCONN:
+ break;
+ default:
+ printk("%s: connect returned unhandled error %d\n",
+--
+2.43.0
+
--- /dev/null
+From 805685ec2a0ede94cd9829d059b2e85823490526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 16:57:04 +0800
+Subject: virtio_net: Add hash_key_length check
+
+From: Philo Lu <lulie@linux.alibaba.com>
+
+[ Upstream commit 3f7d9c1964fcd16d02a8a9d4fd6f6cb60c4cc530 ]
+
+Add hash_key_length check in virtnet_probe() to avoid possible out of
+bound errors when setting/reading the hash key.
+
+Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.")
+Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Acked-by: Joe Damato <jdamato@fastly.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 2da3be3fb9423..426c05d5b1381 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -4549,6 +4549,12 @@ static int virtnet_probe(struct virtio_device *vdev)
+ if (vi->has_rss || vi->has_rss_hash_report) {
+ vi->rss_key_size =
+ virtio_cread8(vdev, offsetof(struct virtio_net_config, rss_max_key_size));
++ if (vi->rss_key_size > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
++ dev_err(&vdev->dev, "rss_max_key_size=%u exceeds the limit %u.\n",
++ vi->rss_key_size, VIRTIO_NET_RSS_MAX_KEY_SIZE);
++ err = -EINVAL;
++ goto free;
++ }
+
+ vi->rss_hash_types_supported =
+ virtio_cread32(vdev, offsetof(struct virtio_net_config, supported_hash_types));
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
