--- /dev/null
+From eea4d9d7a69ffb2d766214f5484450e9066f8b6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index e7d3398c4d23b..1d1d4e92cb662 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2268,6 +2268,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2383,6 +2384,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 145eb9da88d7cf00a33a9eee1fb4640cac5408f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index 7a27ba8e05779..7605ab23dc8ed 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 6be90a5ef7410e6f0950a46ad037fcf25aa969c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 44e07a3c253b9..ab8741fe57c99 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 81574441774c59486c0989a14078679b7a160932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 8b686da5577b3..44e07a3c253b9 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From b40fdd795a7fec9152bc6d1f0c0764410deb5995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index 85bb624e32b9b..7db206fc97f21 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 801468fa5f819043db8bc0df0544355c6dc7330e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From 51d5ea3a1a9bd32deb7036eef09d2637fd290053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index a54a309879246..a3f4fa346b77e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -528,8 +528,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -543,8 +542,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From 42b5037dc3272673058998a339c678848c34bba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index a3f4fa346b77e..19859c44f9d51 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -503,6 +506,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -566,6 +571,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 21a5e9a7cf0b05cb956d4b569f793e86b770504a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index 41c4a46ce3572..afe7303802c61 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8646,6 +8646,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From abe21d3cbc2b3a8f5c8506a03d33faf855c738a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index cc1cfc827bb9a..44bb3ccc31574 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ }
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From 860707128ae71485d1f4dcd26c1520c43c00e7de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index cbbbd105a5a7b..26d70ac90933c 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 37e791b86698b3efbd3ab77b0ecac008495522e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 20:26:18 +0200
+Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ]
+
+The of_gpio_n_cells default is 2 when ->of_xlate() callback is
+not defined. No need to assign it explicitly in the driver.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index c00968ce7a569..cbbbd105a5a7b 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->of_gpio_n_cells = 2;
+ chip->can_sleep = false;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+--
+2.51.0
+
--- /dev/null
+From 441b5e1de08b3ff58be2d509b8c393fe058335a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index 4a24b855d3ce2..4b0f576e1e6c0 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -201,6 +201,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From 44d1d373806470825379337d22f9e38df91540e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 136c1f67dd223..e64f7157f065f 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9d6de1be71c0fdbc5bc0131f415ab807cf6c34b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index be06de791c544..136c1f67dd223 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From cbdec358757832d3b0a278b14a574f44cad50d04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index c6481bd612390..565a8bfe5692a 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c19bd971798ba090095811423b86146fdb6beb6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index a0551d6c2ffd6..264f5ae76e072 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From aeccab5c1b67892cc969a6022e7101a87881d7e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 93ebd14b48ed7..2832af34216d5 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From d876f64205286a2998f680cfa17abdb680c77cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 81b7ec2ae8615..17bfcd8b7fbb1 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1570,7 +1570,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED ||
+ tool->compressed == perf_session__process_compressed_event_stub)
+--
+2.51.0
+
--- /dev/null
+From d1dca40086f08f3f57133962e15b469c4d0096ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 67d3f5aad0167..160691a1d5522 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1f26ebb31e0e9ec3a7eba8ae83ebc3873091426d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index 51424cdc3b682..aa9a0ebc1f937 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 41c9479c435299ce64b771b9ab6645fdf46cc42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index d1d5a44d9122a..3b3aaa7d8283c 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From b37f6614629bc16560cee0f48a85f95ada14bd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:15:57 +0800
+Subject: scsi: libsas: Add sas_task_find_rq()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
+
+blk-mq already provides a unique tag per request. Some libsas LLDDs - like
+hisi_sas - already use this tag as the unique per-I/O HW tag.
+
+Add a common function to provide the request associated with a sas_task for
+all libsas LLDDs.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/scsi/libsas.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index daf9b07956abf..a4d34c118f8f7 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -622,6 +622,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);
+ extern struct sas_task *sas_alloc_slow_task(gfp_t flags);
+ extern void sas_free_task(struct sas_task *task);
+
++static inline struct request *sas_task_find_rq(struct sas_task *task)
++{
++ struct scsi_cmnd *scmd;
++
++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) {
++ struct ata_queued_cmd *qc = task->uldd_task;
++
++ scmd = qc ? qc->scsicmd : NULL;
++ } else {
++ scmd = task->uldd_task;
++ }
++
++ if (!scmd)
++ return NULL;
++
++ return scsi_cmd_to_rq(scmd);
++}
++
+ struct sas_domain_function_template {
+ /* The class calls these to notify the LLDD of an event. */
+ void (*lldd_port_formed)(struct asd_sas_phy *);
+--
+2.51.0
+
--- /dev/null
+From f2459efd2cc587707d039435d73945ca843e8ebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:02 +0800
+Subject: scsi: mvsas: Delete mvs_tag_init()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
+
+All mvs_tag_init() does is zero the tag bitmap, but this is already done
+with the kzalloc() call to alloc the tags, so delete this unneeded
+function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 --
+ drivers/scsi/mvsas/mv_sas.c | 7 -------
+ drivers/scsi/mvsas/mv_sas.h | 1 -
+ 3 files changed, 10 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 85ca8421fb862..17a4fc7cd14bb 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -287,8 +287,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ }
+ mvi->tags_num = slot_nr;
+
+- /* Initialize tags */
+- mvs_tag_init(mvi);
+ return 0;
+ err_out:
+ return 1;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 239b81ab924f7..4450641f6e736 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ return 0;
+ }
+
+-void mvs_tag_init(struct mvs_info *mvi)
+-{
+- int i;
+- for (i = 0; i < mvi->tags_num; ++i)
+- mvs_tag_clear(mvi, i);
+-}
+-
+ static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev)
+ {
+ unsigned long i = 0, j = 0, hi = 0;
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 327fdd5ee962f..8617a5ff5fe93 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+ int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+-void mvs_tag_init(struct mvs_info *mvi);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
--- /dev/null
+From b98ed88bce00d6283fe55988a103113f5abfe32a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index ccbea18f8ee12..c9dfbc1e37655 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From a0c5512022779c7fc68399f51c7a5a9ba96f606a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:03 +0800
+Subject: scsi: mvsas: Use sas_task_find_rq() for tagging
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
+
+The request associated with a SCSI command coming from the block layer has
+a unique tag, so use that when possible for getting a slot.
+
+Unfortunately we don't support reserved commands in the SCSI midlayer yet.
+As such, SMP tasks - as an example - will not have a request associated, so
+in the interim continue to manage those tags for that type of sas_task
+internally.
+
+We reserve an arbitrary 4 tags for these internal tags. Indeed, we already
+decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag
+MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
+mvsas: add support for 94xx; layout change; bug fixes"), but what those 2
+slots are used for is not obvious.
+
+Also make the tag management functions static, where possible.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_defs.h | 1 +
+ drivers/scsi/mvsas/mv_init.c | 9 +++++----
+ drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++-------------
+ drivers/scsi/mvsas/mv_sas.h | 7 +------
+ 4 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h
+index 199ab49aa047f..3ec1c7546cdb4 100644
+--- a/drivers/scsi/mvsas/mv_defs.h
++++ b/drivers/scsi/mvsas/mv_defs.h
+@@ -40,6 +40,7 @@ enum driver_configuration {
+ MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */
+ MVS_OAF_SZ = 64, /* Open address frame buffer size */
+ MVS_QUEUE_SIZE = 64, /* Support Queue depth */
++ MVS_RSVD_SLOTS = 4,
+ MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2,
+ };
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 17a4fc7cd14bb..ccbea18f8ee12 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -143,7 +143,7 @@ static void mvs_free(struct mvs_info *mvi)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+ cancel_delayed_work(&mwq->work_q);
+- kfree(mvi->tags);
++ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+
+@@ -285,7 +285,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name);
+ goto err_out;
+ }
+- mvi->tags_num = slot_nr;
+
+ return 0;
+ err_out:
+@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev,
+ mvi->sas = sha;
+ mvi->shost = shost;
+
+- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL);
+- if (!mvi->tags)
++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL);
++ if (!mvi->rsvd_tags)
+ goto err_out;
+
+ if (MVS_CHIP_DISP->chip_ioremap(mvi))
+@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,
+ else
+ can_queue = MVS_CHIP_SLOT_SZ;
+
++ can_queue -= MVS_RSVD_SLOTS;
++
+ shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG);
+ shost->can_queue = can_queue;
+ mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 4450641f6e736..6fca411007343 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)
+ return 0;
+ }
+
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ clear_bit(tag, bitmap);
+ }
+
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_free(struct mvs_info *mvi, u32 tag)
+ {
++ if (tag >= MVS_RSVD_SLOTS)
++ return;
++
+ mvs_tag_clear(mvi, tag);
+ }
+
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ set_bit(tag, bitmap);
+ }
+
+-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ {
+ unsigned int index, tag;
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+
+- index = find_first_zero_bit(bitmap, mvi->tags_num);
++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS);
+ tag = index;
+- if (tag >= mvi->tags_num)
++ if (tag >= MVS_RSVD_SLOTS)
+ return -SAS_QUEUE_FULL;
+ mvs_tag_set(mvi, tag);
+ *tag_out = tag;
+@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ struct mvs_task_exec_info tei;
+ struct mvs_slot_info *slot;
+ u32 tag = 0xdeadbeef, n_elem = 0;
++ struct request *rq;
+ int rc = 0;
+
+ if (!dev->port) {
+@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ n_elem = task->num_scatter;
+ }
+
+- rc = mvs_tag_alloc(mvi, &tag);
+- if (rc)
+- goto err_out;
++ rq = sas_task_find_rq(task);
++ if (rq) {
++ tag = rq->tag + MVS_RSVD_SLOTS;
++ } else {
++ rc = mvs_tag_alloc(mvi, &tag);
++ if (rc)
++ goto err_out;
++ }
+
+ slot = &mvi->slot_info[tag];
+
+@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ {
+ u32 slot_idx = rx_desc & RXQ_SLOT_MASK;
+- mvs_tag_clear(mvi, slot_idx);
++ mvs_tag_free(mvi, slot_idx);
+ }
+
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 8617a5ff5fe93..ab1f7fb85574d 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -370,8 +370,7 @@ struct mvs_info {
+ u32 chip_id;
+ const struct mvs_chip_info *chip;
+
+- int tags_num;
+- unsigned long *tags;
++ unsigned long *rsvd_tags;
+ /* further per-slot information */
+ struct mvs_phy phy[MVS_MAX_PHYS];
+ struct mvs_port port[MVS_MAX_PHYS];
+@@ -424,10 +423,6 @@ struct mvs_task_exec_info {
+
+ /******************** function prototype *********************/
+ void mvs_get_sas_addr(void *buf, u32 buflen);
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
fs-always-return-zero-on-success-from-replace_fd.patch
clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-at91-peripheral-fix-return-value.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+scsi-libsas-add-sas_task_find_rq.patch
+scsi-mvsas-delete-mvs_tag_init.patch
+scsi-mvsas-use-sas_task_find_rq-for-tagging.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
--- /dev/null
+From 1cd2eb3874d6965c0304390ad20d8ab2e9a06ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 64a87a39287a1..50af55778617c 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7000,7 +7000,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From ea8d41e1a0ac7800575fc763588f78a80c1eb0e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 221250973d078..432a35bb5e90a 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -263,10 +263,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin:
+ $(BUILD)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From c0bec29f27d85f85f3e4aa2129d2c853dc26cc45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index b3452259d6e0b..c8c68301543b2 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -831,8 +831,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 515ed2ae9787de0bdd40da26ae643d2572c9b6eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 18:26:26 +0800
+Subject: bpf: Avoid RCU context warning when unpinning htab with internal
+ structs
+
+From: KaFai Wan <kafai.wan@linux.dev>
+
+[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
+
+When unpinning a BPF hash table (htab or htab_lru) that contains internal
+structures (timer, workqueue, or task_work) in its values, a BUG warning
+is triggered:
+ BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0
+ ...
+
+The issue arises from the interaction between BPF object unpinning and
+RCU callback mechanisms:
+1. BPF object unpinning uses ->free_inode() which schedules cleanup via
+ call_rcu(), deferring the actual freeing to an RCU callback that
+ executes within the RCU_SOFTIRQ context.
+2. During cleanup of hash tables containing internal structures,
+ htab_map_free_internal_structs() is invoked, which includes
+ cond_resched() or cond_resched_rcu() calls to yield the CPU during
+ potentially long operations.
+
+However, cond_resched() or cond_resched_rcu() cannot be safely called from
+atomic RCU softirq context, leading to the BUG warning when attempting
+to reschedule.
+
+Fix this by changing from ->free_inode() to ->destroy_inode() and rename
+bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link).
+This allows direct inode freeing without RCU callback scheduling,
+avoiding the invalid context warning.
+
+Reported-by: Le Chen <tom2cat@sjtu.edu.cn>
+Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 5a8d9f7467bf4..849df8268af57 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -610,7 +610,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void bpf_free_inode(struct inode *inode)
++static void bpf_destroy_inode(struct inode *inode)
+ {
+ enum bpf_type type;
+
+@@ -625,7 +625,7 @@ static const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .free_inode = bpf_free_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+--
+2.51.0
+
--- /dev/null
+From d70eeb15268aae3e4440bf9d691e418d45adaa6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b95af925b9c27..1403829b96db9 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2257,6 +2257,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2364,6 +2365,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 124309be0414dbafbbd0e9db669a7b38c957507e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:15:01 +0200
+Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+
+From: Eric Woudstra <ericwouds@gmail.com>
+
+[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
+
+net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+7 locks held by socat/410:
+ #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
+ #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
+ [..]
+ #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
+
+Call Trace:
+ lockdep_rcu_suspicious.cold+0x4f/0xb1
+ br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
+ br_fill_forward_path+0x7a/0x4d0 [bridge]
+
+Use to correct helper, non _rcu variant requires RTNL mutex.
+
+Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
+Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 86441ff78a0f8..055d988d280cd 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -1391,7 +1391,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,
+ if (!br_opt_get(br, BROPT_VLAN_ENABLED))
+ return;
+
+- vg = br_vlan_group(br);
++ vg = br_vlan_group_rcu(br);
+
+ if (idx >= 0 &&
+ ctx->vlan[idx].proto == br->vlan_proto) {
+--
+2.51.0
+
--- /dev/null
+From 068e81844cb00d85dfda423f75eb827249cb4e3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index 7a27ba8e05779..7605ab23dc8ed 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -268,8 +268,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 37a7cfed7e8f169c4f368ddccdef41995e4128ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 44e07a3c253b9..ab8741fe57c99 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 91edd49af18954bb2b1394a10be463e4a2c71828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 8b686da5577b3..44e07a3c253b9 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From fa7cd048eeb4cfafc01684c88510a3f02b814cc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:12 -0500
+Subject: cpufreq: tegra186: Set target frequency for all cpus in policy
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
+
+The original commit set all cores in a cluster to a shared policy, but
+did not update set_target to apply a frequency change to all cores for
+the policy. This caused most cores to remain stuck at their boot
+frequency.
+
+Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 5d1943e787b0c..af7edddaa84e4 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+ {
+ struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+ struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset;
++ unsigned int edvd_offset;
+ u32 edvd_val = tbl->driver_data;
++ u32 cpu;
+
+- writel(edvd_val, data->regs + edvd_offset);
++ for_each_cpu(cpu, policy->cpus) {
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 042d8ede72e8c29e7ddd4d930879e20106829240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index 3505b071e6471..365f3082ea041 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From fce5162ae03b85152928c540e605123b83c696ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From 783bab93b2f6347401f89056425e79766b163bab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 670d5ab9d9984..b761dda491d54 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From 1c4b75ec00bed019af33a1722f5b17959a0d6845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index b761dda491d54..f97c182677082 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From d519df15bb8c1df276b1896b151f6feafb8bbd42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index 41c4a46ce3572..afe7303802c61 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8646,6 +8646,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From 1e00178bb3f0c1b59bfdeeaff08c2a1d7bd8a511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Nov 2021 10:48:40 +0100
+Subject: drm/vmwgfx: Copy DRM hash-table code into driver
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 2985c96485b7ef4e015d13dc3081fb0479260951 ]
+
+Besides some legacy code, vmwgfx is the only user of DRM's hash-
+table implementation. Copy the code into the driver, so that the
+core code can be retired.
+
+No functional changes. However, the real solution for vmwgfx is to
+use Linux' generic hash-table functions.
+
+v2:
+ * add TODO item for updating vmwgfx (Sam)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20211129094841.22499-3-tzimmermann@suse.de
+Stable-dep-of: dfe1323ab3c8 ("drm/vmwgfx: Fix Use-after-free in validation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/gpu/todo.rst | 11 ++
+ drivers/gpu/drm/vmwgfx/Makefile | 2 +-
+ drivers/gpu/drm/vmwgfx/ttm_object.c | 52 +++---
+ drivers/gpu/drm/vmwgfx/ttm_object.h | 3 +-
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 24 +--
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 2 +-
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 +-
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
+ drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c | 199 +++++++++++++++++++++
+ drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h | 83 +++++++++
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 22 +--
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 7 +-
+ 12 files changed, 353 insertions(+), 60 deletions(-)
+ create mode 100644 drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c
+ create mode 100644 drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h
+
+diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst
+index 67de1e94fdf76..f31a838d09fbb 100644
+--- a/Documentation/gpu/todo.rst
++++ b/Documentation/gpu/todo.rst
+@@ -635,6 +635,17 @@ See drivers/gpu/drm/amd/display/TODO for tasks.
+
+ Contact: Harry Wentland, Alex Deucher
+
++vmwgfx: Replace hashtable with Linux' implementation
++----------------------------------------------------
++
++The vmwgfx driver uses its own hashtable implementation. Replace the
++code with Linux' implementation and update the callers. It's mostly a
++refactoring task, but the interfaces are different.
++
++Contact: Zack Rusin, Thomas Zimmermann <tzimmermann@suse.de>
++
++Level: Intermediate
++
+ Bootsplash
+ ==========
+
+diff --git a/drivers/gpu/drm/vmwgfx/Makefile b/drivers/gpu/drm/vmwgfx/Makefile
+index 18edc7ca5b454..59b0b77456dd2 100644
+--- a/drivers/gpu/drm/vmwgfx/Makefile
++++ b/drivers/gpu/drm/vmwgfx/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_kms.o vmwgfx_drv.o \
++vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_hashtab.o vmwgfx_kms.o vmwgfx_drv.o \
+ vmwgfx_ioctl.o vmwgfx_resource.o vmwgfx_ttm_buffer.o \
+ vmwgfx_cmd.o vmwgfx_irq.o vmwgfx_ldu.o vmwgfx_ttm_glue.o \
+ vmwgfx_overlay.o vmwgfx_gmrid_manager.o vmwgfx_fence.o \
+diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.c b/drivers/gpu/drm/vmwgfx/ttm_object.c
+index 04789b2bb2a26..123ab2cbec484 100644
+--- a/drivers/gpu/drm/vmwgfx/ttm_object.c
++++ b/drivers/gpu/drm/vmwgfx/ttm_object.c
+@@ -70,7 +70,7 @@ struct ttm_object_file {
+ struct ttm_object_device *tdev;
+ spinlock_t lock;
+ struct list_head ref_list;
+- struct drm_open_hash ref_hash[TTM_REF_NUM];
++ struct vmwgfx_open_hash ref_hash[TTM_REF_NUM];
+ struct kref refcount;
+ };
+
+@@ -88,7 +88,7 @@ struct ttm_object_file {
+
+ struct ttm_object_device {
+ spinlock_t object_lock;
+- struct drm_open_hash object_hash;
++ struct vmwgfx_open_hash object_hash;
+ atomic_t object_count;
+ struct ttm_mem_global *mem_glob;
+ struct dma_buf_ops ops;
+@@ -120,7 +120,7 @@ struct ttm_object_device {
+
+ struct ttm_ref_object {
+ struct rcu_head rcu_head;
+- struct drm_hash_item hash;
++ struct vmwgfx_hash_item hash;
+ struct list_head head;
+ struct kref kref;
+ enum ttm_ref_type ref_type;
+@@ -244,12 +244,12 @@ void ttm_base_object_unref(struct ttm_base_object **p_base)
+ struct ttm_base_object *
+ ttm_base_object_noref_lookup(struct ttm_object_file *tfile, uint32_t key)
+ {
+- struct drm_hash_item *hash;
+- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
++ struct vmwgfx_hash_item *hash;
++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
+ int ret;
+
+ rcu_read_lock();
+- ret = drm_ht_find_item_rcu(ht, key, &hash);
++ ret = vmwgfx_ht_find_item_rcu(ht, key, &hash);
+ if (ret) {
+ rcu_read_unlock();
+ return NULL;
+@@ -264,12 +264,12 @@ struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,
+ uint32_t key)
+ {
+ struct ttm_base_object *base = NULL;
+- struct drm_hash_item *hash;
+- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
++ struct vmwgfx_hash_item *hash;
++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
+ int ret;
+
+ rcu_read_lock();
+- ret = drm_ht_find_item_rcu(ht, key, &hash);
++ ret = vmwgfx_ht_find_item_rcu(ht, key, &hash);
+
+ if (likely(ret == 0)) {
+ base = drm_hash_entry(hash, struct ttm_ref_object, hash)->obj;
+@@ -309,12 +309,12 @@ ttm_base_object_lookup_for_ref(struct ttm_object_device *tdev, uint32_t key)
+ bool ttm_ref_object_exists(struct ttm_object_file *tfile,
+ struct ttm_base_object *base)
+ {
+- struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
+- struct drm_hash_item *hash;
++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];
++ struct vmwgfx_hash_item *hash;
+ struct ttm_ref_object *ref;
+
+ rcu_read_lock();
+- if (unlikely(drm_ht_find_item_rcu(ht, base->handle, &hash) != 0))
++ if (unlikely(vmwgfx_ht_find_item_rcu(ht, base->handle, &hash) != 0))
+ goto out_false;
+
+ /*
+@@ -346,9 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
+ enum ttm_ref_type ref_type, bool *existed,
+ bool require_existed)
+ {
+- struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[ref_type];
+ struct ttm_ref_object *ref;
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+ struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
+ struct ttm_operation_ctx ctx = {
+ .interruptible = false,
+@@ -364,7 +364,7 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
+
+ while (ret == -EINVAL) {
+ rcu_read_lock();
+- ret = drm_ht_find_item_rcu(ht, base->handle, &hash);
++ ret = vmwgfx_ht_find_item_rcu(ht, base->handle, &hash);
+
+ if (ret == 0) {
+ ref = drm_hash_entry(hash, struct ttm_ref_object, hash);
+@@ -395,7 +395,7 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
+ kref_init(&ref->kref);
+
+ spin_lock(&tfile->lock);
+- ret = drm_ht_insert_item_rcu(ht, &ref->hash);
++ ret = vmwgfx_ht_insert_item_rcu(ht, &ref->hash);
+
+ if (likely(ret == 0)) {
+ list_add_tail(&ref->head, &tfile->ref_list);
+@@ -423,11 +423,11 @@ ttm_ref_object_release(struct kref *kref)
+ container_of(kref, struct ttm_ref_object, kref);
+ struct ttm_base_object *base = ref->obj;
+ struct ttm_object_file *tfile = ref->tfile;
+- struct drm_open_hash *ht;
++ struct vmwgfx_open_hash *ht;
+ struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
+
+ ht = &tfile->ref_hash[ref->ref_type];
+- (void)drm_ht_remove_item_rcu(ht, &ref->hash);
++ (void)vmwgfx_ht_remove_item_rcu(ht, &ref->hash);
+ list_del(&ref->head);
+ spin_unlock(&tfile->lock);
+
+@@ -443,13 +443,13 @@ ttm_ref_object_release(struct kref *kref)
+ int ttm_ref_object_base_unref(struct ttm_object_file *tfile,
+ unsigned long key, enum ttm_ref_type ref_type)
+ {
+- struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
++ struct vmwgfx_open_hash *ht = &tfile->ref_hash[ref_type];
+ struct ttm_ref_object *ref;
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+ int ret;
+
+ spin_lock(&tfile->lock);
+- ret = drm_ht_find_item(ht, key, &hash);
++ ret = vmwgfx_ht_find_item(ht, key, &hash);
+ if (unlikely(ret != 0)) {
+ spin_unlock(&tfile->lock);
+ return -EINVAL;
+@@ -483,7 +483,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile)
+
+ spin_unlock(&tfile->lock);
+ for (i = 0; i < TTM_REF_NUM; ++i)
+- drm_ht_remove(&tfile->ref_hash[i]);
++ vmwgfx_ht_remove(&tfile->ref_hash[i]);
+
+ ttm_object_file_unref(&tfile);
+ }
+@@ -505,7 +505,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev,
+ INIT_LIST_HEAD(&tfile->ref_list);
+
+ for (i = 0; i < TTM_REF_NUM; ++i) {
+- ret = drm_ht_create(&tfile->ref_hash[i], hash_order);
++ ret = vmwgfx_ht_create(&tfile->ref_hash[i], hash_order);
+ if (ret) {
+ j = i;
+ goto out_err;
+@@ -515,7 +515,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev,
+ return tfile;
+ out_err:
+ for (i = 0; i < j; ++i)
+- drm_ht_remove(&tfile->ref_hash[i]);
++ vmwgfx_ht_remove(&tfile->ref_hash[i]);
+
+ kfree(tfile);
+
+@@ -536,7 +536,7 @@ ttm_object_device_init(struct ttm_mem_global *mem_glob,
+ tdev->mem_glob = mem_glob;
+ spin_lock_init(&tdev->object_lock);
+ atomic_set(&tdev->object_count, 0);
+- ret = drm_ht_create(&tdev->object_hash, hash_order);
++ ret = vmwgfx_ht_create(&tdev->object_hash, hash_order);
+ if (ret != 0)
+ goto out_no_object_hash;
+
+@@ -561,7 +561,7 @@ void ttm_object_device_release(struct ttm_object_device **p_tdev)
+
+ WARN_ON_ONCE(!idr_is_empty(&tdev->idr));
+ idr_destroy(&tdev->idr);
+- drm_ht_remove(&tdev->object_hash);
++ vmwgfx_ht_remove(&tdev->object_hash);
+
+ kfree(tdev);
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/ttm_object.h b/drivers/gpu/drm/vmwgfx/ttm_object.h
+index 49b064f0cb19c..6885ccbeec7a1 100644
+--- a/drivers/gpu/drm/vmwgfx/ttm_object.h
++++ b/drivers/gpu/drm/vmwgfx/ttm_object.h
+@@ -42,9 +42,8 @@
+ #include <linux/list.h>
+ #include <linux/rcupdate.h>
+
+-#include <drm/drm_hashtab.h>
+-
+ #include "ttm_memory.h"
++#include "vmwgfx_hashtab.h"
+
+ /**
+ * enum ttm_ref_type
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index 8381750db81b6..494cb98061f22 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -42,7 +42,7 @@
+ */
+ struct vmw_cmdbuf_res {
+ struct vmw_resource *res;
+- struct drm_hash_item hash;
++ struct vmwgfx_hash_item hash;
+ struct list_head head;
+ enum vmw_cmdbuf_res_state state;
+ struct vmw_cmdbuf_res_manager *man;
+@@ -59,7 +59,7 @@ struct vmw_cmdbuf_res {
+ * @resources and @list are protected by the cmdbuf mutex for now.
+ */
+ struct vmw_cmdbuf_res_manager {
+- struct drm_open_hash resources;
++ struct vmwgfx_open_hash resources;
+ struct list_head list;
+ struct vmw_private *dev_priv;
+ };
+@@ -81,11 +81,11 @@ vmw_cmdbuf_res_lookup(struct vmw_cmdbuf_res_manager *man,
+ enum vmw_cmdbuf_res_type res_type,
+ u32 user_key)
+ {
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+ int ret;
+ unsigned long key = user_key | (res_type << 24);
+
+- ret = drm_ht_find_item(&man->resources, key, &hash);
++ ret = vmwgfx_ht_find_item(&man->resources, key, &hash);
+ if (unlikely(ret != 0))
+ return ERR_PTR(ret);
+
+@@ -105,7 +105,7 @@ static void vmw_cmdbuf_res_free(struct vmw_cmdbuf_res_manager *man,
+ struct vmw_cmdbuf_res *entry)
+ {
+ list_del(&entry->head);
+- WARN_ON(drm_ht_remove_item(&man->resources, &entry->hash));
++ WARN_ON(vmwgfx_ht_remove_item(&man->resources, &entry->hash));
+ vmw_resource_unreference(&entry->res);
+ kfree(entry);
+ }
+@@ -167,7 +167,7 @@ void vmw_cmdbuf_res_revert(struct list_head *list)
+ vmw_cmdbuf_res_free(entry->man, entry);
+ break;
+ case VMW_CMDBUF_RES_DEL:
+- ret = drm_ht_insert_item(&entry->man->resources, &entry->hash);
++ ret = vmwgfx_ht_insert_item(&entry->man->resources, &entry->hash);
+ BUG_ON(ret);
+ list_move_tail(&entry->head, &entry->man->list);
+ entry->state = VMW_CMDBUF_RES_COMMITTED;
+@@ -206,7 +206,7 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
+ return -ENOMEM;
+
+ cres->hash.key = user_key | (res_type << 24);
+- ret = drm_ht_insert_item(&man->resources, &cres->hash);
++ ret = vmwgfx_ht_insert_item(&man->resources, &cres->hash);
+ if (unlikely(ret != 0)) {
+ kfree(cres);
+ goto out_invalid_key;
+@@ -244,10 +244,10 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man,
+ struct vmw_resource **res_p)
+ {
+ struct vmw_cmdbuf_res *entry;
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+ int ret;
+
+- ret = drm_ht_find_item(&man->resources, user_key | (res_type << 24),
++ ret = vmwgfx_ht_find_item(&man->resources, user_key | (res_type << 24),
+ &hash);
+ if (likely(ret != 0))
+ return -EINVAL;
+@@ -260,7 +260,7 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man,
+ *res_p = NULL;
+ break;
+ case VMW_CMDBUF_RES_COMMITTED:
+- (void) drm_ht_remove_item(&man->resources, &entry->hash);
++ (void) vmwgfx_ht_remove_item(&man->resources, &entry->hash);
+ list_del(&entry->head);
+ entry->state = VMW_CMDBUF_RES_DEL;
+ list_add_tail(&entry->head, list);
+@@ -295,7 +295,7 @@ vmw_cmdbuf_res_man_create(struct vmw_private *dev_priv)
+
+ man->dev_priv = dev_priv;
+ INIT_LIST_HEAD(&man->list);
+- ret = drm_ht_create(&man->resources, VMW_CMDBUF_RES_MAN_HT_ORDER);
++ ret = vmwgfx_ht_create(&man->resources, VMW_CMDBUF_RES_MAN_HT_ORDER);
+ if (ret == 0)
+ return man;
+
+@@ -320,7 +320,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man)
+ list_for_each_entry_safe(entry, next, &man->list, head)
+ vmw_cmdbuf_res_free(man, entry);
+
+- drm_ht_remove(&man->resources);
++ vmwgfx_ht_remove(&man->resources);
+ kfree(man);
+ }
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index 0f09a9116b054..4fea95a650418 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1149,7 +1149,7 @@ static void vmw_driver_unload(struct drm_device *dev)
+ unregister_pm_notifier(&dev_priv->pm_nb);
+
+ if (dev_priv->ctx.res_ht_initialized)
+- drm_ht_remove(&dev_priv->ctx.res_ht);
++ vmwgfx_ht_remove(&dev_priv->ctx.res_ht);
+ vfree(dev_priv->ctx.cmd_bounce);
+ if (dev_priv->enable_fb) {
+ vmw_fb_off(dev_priv);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+index 9c60bb2aefe1f..1099cb5e25006 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -34,7 +34,6 @@
+ #include <drm/drm_auth.h>
+ #include <drm/drm_device.h>
+ #include <drm/drm_file.h>
+-#include <drm/drm_hashtab.h>
+ #include <drm/drm_rect.h>
+
+ #include <drm/ttm/ttm_bo_driver.h>
+@@ -43,6 +42,7 @@
+ #include "ttm_object.h"
+
+ #include "vmwgfx_fence.h"
++#include "vmwgfx_hashtab.h"
+ #include "vmwgfx_reg.h"
+ #include "vmwgfx_validation.h"
+
+@@ -131,7 +131,7 @@ struct vmw_buffer_object {
+ */
+ struct vmw_validate_buffer {
+ struct ttm_validate_buffer base;
+- struct drm_hash_item hash;
++ struct vmwgfx_hash_item hash;
+ bool validate_as_mob;
+ };
+
+@@ -404,7 +404,7 @@ struct vmw_ctx_validation_info;
+ * @ctx: The validation context
+ */
+ struct vmw_sw_context{
+- struct drm_open_hash res_ht;
++ struct vmwgfx_open_hash res_ht;
+ bool res_ht_initialized;
+ bool kernel;
+ struct vmw_fpriv *fp;
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 21134c7f18382..7dd42c5a7fd62 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -4112,7 +4112,7 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ vmw_binding_state_reset(sw_context->staged_bindings);
+
+ if (!sw_context->res_ht_initialized) {
+- ret = drm_ht_create(&sw_context->res_ht, VMW_RES_HT_ORDER);
++ ret = vmwgfx_ht_create(&sw_context->res_ht, VMW_RES_HT_ORDER);
+ if (unlikely(ret != 0))
+ goto out_unlock;
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c
+new file mode 100644
+index 0000000000000..06aebc12774e7
+--- /dev/null
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.c
+@@ -0,0 +1,199 @@
++/*
++ * Copyright 2006 Tungsten Graphics, Inc., Bismarck, ND. USA.
++ * All Rights Reserved.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the
++ * "Software"), to deal in the Software without restriction, including
++ * without limitation the rights to use, copy, modify, merge, publish,
++ * distribute, sub license, and/or sell copies of the Software, and to
++ * permit persons to whom the Software is furnished to do so, subject to
++ * the following conditions:
++ *
++ * The above copyright notice and this permission notice (including the
++ * next paragraph) shall be included in all copies or substantial portions
++ * of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
++ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
++ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
++ * USE OR OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++/*
++ * Simple open hash tab implementation.
++ *
++ * Authors:
++ * Thomas Hellström <thomas-at-tungstengraphics-dot-com>
++ */
++
++#include <linux/export.h>
++#include <linux/hash.h>
++#include <linux/mm.h>
++#include <linux/rculist.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++
++#include <drm/drm_print.h>
++
++#include "vmwgfx_hashtab.h"
++
++int vmwgfx_ht_create(struct vmwgfx_open_hash *ht, unsigned int order)
++{
++ unsigned int size = 1 << order;
++
++ ht->order = order;
++ ht->table = NULL;
++ if (size <= PAGE_SIZE / sizeof(*ht->table))
++ ht->table = kcalloc(size, sizeof(*ht->table), GFP_KERNEL);
++ else
++ ht->table = vzalloc(array_size(size, sizeof(*ht->table)));
++ if (!ht->table) {
++ DRM_ERROR("Out of memory for hash table\n");
++ return -ENOMEM;
++ }
++ return 0;
++}
++
++void vmwgfx_ht_verbose_list(struct vmwgfx_open_hash *ht, unsigned long key)
++{
++ struct vmwgfx_hash_item *entry;
++ struct hlist_head *h_list;
++ unsigned int hashed_key;
++ int count = 0;
++
++ hashed_key = hash_long(key, ht->order);
++ DRM_DEBUG("Key is 0x%08lx, Hashed key is 0x%08x\n", key, hashed_key);
++ h_list = &ht->table[hashed_key];
++ hlist_for_each_entry(entry, h_list, head)
++ DRM_DEBUG("count %d, key: 0x%08lx\n", count++, entry->key);
++}
++
++static struct hlist_node *vmwgfx_ht_find_key(struct vmwgfx_open_hash *ht, unsigned long key)
++{
++ struct vmwgfx_hash_item *entry;
++ struct hlist_head *h_list;
++ unsigned int hashed_key;
++
++ hashed_key = hash_long(key, ht->order);
++ h_list = &ht->table[hashed_key];
++ hlist_for_each_entry(entry, h_list, head) {
++ if (entry->key == key)
++ return &entry->head;
++ if (entry->key > key)
++ break;
++ }
++ return NULL;
++}
++
++static struct hlist_node *vmwgfx_ht_find_key_rcu(struct vmwgfx_open_hash *ht, unsigned long key)
++{
++ struct vmwgfx_hash_item *entry;
++ struct hlist_head *h_list;
++ unsigned int hashed_key;
++
++ hashed_key = hash_long(key, ht->order);
++ h_list = &ht->table[hashed_key];
++ hlist_for_each_entry_rcu(entry, h_list, head) {
++ if (entry->key == key)
++ return &entry->head;
++ if (entry->key > key)
++ break;
++ }
++ return NULL;
++}
++
++int vmwgfx_ht_insert_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item)
++{
++ struct vmwgfx_hash_item *entry;
++ struct hlist_head *h_list;
++ struct hlist_node *parent;
++ unsigned int hashed_key;
++ unsigned long key = item->key;
++
++ hashed_key = hash_long(key, ht->order);
++ h_list = &ht->table[hashed_key];
++ parent = NULL;
++ hlist_for_each_entry(entry, h_list, head) {
++ if (entry->key == key)
++ return -EINVAL;
++ if (entry->key > key)
++ break;
++ parent = &entry->head;
++ }
++ if (parent)
++ hlist_add_behind_rcu(&item->head, parent);
++ else
++ hlist_add_head_rcu(&item->head, h_list);
++ return 0;
++}
++
++/*
++ * Just insert an item and return any "bits" bit key that hasn't been
++ * used before.
++ */
++int vmwgfx_ht_just_insert_please(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item,
++ unsigned long seed, int bits, int shift,
++ unsigned long add)
++{
++ int ret;
++ unsigned long mask = (1UL << bits) - 1;
++ unsigned long first, unshifted_key;
++
++ unshifted_key = hash_long(seed, bits);
++ first = unshifted_key;
++ do {
++ item->key = (unshifted_key << shift) + add;
++ ret = vmwgfx_ht_insert_item(ht, item);
++ if (ret)
++ unshifted_key = (unshifted_key + 1) & mask;
++ } while (ret && (unshifted_key != first));
++
++ if (ret) {
++ DRM_ERROR("Available key bit space exhausted\n");
++ return -EINVAL;
++ }
++ return 0;
++}
++
++int vmwgfx_ht_find_item(struct vmwgfx_open_hash *ht, unsigned long key,
++ struct vmwgfx_hash_item **item)
++{
++ struct hlist_node *list;
++
++ list = vmwgfx_ht_find_key_rcu(ht, key);
++ if (!list)
++ return -EINVAL;
++
++ *item = hlist_entry(list, struct vmwgfx_hash_item, head);
++ return 0;
++}
++
++int vmwgfx_ht_remove_key(struct vmwgfx_open_hash *ht, unsigned long key)
++{
++ struct hlist_node *list;
++
++ list = vmwgfx_ht_find_key(ht, key);
++ if (list) {
++ hlist_del_init_rcu(list);
++ return 0;
++ }
++ return -EINVAL;
++}
++
++int vmwgfx_ht_remove_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item)
++{
++ hlist_del_init_rcu(&item->head);
++ return 0;
++}
++
++void vmwgfx_ht_remove(struct vmwgfx_open_hash *ht)
++{
++ if (ht->table) {
++ kvfree(ht->table);
++ ht->table = NULL;
++ }
++}
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h
+new file mode 100644
+index 0000000000000..a9ce12922e21c
+--- /dev/null
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_hashtab.h
+@@ -0,0 +1,83 @@
++/*
++ * Copyright 2006 Tungsten Graphics, Inc., Bismack, ND. USA.
++ * All Rights Reserved.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a
++ * copy of this software and associated documentation files (the
++ * "Software"), to deal in the Software without restriction, including
++ * without limitation the rights to use, copy, modify, merge, publish,
++ * distribute, sub license, and/or sell copies of the Software, and to
++ * permit persons to whom the Software is furnished to do so, subject to
++ * the following conditions:
++ *
++ * The above copyright notice and this permission notice (including the
++ * next paragraph) shall be included in all copies or substantial portions
++ * of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
++ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
++ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
++ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
++ * USE OR OTHER DEALINGS IN THE SOFTWARE.
++ */
++
++/*
++ * Simple open hash tab implementation.
++ *
++ * Authors:
++ * Thomas Hellström <thomas-at-tungstengraphics-dot-com>
++ */
++
++/*
++ * TODO: Replace this hashtable with Linux' generic implementation
++ * from <linux/hashtable.h>.
++ */
++
++#ifndef VMWGFX_HASHTAB_H
++#define VMWGFX_HASHTAB_H
++
++#include <linux/list.h>
++
++#define drm_hash_entry(_ptr, _type, _member) container_of(_ptr, _type, _member)
++
++struct vmwgfx_hash_item {
++ struct hlist_node head;
++ unsigned long key;
++};
++
++struct vmwgfx_open_hash {
++ struct hlist_head *table;
++ u8 order;
++};
++
++int vmwgfx_ht_create(struct vmwgfx_open_hash *ht, unsigned int order);
++int vmwgfx_ht_insert_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item);
++int vmwgfx_ht_just_insert_please(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item,
++ unsigned long seed, int bits, int shift,
++ unsigned long add);
++int vmwgfx_ht_find_item(struct vmwgfx_open_hash *ht, unsigned long key,
++ struct vmwgfx_hash_item **item);
++
++void vmwgfx_ht_verbose_list(struct vmwgfx_open_hash *ht, unsigned long key);
++int vmwgfx_ht_remove_key(struct vmwgfx_open_hash *ht, unsigned long key);
++int vmwgfx_ht_remove_item(struct vmwgfx_open_hash *ht, struct vmwgfx_hash_item *item);
++void vmwgfx_ht_remove(struct vmwgfx_open_hash *ht);
++
++/*
++ * RCU-safe interface
++ *
++ * The user of this API needs to make sure that two or more instances of the
++ * hash table manipulation functions are never run simultaneously.
++ * The lookup function vmwgfx_ht_find_item_rcu may, however, run simultaneously
++ * with any of the manipulation functions as long as it's called from within
++ * an RCU read-locked section.
++ */
++#define vmwgfx_ht_insert_item_rcu vmwgfx_ht_insert_item
++#define vmwgfx_ht_just_insert_please_rcu vmwgfx_ht_just_insert_please
++#define vmwgfx_ht_remove_key_rcu vmwgfx_ht_remove_key
++#define vmwgfx_ht_remove_item_rcu vmwgfx_ht_remove_item
++#define vmwgfx_ht_find_item_rcu vmwgfx_ht_find_item
++
++#endif
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index b09094b50c5d0..41b7417cb5d3d 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -43,7 +43,7 @@
+ */
+ struct vmw_validation_bo_node {
+ struct ttm_validate_buffer base;
+- struct drm_hash_item hash;
++ struct vmwgfx_hash_item hash;
+ unsigned int coherent_count;
+ u32 as_mob : 1;
+ u32 cpu_blit : 1;
+@@ -72,7 +72,7 @@ struct vmw_validation_bo_node {
+ */
+ struct vmw_validation_res_node {
+ struct list_head head;
+- struct drm_hash_item hash;
++ struct vmwgfx_hash_item hash;
+ struct vmw_resource *res;
+ struct vmw_buffer_object *new_backup;
+ unsigned long new_backup_offset;
+@@ -184,9 +184,9 @@ vmw_validation_find_bo_dup(struct vmw_validation_context *ctx,
+ return NULL;
+
+ if (ctx->ht) {
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+
+- if (!drm_ht_find_item(ctx->ht, (unsigned long) vbo, &hash))
++ if (!vmwgfx_ht_find_item(ctx->ht, (unsigned long) vbo, &hash))
+ bo_node = container_of(hash, typeof(*bo_node), hash);
+ } else {
+ struct vmw_validation_bo_node *entry;
+@@ -221,9 +221,9 @@ vmw_validation_find_res_dup(struct vmw_validation_context *ctx,
+ return NULL;
+
+ if (ctx->ht) {
+- struct drm_hash_item *hash;
++ struct vmwgfx_hash_item *hash;
+
+- if (!drm_ht_find_item(ctx->ht, (unsigned long) res, &hash))
++ if (!vmwgfx_ht_find_item(ctx->ht, (unsigned long) res, &hash))
+ res_node = container_of(hash, typeof(*res_node), hash);
+ } else {
+ struct vmw_validation_res_node *entry;
+@@ -280,7 +280,7 @@ int vmw_validation_add_bo(struct vmw_validation_context *ctx,
+
+ if (ctx->ht) {
+ bo_node->hash.key = (unsigned long) vbo;
+- ret = drm_ht_insert_item(ctx->ht, &bo_node->hash);
++ ret = vmwgfx_ht_insert_item(ctx->ht, &bo_node->hash);
+ if (ret) {
+ DRM_ERROR("Failed to initialize a buffer "
+ "validation entry.\n");
+@@ -335,7 +335,7 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+
+ if (ctx->ht) {
+ node->hash.key = (unsigned long) res;
+- ret = drm_ht_insert_item(ctx->ht, &node->hash);
++ ret = vmwgfx_ht_insert_item(ctx->ht, &node->hash);
+ if (ret) {
+ DRM_ERROR("Failed to initialize a resource validation "
+ "entry.\n");
+@@ -688,13 +688,13 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
+ return;
+
+ list_for_each_entry(entry, &ctx->bo_list, base.head)
+- (void) drm_ht_remove_item(ctx->ht, &entry->hash);
++ (void) vmwgfx_ht_remove_item(ctx->ht, &entry->hash);
+
+ list_for_each_entry(val, &ctx->resource_list, head)
+- (void) drm_ht_remove_item(ctx->ht, &val->hash);
++ (void) vmwgfx_ht_remove_item(ctx->ht, &val->hash);
+
+ list_for_each_entry(val, &ctx->resource_ctx_list, head)
+- (void) drm_ht_remove_item(ctx->ht, &val->hash);
++ (void) vmwgfx_ht_remove_item(ctx->ht, &val->hash);
+
+ ctx->ht = NULL;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
+index 739906d1b3ebb..495fd504b8c62 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
+@@ -31,9 +31,10 @@
+ #include <linux/list.h>
+ #include <linux/ww_mutex.h>
+
+-#include <drm/drm_hashtab.h>
+ #include <drm/ttm/ttm_execbuf_util.h>
+
++#include "vmwgfx_hashtab.h"
++
+ #define VMW_RES_DIRTY_NONE 0
+ #define VMW_RES_DIRTY_SET BIT(0)
+ #define VMW_RES_DIRTY_CLEAR BIT(1)
+@@ -73,7 +74,7 @@ struct vmw_validation_mem {
+ * @total_mem: Amount of reserved memory.
+ */
+ struct vmw_validation_context {
+- struct drm_open_hash *ht;
++ struct vmwgfx_open_hash *ht;
+ struct list_head resource_list;
+ struct list_head resource_ctx_list;
+ struct list_head bo_list;
+@@ -151,7 +152,7 @@ vmw_validation_set_val_mem(struct vmw_validation_context *ctx,
+ * available at validation context declaration time
+ */
+ static inline void vmw_validation_set_ht(struct vmw_validation_context *ctx,
+- struct drm_open_hash *ht)
++ struct vmwgfx_open_hash *ht)
+ {
+ ctx->ht = ht;
+ }
+--
+2.51.0
+
--- /dev/null
+From fea81d37e21083f9b63a6b989df28431f8ca89b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index 41b7417cb5d3d..4633bd3081852 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -343,8 +343,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ }
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From 75593dc6a09e0723a69306785d9ff1ff301fb0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index cbbbd105a5a7b..26d70ac90933c 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 072019ce77219728f87d7b460ec4bf98efa27d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 20:26:18 +0200
+Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ]
+
+The of_gpio_n_cells default is 2 when ->of_xlate() callback is
+not defined. No need to assign it explicitly in the driver.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index c00968ce7a569..cbbbd105a5a7b 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->of_gpio_n_cells = 2;
+ chip->can_sleep = false;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+--
+2.51.0
+
--- /dev/null
+From 28950f1fc7915ecfc6851edfa36a799e635e7a97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index 4d0c02ba3f7d3..1187415e26990 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -211,6 +211,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From ecc6cf15b36ca568b923e85ec1c75818d7e3fb20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 136c1f67dd223..e64f7157f065f 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 16600b073e50a08cf18cf05a67c2aa3618fbf847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index be06de791c544..136c1f67dd223 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From 61c65078f3c7ab903ee8ab0855ec8f835a963e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index 9d58d83344670..ea49b0df397e5 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7c7e156202a0a27f4ddeb90dc136b16bb19c4f58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 3bd3603873e32..efbb01460f4ba 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1176,9 +1176,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 6260e303bbf3e865ac3b2b54cebe637de68cd5bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index b5f5ee233b59d..5a883bd722f5d 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -880,7 +880,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From 653349d60f4c061dcccbc356f7c33d79f9efd095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Sep 2022 21:03:16 +0800
+Subject: perf arm-spe: augment the data source type with neoverse_spe list
+
+From: Jing Zhang <renyu.zj@linux.alibaba.com>
+
+[ Upstream commit 74a61d53a6d1ca1172d85964d15c83c2cc3670b3 ]
+
+When synthesizing event with SPE data source, commit 4e6430cbb1a9("perf
+arm-spe: Use SPE data source for neoverse cores") augment the type with
+source information by MIDR. However, is_midr_in_range only compares the
+first entry in neoverse_spe.
+
+Change is_midr_in_range to is_midr_in_range_list to traverse the
+neoverse_spe array so that all neoverse cores synthesize event with data
+source packet.
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: Ali Saidi <alisaidi@amazon.com>
+Reviewed-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.garry@huawei.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Shuai Xue <xueshuai@linux.alibaba.com>
+Cc: Timothy Hayes <timothy.hayes@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Zhuo Song <zhuo.song@linux.alibaba.com>
+Link: https://lore.kernel.org/r/1664197396-42672-1-git-send-email-renyu.zj@linux.alibaba.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 9e7e56596c60e..2d7fc2b01f36b 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+ union perf_mem_data_src data_src = { 0 };
+- bool is_neoverse = is_midr_in_range(midr, neoverse_spe);
++ bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
+
+ if (record->op == ARM_SPE_LD)
+ data_src.mem_op = PERF_MEM_OP_LOAD;
+--
+2.51.0
+
--- /dev/null
+From 4ec36ddd5da5384e5bf6e39fcd97518c65ab172b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 15:15:06 +0000
+Subject: perf arm-spe: Refactor arm-spe to support operation packet type
+
+From: German Gomez <german.gomez@arm.com>
+
+[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ]
+
+Extend the decoder of Arm SPE records to support more fields from the
+operation packet type.
+
+Not all fields are being decoded by this commit. Only those needed to
+support the use-case SVE load/store/other operations.
+
+Suggested-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: German Gomez <german.gomez@arm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Anshuman.Khandual@arm.com
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/r/20230320151509.1137462-2-james.clark@arm.com
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++--
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++----
+ tools/perf/util/arm-spe.c | 8 ++--
+ 3 files changed, 67 insertions(+), 18 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+index 3e36934477154..3b937e89654f4 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+@@ -184,11 +184,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ decoder->record.context_id = payload;
+ break;
+ case ARM_SPE_OP_TYPE:
+- if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) {
+- if (payload & 0x1)
+- decoder->record.op = ARM_SPE_ST;
++ switch (idx) {
++ case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC:
++ decoder->record.op |= ARM_SPE_OP_LDST;
++ if (payload & SPE_OP_PKT_ST)
++ decoder->record.op |= ARM_SPE_OP_ST;
+ else
+- decoder->record.op = ARM_SPE_LD;
++ decoder->record.op |= ARM_SPE_OP_LD;
++ if (SPE_OP_PKT_IS_LDST_SVE(payload))
++ decoder->record.op |= ARM_SPE_OP_SVE_LDST;
++ break;
++ case SPE_OP_PKT_HDR_CLASS_OTHER:
++ decoder->record.op |= ARM_SPE_OP_OTHER;
++ if (SPE_OP_PKT_IS_OTHER_SVE_OP(payload))
++ decoder->record.op |= ARM_SPE_OP_SVE_OTHER;
++ break;
++ case SPE_OP_PKT_HDR_CLASS_BR_ERET:
++ decoder->record.op |= ARM_SPE_OP_BRANCH_ERET;
++ break;
++ default:
++ pr_err("Get packet error!\n");
++ return -1;
+ }
+ break;
+ case ARM_SPE_EVENTS:
+@@ -216,6 +232,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ if (payload & BIT(EV_MISPRED))
+ decoder->record.type |= ARM_SPE_BRANCH_MISS;
+
++ if (payload & BIT(EV_PARTIAL_PREDICATE))
++ decoder->record.type |= ARM_SPE_SVE_PARTIAL_PRED;
++
++ if (payload & BIT(EV_EMPTY_PREDICATE))
++ decoder->record.type |= ARM_SPE_SVE_EMPTY_PRED;
++
+ break;
+ case ARM_SPE_DATA_SOURCE:
+ decoder->record.source = payload;
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index c3943eb95e305..fa269c9c53b33 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -14,19 +14,46 @@
+ #include "arm-spe-pkt-decoder.h"
+
+ enum arm_spe_sample_type {
+- ARM_SPE_L1D_ACCESS = 1 << 0,
+- ARM_SPE_L1D_MISS = 1 << 1,
+- ARM_SPE_LLC_ACCESS = 1 << 2,
+- ARM_SPE_LLC_MISS = 1 << 3,
+- ARM_SPE_TLB_ACCESS = 1 << 4,
+- ARM_SPE_TLB_MISS = 1 << 5,
+- ARM_SPE_BRANCH_MISS = 1 << 6,
+- ARM_SPE_REMOTE_ACCESS = 1 << 7,
++ ARM_SPE_L1D_ACCESS = 1 << 0,
++ ARM_SPE_L1D_MISS = 1 << 1,
++ ARM_SPE_LLC_ACCESS = 1 << 2,
++ ARM_SPE_LLC_MISS = 1 << 3,
++ ARM_SPE_TLB_ACCESS = 1 << 4,
++ ARM_SPE_TLB_MISS = 1 << 5,
++ ARM_SPE_BRANCH_MISS = 1 << 6,
++ ARM_SPE_REMOTE_ACCESS = 1 << 7,
++ ARM_SPE_SVE_PARTIAL_PRED = 1 << 8,
++ ARM_SPE_SVE_EMPTY_PRED = 1 << 9,
+ };
+
+ enum arm_spe_op_type {
+- ARM_SPE_LD = 1 << 0,
+- ARM_SPE_ST = 1 << 1,
++ /* First level operation type */
++ ARM_SPE_OP_OTHER = 1 << 0,
++ ARM_SPE_OP_LDST = 1 << 1,
++ ARM_SPE_OP_BRANCH_ERET = 1 << 2,
++
++ /* Second level operation type for OTHER */
++ ARM_SPE_OP_SVE_OTHER = 1 << 16,
++ ARM_SPE_OP_SVE_FP = 1 << 17,
++ ARM_SPE_OP_SVE_PRED_OTHER = 1 << 18,
++
++ /* Second level operation type for LDST */
++ ARM_SPE_OP_LD = 1 << 16,
++ ARM_SPE_OP_ST = 1 << 17,
++ ARM_SPE_OP_ATOMIC = 1 << 18,
++ ARM_SPE_OP_EXCL = 1 << 19,
++ ARM_SPE_OP_AR = 1 << 20,
++ ARM_SPE_OP_SIMD_FP = 1 << 21,
++ ARM_SPE_OP_GP_REG = 1 << 22,
++ ARM_SPE_OP_UNSPEC_REG = 1 << 23,
++ ARM_SPE_OP_NV_SYSREG = 1 << 24,
++ ARM_SPE_OP_SVE_LDST = 1 << 25,
++ ARM_SPE_OP_SVE_PRED_LDST = 1 << 26,
++ ARM_SPE_OP_SVE_SG = 1 << 27,
++
++ /* Second level operation type for BRANCH_ERET */
++ ARM_SPE_OP_BR_COND = 1 << 16,
++ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+ enum arm_spe_neoverse_data_source {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 2d7fc2b01f36b..c86e60b5954c5 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -336,7 +336,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We have no data on the hit level or data source for stores in the
+ * Neoverse SPE records.
+ */
+- if (record->op & ARM_SPE_ST) {
++ if (record->op & ARM_SPE_OP_ST) {
+ data_src->mem_lvl = PERF_MEM_LVL_NA;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NA;
+@@ -422,12 +422,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+- union perf_mem_data_src data_src = { 0 };
++ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+ bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
+
+- if (record->op == ARM_SPE_LD)
++ if (record->op & ARM_SPE_OP_LD)
+ data_src.mem_op = PERF_MEM_OP_LOAD;
+- else if (record->op == ARM_SPE_ST)
++ else if (record->op & ARM_SPE_OP_ST)
+ data_src.mem_op = PERF_MEM_OP_STORE;
+ else
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 2682f978eb47e3f63dc0745dbbb1a849e1b07584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 19:53:17 +0100
+Subject: perf arm-spe: Rename the common data source encoding
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
+
+The Neoverse CPUs follow the common data source encoding, and other
+CPU variants can share the same format.
+
+Rename the CPU list and data source definitions as common data source
+names. This change prepares for appending more CPU variants.
+
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------
+ tools/perf/util/arm-spe.c | 28 +++++++++----------
+ 2 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index fa269c9c53b33..d9166794e527f 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -56,15 +56,15 @@ enum arm_spe_op_type {
+ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+-enum arm_spe_neoverse_data_source {
+- ARM_SPE_NV_L1D = 0x0,
+- ARM_SPE_NV_L2 = 0x8,
+- ARM_SPE_NV_PEER_CORE = 0x9,
+- ARM_SPE_NV_LOCAL_CLUSTER = 0xa,
+- ARM_SPE_NV_SYS_CACHE = 0xb,
+- ARM_SPE_NV_PEER_CLUSTER = 0xc,
+- ARM_SPE_NV_REMOTE = 0xd,
+- ARM_SPE_NV_DRAM = 0xe,
++enum arm_spe_common_data_source {
++ ARM_SPE_COMMON_DS_L1D = 0x0,
++ ARM_SPE_COMMON_DS_L2 = 0x8,
++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9,
++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa,
++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb,
++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc,
++ ARM_SPE_COMMON_DS_REMOTE = 0xd,
++ ARM_SPE_COMMON_DS_DRAM = 0xe,
+ };
+
+ struct arm_spe_record {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index c86e60b5954c5..68445c1e1db3b 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -314,15 +314,15 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq,
+ return arm_spe_deliver_synth_event(spe, speq, event, &sample);
+ }
+
+-static const struct midr_range neoverse_spe[] = {
++static const struct midr_range common_ds_encoding_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+ {},
+ };
+
+-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record,
+- union perf_mem_data_src *data_src)
++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
+ {
+ /*
+ * Even though four levels of cache hierarchy are possible, no known
+@@ -344,17 +344,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ }
+
+ switch (record->source) {
+- case ARM_SPE_NV_L1D:
++ case ARM_SPE_COMMON_DS_L1D:
+ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_L2:
++ case ARM_SPE_COMMON_DS_L2:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_PEER_CORE:
++ case ARM_SPE_COMMON_DS_PEER_CORE:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -363,8 +363,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know if this is L1, L2 but we do know it was a cache-2-cache
+ * transfer, so set SNOOPX_PEER
+ */
+- case ARM_SPE_NV_LOCAL_CLUSTER:
+- case ARM_SPE_NV_PEER_CLUSTER:
++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER:
++ case ARM_SPE_COMMON_DS_PEER_CLUSTER:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -372,7 +372,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ /*
+ * System cache is assumed to be L3
+ */
+- case ARM_SPE_NV_SYS_CACHE:
++ case ARM_SPE_COMMON_DS_SYS_CACHE:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoop = PERF_MEM_SNOOP_HIT;
+@@ -381,13 +381,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know what level it hit in, except it came from the other
+ * socket
+ */
+- case ARM_SPE_NV_REMOTE:
++ case ARM_SPE_COMMON_DS_REMOTE:
+ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+- case ARM_SPE_NV_DRAM:
++ case ARM_SPE_COMMON_DS_DRAM:
+ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+@@ -423,7 +423,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus);
+
+ if (record->op & ARM_SPE_OP_LD)
+ data_src.mem_op = PERF_MEM_OP_LOAD;
+@@ -432,8 +432,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m
+ else
+ return 0;
+
+- if (is_neoverse)
+- arm_spe__synth_data_source_neoverse(record, &data_src);
++ if (is_common)
++ arm_spe__synth_data_source_common(record, &data_src);
+ else
+ arm_spe__synth_data_source_generic(record, &data_src);
+
+--
+2.51.0
+
--- /dev/null
+From ad7020e05e83a6049b828ad6de58864d864d02c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Nov 2021 13:36:24 +0000
+Subject: perf arm-spe: Save context ID in record
+
+From: German Gomez <german.gomez@arm.com>
+
+[ Upstream commit 169de64f5dc22d9984d45c1f119fb644fa16d64a ]
+
+This patch is to save context ID in record, this will be used to set TID
+for samples.
+
+Reviewed-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: German Gomez <german.gomez@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/r/20211111133625.193568-4-german.gomez@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe-decoder/arm-spe-decoder.c | 2 ++
+ tools/perf/util/arm-spe-decoder/arm-spe-decoder.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+index 32fe41835fa68..3fc528c9270c2 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+@@ -151,6 +151,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ u64 payload, ip;
+
+ memset(&decoder->record, 0x0, sizeof(decoder->record));
++ decoder->record.context_id = (u64)-1;
+
+ while (1) {
+ err = arm_spe_get_next_packet(decoder);
+@@ -180,6 +181,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ case ARM_SPE_COUNTER:
+ break;
+ case ARM_SPE_CONTEXT:
++ decoder->record.context_id = payload;
+ break;
+ case ARM_SPE_OP_TYPE:
+ if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) {
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 59bdb73096741..46a8556a9e956 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -38,6 +38,7 @@ struct arm_spe_record {
+ u64 timestamp;
+ u64 virt_addr;
+ u64 phys_addr;
++ u64 context_id;
+ };
+
+ struct arm_spe_insn;
+--
+2.51.0
+
--- /dev/null
+From c921941a6d3aafe12beba046b9e0b95909d3dc54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Aug 2022 14:24:39 +0800
+Subject: perf arm-spe: Use SPE data source for neoverse cores
+
+From: Ali Saidi <alisaidi@amazon.com>
+
+[ Upstream commit 4e6430cbb1a9f1dc0a698f93026b6178da437798 ]
+
+When synthesizing data from SPE, augment the type with source information
+for Arm Neoverse cores. The field is IMPLDEF but the Neoverse cores all use
+the same encoding. I can't find encoding information for any other SPE
+implementations to unify their choices with Arm's thus that is left for
+future work.
+
+This change populates the mem_lvl_num for Neoverse cores as well as the
+deprecated mem_lvl namespace.
+
+Reviewed-by: German Gomez <german.gomez@arm.com>
+Reviewed-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Ali Saidi <alisaidi@amazon.com>
+Tested-by: Leo Yan <leo.yan@linaro.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Anshuman Khandual <anshuman.khandual@arm.com>
+Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Like Xu <likexu@tencent.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Timothy Hayes <timothy.hayes@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/r/20220811062451.435810-4-leo.yan@linaro.org
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 039fd0634a06 ("perf arm_spe: Correct setting remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.c | 1 +
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 12 ++
+ tools/perf/util/arm-spe.c | 130 +++++++++++++++---
+ 3 files changed, 127 insertions(+), 16 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+index 3fc528c9270c2..3e36934477154 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+@@ -218,6 +218,7 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+
+ break;
+ case ARM_SPE_DATA_SOURCE:
++ decoder->record.source = payload;
+ break;
+ case ARM_SPE_BAD:
+ break;
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 46a8556a9e956..c3943eb95e305 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -29,6 +29,17 @@ enum arm_spe_op_type {
+ ARM_SPE_ST = 1 << 1,
+ };
+
++enum arm_spe_neoverse_data_source {
++ ARM_SPE_NV_L1D = 0x0,
++ ARM_SPE_NV_L2 = 0x8,
++ ARM_SPE_NV_PEER_CORE = 0x9,
++ ARM_SPE_NV_LOCAL_CLUSTER = 0xa,
++ ARM_SPE_NV_SYS_CACHE = 0xb,
++ ARM_SPE_NV_PEER_CLUSTER = 0xc,
++ ARM_SPE_NV_REMOTE = 0xd,
++ ARM_SPE_NV_DRAM = 0xe,
++};
++
+ struct arm_spe_record {
+ enum arm_spe_sample_type type;
+ int err;
+@@ -39,6 +50,7 @@ struct arm_spe_record {
+ u64 virt_addr;
+ u64 phys_addr;
+ u64 context_id;
++ u16 source;
+ };
+
+ struct arm_spe_insn;
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 569e1b8ad0abc..7b16898af4e7f 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -34,6 +34,7 @@
+ #include "arm-spe-decoder/arm-spe-decoder.h"
+ #include "arm-spe-decoder/arm-spe-pkt-decoder.h"
+
++#include "../../arch/arm64/include/asm/cputype.h"
+ #define MAX_TIMESTAMP (~0ULL)
+
+ struct arm_spe {
+@@ -45,6 +46,7 @@ struct arm_spe {
+ struct perf_session *session;
+ struct machine *machine;
+ u32 pmu_type;
++ u64 midr;
+
+ struct perf_tsc_conversion tc;
+
+@@ -312,35 +314,128 @@ static int arm_spe__synth_branch_sample(struct arm_spe_queue *speq,
+ return arm_spe_deliver_synth_event(spe, speq, event, &sample);
+ }
+
+-static u64 arm_spe__synth_data_source(const struct arm_spe_record *record)
++static const struct midr_range neoverse_spe[] = {
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
++ {},
++};
++
++static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
+ {
+- union perf_mem_data_src data_src = { 0 };
++ /*
++ * Even though four levels of cache hierarchy are possible, no known
++ * production Neoverse systems currently include more than three levels
++ * so for the time being we assume three exist. If a production system
++ * is built with four the this function would have to be changed to
++ * detect the number of levels for reporting.
++ */
+
+- if (record->op == ARM_SPE_LD)
+- data_src.mem_op = PERF_MEM_OP_LOAD;
+- else if (record->op == ARM_SPE_ST)
+- data_src.mem_op = PERF_MEM_OP_STORE;
+- else
+- return 0;
++ /*
++ * We have no data on the hit level or data source for stores in the
++ * Neoverse SPE records.
++ */
++ if (record->op & ARM_SPE_ST) {
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
++ data_src->mem_snoop = PERF_MEM_SNOOP_NA;
++ return;
++ }
++
++ switch (record->source) {
++ case ARM_SPE_NV_L1D:
++ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1;
++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
++ break;
++ case ARM_SPE_NV_L2:
++ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
++ break;
++ case ARM_SPE_NV_PEER_CORE:
++ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
++ break;
++ /*
++ * We don't know if this is L1, L2 but we do know it was a cache-2-cache
++ * transfer, so set SNOOPX_PEER
++ */
++ case ARM_SPE_NV_LOCAL_CLUSTER:
++ case ARM_SPE_NV_PEER_CLUSTER:
++ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
++ break;
++ /*
++ * System cache is assumed to be L3
++ */
++ case ARM_SPE_NV_SYS_CACHE:
++ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
++ data_src->mem_snoop = PERF_MEM_SNOOP_HIT;
++ break;
++ /*
++ * We don't know what level it hit in, except it came from the other
++ * socket
++ */
++ case ARM_SPE_NV_REMOTE:
++ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
++ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
++ break;
++ case ARM_SPE_NV_DRAM:
++ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM;
++ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
++ break;
++ default:
++ break;
++ }
++}
+
++static void arm_spe__synth_data_source_generic(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
++{
+ if (record->type & (ARM_SPE_LLC_ACCESS | ARM_SPE_LLC_MISS)) {
+- data_src.mem_lvl = PERF_MEM_LVL_L3;
++ data_src->mem_lvl = PERF_MEM_LVL_L3;
+
+ if (record->type & ARM_SPE_LLC_MISS)
+- data_src.mem_lvl |= PERF_MEM_LVL_MISS;
++ data_src->mem_lvl |= PERF_MEM_LVL_MISS;
+ else
+- data_src.mem_lvl |= PERF_MEM_LVL_HIT;
++ data_src->mem_lvl |= PERF_MEM_LVL_HIT;
+ } else if (record->type & (ARM_SPE_L1D_ACCESS | ARM_SPE_L1D_MISS)) {
+- data_src.mem_lvl = PERF_MEM_LVL_L1;
++ data_src->mem_lvl = PERF_MEM_LVL_L1;
+
+ if (record->type & ARM_SPE_L1D_MISS)
+- data_src.mem_lvl |= PERF_MEM_LVL_MISS;
++ data_src->mem_lvl |= PERF_MEM_LVL_MISS;
+ else
+- data_src.mem_lvl |= PERF_MEM_LVL_HIT;
++ data_src->mem_lvl |= PERF_MEM_LVL_HIT;
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src.mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++}
++
++static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
++{
++ union perf_mem_data_src data_src = { 0 };
++ bool is_neoverse = is_midr_in_range(midr, neoverse_spe);
++
++ if (record->op == ARM_SPE_LD)
++ data_src.mem_op = PERF_MEM_OP_LOAD;
++ else if (record->op == ARM_SPE_ST)
++ data_src.mem_op = PERF_MEM_OP_STORE;
++ else
++ return 0;
++
++ if (is_neoverse)
++ arm_spe__synth_data_source_neoverse(record, &data_src);
++ else
++ arm_spe__synth_data_source_generic(record, &data_src);
+
+ if (record->type & (ARM_SPE_TLB_ACCESS | ARM_SPE_TLB_MISS)) {
+ data_src.mem_dtlb = PERF_MEM_TLB_WK;
+@@ -361,7 +456,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq)
+ u64 data_src;
+ int err;
+
+- data_src = arm_spe__synth_data_source(record);
++ data_src = arm_spe__synth_data_source(record, spe->midr);
+
+ if (spe->sample_flc) {
+ if (record->type & ARM_SPE_L1D_MISS) {
+@@ -1047,6 +1142,8 @@ int arm_spe_process_auxtrace_info(union perf_event *event,
+ struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
+ size_t min_sz = sizeof(u64) * ARM_SPE_AUXTRACE_PRIV_MAX;
+ struct perf_record_time_conv *tc = &session->time_conv;
++ const char *cpuid = perf_env__cpuid(session->evlist->env);
++ u64 midr = strtol(cpuid, NULL, 16);
+ struct arm_spe *spe;
+ int err;
+
+@@ -1066,6 +1163,7 @@ int arm_spe_process_auxtrace_info(union perf_event *event,
+ spe->machine = &session->machines.host; /* No kvm support */
+ spe->auxtrace_type = auxtrace_info->type;
+ spe->pmu_type = auxtrace_info->priv[ARM_SPE_PMU_TYPE];
++ spe->midr = midr;
+
+ spe->timeless_decoding = arm_spe__is_timeless_decoding(spe);
+
+--
+2.51.0
+
--- /dev/null
+From 67f619bb4b76be404b427893d3befb7b3aad0929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:09 +0100
+Subject: perf arm_spe: Correct memory level for remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
+
+For remote accesses, the data source packet does not contain information
+about the memory level. To avoid misinformation, set the memory level to
+NA (Not Available).
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 68445c1e1db3b..98d6cfadb1130 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -382,8 +382,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor
+ * socket
+ */
+ case ARM_SPE_COMMON_DS_REMOTE:
+- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 0c2f44bd920716a99c70d623ef2a7ab46d06dbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:08 +0100
+Subject: perf arm_spe: Correct setting remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
+
+Set the mem_remote field for a remote access to appropriately represent
+the event.
+
+Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 7b16898af4e7f..9e7e56596c60e 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -417,7 +417,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ }
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+--
+2.51.0
+
--- /dev/null
+From e2ec384b9c03c92b759b2975e509b8270d8a3aa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:17 -0700
+Subject: perf evsel: Avoid container_of on a NULL leader
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
+
+An evsel should typically have a leader of itself, however, in tests
+like 'Sample parsing' a NULL leader may occur and the container_of
+will return a corrupt pointer.
+
+Avoid this with an explicit NULL test.
+
+Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index f14c83e6829a8..a9cb1aede476e 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2930,6 +2930,8 @@ bool evsel__is_hybrid(struct evsel *evsel)
+
+ struct evsel *evsel__leader(struct evsel *evsel)
+ {
++ if (evsel->core.leader == NULL)
++ return NULL;
+ return container_of(evsel->core.leader, struct evsel, core);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9728ce23678e16d4400a57aa4ce4547876f1f9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 562e9b8080272..0ecfda9d9f8b4 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1598,7 +1598,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED ||
+ tool->compressed == perf_session__process_compressed_event_stub)
+--
+2.51.0
+
--- /dev/null
+From 3e0dc42387952be7a10faadf2d1bca783739e099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 0df471bf1590e..b215e89b65f7d 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -115,6 +115,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -126,6 +127,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -137,6 +139,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -149,6 +152,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 00f972eb3ec07f28ffaac17af9e6c9ead32ffe65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index 51424cdc3b682..aa9a0ebc1f937 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From f6ab06696028b1447be33b6248564916b643b638 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index d1d5a44d9122a..3b3aaa7d8283c 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From d892992f8b682b77fbbe3a078c51c9ed25816ee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 13:39:16 +0200
+Subject: s390/cio: unregister the subchannel while purging
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit fa172f043f5bc21c357c54a6ca2e9c8acd18c3db ]
+
+The cio_ignore list is used to create and maintain the list of devices
+which is to be ignored by Linux. During boot-time, this list is adjusted
+and accommodate all the devices which are configured on the HMC
+interface. Once these devices are accessible, they are then available to
+Linux and set online.
+
+cio_ignore purge function should align with this functionality. But
+currently, the subchannel associated with the offline-devices are not
+unregistered during purge. Add an explicit subchannel-unregister function
+in the purge_fn callback.
+
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Stable-dep-of: 9daa5a879586 ("s390/cio: Update purge function to unregister the unused subchannels")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index c2ed91b69f079..70c5b85d2dfc9 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1327,6 +1327,7 @@ static int purge_fn(struct device *dev, void *data)
+ {
+ struct ccw_device *cdev = to_ccwdev(dev);
+ struct ccw_dev_id *id = &cdev->private->dev_id;
++ struct subchannel *sch = to_subchannel(cdev->dev.parent);
+
+ spin_lock_irq(cdev->ccwlock);
+ if (is_blacklisted(id->ssid, id->devno) &&
+@@ -1335,6 +1336,7 @@ static int purge_fn(struct device *dev, void *data)
+ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+ id->devno);
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+ spin_unlock_irq(cdev->ccwlock);
+--
+2.51.0
+
--- /dev/null
+From 74b0bb4c573f9eca8e5d9227f7c6e357c20a402b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 15:38:17 +0200
+Subject: s390/cio: Update purge function to unregister the unused subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
+
+Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers")', cio no longer unregisters
+subchannels when the attached device is invalid or unavailable.
+
+As an unintended side-effect, the cio_ignore purge function no longer
+removes subchannels for devices on the cio_ignore list if no CCW device
+is attached. This situation occurs when a CCW device is non-operational
+or unavailable
+
+To ensure the same outcome of the purge function as when the
+current cio_ignore list had been active during boot, update the purge
+function to remove I/O subchannels without working CCW devices if the
+associated device number is found on the cio_ignore list.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 70c5b85d2dfc9..22fa1296a5168 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1323,23 +1323,34 @@ void ccw_device_schedule_recovery(void)
+ spin_unlock_irqrestore(&recovery_lock, flags);
+ }
+
+-static int purge_fn(struct device *dev, void *data)
++static int purge_fn(struct subchannel *sch, void *data)
+ {
+- struct ccw_device *cdev = to_ccwdev(dev);
+- struct ccw_dev_id *id = &cdev->private->dev_id;
+- struct subchannel *sch = to_subchannel(cdev->dev.parent);
++ struct ccw_device *cdev;
+
+- spin_lock_irq(cdev->ccwlock);
+- if (is_blacklisted(id->ssid, id->devno) &&
+- (cdev->private->state == DEV_STATE_OFFLINE) &&
+- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
+- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+- id->devno);
++ spin_lock_irq(&sch->lock);
++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv)
++ goto unlock;
++
++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev))
++ goto unlock;
++
++ cdev = sch_get_cdev(sch);
++ if (cdev) {
++ if (cdev->private->state != DEV_STATE_OFFLINE)
++ goto unlock;
++
++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
++ goto unlock;
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+- css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+- spin_unlock_irq(cdev->ccwlock);
++
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid,
++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)");
++
++unlock:
++ spin_unlock_irq(&sch->lock);
+ /* Abort loop in case of pending signal. */
+ if (signal_pending(current))
+ return -EINTR;
+@@ -1355,7 +1366,7 @@ static int purge_fn(struct device *dev, void *data)
+ int ccw_purge_blacklisted(void)
+ {
+ CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n");
+- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn);
++ for_each_subchannel_staged(purge_fn, NULL, NULL);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 393b5fd8b6f9e7b0e352a2e733f8eee9ba9f09d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:15:57 +0800
+Subject: scsi: libsas: Add sas_task_find_rq()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
+
+blk-mq already provides a unique tag per request. Some libsas LLDDs - like
+hisi_sas - already use this tag as the unique per-I/O HW tag.
+
+Add a common function to provide the request associated with a sas_task for
+all libsas LLDDs.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/scsi/libsas.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 306005b3b60f3..97e99385f70ce 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -631,6 +631,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);
+ extern struct sas_task *sas_alloc_slow_task(gfp_t flags);
+ extern void sas_free_task(struct sas_task *task);
+
++static inline struct request *sas_task_find_rq(struct sas_task *task)
++{
++ struct scsi_cmnd *scmd;
++
++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) {
++ struct ata_queued_cmd *qc = task->uldd_task;
++
++ scmd = qc ? qc->scsicmd : NULL;
++ } else {
++ scmd = task->uldd_task;
++ }
++
++ if (!scmd)
++ return NULL;
++
++ return scsi_cmd_to_rq(scmd);
++}
++
+ struct sas_domain_function_template {
+ /* The class calls these to notify the LLDD of an event. */
+ void (*lldd_port_formed)(struct asd_sas_phy *);
+--
+2.51.0
+
--- /dev/null
+From 81e9b927529f27e4896cc2ea78af5a6c465456ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:02 +0800
+Subject: scsi: mvsas: Delete mvs_tag_init()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
+
+All mvs_tag_init() does is zero the tag bitmap, but this is already done
+with the kzalloc() call to alloc the tags, so delete this unneeded
+function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 --
+ drivers/scsi/mvsas/mv_sas.c | 7 -------
+ drivers/scsi/mvsas/mv_sas.h | 1 -
+ 3 files changed, 10 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 1c98662db080f..e2093e7637d82 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ }
+ mvi->tags_num = slot_nr;
+
+- /* Initialize tags */
+- mvs_tag_init(mvi);
+ return 0;
+ err_out:
+ return 1;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index efd11fabff937..3b4576dba590e 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ return 0;
+ }
+
+-void mvs_tag_init(struct mvs_info *mvi)
+-{
+- int i;
+- for (i = 0; i < mvi->tags_num; ++i)
+- mvs_tag_clear(mvi, i);
+-}
+-
+ static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev)
+ {
+ unsigned long i = 0, j = 0, hi = 0;
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index fa654c73beeee..8dd30f8b478ec 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+ int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+-void mvs_tag_init(struct mvs_info *mvi);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
--- /dev/null
+From 263bd482bf21b8ff1de7f420321969dab6157737 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 5f217f9ab5223..d348350c15094 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From 33e1645e9ee8d12b5eb93435bb4937834787ebcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:03 +0800
+Subject: scsi: mvsas: Use sas_task_find_rq() for tagging
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
+
+The request associated with a SCSI command coming from the block layer has
+a unique tag, so use that when possible for getting a slot.
+
+Unfortunately we don't support reserved commands in the SCSI midlayer yet.
+As such, SMP tasks - as an example - will not have a request associated, so
+in the interim continue to manage those tags for that type of sas_task
+internally.
+
+We reserve an arbitrary 4 tags for these internal tags. Indeed, we already
+decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag
+MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
+mvsas: add support for 94xx; layout change; bug fixes"), but what those 2
+slots are used for is not obvious.
+
+Also make the tag management functions static, where possible.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_defs.h | 1 +
+ drivers/scsi/mvsas/mv_init.c | 9 +++++----
+ drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++-------------
+ drivers/scsi/mvsas/mv_sas.h | 7 +------
+ 4 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h
+index 7123a2efbf583..8ef174cd4d374 100644
+--- a/drivers/scsi/mvsas/mv_defs.h
++++ b/drivers/scsi/mvsas/mv_defs.h
+@@ -40,6 +40,7 @@ enum driver_configuration {
+ MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */
+ MVS_OAF_SZ = 64, /* Open address frame buffer size */
+ MVS_QUEUE_SIZE = 64, /* Support Queue depth */
++ MVS_RSVD_SLOTS = 4,
+ MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2,
+ };
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index e2093e7637d82..5f217f9ab5223 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+ cancel_delayed_work(&mwq->work_q);
+- kfree(mvi->tags);
++ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+
+@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name);
+ goto err_out;
+ }
+- mvi->tags_num = slot_nr;
+
+ return 0;
+ err_out:
+@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev,
+ mvi->sas = sha;
+ mvi->shost = shost;
+
+- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL);
+- if (!mvi->tags)
++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL);
++ if (!mvi->rsvd_tags)
+ goto err_out;
+
+ if (MVS_CHIP_DISP->chip_ioremap(mvi))
+@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,
+ else
+ can_queue = MVS_CHIP_SLOT_SZ;
+
++ can_queue -= MVS_RSVD_SLOTS;
++
+ shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG);
+ shost->can_queue = can_queue;
+ mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 3b4576dba590e..e79297395ac77 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)
+ return 0;
+ }
+
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ clear_bit(tag, bitmap);
+ }
+
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_free(struct mvs_info *mvi, u32 tag)
+ {
++ if (tag >= MVS_RSVD_SLOTS)
++ return;
++
+ mvs_tag_clear(mvi, tag);
+ }
+
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ set_bit(tag, bitmap);
+ }
+
+-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ {
+ unsigned int index, tag;
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+
+- index = find_first_zero_bit(bitmap, mvi->tags_num);
++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS);
+ tag = index;
+- if (tag >= mvi->tags_num)
++ if (tag >= MVS_RSVD_SLOTS)
+ return -SAS_QUEUE_FULL;
+ mvs_tag_set(mvi, tag);
+ *tag_out = tag;
+@@ -691,6 +694,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ struct mvs_task_exec_info tei;
+ struct mvs_slot_info *slot;
+ u32 tag = 0xdeadbeef, n_elem = 0;
++ struct request *rq;
+ int rc = 0;
+
+ if (!dev->port) {
+@@ -755,9 +759,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ n_elem = task->num_scatter;
+ }
+
+- rc = mvs_tag_alloc(mvi, &tag);
+- if (rc)
+- goto err_out;
++ rq = sas_task_find_rq(task);
++ if (rq) {
++ tag = rq->tag + MVS_RSVD_SLOTS;
++ } else {
++ rc = mvs_tag_alloc(mvi, &tag);
++ if (rc)
++ goto err_out;
++ }
+
+ slot = &mvi->slot_info[tag];
+
+@@ -860,7 +869,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ {
+ u32 slot_idx = rx_desc & RXQ_SLOT_MASK;
+- mvs_tag_clear(mvi, slot_idx);
++ mvs_tag_free(mvi, slot_idx);
+ }
+
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 8dd30f8b478ec..cba6e7667a7ba 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -370,8 +370,7 @@ struct mvs_info {
+ u32 chip_id;
+ const struct mvs_chip_info *chip;
+
+- int tags_num;
+- unsigned long *tags;
++ unsigned long *rsvd_tags;
+ /* further per-slot information */
+ struct mvs_phy phy[MVS_MAX_PHYS];
+ struct mvs_port port[MVS_MAX_PHYS];
+@@ -424,10 +423,6 @@ struct mvs_task_exec_info {
+
+ /******************** function prototype *********************/
+ void mvs_get_sas_addr(void *buf, u32 buflen);
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
fs-always-return-zero-on-success-from-replace_fd.patch
clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
+perf-evsel-avoid-container_of-on-a-null-leader.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-at91-peripheral-fix-return-value.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+perf-arm-spe-save-context-id-in-record.patch
+perf-arm-spe-use-spe-data-source-for-neoverse-cores.patch
+perf-arm_spe-correct-setting-remote-access.patch
+perf-arm-spe-augment-the-data-source-type-with-neove.patch
+perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch
+perf-arm-spe-rename-the-common-data-source-encoding.patch
+perf-arm_spe-correct-memory-level-for-remote-access.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch
+scsi-libsas-add-sas_task_find_rq.patch
+scsi-mvsas-delete-mvs_tag_init.patch
+scsi-mvsas-use-sas_task_find_rq-for-tagging.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+s390-cio-unregister-the-subchannel-while-purging.patch
+s390-cio-update-purge-function-to-unregister-the-unu.patch
+drm-vmwgfx-copy-drm-hash-table-code-into-driver.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
+bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch
--- /dev/null
+From c13e5146f0632f83abaf551fd0dd6df0f70d6ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index fea019cc92d3c..15548dc3cc5c5 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7060,7 +7060,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From d02b22d79cb5eae6e93ec260e8de9504d40b5848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index aa3b0d75e44b7..37aa85a81e0a0 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -268,10 +268,10 @@ $(OUTPUT)test-libbabeltrace.bin:
+ $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From 193e0180c608ccf9700552e3f642b1f138a38f4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index b3452259d6e0b..c8c68301543b2 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -831,8 +831,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9e1b4edc6b181870c737fdde49a413ce6dbdee1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 44e07a3c253b9..ab8741fe57c99 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -385,7 +385,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -408,7 +408,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 5054d771cfe4c1720e1e3de4e40227ad1a20cd95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 8b686da5577b3..44e07a3c253b9 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -374,23 +374,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -447,7 +449,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From bbdfece1925e6400915ab7b866343aef550e8d36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index aa6b89e91ac80..8a74cc34ac50a 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -203,9 +203,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -215,19 +220,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From eaae681910c1c0ffbd9521cea815ab51ec5bada6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index f611b2290a1b9..a18b9bb0631c2 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ }
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From dea19fe54d0969037c134b8fe9583ab1324f829b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 8395f4013b111..dcabf38859ec5 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e8c1b50298779ff0cce6f54da36ff803efdbdf90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index bb7bb17386475..8395f4013b111 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From ad2144886156e22740f4425dc7632427e6965f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index c6481bd612390..565a8bfe5692a 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b79d06ead324a1922516550c35cab532f5b3a832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 91334229c1205..545658afb4f5c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1175,9 +1175,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 3fc1663366503c62cdc919f1657f0db1dfa4fd5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 6b613569372a0..9c714a6c93076 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -873,7 +873,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From feba4e9ccd6b4577192b167f7a9b9b6f59255440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 01e15b445cb58..cd60a878752f2 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1504,7 +1504,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED ||
+ tool->compressed == perf_session__process_compressed_event_stub)
+--
+2.51.0
+
--- /dev/null
+From d9e2c984129ee2f288d5f86682143dc9665b33c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 437426be29e99..21c4169d0c9d0 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -114,6 +114,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -125,6 +126,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -136,6 +138,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -148,6 +151,7 @@ int test__PERF_RECORD(struct test *test __maybe_unused, int subtest __maybe_unus
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b20ce115c67d98132897386acb7406397e20e20a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index 51424cdc3b682..aa9a0ebc1f937 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 3e9e786d0d7a2954da92a283ea5bdc8cb711e8fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index d1d5a44d9122a..3b3aaa7d8283c 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -671,7 +671,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From 7126251637f06db0cf2ad4071f8cf8f7a3f6c73c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:15:57 +0800
+Subject: scsi: libsas: Add sas_task_find_rq()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
+
+blk-mq already provides a unique tag per request. Some libsas LLDDs - like
+hisi_sas - already use this tag as the unique per-I/O HW tag.
+
+Add a common function to provide the request associated with a sas_task for
+all libsas LLDDs.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/scsi/libsas.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 4e2d61e8fb1ed..8461fad88a119 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -620,6 +620,24 @@ extern struct sas_task *sas_alloc_task(gfp_t flags);
+ extern struct sas_task *sas_alloc_slow_task(gfp_t flags);
+ extern void sas_free_task(struct sas_task *task);
+
++static inline struct request *sas_task_find_rq(struct sas_task *task)
++{
++ struct scsi_cmnd *scmd;
++
++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) {
++ struct ata_queued_cmd *qc = task->uldd_task;
++
++ scmd = qc ? qc->scsicmd : NULL;
++ } else {
++ scmd = task->uldd_task;
++ }
++
++ if (!scmd)
++ return NULL;
++
++ return scsi_cmd_to_rq(scmd);
++}
++
+ struct sas_domain_function_template {
+ /* The class calls these to notify the LLDD of an event. */
+ void (*lldd_port_formed)(struct asd_sas_phy *);
+--
+2.51.0
+
--- /dev/null
+From e56f1ccb66b5b3d18eeee2b3e8301ae4d2e045a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:02 +0800
+Subject: scsi: mvsas: Delete mvs_tag_init()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
+
+All mvs_tag_init() does is zero the tag bitmap, but this is already done
+with the kzalloc() call to alloc the tags, so delete this unneeded
+function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 --
+ drivers/scsi/mvsas/mv_sas.c | 7 -------
+ drivers/scsi/mvsas/mv_sas.h | 1 -
+ 3 files changed, 10 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 0c5e2c6105867..7622de9d7d8ba 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ }
+ mvi->tags_num = slot_nr;
+
+- /* Initialize tags */
+- mvs_tag_init(mvi);
+ return 0;
+ err_out:
+ return 1;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 68caeaf9e6369..377b931f46dcf 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ return 0;
+ }
+
+-void mvs_tag_init(struct mvs_info *mvi)
+-{
+- int i;
+- for (i = 0; i < mvi->tags_num; ++i)
+- mvs_tag_clear(mvi, i);
+-}
+-
+ static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev)
+ {
+ unsigned long i = 0, j = 0, hi = 0;
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 519edc796691a..6689481779343 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+ int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+-void mvs_tag_init(struct mvs_info *mvi);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
--- /dev/null
+From 2edab7fc73e57be688947fb5c3b739543d0d90d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 264f32065ea7a..d0a6639c3542d 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -138,7 +138,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From 67245162e189b5fdcfa97069aa41a632c4d0b1fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:03 +0800
+Subject: scsi: mvsas: Use sas_task_find_rq() for tagging
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
+
+The request associated with a SCSI command coming from the block layer has
+a unique tag, so use that when possible for getting a slot.
+
+Unfortunately we don't support reserved commands in the SCSI midlayer yet.
+As such, SMP tasks - as an example - will not have a request associated, so
+in the interim continue to manage those tags for that type of sas_task
+internally.
+
+We reserve an arbitrary 4 tags for these internal tags. Indeed, we already
+decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag
+MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
+mvsas: add support for 94xx; layout change; bug fixes"), but what those 2
+slots are used for is not obvious.
+
+Also make the tag management functions static, where possible.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_defs.h | 1 +
+ drivers/scsi/mvsas/mv_init.c | 9 +++++----
+ drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++-------------
+ drivers/scsi/mvsas/mv_sas.h | 7 +------
+ 4 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h
+index 199ab49aa047f..3ec1c7546cdb4 100644
+--- a/drivers/scsi/mvsas/mv_defs.h
++++ b/drivers/scsi/mvsas/mv_defs.h
+@@ -40,6 +40,7 @@ enum driver_configuration {
+ MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */
+ MVS_OAF_SZ = 64, /* Open address frame buffer size */
+ MVS_QUEUE_SIZE = 64, /* Support Queue depth */
++ MVS_RSVD_SLOTS = 4,
+ MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2,
+ };
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 7622de9d7d8ba..264f32065ea7a 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+ cancel_delayed_work(&mwq->work_q);
+- kfree(mvi->tags);
++ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+
+@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name);
+ goto err_out;
+ }
+- mvi->tags_num = slot_nr;
+
+ return 0;
+ err_out:
+@@ -368,8 +367,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev,
+ mvi->sas = sha;
+ mvi->shost = shost;
+
+- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL);
+- if (!mvi->tags)
++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL);
++ if (!mvi->rsvd_tags)
+ goto err_out;
+
+ if (MVS_CHIP_DISP->chip_ioremap(mvi))
+@@ -470,6 +469,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,
+ else
+ can_queue = MVS_CHIP_SLOT_SZ;
+
++ can_queue -= MVS_RSVD_SLOTS;
++
+ shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG);
+ shost->can_queue = can_queue;
+ mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 377b931f46dcf..393a8ee551e4d 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)
+ return 0;
+ }
+
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ clear_bit(tag, bitmap);
+ }
+
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_free(struct mvs_info *mvi, u32 tag)
+ {
++ if (tag >= MVS_RSVD_SLOTS)
++ return;
++
+ mvs_tag_clear(mvi, tag);
+ }
+
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ set_bit(tag, bitmap);
+ }
+
+-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ {
+ unsigned int index, tag;
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+
+- index = find_first_zero_bit(bitmap, mvi->tags_num);
++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS);
+ tag = index;
+- if (tag >= mvi->tags_num)
++ if (tag >= MVS_RSVD_SLOTS)
+ return -SAS_QUEUE_FULL;
+ mvs_tag_set(mvi, tag);
+ *tag_out = tag;
+@@ -693,6 +696,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ struct mvs_task_exec_info tei;
+ struct mvs_slot_info *slot;
+ u32 tag = 0xdeadbeef, n_elem = 0;
++ struct request *rq;
+ int rc = 0;
+
+ if (!dev->port) {
+@@ -757,9 +761,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ n_elem = task->num_scatter;
+ }
+
+- rc = mvs_tag_alloc(mvi, &tag);
+- if (rc)
+- goto err_out;
++ rq = sas_task_find_rq(task);
++ if (rq) {
++ tag = rq->tag + MVS_RSVD_SLOTS;
++ } else {
++ rc = mvs_tag_alloc(mvi, &tag);
++ if (rc)
++ goto err_out;
++ }
+
+ slot = &mvi->slot_info[tag];
+
+@@ -862,7 +871,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ {
+ u32 slot_idx = rx_desc & RXQ_SLOT_MASK;
+- mvs_tag_clear(mvi, slot_idx);
++ mvs_tag_free(mvi, slot_idx);
+ }
+
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 6689481779343..42caca5bb874a 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -370,8 +370,7 @@ struct mvs_info {
+ u32 chip_id;
+ const struct mvs_chip_info *chip;
+
+- int tags_num;
+- unsigned long *tags;
++ unsigned long *rsvd_tags;
+ /* further per-slot information */
+ struct mvs_phy phy[MVS_MAX_PHYS];
+ struct mvs_port port[MVS_MAX_PHYS];
+@@ -424,10 +423,6 @@ struct mvs_task_exec_info {
+
+ /******************** function prototype *********************/
+ void mvs_get_sas_addr(void *buf, u32 buflen);
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
pinctrl-check-the-return-value-of-pinmux_ops-get_function_name.patch
clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+scsi-libsas-add-sas_task_find_rq.patch
+scsi-mvsas-delete-mvs_tag_init.patch
+scsi-mvsas-use-sas_task_find_rq-for-tagging.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+tpm-tpm_tis-claim-locality-before-writing-interrupt-.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
--- /dev/null
+From 45b112b95ac78733d58540228913fc0595bf0946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 9d65e684e626c..541f9a89b4902 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -6800,7 +6800,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From ba47c78d8b540455554b51bb01061db11feb6b9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 8104e505efde6..f5b7b1489e1fc 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -258,10 +258,10 @@ $(OUTPUT)test-sync-compare-and-swap.bin:
+ $(BUILD)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From 834b2e51ce026e61ffdf97111dd9b9a75707fef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:29 +0100
+Subject: tpm, tpm_tis: Claim locality before writing interrupt registers
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit 15d7aa4e46eba87242a320f39773aa16faddadee ]
+
+In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR,
+TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts.
+Currently these modifications are done without holding a locality thus they
+have no effect. Fix this by claiming the (default) locality before the
+registers are written.
+
+Since now tpm_tis_gen_interrupt() is called with the locality already
+claimed remove locality request and release from this function.
+
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Stable-dep-of: 8a81236f2cb0 ("tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index a084f732c1804..60f4b8b9c6f14 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -633,16 +633,10 @@ static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ cap_t cap;
+ int ret;
+
+- ret = request_locality(chip, 0);
+- if (ret < 0)
+- return;
+-
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+ else
+ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+-
+- release_locality(chip, 0);
+ }
+
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -665,10 +659,16 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ }
+ priv->irq = irq;
+
++ rc = request_locality(chip, 0);
++ if (rc < 0)
++ return rc;
++
+ rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality),
+ &original_int_vec);
+- if (rc < 0)
++ if (rc < 0) {
++ release_locality(chip, priv->locality);
+ return rc;
++ }
+
+ rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ if (rc < 0)
+@@ -702,10 +702,12 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+ tpm_tis_write8(priv, original_int_vec,
+ TPM_INT_VECTOR(priv->locality));
+- return -1;
++ rc = -1;
+ }
+
+- return 0;
++ release_locality(chip, priv->locality);
++
++ return rc;
+ }
+
+ /* Try to find the IRQ the TPM is using. This is for legacy x86 systems that
+--
+2.51.0
+
--- /dev/null
+From 18472f7c5fa6077fd9bfbd7d42d4c7f6a308e0e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 60f4b8b9c6f14..b538db3052b77 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -700,8 +700,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d87b3c47efe09ac03b63e9164311638279c7682f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 18:26:26 +0800
+Subject: bpf: Avoid RCU context warning when unpinning htab with internal
+ structs
+
+From: KaFai Wan <kafai.wan@linux.dev>
+
+[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
+
+When unpinning a BPF hash table (htab or htab_lru) that contains internal
+structures (timer, workqueue, or task_work) in its values, a BUG warning
+is triggered:
+ BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0
+ ...
+
+The issue arises from the interaction between BPF object unpinning and
+RCU callback mechanisms:
+1. BPF object unpinning uses ->free_inode() which schedules cleanup via
+ call_rcu(), deferring the actual freeing to an RCU callback that
+ executes within the RCU_SOFTIRQ context.
+2. During cleanup of hash tables containing internal structures,
+ htab_map_free_internal_structs() is invoked, which includes
+ cond_resched() or cond_resched_rcu() calls to yield the CPU during
+ potentially long operations.
+
+However, cond_resched() or cond_resched_rcu() cannot be safely called from
+atomic RCU softirq context, leading to the BUG warning when attempting
+to reschedule.
+
+Fix this by changing from ->free_inode() to ->destroy_inode() and rename
+bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link).
+This allows direct inode freeing without RCU callback scheduling,
+avoiding the invalid context warning.
+
+Reported-by: Le Chen <tom2cat@sjtu.edu.cn>
+Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 4f841e16779e7..9b184f3fbf45f 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -610,7 +610,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void bpf_free_inode(struct inode *inode)
++static void bpf_destroy_inode(struct inode *inode)
+ {
+ enum bpf_type type;
+
+@@ -625,7 +625,7 @@ static const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .free_inode = bpf_free_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+--
+2.51.0
+
--- /dev/null
+From 148976afa9d974ff69aaa93f53246eaad83908e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 183ede9345e61..9b4254feefccd 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2266,6 +2266,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2375,6 +2376,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 227a118569c3e270b81c2bbc9a63627b8514eafb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:15:01 +0200
+Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+
+From: Eric Woudstra <ericwouds@gmail.com>
+
+[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
+
+net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+7 locks held by socat/410:
+ #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
+ #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
+ [..]
+ #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
+
+Call Trace:
+ lockdep_rcu_suspicious.cold+0x4f/0xb1
+ br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
+ br_fill_forward_path+0x7a/0x4d0 [bridge]
+
+Use to correct helper, non _rcu variant requires RTNL mutex.
+
+Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
+Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 23a82567fe624..54b0f24eb08ff 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,
+ if (!br_opt_get(br, BROPT_VLAN_ENABLED))
+ return;
+
+- vg = br_vlan_group(br);
++ vg = br_vlan_group_rcu(br);
+
+ if (idx >= 0 &&
+ ctx->vlan[idx].proto == br->vlan_proto) {
+--
+2.51.0
+
--- /dev/null
+From c3b72e9908f04f6b7715a97f4565605cb04b0baf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index 5104d4025484c..a5e8f5949d770 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -275,8 +275,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 903f7279f82e8ce48af230aca91ec081d6784349 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:09:31 +0800
+Subject: clk: mediatek: clk-mux: Do not pass flags to
+ clk_mux_determine_rate_flags()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
+
+The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags.
+Passing one to the other is wrong.
+
+Since there aren't any actual users adding CLK_MUX_* flags, just drop it
+for now.
+
+Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mux.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c
+index c8593554239d6..93fa67294e5ab 100644
+--- a/drivers/clk/mediatek/clk-mux.c
++++ b/drivers/clk/mediatek/clk-mux.c
+@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)
+ static int mtk_clk_mux_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw);
+-
+- return clk_mux_determine_rate_flags(hw, req, mux->data->flags);
++ return clk_mux_determine_rate_flags(hw, req, 0);
+ }
+
+ const struct clk_ops mtk_mux_clr_set_upd_ops = {
+--
+2.51.0
+
--- /dev/null
+From d9a37ac6df83d21dfea4f0344aab1bbee3576da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:28 +0200
+Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
+
+The infrastructure gate for the HDMI specific crystal needs the
+top_hdmi_xtal clock to be configured in order to ungate the 26m
+clock to the HDMI IP, and it wouldn't work without.
+
+Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
+
+Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+index fcd410461d3bb..516b5830f16e1 100644
+--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c
++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {
+ GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28),
+ GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29),
+ /* INFRA_AO1 */
+- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0),
++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0),
+ GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
+--
+2.51.0
+
--- /dev/null
+From 0b587a93dc207856a3aac83d6310d03eb00e81fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 821155f79b015..bbd7d64038fab 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From e6d908750da55a1e9f288087d0312307cf526241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 69ebf65081b81..821155f79b015 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 815f25e376ca23f9b1da84d7115e20d527abcdb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Apr 2025 15:54:28 +0300
+Subject: clk: tegra: do not overallocate memory for bpmp clocks
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
+
+struct tegra_bpmp::clocks is a pointer to a dynamically allocated array
+of pointers to 'struct tegra_bpmp_clk'.
+
+But the size of the allocated area is calculated like it is an array
+containing actual 'struct tegra_bpmp_clk' objects - it's not true, there
+are just pointers.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace static
+analysis tool.
+
+Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-bpmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index 39241662a412a..3bc56a3c6b240 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -603,7 +603,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp,
+
+ bpmp->num_clocks = count;
+
+- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL);
++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL);
+ if (!bpmp->clocks)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 230db12153e34ebeddc36802021772535fcda012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:12 -0500
+Subject: cpufreq: tegra186: Set target frequency for all cpus in policy
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
+
+The original commit set all cores in a cluster to a shared policy, but
+did not update set_target to apply a frequency change to all cores for
+the policy. This caused most cores to remain stuck at their boot
+frequency.
+
+Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 6c88827f4e625..ee57676bbee14 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+ {
+ struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+ struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset;
++ unsigned int edvd_offset;
+ u32 edvd_val = tbl->driver_data;
++ u32 cpu;
+
+- writel(edvd_val, data->regs + edvd_offset);
++ for_each_cpu(cpu, policy->cpus) {
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 15a87a53de79b28e362ccac46d25da4bae9965c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index 307eba74b901e..9aa8603fcf63b 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From f925b779753f7bd8c69e18eb899250e9f6fbc089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From a6cc6038e8d4ef94d0d41ffab06fdb014b1373c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 670d5ab9d9984..b761dda491d54 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From 02043d2ab08bdfd42d342ec0215627a8d3621457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index b761dda491d54..f97c182677082 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 7074521df91856baf5f663a26124f97ad17bd126 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index bd8085ec54ed5..da5596fbfdcb3 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8648,6 +8648,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From a4b416f614548f7de46cafbdd941dd531760c00c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:26 -0500
+Subject: drm/vmwgfx: Fix copy-paste typo in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
+
+'entry' should be 'val' which is the loop iterator.
+
+Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index d37cf22e9caeb..27f33297fcf3e 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -692,7 +692,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
+ hash_del_rcu(&val->hash.head);
+
+ list_for_each_entry(val, &ctx->resource_ctx_list, head)
+- hash_del_rcu(&entry->hash.head);
++ hash_del_rcu(&val->hash.head);
+
+ ctx->sw_context = NULL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 00ac99ed79808d4f67b69c054966e4dce9ddf28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index f5c4a40fb16d7..d37cf22e9caeb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From eb8bdd92f2973af950551ea6f7790f2e542c9a51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index cbbbd105a5a7b..26d70ac90933c 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 30545b34024126493a88f22a2d24282466a03939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 20:26:18 +0200
+Subject: gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit a060dc6620c13435b78e92cd2ebdbb6d11af237a ]
+
+The of_gpio_n_cells default is 2 when ->of_xlate() callback is
+not defined. No need to assign it explicitly in the driver.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: b5f8aa8d4bde ("gpio: wcd934x: mark the GPIO controller as sleeping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index c00968ce7a569..cbbbd105a5a7b 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -101,7 +101,6 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->of_gpio_n_cells = 2;
+ chip->can_sleep = false;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+--
+2.51.0
+
--- /dev/null
+From 0b60ab1c278f49c12cd4b2461e35395ce3beffc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index ad47d7b31046c..91db42a9f6589 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -273,6 +273,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From 65a6305dc4c8efe4ca484e07d3192c2f16bc2670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Init acpi_gbl_use_global_lock to false
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
+
+Init acpi_gbl_use_global_lock to false, in order to void error messages
+during boot phase:
+
+ ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182)
+ ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
+
+Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 55efe2f5fa1c3..e2d294aebab2a 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -254,6 +254,7 @@ void __init platform_init(void)
+
+ #ifdef CONFIG_ACPI
+ acpi_table_upgrade();
++ acpi_gbl_use_global_lock = false;
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 48fc21db1fd7373eaad2152d34de7d6e73816290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2024 15:45:53 +0800
+Subject: LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ]
+
+Both acpi_table_upgrade() and acpi_boot_table_init() are defined as
+empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in
+include/linux/acpi.h, there are no implicit declaration errors with
+various configs.
+
+ #ifdef CONFIG_ACPI_TABLE_UPGRADE
+ void acpi_table_upgrade(void);
+ #else
+ static inline void acpi_table_upgrade(void) { }
+ #endif
+
+ #ifdef CONFIG_ACPI
+ ...
+ void acpi_boot_table_init (void);
+ ...
+ #else /* !CONFIG_ACPI */
+ ...
+ static inline void acpi_boot_table_init(void)
+ {
+ }
+ ...
+ #endif /* !CONFIG_ACPI */
+
+As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary
+here, just remove it. At the same time, just keep CONFIG_ACPI to prevent
+potential build errors in future, and give a signal to indicate the code
+is ACPI-specific. For the same reason, we also put acpi_table_upgrade()
+under CONFIG_ACPI.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index b00e885d98458..55efe2f5fa1c3 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -252,10 +252,8 @@ void __init platform_init(void)
+ arch_reserve_vmcore();
+ arch_parse_crashkernel();
+
+-#ifdef CONFIG_ACPI_TABLE_UPGRADE
+- acpi_table_upgrade();
+-#endif
+ #ifdef CONFIG_ACPI
++ acpi_table_upgrade();
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From cec4f955658eeebe2cd955bce22f60d4c0b31b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 406821a78d510..6a48b832950db 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -618,10 +618,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 43d8526ed3cfdf907b61dd1d8ee26d1e232c54a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index d097f45b0e5f5..406821a78d510 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -619,7 +619,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From a2043cff303930c4223cdac9e06ca9fd4063fd42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index 9d58d83344670..ea49b0df397e5 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -482,10 +482,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 742629eab31b39f2334448c325d2e1ae6429a70f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index ca4b93a010346..e66f77af677cf 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 3646afdb3b2a183b587b995da24ab57a35ada601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 4848d5d50a5f5..1ca9073c95835 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From 1045187a5f9e3ba99f7ad96430f0f84a46a987b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 15:15:06 +0000
+Subject: perf arm-spe: Refactor arm-spe to support operation packet type
+
+From: German Gomez <german.gomez@arm.com>
+
+[ Upstream commit 0066015a3d8f9c01a17eb04579edba7dac9510af ]
+
+Extend the decoder of Arm SPE records to support more fields from the
+operation packet type.
+
+Not all fields are being decoded by this commit. Only those needed to
+support the use-case SVE load/store/other operations.
+
+Suggested-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: German Gomez <german.gomez@arm.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Anshuman.Khandual@arm.com
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/r/20230320151509.1137462-2-james.clark@arm.com
+Signed-off-by: James Clark <james.clark@arm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.c | 30 ++++++++++--
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 47 +++++++++++++++----
+ tools/perf/util/arm-spe.c | 8 ++--
+ 3 files changed, 67 insertions(+), 18 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+index 091987dd39668..709d3f6b58c68 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.c
+@@ -186,11 +186,27 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ decoder->record.context_id = payload;
+ break;
+ case ARM_SPE_OP_TYPE:
+- if (idx == SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC) {
+- if (payload & 0x1)
+- decoder->record.op = ARM_SPE_ST;
++ switch (idx) {
++ case SPE_OP_PKT_HDR_CLASS_LD_ST_ATOMIC:
++ decoder->record.op |= ARM_SPE_OP_LDST;
++ if (payload & SPE_OP_PKT_ST)
++ decoder->record.op |= ARM_SPE_OP_ST;
+ else
+- decoder->record.op = ARM_SPE_LD;
++ decoder->record.op |= ARM_SPE_OP_LD;
++ if (SPE_OP_PKT_IS_LDST_SVE(payload))
++ decoder->record.op |= ARM_SPE_OP_SVE_LDST;
++ break;
++ case SPE_OP_PKT_HDR_CLASS_OTHER:
++ decoder->record.op |= ARM_SPE_OP_OTHER;
++ if (SPE_OP_PKT_IS_OTHER_SVE_OP(payload))
++ decoder->record.op |= ARM_SPE_OP_SVE_OTHER;
++ break;
++ case SPE_OP_PKT_HDR_CLASS_BR_ERET:
++ decoder->record.op |= ARM_SPE_OP_BRANCH_ERET;
++ break;
++ default:
++ pr_err("Get packet error!\n");
++ return -1;
+ }
+ break;
+ case ARM_SPE_EVENTS:
+@@ -218,6 +234,12 @@ static int arm_spe_read_record(struct arm_spe_decoder *decoder)
+ if (payload & BIT(EV_MISPRED))
+ decoder->record.type |= ARM_SPE_BRANCH_MISS;
+
++ if (payload & BIT(EV_PARTIAL_PREDICATE))
++ decoder->record.type |= ARM_SPE_SVE_PARTIAL_PRED;
++
++ if (payload & BIT(EV_EMPTY_PREDICATE))
++ decoder->record.type |= ARM_SPE_SVE_EMPTY_PRED;
++
+ break;
+ case ARM_SPE_DATA_SOURCE:
+ decoder->record.source = payload;
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 46a61df1145b6..1443c28545a94 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -14,19 +14,46 @@
+ #include "arm-spe-pkt-decoder.h"
+
+ enum arm_spe_sample_type {
+- ARM_SPE_L1D_ACCESS = 1 << 0,
+- ARM_SPE_L1D_MISS = 1 << 1,
+- ARM_SPE_LLC_ACCESS = 1 << 2,
+- ARM_SPE_LLC_MISS = 1 << 3,
+- ARM_SPE_TLB_ACCESS = 1 << 4,
+- ARM_SPE_TLB_MISS = 1 << 5,
+- ARM_SPE_BRANCH_MISS = 1 << 6,
+- ARM_SPE_REMOTE_ACCESS = 1 << 7,
++ ARM_SPE_L1D_ACCESS = 1 << 0,
++ ARM_SPE_L1D_MISS = 1 << 1,
++ ARM_SPE_LLC_ACCESS = 1 << 2,
++ ARM_SPE_LLC_MISS = 1 << 3,
++ ARM_SPE_TLB_ACCESS = 1 << 4,
++ ARM_SPE_TLB_MISS = 1 << 5,
++ ARM_SPE_BRANCH_MISS = 1 << 6,
++ ARM_SPE_REMOTE_ACCESS = 1 << 7,
++ ARM_SPE_SVE_PARTIAL_PRED = 1 << 8,
++ ARM_SPE_SVE_EMPTY_PRED = 1 << 9,
+ };
+
+ enum arm_spe_op_type {
+- ARM_SPE_LD = 1 << 0,
+- ARM_SPE_ST = 1 << 1,
++ /* First level operation type */
++ ARM_SPE_OP_OTHER = 1 << 0,
++ ARM_SPE_OP_LDST = 1 << 1,
++ ARM_SPE_OP_BRANCH_ERET = 1 << 2,
++
++ /* Second level operation type for OTHER */
++ ARM_SPE_OP_SVE_OTHER = 1 << 16,
++ ARM_SPE_OP_SVE_FP = 1 << 17,
++ ARM_SPE_OP_SVE_PRED_OTHER = 1 << 18,
++
++ /* Second level operation type for LDST */
++ ARM_SPE_OP_LD = 1 << 16,
++ ARM_SPE_OP_ST = 1 << 17,
++ ARM_SPE_OP_ATOMIC = 1 << 18,
++ ARM_SPE_OP_EXCL = 1 << 19,
++ ARM_SPE_OP_AR = 1 << 20,
++ ARM_SPE_OP_SIMD_FP = 1 << 21,
++ ARM_SPE_OP_GP_REG = 1 << 22,
++ ARM_SPE_OP_UNSPEC_REG = 1 << 23,
++ ARM_SPE_OP_NV_SYSREG = 1 << 24,
++ ARM_SPE_OP_SVE_LDST = 1 << 25,
++ ARM_SPE_OP_SVE_PRED_LDST = 1 << 26,
++ ARM_SPE_OP_SVE_SG = 1 << 27,
++
++ /* Second level operation type for BRANCH_ERET */
++ ARM_SPE_OP_BR_COND = 1 << 16,
++ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+ enum arm_spe_neoverse_data_source {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 98e3c3fce05a2..9f0c4565bc5be 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -411,7 +411,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We have no data on the hit level or data source for stores in the
+ * Neoverse SPE records.
+ */
+- if (record->op & ARM_SPE_ST) {
++ if (record->op & ARM_SPE_OP_ST) {
+ data_src->mem_lvl = PERF_MEM_LVL_NA;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NA;
+@@ -497,12 +497,12 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+- union perf_mem_data_src data_src = { 0 };
++ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+ bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
+
+- if (record->op == ARM_SPE_LD)
++ if (record->op & ARM_SPE_OP_LD)
+ data_src.mem_op = PERF_MEM_OP_LOAD;
+- else if (record->op == ARM_SPE_ST)
++ else if (record->op & ARM_SPE_OP_ST)
+ data_src.mem_op = PERF_MEM_OP_STORE;
+ else
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From e47e4690e3e4cd34c555a9a1b29d8292adb68846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 19:53:17 +0100
+Subject: perf arm-spe: Rename the common data source encoding
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
+
+The Neoverse CPUs follow the common data source encoding, and other
+CPU variants can share the same format.
+
+Rename the CPU list and data source definitions as common data source
+names. This change prepares for appending more CPU variants.
+
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------
+ tools/perf/util/arm-spe.c | 28 +++++++++----------
+ 2 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 1443c28545a94..358c611eeddbb 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -56,15 +56,15 @@ enum arm_spe_op_type {
+ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+-enum arm_spe_neoverse_data_source {
+- ARM_SPE_NV_L1D = 0x0,
+- ARM_SPE_NV_L2 = 0x8,
+- ARM_SPE_NV_PEER_CORE = 0x9,
+- ARM_SPE_NV_LOCAL_CLUSTER = 0xa,
+- ARM_SPE_NV_SYS_CACHE = 0xb,
+- ARM_SPE_NV_PEER_CLUSTER = 0xc,
+- ARM_SPE_NV_REMOTE = 0xd,
+- ARM_SPE_NV_DRAM = 0xe,
++enum arm_spe_common_data_source {
++ ARM_SPE_COMMON_DS_L1D = 0x0,
++ ARM_SPE_COMMON_DS_L2 = 0x8,
++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9,
++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa,
++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb,
++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc,
++ ARM_SPE_COMMON_DS_REMOTE = 0xd,
++ ARM_SPE_COMMON_DS_DRAM = 0xe,
+ };
+
+ struct arm_spe_record {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 9f0c4565bc5be..36f03d532d5bc 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -389,15 +389,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,
+ return arm_spe_deliver_synth_event(spe, speq, event, &sample);
+ }
+
+-static const struct midr_range neoverse_spe[] = {
++static const struct midr_range common_ds_encoding_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+ {},
+ };
+
+-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record,
+- union perf_mem_data_src *data_src)
++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
+ {
+ /*
+ * Even though four levels of cache hierarchy are possible, no known
+@@ -419,17 +419,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ }
+
+ switch (record->source) {
+- case ARM_SPE_NV_L1D:
++ case ARM_SPE_COMMON_DS_L1D:
+ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_L2:
++ case ARM_SPE_COMMON_DS_L2:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_PEER_CORE:
++ case ARM_SPE_COMMON_DS_PEER_CORE:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -438,8 +438,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know if this is L1, L2 but we do know it was a cache-2-cache
+ * transfer, so set SNOOPX_PEER
+ */
+- case ARM_SPE_NV_LOCAL_CLUSTER:
+- case ARM_SPE_NV_PEER_CLUSTER:
++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER:
++ case ARM_SPE_COMMON_DS_PEER_CLUSTER:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -447,7 +447,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ /*
+ * System cache is assumed to be L3
+ */
+- case ARM_SPE_NV_SYS_CACHE:
++ case ARM_SPE_COMMON_DS_SYS_CACHE:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoop = PERF_MEM_SNOOP_HIT;
+@@ -456,13 +456,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know what level it hit in, except it came from the other
+ * socket
+ */
+- case ARM_SPE_NV_REMOTE:
++ case ARM_SPE_COMMON_DS_REMOTE:
+ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+- case ARM_SPE_NV_DRAM:
++ case ARM_SPE_COMMON_DS_DRAM:
+ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+@@ -498,7 +498,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus);
+
+ if (record->op & ARM_SPE_OP_LD)
+ data_src.mem_op = PERF_MEM_OP_LOAD;
+@@ -507,8 +507,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m
+ else
+ return 0;
+
+- if (is_neoverse)
+- arm_spe__synth_data_source_neoverse(record, &data_src);
++ if (is_common)
++ arm_spe__synth_data_source_common(record, &data_src);
+ else
+ arm_spe__synth_data_source_generic(record, &data_src);
+
+--
+2.51.0
+
--- /dev/null
+From 5bc81ff3190ae04b9e75e4eb05fd14000cda3375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:09 +0100
+Subject: perf arm_spe: Correct memory level for remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
+
+For remote accesses, the data source packet does not contain information
+about the memory level. To avoid misinformation, set the memory level to
+NA (Not Available).
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 36f03d532d5bc..383eda614f5c4 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -457,8 +457,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor
+ * socket
+ */
+ case ARM_SPE_COMMON_DS_REMOTE:
+- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 3ce4f35a8129659eb3ea3d3113a78841eb2e4de5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:08 +0100
+Subject: perf arm_spe: Correct setting remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
+
+Set the mem_remote field for a remote access to appropriately represent
+the event.
+
+Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 906476a839e1f..98e3c3fce05a2 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -492,7 +492,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ }
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+--
+2.51.0
+
--- /dev/null
+From f2f6cbd9583284265c973eeeb79d131deaa060f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:17 -0700
+Subject: perf evsel: Avoid container_of on a NULL leader
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
+
+An evsel should typically have a leader of itself, however, in tests
+like 'Sample parsing' a NULL leader may occur and the container_of
+will return a corrupt pointer.
+
+Avoid this with an explicit NULL test.
+
+Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 22969cc00a5fc..755da242f2670 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3146,6 +3146,8 @@ bool evsel__is_hybrid(struct evsel *evsel)
+
+ struct evsel *evsel__leader(struct evsel *evsel)
+ {
++ if (evsel->core.leader == NULL)
++ return NULL;
+ return container_of(evsel->core.leader, struct evsel, core);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 300182fa1514641f330551b1b36de135e06df005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index c8f7634f9846c..1c4d124b10531 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1658,7 +1658,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED ||
+ tool->compressed == perf_session__process_compressed_event_stub)
+--
+2.51.0
+
--- /dev/null
+From 52673f839027ea46c1df1cf53f4a2ed6db504c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 7aa946aa886de..c410ce87323b0 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -113,6 +113,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -124,6 +125,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -135,6 +137,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -147,6 +150,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e3897524845934cc23c0f1bb22d43afd6841a63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index 51424cdc3b682..aa9a0ebc1f937 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -115,7 +115,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From a58d505536283496e90d4e8c57c36599cd358daa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:07:13 +0200
+Subject: rtc: optee: fix memory leak on driver removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
+
+Fix a memory leak in case of driver removal.
+Free the shared memory used for arguments exchanges between kernel and
+OP-TEE RTC PTA.
+
+Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-optee.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c
+index 9f8b5d4a8f6b6..6b77c122fdc10 100644
+--- a/drivers/rtc/rtc-optee.c
++++ b/drivers/rtc/rtc-optee.c
+@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev)
+ {
+ struct optee_rtc *priv = dev_get_drvdata(dev);
+
++ tee_shm_free(priv->shm);
+ tee_client_close_session(priv->ctx, priv->session_id);
+ tee_client_close_context(priv->ctx);
+
+--
+2.51.0
+
--- /dev/null
+From 43d3e442bdf992564be2978b58929eeda46abc19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index f587afa843573..6ae7b6f1f3167 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From 39fe5b5fd2e22570728839a83d642a6d1dc04eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 15:38:17 +0200
+Subject: s390/cio: Update purge function to unregister the unused subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
+
+Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers")', cio no longer unregisters
+subchannels when the attached device is invalid or unavailable.
+
+As an unintended side-effect, the cio_ignore purge function no longer
+removes subchannels for devices on the cio_ignore list if no CCW device
+is attached. This situation occurs when a CCW device is non-operational
+or unavailable
+
+To ensure the same outcome of the purge function as when the
+current cio_ignore list had been active during boot, update the purge
+function to remove I/O subchannels without working CCW devices if the
+associated device number is found on the cio_ignore list.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index bdf5a50bd931d..c3cb73cbd0fc3 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1309,23 +1309,34 @@ void ccw_device_schedule_recovery(void)
+ spin_unlock_irqrestore(&recovery_lock, flags);
+ }
+
+-static int purge_fn(struct device *dev, void *data)
++static int purge_fn(struct subchannel *sch, void *data)
+ {
+- struct ccw_device *cdev = to_ccwdev(dev);
+- struct ccw_dev_id *id = &cdev->private->dev_id;
+- struct subchannel *sch = to_subchannel(cdev->dev.parent);
++ struct ccw_device *cdev;
+
+- spin_lock_irq(cdev->ccwlock);
+- if (is_blacklisted(id->ssid, id->devno) &&
+- (cdev->private->state == DEV_STATE_OFFLINE) &&
+- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
+- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+- id->devno);
++ spin_lock_irq(&sch->lock);
++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv)
++ goto unlock;
++
++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev))
++ goto unlock;
++
++ cdev = sch_get_cdev(sch);
++ if (cdev) {
++ if (cdev->private->state != DEV_STATE_OFFLINE)
++ goto unlock;
++
++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
++ goto unlock;
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+- css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+- spin_unlock_irq(cdev->ccwlock);
++
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid,
++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)");
++
++unlock:
++ spin_unlock_irq(&sch->lock);
+ /* Abort loop in case of pending signal. */
+ if (signal_pending(current))
+ return -EINTR;
+@@ -1341,7 +1352,7 @@ static int purge_fn(struct device *dev, void *data)
+ int ccw_purge_blacklisted(void)
+ {
+ CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n");
+- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn);
++ for_each_subchannel_staged(purge_fn, NULL, NULL);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1a390a6bf30d6ddef5a6524b50f8378ca907efb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:15:57 +0800
+Subject: scsi: libsas: Add sas_task_find_rq()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit a9ee3f840646e2ec419c734e592ffe997195435e ]
+
+blk-mq already provides a unique tag per request. Some libsas LLDDs - like
+hisi_sas - already use this tag as the unique per-I/O HW tag.
+
+Add a common function to provide the request associated with a sas_task for
+all libsas LLDDs.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-2-git-send-email-john.garry@huawei.com
+Reviewed-by: Jack Wang <jinpu.wang@ionos.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/scsi/libsas.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 2dbead74a2afe..9e9dff75a02bc 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -648,6 +648,24 @@ static inline bool sas_is_internal_abort(struct sas_task *task)
+ return task->task_proto == SAS_PROTOCOL_INTERNAL_ABORT;
+ }
+
++static inline struct request *sas_task_find_rq(struct sas_task *task)
++{
++ struct scsi_cmnd *scmd;
++
++ if (task->task_proto & SAS_PROTOCOL_STP_ALL) {
++ struct ata_queued_cmd *qc = task->uldd_task;
++
++ scmd = qc ? qc->scsicmd : NULL;
++ } else {
++ scmd = task->uldd_task;
++ }
++
++ if (!scmd)
++ return NULL;
++
++ return scsi_cmd_to_rq(scmd);
++}
++
+ struct sas_domain_function_template {
+ /* The class calls these to notify the LLDD of an event. */
+ void (*lldd_port_formed)(struct asd_sas_phy *);
+--
+2.51.0
+
--- /dev/null
+From 1ba768044a2a195e8284462e75b76d357efbfba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:02 +0800
+Subject: scsi: mvsas: Delete mvs_tag_init()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit ffc9f9bf3f14876d019f67ef17d41138802529a8 ]
+
+All mvs_tag_init() does is zero the tag bitmap, but this is already done
+with the kzalloc() call to alloc the tags, so delete this unneeded
+function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-7-git-send-email-john.garry@huawei.com
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 --
+ drivers/scsi/mvsas/mv_sas.c | 7 -------
+ drivers/scsi/mvsas/mv_sas.h | 1 -
+ 3 files changed, 10 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 2fde496fff5f7..c85fb812ad437 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -286,8 +286,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ }
+ mvi->tags_num = slot_nr;
+
+- /* Initialize tags */
+- mvs_tag_init(mvi);
+ return 0;
+ err_out:
+ return 1;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 1275f3be530f7..82a308840b117 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -51,13 +51,6 @@ inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ return 0;
+ }
+
+-void mvs_tag_init(struct mvs_info *mvi)
+-{
+- int i;
+- for (i = 0; i < mvi->tags_num; ++i)
+- mvs_tag_clear(mvi, i);
+-}
+-
+ static struct mvs_info *mvs_find_dev_mvi(struct domain_device *dev)
+ {
+ unsigned long i = 0, j = 0, hi = 0;
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index 509d8f32a04ff..fe57665bdb505 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -428,7 +428,6 @@ void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+ void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+ int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+-void mvs_tag_init(struct mvs_info *mvi);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
--- /dev/null
+From c209d3d5c8c03a41421977e68a5a44cb039be1b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index cfe84473a5153..b500c343cad75 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -141,7 +141,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From 4e32a966607c841d49f87f8a8deaca6153490dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Oct 2022 19:16:03 +0800
+Subject: scsi: mvsas: Use sas_task_find_rq() for tagging
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2acf97f199f9eba8321390325519e9b6bff60108 ]
+
+The request associated with a SCSI command coming from the block layer has
+a unique tag, so use that when possible for getting a slot.
+
+Unfortunately we don't support reserved commands in the SCSI midlayer yet.
+As such, SMP tasks - as an example - will not have a request associated, so
+in the interim continue to manage those tags for that type of sas_task
+internally.
+
+We reserve an arbitrary 4 tags for these internal tags. Indeed, we already
+decrement MVS_RSVD_SLOTS by 2 for the shost can_queue when flag
+MVF_FLAG_SOC is set. This change was made in commit 20b09c2992fe ("[SCSI]
+mvsas: add support for 94xx; layout change; bug fixes"), but what those 2
+slots are used for is not obvious.
+
+Also make the tag management functions static, where possible.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1666091763-11023-8-git-send-email-john.garry@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 60cd16a3b743 ("scsi: mvsas: Fix use-after-free bugs in mvs_work_queue")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_defs.h | 1 +
+ drivers/scsi/mvsas/mv_init.c | 9 +++++----
+ drivers/scsi/mvsas/mv_sas.c | 35 ++++++++++++++++++++++-------------
+ drivers/scsi/mvsas/mv_sas.h | 7 +------
+ 4 files changed, 29 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_defs.h b/drivers/scsi/mvsas/mv_defs.h
+index 7123a2efbf583..8ef174cd4d374 100644
+--- a/drivers/scsi/mvsas/mv_defs.h
++++ b/drivers/scsi/mvsas/mv_defs.h
+@@ -40,6 +40,7 @@ enum driver_configuration {
+ MVS_ATA_CMD_SZ = 96, /* SATA command table buffer size */
+ MVS_OAF_SZ = 64, /* Open address frame buffer size */
+ MVS_QUEUE_SIZE = 64, /* Support Queue depth */
++ MVS_RSVD_SLOTS = 4,
+ MVS_SOC_CAN_QUEUE = MVS_SOC_SLOTS - 2,
+ };
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index c85fb812ad437..cfe84473a5153 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -142,7 +142,7 @@ static void mvs_free(struct mvs_info *mvi)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+ cancel_delayed_work(&mwq->work_q);
+- kfree(mvi->tags);
++ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+
+@@ -284,7 +284,6 @@ static int mvs_alloc(struct mvs_info *mvi, struct Scsi_Host *shost)
+ printk(KERN_DEBUG "failed to create dma pool %s.\n", pool_name);
+ goto err_out;
+ }
+- mvi->tags_num = slot_nr;
+
+ return 0;
+ err_out:
+@@ -367,8 +366,8 @@ static struct mvs_info *mvs_pci_alloc(struct pci_dev *pdev,
+ mvi->sas = sha;
+ mvi->shost = shost;
+
+- mvi->tags = kzalloc(MVS_CHIP_SLOT_SZ>>3, GFP_KERNEL);
+- if (!mvi->tags)
++ mvi->rsvd_tags = bitmap_zalloc(MVS_RSVD_SLOTS, GFP_KERNEL);
++ if (!mvi->rsvd_tags)
+ goto err_out;
+
+ if (MVS_CHIP_DISP->chip_ioremap(mvi))
+@@ -469,6 +468,8 @@ static void mvs_post_sas_ha_init(struct Scsi_Host *shost,
+ else
+ can_queue = MVS_CHIP_SLOT_SZ;
+
++ can_queue -= MVS_RSVD_SLOTS;
++
+ shost->sg_tablesize = min_t(u16, SG_ALL, MVS_MAX_SG);
+ shost->can_queue = can_queue;
+ mvi->shost->cmd_per_lun = MVS_QUEUE_SIZE;
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 82a308840b117..fd73fcf71bd1d 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -20,31 +20,34 @@ static int mvs_find_tag(struct mvs_info *mvi, struct sas_task *task, u32 *tag)
+ return 0;
+ }
+
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_clear(struct mvs_info *mvi, u32 tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ clear_bit(tag, bitmap);
+ }
+
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag)
++static void mvs_tag_free(struct mvs_info *mvi, u32 tag)
+ {
++ if (tag >= MVS_RSVD_SLOTS)
++ return;
++
+ mvs_tag_clear(mvi, tag);
+ }
+
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
++static void mvs_tag_set(struct mvs_info *mvi, unsigned int tag)
+ {
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+ set_bit(tag, bitmap);
+ }
+
+-inline int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
++static int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out)
+ {
+ unsigned int index, tag;
+- void *bitmap = mvi->tags;
++ void *bitmap = mvi->rsvd_tags;
+
+- index = find_first_zero_bit(bitmap, mvi->tags_num);
++ index = find_first_zero_bit(bitmap, MVS_RSVD_SLOTS);
+ tag = index;
+- if (tag >= mvi->tags_num)
++ if (tag >= MVS_RSVD_SLOTS)
+ return -SAS_QUEUE_FULL;
+ mvs_tag_set(mvi, tag);
+ *tag_out = tag;
+@@ -696,6 +699,7 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ struct mvs_task_exec_info tei;
+ struct mvs_slot_info *slot;
+ u32 tag = 0xdeadbeef, n_elem = 0;
++ struct request *rq;
+ int rc = 0;
+
+ if (!dev->port) {
+@@ -760,9 +764,14 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf
+ n_elem = task->num_scatter;
+ }
+
+- rc = mvs_tag_alloc(mvi, &tag);
+- if (rc)
+- goto err_out;
++ rq = sas_task_find_rq(task);
++ if (rq) {
++ tag = rq->tag + MVS_RSVD_SLOTS;
++ } else {
++ rc = mvs_tag_alloc(mvi, &tag);
++ if (rc)
++ goto err_out;
++ }
+
+ slot = &mvi->slot_info[tag];
+
+@@ -857,7 +866,7 @@ int mvs_queue_command(struct sas_task *task, gfp_t gfp_flags)
+ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ {
+ u32 slot_idx = rx_desc & RXQ_SLOT_MASK;
+- mvs_tag_clear(mvi, slot_idx);
++ mvs_tag_free(mvi, slot_idx);
+ }
+
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+diff --git a/drivers/scsi/mvsas/mv_sas.h b/drivers/scsi/mvsas/mv_sas.h
+index fe57665bdb505..68df771e29759 100644
+--- a/drivers/scsi/mvsas/mv_sas.h
++++ b/drivers/scsi/mvsas/mv_sas.h
+@@ -370,8 +370,7 @@ struct mvs_info {
+ u32 chip_id;
+ const struct mvs_chip_info *chip;
+
+- int tags_num;
+- unsigned long *tags;
++ unsigned long *rsvd_tags;
+ /* further per-slot information */
+ struct mvs_phy phy[MVS_MAX_PHYS];
+ struct mvs_port port[MVS_MAX_PHYS];
+@@ -424,10 +423,6 @@ struct mvs_task_exec_info {
+
+ /******************** function prototype *********************/
+ void mvs_get_sas_addr(void *buf, u32 buflen);
+-void mvs_tag_clear(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_free(struct mvs_info *mvi, u32 tag);
+-void mvs_tag_set(struct mvs_info *mvi, unsigned int tag);
+-int mvs_tag_alloc(struct mvs_info *mvi, u32 *tag_out);
+ void mvs_iounmap(void __iomem *regs);
+ int mvs_ioremap(struct mvs_info *mvi, int bar, int bar_ex);
+ void mvs_phys_reset(struct mvs_info *mvi, u32 phy_mask, int hard);
+--
+2.51.0
+
clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
+perf-evsel-avoid-container_of-on-a-null-leader.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-at91-peripheral-fix-return-value.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+rtc-optee-fix-memory-leak-on-driver-removal.patch
+perf-arm_spe-correct-setting-remote-access.patch
+perf-arm-spe-refactor-arm-spe-to-support-operation-p.patch
+perf-arm-spe-rename-the-common-data-source-encoding.patch
+perf-arm_spe-correct-memory-level-for-remote-access.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch
+clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch
+cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch
+scsi-libsas-add-sas_task_find_rq.patch
+scsi-mvsas-delete-mvs_tag_init.patch
+scsi-mvsas-use-sas_task_find_rq-for-tagging.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+loongarch-remove-config_acpi_table_upgrade-in-platfo.patch
+loongarch-init-acpi_gbl_use_global_lock-to-false.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+s390-cio-update-purge-function-to-unregister-the-unu.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+drm-vmwgfx-fix-copy-paste-typo-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-remove-duplicate-assignment-of-of_gpio_.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
+bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch
--- /dev/null
+From 5d036e4484abd69d50c2185ce86cf49537dae392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 5ee1e1c2082cf..1820e297e8ea0 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7125,7 +7125,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From 8ba0e02486a66808d8eb2016f99fdf81a599db49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 690fe97be1904..1b7886cbbb65a 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -282,10 +282,10 @@ $(OUTPUT)test-libbabeltrace.bin:
+ $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From fe985041fc529ff00cd867dab49a9210c73ab5ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index caf9ba2dc0b13..968b891bcb030 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -878,8 +878,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 664c87e3c02ac3c428afee0745c4a271b3455b23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:52 +0300
+Subject: ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
+ instead of buffer time
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ]
+
+Instead of constraining the ALSA buffer time to be double of the firmware
+host buffer size, it is better to set it for the period time.
+This will implicitly constrain the buffer time to a safe value
+(num_periods is at least 2) and prohibits applications to set smaller
+period size than what will be covered by the initial DMA burst.
+
+Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c
+index f6e24edd7adbe..898e4fcde2dde 100644
+--- a/sound/soc/sof/intel/hda-pcm.c
++++ b/sound/soc/sof/intel/hda-pcm.c
+@@ -29,6 +29,8 @@
+ #define SDnFMT_BITS(x) ((x) << 4)
+ #define SDnFMT_CHAN(x) ((x) << 0)
+
++#define HDA_MAX_PERIOD_TIME_HEADROOM 10
++
+ static bool hda_always_enable_dmi_l1;
+ module_param_named(always_enable_dmi_l1, hda_always_enable_dmi_l1, bool, 0444);
+ MODULE_PARM_DESC(always_enable_dmi_l1, "SOF HDA always enable DMI l1");
+@@ -276,19 +278,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev,
+ * On playback start the DMA will transfer dsp_max_burst_size_in_ms
+ * amount of data in one initial burst to fill up the host DMA buffer.
+ * Consequent DMA burst sizes are shorter and their length can vary.
+- * To make sure that userspace allocate large enough ALSA buffer we need
+- * to place a constraint on the buffer time.
++ * To avoid immediate xrun by the initial burst we need to place
++ * constraint on the period size (via PERIOD_TIME) to cover the size of
++ * the host buffer.
++ * We need to add headroom of max 10ms as the firmware needs time to
++ * settle to the 1ms pacing and initially it can run faster for few
++ * internal periods.
+ *
+ * On capture the DMA will transfer 1ms chunks.
+- *
+- * Exact dsp_max_burst_size_in_ms constraint is racy, so set the
+- * constraint to a minimum of 2x dsp_max_burst_size_in_ms.
+ */
+- if (spcm->stream[direction].dsp_max_burst_size_in_ms)
++ if (spcm->stream[direction].dsp_max_burst_size_in_ms) {
++ unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms;
++
++ /*
++ * add headroom over the maximum burst size to cover the time
++ * needed for the DMA pace to settle.
++ * Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM
++ */
++ period_time += min(period_time, HDA_MAX_PERIOD_TIME_HEADROOM);
++
+ snd_pcm_hw_constraint_minmax(substream->runtime,
+- SNDRV_PCM_HW_PARAM_BUFFER_TIME,
+- spcm->stream[direction].dsp_max_burst_size_in_ms * USEC_PER_MSEC * 2,
++ SNDRV_PCM_HW_PARAM_PERIOD_TIME,
++ period_time * USEC_PER_MSEC,
+ UINT_MAX);
++ }
+
+ /* binding pcm substream to hda stream */
+ substream->runtime->private_data = &dsp_stream->hstream;
+--
+2.51.0
+
--- /dev/null
+From 935e433b6112028267d1283303cdbff57a65ebee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 10:47:19 +0300
+Subject: ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ]
+
+It is allowed to mix Link and Host DMA channels in a way that their index
+is different. In this case we would read the LLP from a channel which is
+not used or used for other operation.
+
+Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire
+configuration:
+playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA
+used
+Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and
+Link channel 0 (stream_tag 1).
+
+In this case reading the LLP from channel 2 is incorrect as that is not the
+Link channel used for the HDMI playback.
+
+To correct this, we should look up the BE and get the channel used on the
+Link side.
+
+Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 24f3cc7676142..2be0d02f9cf9b 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -1103,10 +1103,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,
+ struct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ {
+- struct hdac_stream *hstream = substream->runtime->private_data;
+- struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream);
++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
++ struct snd_soc_pcm_runtime *be_rtd = NULL;
++ struct hdac_ext_stream *hext_stream;
++ struct snd_soc_dai *cpu_dai;
++ struct snd_soc_dpcm *dpcm;
+ u32 llp_l, llp_u;
+
++ /*
++ * The LLP needs to be read from the Link DMA used for this FE as it is
++ * allowed to use any combination of Link and Host channels
++ */
++ for_each_dpcm_be(rtd, substream->stream, dpcm) {
++ if (dpcm->fe != rtd)
++ continue;
++
++ be_rtd = dpcm->be;
++ }
++
++ if (!be_rtd)
++ return 0;
++
++ cpu_dai = snd_soc_rtd_to_cpu(be_rtd, 0);
++ if (!cpu_dai)
++ return 0;
++
++ hext_stream = snd_soc_dai_get_dma_data(cpu_dai, substream);
++ if (!hext_stream)
++ return 0;
++
+ /*
+ * The pplc_addr have been calculated during probe in
+ * hda_dsp_stream_init():
+--
+2.51.0
+
--- /dev/null
+From be2894ff5da9d0b9715d66f12f9fea05826b3857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:51 +0300
+Subject: ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer
+ size
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ]
+
+For ChainDMA the firmware allocates 5ms host buffer instead of the standard
+4ms which should be taken into account when setting the constraint on the
+buffer size.
+
+Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.c | 9 +++++++--
+ sound/soc/sof/ipc4-topology.h | 3 +++
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
+index f82db7f2a6b7e..ac836d0d20de0 100644
+--- a/sound/soc/sof/ipc4-topology.c
++++ b/sound/soc/sof/ipc4-topology.c
+@@ -519,8 +519,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget)
+ swidget->tuples,
+ swidget->num_tuples, sizeof(u32), 1);
+ /* Set default DMA buffer size if it is not specified in topology */
+- if (!sps->dsp_max_burst_size_in_ms)
+- sps->dsp_max_burst_size_in_ms = SOF_IPC4_MIN_DMA_BUFFER_SIZE;
++ if (!sps->dsp_max_burst_size_in_ms) {
++ struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget;
++ struct sof_ipc4_pipeline *pipeline = pipe_widget->private;
++
++ sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ?
++ SOF_IPC4_CHAIN_DMA_BUFFER_SIZE : SOF_IPC4_MIN_DMA_BUFFER_SIZE;
++ }
+ } else {
+ /* Capture data is copied from DSP to host in 1ms bursts */
+ spcm->stream[dir].dsp_max_burst_size_in_ms = 1;
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index 187e186ba4f8f..adb52a1eff85f 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -63,6 +63,9 @@
+ /* FW requires minimum 4ms DMA buffer size */
+ #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4
+
++/* ChainDMA in fw uses 5ms DMA buffer */
++#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5
++
+ /*
+ * The base of multi-gateways. Multi-gateways addressing starts from
+ * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources
+--
+2.51.0
+
--- /dev/null
+From 3eeb9509e2b04e4bc18f8030637862ff892589ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:50 +0300
+Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
+
+The firmware has changed the minimum host buffer size from 2 periods to
+4 periods (1 period is 1ms) which was missed by the kernel side.
+
+Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
+
+Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7
+Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index f4dc499c0ffe5..187e186ba4f8f 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -60,8 +60,8 @@
+
+ #define SOF_IPC4_INVALID_NODE_ID 0xffffffff
+
+-/* FW requires minimum 2ms DMA buffer size */
+-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2
++/* FW requires minimum 4ms DMA buffer size */
++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4
+
+ /*
+ * The base of multi-gateways. Multi-gateways addressing starts from
+--
+2.51.0
+
--- /dev/null
+From ddd61beef9b8337b981be7541a09028c1849490b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 18:26:26 +0800
+Subject: bpf: Avoid RCU context warning when unpinning htab with internal
+ structs
+
+From: KaFai Wan <kafai.wan@linux.dev>
+
+[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
+
+When unpinning a BPF hash table (htab or htab_lru) that contains internal
+structures (timer, workqueue, or task_work) in its values, a BUG warning
+is triggered:
+ BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0
+ ...
+
+The issue arises from the interaction between BPF object unpinning and
+RCU callback mechanisms:
+1. BPF object unpinning uses ->free_inode() which schedules cleanup via
+ call_rcu(), deferring the actual freeing to an RCU callback that
+ executes within the RCU_SOFTIRQ context.
+2. During cleanup of hash tables containing internal structures,
+ htab_map_free_internal_structs() is invoked, which includes
+ cond_resched() or cond_resched_rcu() calls to yield the CPU during
+ potentially long operations.
+
+However, cond_resched() or cond_resched_rcu() cannot be safely called from
+atomic RCU softirq context, leading to the BUG warning when attempting
+to reschedule.
+
+Fix this by changing from ->free_inode() to ->destroy_inode() and rename
+bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link).
+This allows direct inode freeing without RCU callback scheduling,
+avoiding the invalid context warning.
+
+Reported-by: Le Chen <tom2cat@sjtu.edu.cn>
+Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 9aaf5124648bd..746b5644d9a19 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -775,7 +775,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void bpf_free_inode(struct inode *inode)
++static void bpf_destroy_inode(struct inode *inode)
+ {
+ enum bpf_type type;
+
+@@ -790,7 +790,7 @@ const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .free_inode = bpf_free_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+--
+2.51.0
+
--- /dev/null
+From a9e4389a5b0704abf4fec816ad8341b68e2b3063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c850e5d6cbd87..fef4d85fee008 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2289,6 +2289,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2397,6 +2398,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c4effc09cb7d9513db8cb931f4e8ffc733162561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:15:01 +0200
+Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+
+From: Eric Woudstra <ericwouds@gmail.com>
+
+[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
+
+net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+7 locks held by socat/410:
+ #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
+ #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
+ [..]
+ #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
+
+Call Trace:
+ lockdep_rcu_suspicious.cold+0x4f/0xb1
+ br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
+ br_fill_forward_path+0x7a/0x4d0 [bridge]
+
+Use to correct helper, non _rcu variant requires RTNL mutex.
+
+Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
+Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index f2efb58d152bc..13d6c3f51c29d 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,
+ if (!br_opt_get(br, BROPT_VLAN_ENABLED))
+ return;
+
+- vg = br_vlan_group(br);
++ vg = br_vlan_group_rcu(br);
+
+ if (idx >= 0 &&
+ ctx->vlan[idx].proto == br->vlan_proto) {
+--
+2.51.0
+
--- /dev/null
+From 4036e2a1844870b3c1f23065bfe3f131f1c71339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:26:03 +0800
+Subject: cifs: Fix copy_to_iter return value check
+
+From: Fushuai Wang <wangfushuai@baidu.com>
+
+[ Upstream commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 ]
+
+The return value of copy_to_iter() function will never be negative,
+it is the number of bytes copied, or zero if nothing was copied.
+Update the check to treat 0 as an error, and return -1 in that case.
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Acked-by: Tom Talpey <tom@talpey.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index c946c3a09245c..1b30035d02bc5 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4657,7 +4657,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ unsigned int pad_len;
+ struct cifs_io_subrequest *rdata = mid->callback_data;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
+- int length;
++ size_t copied;
+ bool use_rdma_mr = false;
+
+ if (shdr->Command != SMB2_READ) {
+@@ -4770,10 +4770,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ } else if (buf_len >= data_offset + data_len) {
+ /* read response payload is in buf */
+ WARN_ONCE(buffer, "read data can be either in buf or in buffer");
+- length = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter);
+- if (length < 0)
+- return length;
+- rdata->got_bytes = data_len;
++ copied = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter);
++ if (copied == 0)
++ return -EIO;
++ rdata->got_bytes = copied;
+ } else {
+ /* read response payload cannot be in both buf and pages */
+ WARN_ONCE(1, "buf can not contain only a part of read data");
+--
+2.51.0
+
--- /dev/null
+From 0eff0f0819abd5fac655b8b337ab938c5c051026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jun 2025 18:11:10 +0200
+Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse
+ points
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ]
+
+EA $LXMOD is required for WSL non-symlink reparse points.
+
+Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 60 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c
+index 0385a514f59e9..4670c3e451a75 100644
+--- a/fs/smb/client/smb1ops.c
++++ b/fs/smb/client/smb1ops.c
+@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid,
+ }
+
+ #ifdef CONFIG_CIFS_XATTR
++ /*
++ * For non-symlink WSL reparse points it is required to fetch
++ * EA $LXMOD which contains in its S_DT part the mandatory file type.
++ */
++ if (!rc && data->reparse_point) {
++ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
++
++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE,
++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb);
++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) {
++ ea->next_entry_offset = cpu_to_le32(0);
++ ea->flags = 0;
++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE);
++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1);
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
++ rc = 0;
++ } else if (rc >= 0) {
++ /* It is an error if EA $LXMOD has wrong size. */
++ rc = -EINVAL;
++ } else {
++ /*
++ * In all other cases ignore error if fetching
++ * of EA $LXMOD failed. It is needed only for
++ * non-symlink WSL reparse points and wsl_to_fattr()
++ * handle the case when EA is missing.
++ */
++ rc = 0;
++ }
++ }
++
+ /*
+ * For WSL CHR and BLK reparse points it is required to fetch
+ * EA $LXDEV which contains major and minor device numbers.
+ */
+ if (!rc && data->reparse_point) {
+ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
+
+ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
+ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV,
+ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
+ SMB2_WSL_XATTR_DEV_SIZE, cifs_sb);
+@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid,
+ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
+ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE);
+ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1);
+- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
+- SMB2_WSL_XATTR_DEV_SIZE;
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
+ rc = 0;
+ } else if (rc >= 0) {
+ /* It is an error if EA $LXDEV has wrong size. */
+--
+2.51.0
+
--- /dev/null
+From d1ea8714deed9b33022296ae5f7efbb27619cfa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index c173a44c800aa..629f050a855aa 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 3a672fe574842ee11a9d9cee4e0a969071202d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:09:31 +0800
+Subject: clk: mediatek: clk-mux: Do not pass flags to
+ clk_mux_determine_rate_flags()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
+
+The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags.
+Passing one to the other is wrong.
+
+Since there aren't any actual users adding CLK_MUX_* flags, just drop it
+for now.
+
+Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mux.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c
+index 60990296450bb..9a12e58230bed 100644
+--- a/drivers/clk/mediatek/clk-mux.c
++++ b/drivers/clk/mediatek/clk-mux.c
+@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)
+ static int mtk_clk_mux_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw);
+-
+- return clk_mux_determine_rate_flags(hw, req, mux->data->flags);
++ return clk_mux_determine_rate_flags(hw, req, 0);
+ }
+
+ const struct clk_ops mtk_mux_clr_set_upd_ops = {
+--
+2.51.0
+
--- /dev/null
+From 4a451f2d1c1c89c868ead27fcceaeb07766b7be9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:28 +0200
+Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
+
+The infrastructure gate for the HDMI specific crystal needs the
+top_hdmi_xtal clock to be configured in order to ungate the 26m
+clock to the HDMI IP, and it wouldn't work without.
+
+Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
+
+Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+index bb648a88e43af..ad47fdb234607 100644
+--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c
++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {
+ GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28),
+ GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29),
+ /* INFRA_AO1 */
+- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0),
++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0),
+ GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
+--
+2.51.0
+
--- /dev/null
+From 356b5e626a2e9f2bc075c678cb6b7edeea54d30e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 30e0b283ca608..b9e204d63a972 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 74d09cabce90bb7a391394adfa9326804c0303ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 81efa885069b2..30e0b283ca608 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From f90b540cb5d97f197205579f5930e1513696d314 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:33:36 +0300
+Subject: clk: qcom: common: Fix NULL vs IS_ERR() check in
+ qcom_cc_icc_register()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ]
+
+The devm_clk_hw_get_clk() function doesn't return NULL, it returns error
+pointers. Update the checking to match.
+
+Fixes: 8737ec830ee3 ("clk: qcom: common: Add interconnect clocks support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/aLaPwL2gFS85WsfD@stanley.mountain
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
+index 33cc1f73c69d1..cab2dbb7a8d49 100644
+--- a/drivers/clk/qcom/common.c
++++ b/drivers/clk/qcom/common.c
+@@ -273,8 +273,8 @@ static int qcom_cc_icc_register(struct device *dev,
+ icd[i].slave_id = desc->icc_hws[i].slave_id;
+ hws = &desc->clks[desc->icc_hws[i].clk_id]->hw;
+ icd[i].clk = devm_clk_hw_get_clk(dev, hws, "icc");
+- if (!icd[i].clk)
+- return dev_err_probe(dev, -ENOENT,
++ if (IS_ERR(icd[i].clk))
++ return dev_err_probe(dev, PTR_ERR(icd[i].clk),
+ "(%d) clock entry is null\n", i);
+ icd[i].name = clk_hw_get_name(hws);
+ }
+--
+2.51.0
+
--- /dev/null
+From 754c5b629729a5e539919dbd9c3b14d622370b19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 02:28:10 +0100
+Subject: clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
+
+From: Yuan CHen <chenyuan@kylinos.cn>
+
+[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ]
+
+In case of krealloc_array() failure, the current error handling just
+returns from the function without freeing the original array.
+Fix this memory leak by freeing the original array.
+
+Fixes: 6aa1754764901668 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system")
+Signed-off-by: Yuan CHen <chenyuan@kylinos.cn>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250908012810.4767-1-chenyuan_fl@163.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
+index 0f27c33192e10..112ed81f648ee 100644
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -1012,6 +1012,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,
+
+ of_for_each_phandle(&it, rc, node, "clocks", "#clock-cells", -1) {
+ int idx;
++ unsigned int *new_ids;
+
+ if (it.node != priv->np)
+ continue;
+@@ -1022,11 +1023,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,
+ if (args[0] != CPG_MOD)
+ continue;
+
+- ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL);
+- if (!ids) {
++ new_ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL);
++ if (!new_ids) {
+ of_node_put(it.node);
++ kfree(ids);
+ return -ENOMEM;
+ }
++ ids = new_ids;
+
+ if (priv->reg_layout == CLK_REG_LAYOUT_RZ_A)
+ idx = MOD_CLK_PACK_10(args[1]); /* for DEF_MOD_STB() */
+--
+2.51.0
+
--- /dev/null
+From 79c4fe3b859c0b05d9e8fbb030bcce67a3655b69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Apr 2025 15:54:28 +0300
+Subject: clk: tegra: do not overallocate memory for bpmp clocks
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
+
+struct tegra_bpmp::clocks is a pointer to a dynamically allocated array
+of pointers to 'struct tegra_bpmp_clk'.
+
+But the size of the allocated area is calculated like it is an array
+containing actual 'struct tegra_bpmp_clk' objects - it's not true, there
+are just pointers.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace static
+analysis tool.
+
+Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-bpmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index 7bfba0afd7783..4ec408c3a26aa 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp,
+
+ bpmp->num_clocks = count;
+
+- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL);
++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL);
+ if (!bpmp->clocks)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From dca6c7f56dd453cd32ab1c86d1c6d47868e05b05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:12 -0500
+Subject: cpufreq: tegra186: Set target frequency for all cpus in policy
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
+
+The original commit set all cores in a cluster to a shared policy, but
+did not update set_target to apply a frequency change to all cores for
+the policy. This caused most cores to remain stuck at their boot
+frequency.
+
+Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 7b8fcfa55038b..39186008afbfd 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+ {
+ struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+ struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset;
++ unsigned int edvd_offset;
+ u32 edvd_val = tbl->driver_data;
++ u32 cpu;
+
+- writel(edvd_val, data->regs + edvd_offset);
++ for_each_cpu(cpu, policy->cpus) {
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2bed23ed7562998d0b6546553376d76c04737a5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index e63fc6442e320..aa7ebc1235274 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 4314f4ed6fe392982d768f8e1b50b903039d64d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From e7945c1e97de643b77f205b0c83aca5d99c2c7f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 2b1673d69ea83..e5c2fb134d14d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From a91ecbb051bde34e4b6fce9e218d0fec9c26d3fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index e5c2fb134d14d..1ab5ae9b5ea51 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 5875e6005baa8acf96c3ed524c1d98ab47164edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index bd8085ec54ed5..da5596fbfdcb3 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8648,6 +8648,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From e9aaf2fc458567ae4fd4b146d1773ea3b8f71b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:36:55 -0400
+Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
+
+Check that the resource which is converted to a surface exists before
+trying to use the cursor snooper on it.
+
+vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers
+because some svga commands accept SVGA3D_INVALID_ID to mean "no surface",
+unfortunately functions that accept the actual surfaces as objects might
+(and in case of the cursor snooper, do not) be able to handle null
+objects. Make sure that we validate not only the identifier (via the
+vmw_cmd_res_check) but also check that the actual resource exists before
+trying to do something with it.
+
+Fixes unchecked null-ptr reference in the snooping code.
+
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index ea741bc4ac3fc..8b72848bb25cd 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1515,6 +1515,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+ SVGA3dCmdHeader *header)
+ {
+ struct vmw_bo *vmw_bo = NULL;
++ struct vmw_resource *res;
+ struct vmw_surface *srf = NULL;
+ VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);
+ int ret;
+@@ -1550,18 +1551,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+
+ dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?
+ VMW_RES_DIRTY_SET : 0;
+- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+- dirty, user_surface_converter,
+- &cmd->body.host.sid, NULL);
++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,
++ user_surface_converter, &cmd->body.host.sid,
++ NULL);
+ if (unlikely(ret != 0)) {
+ if (unlikely(ret != -ERESTARTSYS))
+ VMW_DEBUG_USER("could not find surface for DMA.\n");
+ return ret;
+ }
+
+- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);
++ res = sw_context->res_cache[vmw_res_surface].res;
++ if (!res) {
++ VMW_DEBUG_USER("Invalid DMA surface.\n");
++ return -EINVAL;
++ }
+
+- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header);
++ srf = vmw_res_to_srf(res);
++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,
++ header);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 90b1be3c3555082f5d106b74967d682b62a654f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:26 -0500
+Subject: drm/vmwgfx: Fix copy-paste typo in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
+
+'entry' should be 'val' which is the loop iterator.
+
+Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index c18dc414a047f..80e8bbc3021d1 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -639,7 +639,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
+ hash_del_rcu(&val->hash.head);
+
+ list_for_each_entry(val, &ctx->resource_ctx_list, head)
+- hash_del_rcu(&entry->hash.head);
++ hash_del_rcu(&val->hash.head);
+
+ ctx->sw_context = NULL;
+ }
+--
+2.51.0
+
--- /dev/null
+From b62990f36e8fc0f8045413276e1081152cc115e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index e7625b3f71e0e..c18dc414a047f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -309,8 +309,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From 54dce7d343d41f3e71d0506fb5439d6a67e2d50e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:31:46 +0000
+Subject: drm/xe/hw_engine_group: Fix double write lock release in error path
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ]
+
+In xe_hw_engine_group_get_mode(), a write lock is acquired before
+calling switch_mode(), which in turn invokes
+xe_hw_engine_group_suspend_faulting_lr_jobs().
+
+On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(),
+the write lock is released there, and then again in
+xe_hw_engine_group_get_mode(), leading to a double release.
+
+Fix this by keeping both acquire and release operation in
+xe_hw_engine_group_get_mode().
+
+Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes")
+Cc: Francois Dugast <francois.dugast@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_hw_engine_group.c b/drivers/gpu/drm/xe/xe_hw_engine_group.c
+index 82750520a90a5..f14a3cc7d1173 100644
+--- a/drivers/gpu/drm/xe/xe_hw_engine_group.c
++++ b/drivers/gpu/drm/xe/xe_hw_engine_group.c
+@@ -237,17 +237,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group
+
+ err = q->ops->suspend_wait(q);
+ if (err)
+- goto err_suspend;
++ return err;
+ }
+
+ if (need_resume)
+ xe_hw_engine_group_resume_faulting_lr_jobs(group);
+
+ return 0;
+-
+-err_suspend:
+- up_write(&group->mode_sem);
+- return err;
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 0488f6cec6ee263577c2795fec3fa1d38368ba59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index cfa7b0a50c8e3..03b16b8f639ad 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 220139711abf18538502ca18b1d70bc4de624bcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 19:53:36 +0800
+Subject: ice: ice_adapter: release xa entry on adapter allocation failure
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ]
+
+When ice_adapter_new() fails, the reserved XArray entry created by
+xa_insert() is not released. This causes subsequent insertions at
+the same index to return -EBUSY, potentially leading to
+NULL pointer dereferences.
+
+Reorder the operations as suggested by Przemek Kitszel:
+1. Check if adapter already exists (xa_load)
+2. Reserve the XArray slot (xa_reserve)
+3. Allocate the adapter (ice_adapter_new)
+4. Store the adapter (xa_store)
+
+Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed")
+Suggested-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.c b/drivers/net/ethernet/intel/ice/ice_adapter.c
+index 10285995c9edd..cc4798026182e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adapter.c
++++ b/drivers/net/ethernet/intel/ice/ice_adapter.c
+@@ -98,19 +98,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev)
+
+ index = ice_adapter_xa_index(pdev);
+ scoped_guard(mutex, &ice_adapters_mutex) {
+- err = xa_insert(&ice_adapters, index, NULL, GFP_KERNEL);
+- if (err == -EBUSY) {
+- adapter = xa_load(&ice_adapters, index);
++ adapter = xa_load(&ice_adapters, index);
++ if (adapter) {
+ refcount_inc(&adapter->refcount);
+ WARN_ON_ONCE(adapter->index != ice_adapter_index(pdev));
+ return adapter;
+ }
++ err = xa_reserve(&ice_adapters, index, GFP_KERNEL);
+ if (err)
+ return ERR_PTR(err);
+
+ adapter = ice_adapter_new(pdev);
+- if (!adapter)
++ if (!adapter) {
++ xa_release(&ice_adapters, index);
+ return ERR_PTR(-ENOMEM);
++ }
+ xa_store(&ice_adapters, index, adapter, GFP_KERNEL);
+ }
+ return adapter;
+--
+2.51.0
+
--- /dev/null
+From 7474113d633e0d0b73540d1b8f6e907fd01bf3e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index 37bb7771d9143..32b75c0326c93 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -291,6 +291,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From bc956915916a8d30ff7f5d107af36eee42d6f824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ]
+
+Currently, when compiling with GCC, there is no "break 7" instruction
+for zero division due to using the option -mno-check-zero-division, but
+the compiler still generates "break 0" instruction for zero division.
+
+Here is a simple example:
+
+ $ cat test.c
+ int div(int a)
+ {
+ return a / 0;
+ }
+ $ gcc -O2 -S test.c -o test.s
+
+GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes
+"ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the
+objtool warnings for LoongArch, but this is not the intention.
+
+When decoding "break 0" as INSN_TRAP in the previous commit, the aim is
+to handle "break 0" as a trap. The generated "break 0" for zero division
+by GCC is not proper, it should generate a break instruction with proper
+bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference
+to avoid generating the unexpected "break 0" instruction for now.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/
+Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code")
+Suggested-by: WANG Rui <wangrui@loongson.cn>
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile
+index 567bd122a9ee4..c14ae21075c5f 100644
+--- a/arch/loongarch/Makefile
++++ b/arch/loongarch/Makefile
+@@ -114,7 +114,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie
+ LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs)
+ endif
+
+-cflags-y += $(call cc-option, -mno-check-zero-division)
++cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference)
+
+ ifndef CONFIG_KASAN
+ cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset
+--
+2.51.0
+
--- /dev/null
+From abbcba805d220623909699cbeb81b739d3dd5a06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Init acpi_gbl_use_global_lock to false
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
+
+Init acpi_gbl_use_global_lock to false, in order to void error messages
+during boot phase:
+
+ ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182)
+ ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
+
+Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 1fa6a604734ef..2ceb198ae8c80 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -354,6 +354,7 @@ void __init platform_init(void)
+
+ #ifdef CONFIG_ACPI
+ acpi_table_upgrade();
++ acpi_gbl_use_global_lock = false;
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 99783625101e75347e94fbe9beb11f01ec10462c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 12:41:23 +0300
+Subject: mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend()
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 08fb6d8ff900a1d06ef2f4a6ded45cdaa7140c01 ]
+
+pm_runtime_put_autosuspend() will soon be changed to include a call to
+pm_runtime_mark_last_busy(). This patch switches the current users to
+__pm_runtime_put_autosuspend() which will continue to have the
+functionality of old pm_runtime_put_autosuspend().
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index d24f71819c3d6..4e093b58fb7b5 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+
+ task = kzalloc(sizeof(*task), GFP_ATOMIC);
+ if (!task) {
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ __pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ return -ENOMEM;
+ }
+
+@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ list_move_tail(&task->list_entry, &thread->task_busy_list);
+
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ __pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
+ return 0;
+ }
+@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan)
+ spin_unlock_irqrestore(&thread->chan->lock, flags);
+
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ __pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ }
+
+ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+ out:
+ spin_unlock_irqrestore(&thread->chan->lock, flags);
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ __pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
+ return 0;
+
+@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+ return -EFAULT;
+ }
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ __pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c07c48777be2beee8885e3588124f62ce5c990af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:15:58 +0800
+Subject: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
+
+From: Jason-JH Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ]
+
+pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously
+called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit()
+(mailbox.c). This caused lockdep warnings such as "sleeping function
+called from invalid context" when running with lockdebug enabled.
+
+The BUG report:
+ BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164
+ in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3
+ preempt_count: 1, expected: 0
+ RCU nest depth: 0, expected: 0
+ INFO: lockdep is turned off.
+ irq event stamp: 0
+ CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1
+ Hardware name: Google Ciri sku0/unprovisioned board (DT)
+ Workqueue: imgsys_runner imgsys_runner_func
+ Call trace:
+ dump_backtrace+0x100/0x120
+ show_stack+0x20/0x2c
+ dump_stack_lvl+0x84/0xb4
+ dump_stack+0x18/0x48
+ __might_resched+0x354/0x4c0
+ __might_sleep+0x98/0xe4
+ __pm_runtime_resume+0x70/0x124
+ cmdq_mbox_send_data+0xe4/0xb1c
+ msg_submit+0x194/0x2dc
+ mbox_send_message+0x190/0x330
+ imgsys_cmdq_sendtask+0x1618/0x2224
+ imgsys_runner_func+0xac/0x11c
+ process_one_work+0x638/0xf84
+ worker_thread+0x808/0xcd0
+ kthread+0x24c/0x324
+ ret_from_fork+0x10/0x20
+
+Additionally, pm_runtime_put_autosuspend() should be invoked from the
+GCE IRQ handler to ensure the hardware has actually completed its work.
+
+To resolve these issues, remove the pm_runtime calls from
+cmdq_mbox_send_data() and delegate power management responsibilities
+to the client driver.
+
+Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend")
+Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index d24f71819c3d6..38ab35157c85f 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ struct cmdq *cmdq = dev_get_drvdata(chan->mbox->dev);
+ struct cmdq_task *task;
+ unsigned long curr_pa, end_pa;
+- int ret;
+
+ /* Client should not flush new tasks if suspended. */
+ WARN_ON(cmdq->suspended);
+
+- ret = pm_runtime_get_sync(cmdq->mbox.dev);
+- if (ret < 0)
+- return ret;
+-
+ task = kzalloc(sizeof(*task), GFP_ATOMIC);
+- if (!task) {
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ if (!task)
+ return -ENOMEM;
+- }
+
+ task->cmdq = cmdq;
+ INIT_LIST_HEAD(&task->list_entry);
+@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ }
+ list_move_tail(&task->list_entry, &thread->task_busy_list);
+
+- pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f52221d673534050bf0f95ef72ded92025e14d83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 11:15:01 +0300
+Subject: mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 472f8a3fccbb579cb98c1821da4cb9cbd51ee3e4 ]
+
+__pm_runtime_put_autosuspend() was meant to be used by callers that needed
+to put the Runtime PM usage_count without marking the device's last busy
+timestamp. It was however seen that the Runtime PM autosuspend related
+functions should include that call. Thus switch the driver to
+use pm_runtime_put_autosuspend().
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Stable-dep-of: 3f39f5652037 ("mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index 4e093b58fb7b5..d24f71819c3d6 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -390,7 +390,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+
+ task = kzalloc(sizeof(*task), GFP_ATOMIC);
+ if (!task) {
+- __pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ return -ENOMEM;
+ }
+
+@@ -440,7 +440,7 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ list_move_tail(&task->list_entry, &thread->task_busy_list);
+
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- __pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
+ return 0;
+ }
+@@ -488,7 +488,7 @@ static void cmdq_mbox_shutdown(struct mbox_chan *chan)
+ spin_unlock_irqrestore(&thread->chan->lock, flags);
+
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- __pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ }
+
+ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+@@ -528,7 +528,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+ out:
+ spin_unlock_irqrestore(&thread->chan->lock, flags);
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- __pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+
+ return 0;
+
+@@ -543,7 +543,7 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
+ return -EFAULT;
+ }
+ pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- __pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ pm_runtime_put_autosuspend(cmdq->mbox.dev);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a02e648c43cc5c15514a1001a8fdef178b27427c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:22 +0530
+Subject: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ]
+
+The cleanup loop was starting at the wrong array index, causing
+out-of-bounds access.
+Start the loop at the correct index for zero-indexed arrays to prevent
+accessing memory beyond the allocated array bounds.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 411bbc10edeaf..fab897b5724c1 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ if (pdata->irq < MAX_SGI)
+ xlnx_mbox_cleanup_sgi(pdata);
+
+- i = pdata->num_mboxes;
++ i = pdata->num_mboxes - 1;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (device_is_registered(&ipi_mbox->dev))
+--
+2.51.0
+
--- /dev/null
+From 20a1ea6d3ad5ee8b0ca3a96928c7e733a492bac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:23 +0530
+Subject: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ]
+
+The driver incorrectly determines SGI vs SPI interrupts by checking IRQ
+number < 16, which fails with dynamic IRQ allocation. During unbind,
+this causes improper SGI cleanup leading to kernel crash.
+
+Add explicit irq_type field to pdata for reliable identification of SGI
+interrupts (type-2) and only clean up SGI resources when appropriate.
+
+Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index fab897b5724c1..5bf81b60e9e67 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -62,7 +62,8 @@
+ #define DST_BIT_POS 9U
+ #define SRC_BITMASK GENMASK(11, 8)
+
+-#define MAX_SGI 16
++/* Macro to represent SGI type for IPI IRQs */
++#define IPI_IRQ_TYPE_SGI 2
+
+ /*
+ * Module parameters
+@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox {
+ * @dev: device pointer corresponding to the Xilinx ZynqMP
+ * IPI agent
+ * @irq: IPI agent interrupt ID
++ * @irq_type: IPI SGI or SPI IRQ type
+ * @method: IPI SMC or HVC is going to be used
+ * @local_id: local IPI agent ID
+ * @virq_sgi: IRQ number mapped to SGI
+@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox {
+ struct zynqmp_ipi_pdata {
+ struct device *dev;
+ int irq;
++ unsigned int irq_type;
+ unsigned int method;
+ u32 local_id;
+ int virq_sgi;
+@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ struct zynqmp_ipi_mbox *ipi_mbox;
+ int i;
+
+- if (pdata->irq < MAX_SGI)
++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI)
+ xlnx_mbox_cleanup_sgi(pdata);
+
+ i = pdata->num_mboxes - 1;
+@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev)
+ dev_err(dev, "failed to parse interrupts\n");
+ goto free_mbox_dev;
+ }
+- ret = out_irq.args[1];
++
++ /* Use interrupt type to distinguish SGI and SPI interrupts */
++ pdata->irq_type = out_irq.args[0];
+
+ /*
+ * If Interrupt number is in SGI range, then request SGI else request
+ * IPI system IRQ.
+ */
+- if (ret < MAX_SGI) {
+- pdata->irq = ret;
++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) {
++ pdata->irq = out_irq.args[1];
+ ret = xlnx_mbox_init_sgi(pdev, pdata->irq, pdata);
+ if (ret)
+ goto free_mbox_dev;
+--
+2.51.0
+
--- /dev/null
+From 14472a3333819e4a70486bfd3b1b64e0d1250608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 388f418aebb72..411bbc10edeaf 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fe3da23bac6c9a5403efaaff9e02a74536761cc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index d59fcb74b3479..388f418aebb72 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From bbc6ebdf6890b7048a2a6f28a0a0c2139490fe2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index 026f7270a54de..fb5d12a87872e 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3c7bd5a5792e8524f9d3b6542065882e4433e835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 281b34af0bb48..3160a1a2d2ab3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 0b83ef6d4795ac2855cdbf8d0d6c70742ec0de62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 09:11:49 +0800
+Subject: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ]
+
+The origin code calls cancel_delayed_work() in ocelot_stats_deinit()
+to cancel the cyclic delayed work item ocelot->stats_work. However,
+cancel_delayed_work() may fail to cancel the work item if it is already
+executing. While destroy_workqueue() does wait for all pending work items
+in the work queue to complete before destroying the work queue, it cannot
+prevent the delayed work item from being rescheduled within the
+ocelot_check_stats_work() function. This limitation exists because the
+delayed work item is only enqueued into the work queue after its timer
+expires. Before the timer expiration, destroy_workqueue() has no visibility
+of this pending work item. Once the work queue appears empty,
+destroy_workqueue() proceeds with destruction. When the timer eventually
+expires, the delayed work item gets queued again, leading to the following
+warning:
+
+workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
+WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0
+...
+RIP: 0010:__queue_work+0x875/0xaf0
+...
+RSP: 0018:ffff88806d108b10 EFLAGS: 00010086
+RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027
+RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88
+RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2
+R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000
+R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0
+FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0
+Call Trace:
+ <IRQ>
+ ? kasan_report+0xc6/0xf0
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ call_timer_fn+0x25/0x1c0
+ __run_timer_base.part.0+0x3be/0x8c0
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ ? rcu_sched_clock_irq+0xb06/0x27d0
+ ? __pfx___run_timer_base.part.0+0x10/0x10
+ ? try_to_wake_up+0xb15/0x1960
+ ? _raw_spin_lock_irq+0x80/0xe0
+ ? __pfx__raw_spin_lock_irq+0x10/0x10
+ tmigr_handle_remote_up+0x603/0x7e0
+ ? __pfx_tmigr_handle_remote_up+0x10/0x10
+ ? sched_balance_trigger+0x1c0/0x9f0
+ ? sched_tick+0x221/0x5a0
+ ? _raw_spin_lock_irq+0x80/0xe0
+ ? __pfx__raw_spin_lock_irq+0x10/0x10
+ ? tick_nohz_handler+0x339/0x440
+ ? __pfx_tmigr_handle_remote_up+0x10/0x10
+ __walk_groups.isra.0+0x42/0x150
+ tmigr_handle_remote+0x1f4/0x2e0
+ ? __pfx_tmigr_handle_remote+0x10/0x10
+ ? ktime_get+0x60/0x140
+ ? lapic_next_event+0x11/0x20
+ ? clockevents_program_event+0x1d4/0x2a0
+ ? hrtimer_interrupt+0x322/0x780
+ handle_softirqs+0x16a/0x550
+ irq_exit_rcu+0xaf/0xe0
+ sysvec_apic_timer_interrupt+0x70/0x80
+ </IRQ>
+...
+
+The following diagram reveals the cause of the above warning:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mscc_ocelot_remove() |
+ ocelot_deinit() | ocelot_check_stats_work()
+ ocelot_stats_deinit() |
+ cancel_delayed_work()| ...
+ | queue_delayed_work()
+ destroy_workqueue() | (wait a time)
+ | __queue_work() //UAF
+
+The above scenario actually constitutes a UAF vulnerability.
+
+The ocelot_stats_deinit() is only invoked when initialization
+failure or resource destruction, so we must ensure that any
+delayed work items cannot be rescheduled.
+
+Replace cancel_delayed_work() with disable_delayed_work_sync()
+to guarantee proper cancellation of the delayed work item and
+ensure completion of any currently executing work before the
+workqueue is deallocated.
+
+A deadlock concern was considered: ocelot_stats_deinit() is called
+in a process context and is not holding any locks that the delayed
+work item might also need. Therefore, the use of the _sync() variant
+is safe here.
+
+This bug was identified through static analysis. To reproduce the
+issue and validate the fix, I simulated ocelot-switch device by
+writing a kernel module and prepared the necessary resources for
+the virtual ocelot-switch device's probe process. Then, removing
+the virtual device will trigger the mscc_ocelot_remove() function,
+which in turn destroys the workqueue.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c
+index c018783757fb2..858d4cbc83d3f 100644
+--- a/drivers/net/ethernet/mscc/ocelot_stats.c
++++ b/drivers/net/ethernet/mscc/ocelot_stats.c
+@@ -984,6 +984,6 @@ int ocelot_stats_init(struct ocelot *ocelot)
+
+ void ocelot_stats_deinit(struct ocelot *ocelot)
+ {
+- cancel_delayed_work(&ocelot->stats_work);
++ disable_delayed_work_sync(&ocelot->stats_work);
+ destroy_workqueue(ocelot->stats_queue);
+ }
+--
+2.51.0
+
--- /dev/null
+From 3db7406c0f520353415d901d1e4e31b877a5c640 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index a0524ba8d7878..93cac73472c79 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From f443f5ae7b103a387b7d1b9a0d219a595cd7c399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 12:08:16 +0200
+Subject: netfilter: nft_objref: validate objref and objrefmap expressions
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
+
+Referencing a synproxy stateful object from OUTPUT hook causes kernel
+crash due to infinite recursive calls:
+
+BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)
+[...]
+Call Trace:
+ __find_rr_leaf+0x99/0x230
+ fib6_table_lookup+0x13b/0x2d0
+ ip6_pol_route+0xa4/0x400
+ fib6_rule_lookup+0x156/0x240
+ ip6_route_output_flags+0xc6/0x150
+ __nf_ip6_route+0x23/0x50
+ synproxy_send_tcp_ipv6+0x106/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+ nft_synproxy_do_eval+0x263/0x310
+ nft_do_chain+0x5a8/0x5f0 [nf_tables
+ nft_do_chain_inet+0x98/0x110
+ nf_hook_slow+0x43/0xc0
+ __ip6_local_out+0xf0/0x170
+ ip6_local_out+0x17/0x70
+ synproxy_send_tcp_ipv6+0x1a2/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+[...]
+
+Implement objref and objrefmap expression validate functions.
+
+Currently, only NFT_OBJECT_SYNPROXY object type requires validation.
+This will also handle a jump to a chain using a synproxy object from the
+OUTPUT hook.
+
+Now when trying to reference a synproxy object in the OUTPUT hook, nft
+will produce the following error:
+
+synproxy_crash.nft: Error: Could not process rule: Operation not supported
+ synproxy name mysynproxy
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Reported-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
+Closes: https://bugzilla.suse.com/1250237
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index 8ee66a86c3bc7..1a62e384766a7 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr,
+ obj->ops->eval(obj, regs, pkt);
+ }
+
++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type)
++{
++ unsigned int hooks;
++
++ switch (type) {
++ case NFT_OBJECT_SYNPROXY:
++ if (ctx->family != NFPROTO_IPV4 &&
++ ctx->family != NFPROTO_IPV6 &&
++ ctx->family != NFPROTO_INET)
++ return -EOPNOTSUPP;
++
++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD);
++
++ return nft_chain_validate_hooks(ctx->chain, hooks);
++ default:
++ break;
++ }
++
++ return 0;
++}
++
++static int nft_objref_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_object *obj = nft_objref_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type);
++}
++
+ static int nft_objref_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = {
+ .activate = nft_objref_activate,
+ .deactivate = nft_objref_deactivate,
+ .dump = nft_objref_dump,
++ .validate = nft_objref_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+ nf_tables_destroy_set(ctx, priv->set);
+ }
+
++static int nft_objref_map_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ const struct nft_objref_map *priv = nft_expr_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, priv->set->objtype);
++}
++
+ static const struct nft_expr_ops nft_objref_map_ops = {
+ .type = &nft_objref_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
+@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = {
+ .deactivate = nft_objref_map_deactivate,
+ .destroy = nft_objref_map_destroy,
+ .dump = nft_objref_map_dump,
++ .validate = nft_objref_map_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 7c75a466267a2dbba8d6ccf1c253566aaf8ef413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 19:53:17 +0100
+Subject: perf arm-spe: Rename the common data source encoding
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
+
+The Neoverse CPUs follow the common data source encoding, and other
+CPU variants can share the same format.
+
+Rename the CPU list and data source definitions as common data source
+names. This change prepares for appending more CPU variants.
+
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------
+ tools/perf/util/arm-spe.c | 28 +++++++++----------
+ 2 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 1443c28545a94..358c611eeddbb 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -56,15 +56,15 @@ enum arm_spe_op_type {
+ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+-enum arm_spe_neoverse_data_source {
+- ARM_SPE_NV_L1D = 0x0,
+- ARM_SPE_NV_L2 = 0x8,
+- ARM_SPE_NV_PEER_CORE = 0x9,
+- ARM_SPE_NV_LOCAL_CLUSTER = 0xa,
+- ARM_SPE_NV_SYS_CACHE = 0xb,
+- ARM_SPE_NV_PEER_CLUSTER = 0xc,
+- ARM_SPE_NV_REMOTE = 0xd,
+- ARM_SPE_NV_DRAM = 0xe,
++enum arm_spe_common_data_source {
++ ARM_SPE_COMMON_DS_L1D = 0x0,
++ ARM_SPE_COMMON_DS_L2 = 0x8,
++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9,
++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa,
++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb,
++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc,
++ ARM_SPE_COMMON_DS_REMOTE = 0xd,
++ ARM_SPE_COMMON_DS_DRAM = 0xe,
+ };
+
+ struct arm_spe_record {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 921b1c6e11379..4754d247dbe73 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,
+ return arm_spe_deliver_synth_event(spe, speq, event, &sample);
+ }
+
+-static const struct midr_range neoverse_spe[] = {
++static const struct midr_range common_ds_encoding_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+ {},
+ };
+
+-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record,
+- union perf_mem_data_src *data_src)
++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
+ {
+ /*
+ * Even though four levels of cache hierarchy are possible, no known
+@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ }
+
+ switch (record->source) {
+- case ARM_SPE_NV_L1D:
++ case ARM_SPE_COMMON_DS_L1D:
+ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_L2:
++ case ARM_SPE_COMMON_DS_L2:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_PEER_CORE:
++ case ARM_SPE_COMMON_DS_PEER_CORE:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know if this is L1, L2 but we do know it was a cache-2-cache
+ * transfer, so set SNOOPX_PEER
+ */
+- case ARM_SPE_NV_LOCAL_CLUSTER:
+- case ARM_SPE_NV_PEER_CLUSTER:
++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER:
++ case ARM_SPE_COMMON_DS_PEER_CLUSTER:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ /*
+ * System cache is assumed to be L3
+ */
+- case ARM_SPE_NV_SYS_CACHE:
++ case ARM_SPE_COMMON_DS_SYS_CACHE:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoop = PERF_MEM_SNOOP_HIT;
+@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know what level it hit in, except it came from the other
+ * socket
+ */
+- case ARM_SPE_NV_REMOTE:
++ case ARM_SPE_COMMON_DS_REMOTE:
+ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+- case ARM_SPE_NV_DRAM:
++ case ARM_SPE_COMMON_DS_DRAM:
+ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus);
+
+ /* Only synthesize data source for LDST operations */
+ if (!is_ldst_op(record->op))
+@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m
+ else
+ return 0;
+
+- if (is_neoverse)
+- arm_spe__synth_data_source_neoverse(record, &data_src);
++ if (is_common)
++ arm_spe__synth_data_source_common(record, &data_src);
+ else
+ arm_spe__synth_data_source_generic(record, &data_src);
+
+--
+2.51.0
+
--- /dev/null
+From 46357687a4fc2fadf7a9ce49e316f856df51c4b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:09 +0100
+Subject: perf arm_spe: Correct memory level for remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
+
+For remote accesses, the data source packet does not contain information
+about the memory level. To avoid misinformation, set the memory level to
+NA (Not Available).
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 4754d247dbe73..9890b17241c34 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor
+ * socket
+ */
+ case ARM_SPE_COMMON_DS_REMOTE:
+- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+--
+2.51.0
+
--- /dev/null
+From e134eb59cb43e169a0f05e52f80bb90a9dcea50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:08 +0100
+Subject: perf arm_spe: Correct setting remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
+
+Set the mem_remote field for a remote access to appropriately represent
+the event.
+
+Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 2c06f2a85400e..921b1c6e11379 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ }
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+--
+2.51.0
+
--- /dev/null
+From e2d75c18f131b3e760a8f84ebf0ed6fe828bc9f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:15 -0700
+Subject: perf disasm: Avoid undefined behavior in incrementing NULL
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ]
+
+Incrementing NULL is undefined behavior and triggers ubsan during the
+perf annotate test.
+
+Split a compound statement over two lines to avoid this.
+
+Fixes: 98f69a573c668a18 ("perf annotate: Split out util/disasm.c")
+Reviewed-by: Collin Funk <collin.funk1@gmail.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/disasm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index 648e8d87ef194..a228a7ba30caa 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -389,13 +389,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ * skip over possible up to 2 operands to get to address, e.g.:
+ * tbnz w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
+ */
+- if (c++ != NULL) {
++ if (c != NULL) {
++ c++;
+ ops->target.addr = strtoull(c, NULL, 16);
+ if (!ops->target.addr) {
+ c = strchr(c, ',');
+ c = validate_comma(c, ops);
+- if (c++ != NULL)
++ if (c != NULL) {
++ c++;
+ ops->target.addr = strtoull(c, NULL, 16);
++ }
+ }
+ } else {
+ ops->target.addr = strtoull(ops->raw, NULL, 16);
+--
+2.51.0
+
--- /dev/null
+From 7733f45f7ea226e9a300b57d37fe08952a7e9d5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:17 -0700
+Subject: perf evsel: Avoid container_of on a NULL leader
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
+
+An evsel should typically have a leader of itself, however, in tests
+like 'Sample parsing' a NULL leader may occur and the container_of
+will return a corrupt pointer.
+
+Avoid this with an explicit NULL test.
+
+Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 6d7249cc1a993..b3de8ce559998 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3497,6 +3497,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)
+
+ struct evsel *evsel__leader(const struct evsel *evsel)
+ {
++ if (evsel->core.leader == NULL)
++ return NULL;
+ return container_of(evsel->core.leader, struct evsel, core);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b1f19e549f2b18801f6ceb0b5b39dc6f42320f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:24:15 -0700
+Subject: perf evsel: Ensure the fallback message is always written to
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
+
+The fallback message is unconditionally printed in places like
+record__open().
+
+If no fallback is attempted this can lead to printing uninitialized
+data, crashes, etc.
+
+Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 70c4e06da7a03..dda107b12b8c6 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3237,7 +3237,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+
+ /* If event has exclude user then don't exclude kernel. */
+ if (evsel->core.attr.exclude_user)
+- return false;
++ goto no_fallback;
+
+ /* Is there already the separator in the name. */
+ if (strchr(name, '/') ||
+@@ -3245,7 +3245,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+ sep = "";
+
+ if (asprintf(&new_name, "%s%su", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+@@ -3268,17 +3268,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+ sep = "";
+
+ if (asprintf(&new_name, "%s%sH", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+ /* Apple M1 requires exclude_guest */
+- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples");
++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples");
+ evsel->core.attr.exclude_guest = 1;
+
+ return true;
+ }
+-
++no_fallback:
++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d",
++ evsel__name(evsel), err);
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From feeac2b5d801ecce7e219db3c27c8f8cbd94b1e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:24 +0100
+Subject: perf python: split Clang options when invoking Popen
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
+
+When passing a list to subprocess.Popen, each element maps to one argv
+token. Current code bundles multiple Clang flags into a single element,
+something like:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+So Clang only sees one long, invalid option instead of separate flags,
+as a result, the script cannot capture any log via PIPE.
+
+Fix this by using shlex.split() to separate the string so each option
+becomes its own argv element. The fixed list will be:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu',
+ '-fintegrated-as',
+ '-Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/setup.py | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
+index 649550e9b7aa8..abb567de3e8a9 100644
+--- a/tools/perf/util/setup.py
++++ b/tools/perf/util/setup.py
+@@ -1,6 +1,7 @@
+ from os import getenv, path
+ from subprocess import Popen, PIPE
+ from re import sub
++import shlex
+
+ cc = getenv("CC")
+
+@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline
+ src_feature_tests = getenv('srctree') + '/tools/build/feature'
+
+ def clang_has_option(option):
+- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines()
++ cmd = shlex.split(f"{cc} {cc_options} {option}")
++ cmd.append(path.join(src_feature_tests, "test-hello.c"))
++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines()
+ return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ]
+
+ if cc_is_clang:
+--
+2.51.0
+
--- /dev/null
+From e04213ee4c16b8088d8cd69a7dbae4d1c1b532e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index dbaf07bf6c5fb..89e5354fa094c 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1371,7 +1371,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ const struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED || perf_tool__compressed_is_stub(tool))
+ dump_event(session->evlist, event, file_offset, &sample, file_path);
+--
+2.51.0
+
--- /dev/null
+From 750a3ffe122cd3c1459e134edbd1ca5e4b1d60ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:48:38 +0100
+Subject: perf test: Add a test for default perf stat command
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ]
+
+Test that one cycles event is opened for each core PMU when "perf stat"
+is run without arguments.
+
+The event line can either be output as "pmu/cycles/" or just "cycles" if
+there is only one PMU. Include 2 spaces for padding in the one PMU case
+to avoid matching when the word cycles is included in metric
+descriptions.
+
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Cc: Yang Jihong <yangjihong@bytedance.com>
+Cc: Dominique Martinet <asmadeus@codewreck.org>
+Cc: Colin Ian King <colin.i.king@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ze Gao <zegao2021@gmail.com>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Cc: Weilin Wang <weilin.wang@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Jing Zhang <renyu.zj@linux.alibaba.com>
+Cc: Yang Li <yang.lee@linux.alibaba.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: ak@linux.intel.com
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Yanteng Si <siyanteng@loongson.cn>
+Cc: Sun Haiyong <sunhaiyong@loongson.cn>
+Cc: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20240926144851.245903-8-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 3f1e67795490a..c6df7eec96b98 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -146,6 +146,30 @@ test_cputype() {
+ echo "cputype test [Success]"
+ }
+
++test_hybrid() {
++ # Test the default stat command on hybrid devices opens one cycles event for
++ # each CPU type.
++ echo "hybrid test"
++
++ # Count the number of core PMUs, assume minimum of 1
++ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l)
++ if [ "$pmus" -lt 1 ]
++ then
++ pmus=1
++ fi
++
++ # Run default Perf stat
++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l)
++
++ if [ "$pmus" -ne "$cycles_events" ]
++ then
++ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]"
++ err=1
++ return
++ fi
++ echo "hybrid test [Success]"
++}
++
+ test_default_stat
+ test_stat_record_report
+ test_stat_record_script
+@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups
+ test_topdown_groups
+ test_topdown_weak_groups
+ test_cputype
++test_hybrid
+ exit $err
+--
+2.51.0
+
--- /dev/null
+From c13e7ab2c06eeb0cb02d121724d156ac03bb7550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 1c4feec1adff1..6e7f053006b4f 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From db24c410eae2afd2630e073fed08370ffe5e65a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:18:31 -0700
+Subject: perf test shell lbr: Avoid failures with perf event paranoia
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ]
+
+When not running as root and with higher perf event paranoia values
+the perf record LBR tests could fail rather than skipping the
+problematic tests.
+
+Add the sensitivity to the test and confirm it passes with paranoia
+values from -1 to 2.
+
+Committer testing:
+
+Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing
+the output shows the mentioned errors before this patch:
+
+ acme@x1:~$ grep -m1 "model name" /proc/cpuinfo
+ model name : 13th Gen Intel(R) Core(TM) i7-1365U
+ acme@x1:~$
+
+Before:
+
+ 132: perf record LBR tests : Skip
+
+After:
+
+ 132: perf record LBR tests : Ok
+
+Fixes: 32559b99e0f59070 ("perf test: Add set of perf record LBR tests")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh
+index ab6f2825f7903..5984ca9b78f8a 100755
+--- a/tools/perf/tests/shell/record_lbr.sh
++++ b/tools/perf/tests/shell/record_lbr.sh
+@@ -4,6 +4,10 @@
+
+ set -e
+
++ParanoidAndNotRoot() {
++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
++}
++
+ if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] &&
+ [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ]
+ then
+@@ -23,6 +27,7 @@ cleanup() {
+ }
+
+ trap_cleanup() {
++ echo "Unexpected signal in ${FUNCNAME[1]}"
+ cleanup
+ exit 1
+ }
+@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2
+ lbr_test "-j ind_jmp" "any indirect jump" 100
+ lbr_test "-j call" "direct calls" 2
+ lbr_test "-j ind_call,u" "any indirect user call" 100
+-lbr_test "-a -b" "system wide any branch" 2
+-lbr_test "-a -j any_call" "system wide any call" 2
++if ! ParanoidAndNotRoot 1
++then
++ lbr_test "-a -b" "system wide any branch" 2
++ lbr_test "-a -j any_call" "system wide any call" 2
++fi
+
+ # Parallel
+ parallel_lbr_test "-b" "parallel any branch" 100 &
+@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 &
+ pid6=$!
+ parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 &
+ pid7=$!
+-parallel_lbr_test "-a -b" "parallel system wide any branch" 100 &
+-pid8=$!
+-parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 &
+-pid9=$!
++if ParanoidAndNotRoot 1
++then
++ pid8=
++ pid9=
++else
++ parallel_lbr_test "-a -b" "parallel system wide any branch" 100 &
++ pid8=$!
++ parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 &
++ pid9=$!
++fi
+
+ for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9
+ do
+--
+2.51.0
+
--- /dev/null
+From 7a6796eb76678f8f5d595447d466170763ee7327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:16 -0700
+Subject: perf test trace_btf_enum: Skip if permissions are insufficient
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ]
+
+Modify test behavior to skip if BPF calls fail with "Operation not
+permitted".
+
+Fixes: d66763fed30f0bd8 ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-3-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/perf/tests/shell/trace_btf_enum.sh b/tools/perf/tests/shell/trace_btf_enum.sh
+index 8d1e6bbeac906..1447d7425f381 100755
+--- a/tools/perf/tests/shell/trace_btf_enum.sh
++++ b/tools/perf/tests/shell/trace_btf_enum.sh
+@@ -23,6 +23,14 @@ check_vmlinux() {
+ fi
+ }
+
++check_permissions() {
++ if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted"
++ then
++ echo "trace+enum test [Skipped permissions]"
++ err=2
++ fi
++}
++
+ trace_landlock() {
+ echo "Tracing syscall ${syscall}"
+
+@@ -54,6 +62,9 @@ trace_non_syscall() {
+ }
+
+ check_vmlinux
++if [ $err = 0 ]; then
++ check_permissions
++fi
+
+ if [ $err = 0 ]; then
+ trace_landlock
+--
+2.51.0
+
--- /dev/null
+From da39e2f431f216234c0e884251e99690c7002c0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 14:30:17 -0700
+Subject: perf test: Update sysfs path for core PMU caps
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit b9228817127430356c929847f111197776201225 ]
+
+While CPU is a system device, it'd be better to use a path for
+event_source devices when it checks PMU capability.
+
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250509213017.204343-2-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 48314d20fe46 ("perf test shell lbr: Avoid failures with perf event paranoia")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/record_lbr.sh | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh
+index 32314641217e6..ab6f2825f7903 100755
+--- a/tools/perf/tests/shell/record_lbr.sh
++++ b/tools/perf/tests/shell/record_lbr.sh
+@@ -4,7 +4,8 @@
+
+ set -e
+
+-if [ ! -f /sys/devices/cpu/caps/branches ] && [ ! -f /sys/devices/cpu_core/caps/branches ]
++if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] &&
++ [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ]
+ then
+ echo "Skip: only x86 CPUs support LBR"
+ exit 2
+--
+2.51.0
+
--- /dev/null
+From 461ad8be5d59f2c84281833691239ed27dcc3974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 23:23:51 -0700
+Subject: perf tools: Add fallback for exclude_guest
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ]
+
+Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default")
+changed to parse "cycles:P" event instead of creating a new cycles
+event for perf record. But it also changed the way how modifiers are
+handled so it doesn't set the exclude_guest bit by default.
+
+It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP
+if not. Let's add a fallback so that it can work with default events.
+
+Also update perf stat hybrid tests to handle possible u or H modifiers.
+
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com>
+Acked-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Atish Patra <atishp@atishpatra.org>
+Cc: Mingwei Zhang <mizhang@google.com>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Palmer Dabbelt <palmer@rivosinc.com>
+Link: https://lore.kernel.org/r/20241016062359.264929-2-namhyung@kernel.org
+Fixes: 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 18 +++++++++++++++---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ tools/perf/util/evsel.c | 21 +++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 628c61397d2d3..b578930ed76a4 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -639,8 +639,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ * (behavior changed with commit b0a873e).
+ */
+ if (errno == EINVAL || errno == ENOSYS ||
+- errno == ENOENT || errno == EOPNOTSUPP ||
+- errno == ENXIO) {
++ errno == ENOENT || errno == ENXIO) {
+ if (verbose > 0)
+ ui__warning("%s event is not supported by the kernel.\n",
+ evsel__name(counter));
+@@ -658,7 +657,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ if (verbose > 0)
+ ui__warning("%s\n", msg);
+ return COUNTER_RETRY;
+- } else if (target__has_per_thread(&target) &&
++ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP &&
+ evsel_list->core.threads &&
+ evsel_list->core.threads->err_thread != -1) {
+ /*
+@@ -679,6 +678,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ return COUNTER_SKIP;
+ }
+
++ if (errno == EOPNOTSUPP) {
++ if (verbose > 0) {
++ ui__warning("%s event is not supported by the kernel.\n",
++ evsel__name(counter));
++ }
++ counter->supported = false;
++ counter->errored = true;
++
++ if ((evsel__leader(counter) != counter) ||
++ !(counter->core.leader->nr_members > 1))
++ return COUNTER_SKIP;
++ }
++
+ evsel__open_strerror(counter, &target, errno, msg, sizeof(msg));
+ ui__error("%s\n", msg);
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index c6df7eec96b98..c4bef71568970 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l)
++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c)
+
+ if [ "$pmus" -ne "$cycles_events" ]
+ then
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index b3de8ce559998..70c4e06da7a03 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3255,6 +3255,27 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+ evsel->core.attr.exclude_kernel = 1;
+ evsel->core.attr.exclude_hv = 1;
+
++ return true;
++ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest &&
++ !evsel->exclude_GH) {
++ const char *name = evsel__name(evsel);
++ char *new_name;
++ const char *sep = ":";
++
++ /* Is there already the separator in the name. */
++ if (strchr(name, '/') ||
++ (strchr(name, ':') && !evsel->is_libpfm_event))
++ sep = "";
++
++ if (asprintf(&new_name, "%s%sH", name, sep) < 0)
++ return false;
++
++ free(evsel->name);
++ evsel->name = new_name;
++ /* Apple M1 requires exclude_guest */
++ scnprintf(msg, msgsize, "trying to fall back to excluding guest samples");
++ evsel->core.attr.exclude_guest = 1;
++
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 10400ec17f6dffc4ddb9b3ff8e3ba855021de432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index af9a97612f9df..f61574d1581e3 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 161eba9d2f89eec4a72b75b854e6fcbf44096c83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:52:12 -0700
+Subject: perf vendor events arm64 AmpereOneX: Fix typo - should be
+ l1d_cache_access_prefetches
+
+From: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+
+[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ]
+
+Add missing 'h' to l1d_cache_access_prefetces
+
+Also fix a couple of typos and use consistent term in brief descriptions
+
+Fixes: 16438b652b464ef7 ("perf vendor events arm64 AmpereOneX: Add core PMU events and metrics")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
+index 5228f94a793f9..6817cac149e0b 100644
+--- a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
++++ b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
+@@ -113,7 +113,7 @@
+ {
+ "MetricName": "load_store_spec_rate",
+ "MetricExpr": "LDST_SPEC / INST_SPEC",
+- "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed",
++ "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed",
+ "MetricGroup": "Operation_Mix",
+ "ScaleUnit": "100percent of operations"
+ },
+@@ -132,7 +132,7 @@
+ {
+ "MetricName": "pc_write_spec_rate",
+ "MetricExpr": "PC_WRITE_SPEC / INST_SPEC",
+- "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed",
++ "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed",
+ "MetricGroup": "Operation_Mix",
+ "ScaleUnit": "100percent of operations"
+ },
+@@ -195,14 +195,14 @@
+ {
+ "MetricName": "stall_frontend_cache_rate",
+ "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES",
+- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss",
++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss",
+ "MetricGroup": "Stall",
+ "ScaleUnit": "100percent of cycles"
+ },
+ {
+ "MetricName": "stall_frontend_tlb_rate",
+ "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES",
+- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss",
++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss",
+ "MetricGroup": "Stall",
+ "ScaleUnit": "100percent of cycles"
+ },
+@@ -391,7 +391,7 @@
+ "ScaleUnit": "100percent of cache acceses"
+ },
+ {
+- "MetricName": "l1d_cache_access_prefetces",
++ "MetricName": "l1d_cache_access_prefetches",
+ "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE",
+ "BriefDescription": "L1D cache access - prefetch",
+ "MetricGroup": "Cache",
+--
+2.51.0
+
--- /dev/null
+From 9bb216c11660860dac93774b739226d1e0b590ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:07:13 +0200
+Subject: rtc: optee: fix memory leak on driver removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
+
+Fix a memory leak in case of driver removal.
+Free the shared memory used for arguments exchanges between kernel and
+OP-TEE RTC PTA.
+
+Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-optee.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c
+index 9f8b5d4a8f6b6..6b77c122fdc10 100644
+--- a/drivers/rtc/rtc-optee.c
++++ b/drivers/rtc/rtc-optee.c
+@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev)
+ {
+ struct optee_rtc *priv = dev_get_drvdata(dev);
+
++ tee_shm_free(priv->shm);
+ tee_client_close_session(priv->ctx, priv->session_id);
+ tee_client_close_context(priv->ctx);
+
+--
+2.51.0
+
--- /dev/null
+From 0249dc93784e9a6a0ba07062bc38479a56f879f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index 4bcd7ca32f27b..b8a0fccef14e0 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From 52ea9c0b67fe1bb36fd300d68b5039573071c982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 15:38:17 +0200
+Subject: s390/cio: Update purge function to unregister the unused subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
+
+Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers")', cio no longer unregisters
+subchannels when the attached device is invalid or unavailable.
+
+As an unintended side-effect, the cio_ignore purge function no longer
+removes subchannels for devices on the cio_ignore list if no CCW device
+is attached. This situation occurs when a CCW device is non-operational
+or unavailable
+
+To ensure the same outcome of the purge function as when the
+current cio_ignore list had been active during boot, update the purge
+function to remove I/O subchannels without working CCW devices if the
+associated device number is found on the cio_ignore list.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 9498825d9c7a5..858a9e171351b 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void)
+ spin_unlock_irqrestore(&recovery_lock, flags);
+ }
+
+-static int purge_fn(struct device *dev, void *data)
++static int purge_fn(struct subchannel *sch, void *data)
+ {
+- struct ccw_device *cdev = to_ccwdev(dev);
+- struct ccw_dev_id *id = &cdev->private->dev_id;
+- struct subchannel *sch = to_subchannel(cdev->dev.parent);
++ struct ccw_device *cdev;
+
+- spin_lock_irq(cdev->ccwlock);
+- if (is_blacklisted(id->ssid, id->devno) &&
+- (cdev->private->state == DEV_STATE_OFFLINE) &&
+- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
+- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+- id->devno);
++ spin_lock_irq(&sch->lock);
++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv)
++ goto unlock;
++
++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev))
++ goto unlock;
++
++ cdev = sch_get_cdev(sch);
++ if (cdev) {
++ if (cdev->private->state != DEV_STATE_OFFLINE)
++ goto unlock;
++
++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
++ goto unlock;
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+- css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+- spin_unlock_irq(cdev->ccwlock);
++
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid,
++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)");
++
++unlock:
++ spin_unlock_irq(&sch->lock);
+ /* Abort loop in case of pending signal. */
+ if (signal_pending(current))
+ return -EINTR;
+@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data)
+ int ccw_purge_blacklisted(void)
+ {
+ CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n");
+- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn);
++ for_each_subchannel_staged(purge_fn, NULL, NULL);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 9bf16ede05381cf62198b19b2501aea346f01442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:46:46 -0700
+Subject: s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f ]
+
+When building s390 defconfig with binutils older than 2.32, there are
+several warnings during the final linking stage:
+
+ s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment
+ s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment
+ s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment
+ s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment
+ s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment
+
+binutils commit afca762f598 ("S/390: Improve partial relro support for
+64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the
+warning.
+
+The :NONE in the .vmlinux.info output section description changes the
+segment for subsequent allocated sections. Move .vmlinux.info right
+above the discards section to place all other sections in the previously
+defined segment, .data.
+
+Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections")
+Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1]
+Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 44 +++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 3f2f90e38808c..0d18d3267bc4f 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -207,6 +207,28 @@ SECTIONS
+ DWARF_DEBUG
+ ELF_DETAILS
+
++ /*
++ * Make sure that the .got.plt is either completely empty or it
++ * contains only the three reserved double words.
++ */
++ .got.plt : {
++ *(.got.plt)
++ }
++ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!")
++
++ /*
++ * Sections that should stay zero sized, which is safer to
++ * explicitly check instead of blindly discarding.
++ */
++ .plt : {
++ *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
++ }
++ ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
++ .rela.dyn : {
++ *(.rela.*) *(.rela_*)
++ }
++ ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!")
++
+ /*
+ * uncompressed image info used by the decompressor
+ * it should match struct vmlinux_info
+@@ -237,28 +259,6 @@ SECTIONS
+ #endif
+ } :NONE
+
+- /*
+- * Make sure that the .got.plt is either completely empty or it
+- * contains only the three reserved double words.
+- */
+- .got.plt : {
+- *(.got.plt)
+- }
+- ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!")
+-
+- /*
+- * Sections that should stay zero sized, which is safer to
+- * explicitly check instead of blindly discarding.
+- */
+- .plt : {
+- *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
+- }
+- ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
+- .rela.dyn : {
+- *(.rela.*) *(.rela_*)
+- }
+- ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!")
+-
+ /* Sections to be discarded */
+ DISCARDS
+ /DISCARD/ : {
+--
+2.51.0
+
--- /dev/null
+From 7512fbe57e6c7f95e713361a2c1076f1b8898c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:05:45 +0200
+Subject: s390: vmlinux.lds.S: Reorder sections
+
+From: Alexey Gladkov <legion@kernel.org>
+
+[ Upstream commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 ]
+
+In the upcoming changes, the ELF_DETAILS macro will be extended with
+the ".modinfo" section, which will cause an error:
+
+>> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment
+>> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment
+>> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment
+
+This happens because the .vmlinux.info use :NONE to override the default
+segment and tell the linker to not put the section in any segment at all.
+
+To avoid this, we need to change the sections order that will be placed
+in the default segment.
+
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Stable-dep-of: 9338d660b79a ("s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index ff1ddba96352a..3f2f90e38808c 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -202,6 +202,11 @@ SECTIONS
+ . = ALIGN(PAGE_SIZE);
+ _end = . ;
+
++ /* Debugging sections. */
++ STABS_DEBUG
++ DWARF_DEBUG
++ ELF_DETAILS
++
+ /*
+ * uncompressed image info used by the decompressor
+ * it should match struct vmlinux_info
+@@ -232,11 +237,6 @@ SECTIONS
+ #endif
+ } :NONE
+
+- /* Debugging sections. */
+- STABS_DEBUG
+- DWARF_DEBUG
+- ELF_DETAILS
+-
+ /*
+ * Make sure that the .got.plt is either completely empty or it
+ * contains only the three reserved double words.
+--
+2.51.0
+
--- /dev/null
+From 5a6dac8702ed5e56b76a7e94159f0cfc371a45fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 020037cbf0d91..655cca5fe7ccb 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From fd969f84b855b87bbab540510470da97e27e9a3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 15:05:41 +0200
+Subject: selftests: netfilter: query conntrack state to check for port clash
+ resolution
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ]
+
+Jakub reported this self test flaking occasionally (fails, but passes on
+re-run) on debug kernels.
+
+This is because the test checks for elapsed time to determine if both
+connections were established in parallel.
+
+Rework this to no longer depend on timing.
+Use busywait helper to check that both sockets have moved to established
+state and then query the conntrack engine for the two entries.
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/
+Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------
+ 1 file changed, 41 insertions(+), 17 deletions(-)
+
+diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+index 1014551dd7694..6731fe1eaf2e9 100755
+--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
++++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+@@ -17,9 +17,31 @@ cleanup()
+
+ checktool "socat -h" "run test without socat"
+ checktool "iptables --version" "run test without iptables"
++checktool "conntrack --version" "run test without conntrack"
+
+ trap cleanup EXIT
+
++connect_done()
++{
++ local ns="$1"
++ local port="$2"
++
++ ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port"
++}
++
++check_ctstate()
++{
++ local ns="$1"
++ local dp="$2"
++
++ if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \
++ --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then
++ echo "FAIL: Did not find expected state for dport $2"
++ ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt'
++ ret=1
++ fi
++}
++
+ setup_ns ns1 ns2
+
+ # Connect the namespaces using a veth pair
+@@ -44,15 +66,18 @@ socatpid=$!
+ ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000"
+
+ # add a virtual IP using DNAT
+-ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201
++ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1
+
+ # ... and route it to the other namespace
+ ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1
+
+-# add a persistent connection from the other namespace
+-ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
++# listener should be up by now, wait if it isn't yet.
++wait_local_port_listen "$ns1" 5201 tcp
+
+-sleep 1
++# add a persistent connection from the other namespace
++sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
++cpid0=$!
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201"
+
+ # ip daddr:dport will be rewritten to 192.168.1.1 5201
+ # NAT must reallocate source port 10000 because
+@@ -71,26 +96,25 @@ fi
+ ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201
+ ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201
+
+-sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null &
++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null &
++cpid1=$!
+
+-# if connect succeeds, client closes instantly due to EOF on stdin.
+-# if connect hangs, it will time out after 5s.
+-echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null &
++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null &
+ cpid2=$!
+
+-time_then=$(date +%s)
+-wait $cpid2
+-rv=$?
+-time_now=$(date +%s)
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203
+
+-# Check how much time has elapsed, expectation is for
+-# 'cpid2' to connect and then exit (and no connect delay).
+-delta=$((time_now - time_then))
++check_ctstate "$ns1" 5202
++check_ctstate "$ns1" 5203
+
+-if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then
++kill $socatpid $cpid0 $cpid1 $cpid2
++socatpid=0
++
++if [ $ret -eq 0 ]; then
+ echo "PASS: could connect to service via redirected ports"
+ else
+- echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)"
++ echo "FAIL: socat cannot connect to service via redirect"
+ ret=1
+ fi
+
+--
+2.51.0
+
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
+perf-disasm-avoid-undefined-behavior-in-incrementing.patch
+perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch
+perf-evsel-avoid-container_of-on-a-null-leader.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch
+clk-at91-peripheral-fix-return-value.patch
+clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+rtc-optee-fix-memory-leak-on-driver-removal.patch
+perf-arm_spe-correct-setting-remote-access.patch
+perf-arm-spe-rename-the-common-data-source-encoding.patch
+perf-arm_spe-correct-memory-level-for-remote-access.patch
+perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch
+perf-test-update-sysfs-path-for-core-pmu-caps.patch
+perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+perf-test-add-a-test-for-default-perf-stat-command.patch
+perf-tools-add-fallback-for-exclude_guest.patch
+perf-evsel-ensure-the-fallback-message-is-always-wri.patch
+clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch
+clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch
+cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch
+asoc-sof-ipc4-topology-account-for-different-chaindm.patch
+asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch
+loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch
+loongarch-init-acpi_gbl_use_global_lock-to-false.patch
+asoc-sof-intel-read-the-llp-via-the-associated-link-.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+drm-xe-hw_engine_group-fix-double-write-lock-release.patch
+s390-cio-update-purge-function-to-unregister-the-unu.patch
+drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+drm-vmwgfx-fix-copy-paste-typo-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch
+ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+perf-python-split-clang-options-when-invoking-popen.patch
+tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch
+mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+mailbox-mtk-cmdq-mailbox-switch-to-__pm_runtime_put_.patch
+mailbox-mtk-cmdq-switch-to-pm_runtime_put_autosuspen.patch
+mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+netfilter-nft_objref-validate-objref-and-objrefmap-e.patch
+bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch
+selftests-netfilter-query-conntrack-state-to-check-f.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+cifs-fix-copy_to_iter-return-value-check.patch
+smb-client-fix-missing-timestamp-updates-after-utime.patch
+cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
+bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch
+s390-vmlinux.lds.s-reorder-sections.patch
+s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch
--- /dev/null
+From f43e7335728f1d12bffcab083c21bf5bb25fd3ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:23:24 -0300
+Subject: smb: client: fix missing timestamp updates after utime(2)
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ]
+
+Don't reuse open handle when changing timestamps to prevent the server
+from disabling automatic timestamp updates as per MS-FSA 2.1.4.17.
+
+---8<---
+import os
+import time
+
+filename = '/mnt/foo'
+
+def print_stat(prefix):
+ st = os.stat(filename)
+ print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime))
+
+fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644)
+print_stat('old')
+os.utime(fd, None)
+time.sleep(2)
+os.write(fd, b'foo')
+os.close(fd)
+time.sleep(2)
+print_stat('new')
+---8<---
+
+Before patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+
+After patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025
+new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025
+
+Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 104a563dc317f..cb049bc70e0cb 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1220,31 +1220,33 @@ int
+ smb2_set_file_info(struct inode *inode, const char *full_path,
+ FILE_BASIC_INFO *buf, const unsigned int xid)
+ {
+- struct cifs_open_parms oparms;
++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++ struct cifsFileInfo *cfile = NULL;
++ struct cifs_open_parms oparms;
+ struct tcon_link *tlink;
+ struct cifs_tcon *tcon;
+- struct cifsFileInfo *cfile;
+- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+- int rc;
+-
+- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
+- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) &&
+- (buf->Attributes == 0))
+- return 0; /* would be a no op, no sense sending this */
++ int rc = 0;
+
+ tlink = cifs_sb_tlink(cifs_sb);
+ if (IS_ERR(tlink))
+ return PTR_ERR(tlink);
+ tcon = tlink_tcon(tlink);
+
+- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) {
++ if (buf->Attributes == 0)
++ goto out; /* would be a no op, no sense sending this */
++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ }
++
+ oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES,
+ FILE_OPEN, 0, ACL_NO_MODE);
+ rc = smb2_compound_op(xid, tcon, cifs_sb,
+ full_path, &oparms, &in_iov,
+ &(int){SMB2_OP_SET_INFO}, 1,
+ cfile, NULL, NULL, NULL);
++out:
+ cifs_put_tlink(tlink);
+ return rc;
+ }
+--
+2.51.0
+
--- /dev/null
+From fd68c746825e188e69f5fbc03fc95538555aff65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 30f4375f8431b..4c8d84fc27ca3 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7338,7 +7338,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From 1c17a977f9c9a01cfaec86f15c56a8502b6555e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 18:41:19 +0000
+Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
+
+Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT
+on their listener, before accept().
+
+This has an unfortunate effect on wscale selection in
+tcp_select_initial_window() during 3WHS.
+
+For instance, tcp_mmap was negotiating wscale 4, regardless
+of tcp_rmem[2] and sysctl_rmem_max.
+
+Do not change tp->window_clamp if it is zero
+or bigger than our computed value.
+
+Zero value is special, it allows tcp_select_initial_window()
+to enable autotuning.
+
+Note that SO_RCVLOWAT use on listener is probably not wise,
+because tp->scaling_ratio has a default value, possibly wrong.
+
+Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 739931aabb4e3..795ffa62cc0e6 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1735,6 +1735,7 @@ EXPORT_SYMBOL(tcp_peek_len);
+ /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */
+ int tcp_set_rcvlowat(struct sock *sk, int val)
+ {
++ struct tcp_sock *tp = tcp_sk(sk);
+ int space, cap;
+
+ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
+@@ -1753,7 +1754,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
+ space = tcp_space_from_win(sk, val);
+ if (space > sk->sk_rcvbuf) {
+ WRITE_ONCE(sk->sk_rcvbuf, space);
+- WRITE_ONCE(tcp_sk(sk)->window_clamp, val);
++
++ if (tp->window_clamp && tp->window_clamp < val)
++ WRITE_ONCE(tp->window_clamp, val);
+ }
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From ff50833397c808c1e969dede98a0501987cf77d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 1658596188bf8..592ca17b4b74a 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -327,10 +327,10 @@ $(OUTPUT)test-libcapstone.bin:
+ $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From e109cb3ff54f3eff31b1d5edac684905d3e4c430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index ed0d3d8449b30..59e992dc65c4c 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 471c139749625c2031b1addd5fbd30e15adb06bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:52 +0300
+Subject: ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
+ instead of buffer time
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 45ad27d9a6f7c620d8bbc80be3bab1faf37dfa0a ]
+
+Instead of constraining the ALSA buffer time to be double of the firmware
+host buffer size, it is better to set it for the period time.
+This will implicitly constrain the buffer time to a safe value
+(num_periods is at least 2) and prohibits applications to set smaller
+period size than what will be covered by the initial DMA burst.
+
+Fixes: fe76d2e75a6d ("ASoC: SOF: Intel: hda-pcm: Use dsp_max_burst_size_in_ms to place constraint")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-4-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c
+index 1dd8d2092c3b4..da6c1e7263cde 100644
+--- a/sound/soc/sof/intel/hda-pcm.c
++++ b/sound/soc/sof/intel/hda-pcm.c
+@@ -29,6 +29,8 @@
+ #define SDnFMT_BITS(x) ((x) << 4)
+ #define SDnFMT_CHAN(x) ((x) << 0)
+
++#define HDA_MAX_PERIOD_TIME_HEADROOM 10
++
+ static bool hda_always_enable_dmi_l1;
+ module_param_named(always_enable_dmi_l1, hda_always_enable_dmi_l1, bool, 0444);
+ MODULE_PARM_DESC(always_enable_dmi_l1, "SOF HDA always enable DMI l1");
+@@ -291,19 +293,30 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev,
+ * On playback start the DMA will transfer dsp_max_burst_size_in_ms
+ * amount of data in one initial burst to fill up the host DMA buffer.
+ * Consequent DMA burst sizes are shorter and their length can vary.
+- * To make sure that userspace allocate large enough ALSA buffer we need
+- * to place a constraint on the buffer time.
++ * To avoid immediate xrun by the initial burst we need to place
++ * constraint on the period size (via PERIOD_TIME) to cover the size of
++ * the host buffer.
++ * We need to add headroom of max 10ms as the firmware needs time to
++ * settle to the 1ms pacing and initially it can run faster for few
++ * internal periods.
+ *
+ * On capture the DMA will transfer 1ms chunks.
+- *
+- * Exact dsp_max_burst_size_in_ms constraint is racy, so set the
+- * constraint to a minimum of 2x dsp_max_burst_size_in_ms.
+ */
+- if (spcm->stream[direction].dsp_max_burst_size_in_ms)
++ if (spcm->stream[direction].dsp_max_burst_size_in_ms) {
++ unsigned int period_time = spcm->stream[direction].dsp_max_burst_size_in_ms;
++
++ /*
++ * add headroom over the maximum burst size to cover the time
++ * needed for the DMA pace to settle.
++ * Limit the headroom time to HDA_MAX_PERIOD_TIME_HEADROOM
++ */
++ period_time += min(period_time, HDA_MAX_PERIOD_TIME_HEADROOM);
++
+ snd_pcm_hw_constraint_minmax(substream->runtime,
+- SNDRV_PCM_HW_PARAM_BUFFER_TIME,
+- spcm->stream[direction].dsp_max_burst_size_in_ms * USEC_PER_MSEC * 2,
++ SNDRV_PCM_HW_PARAM_PERIOD_TIME,
++ period_time * USEC_PER_MSEC,
+ UINT_MAX);
++ }
+
+ /* binding pcm substream to hda stream */
+ substream->runtime->private_data = &dsp_stream->hstream;
+--
+2.51.0
+
--- /dev/null
+From fb814d1de0f47b5efccec492a793982fcf5ab34d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 10:47:19 +0300
+Subject: ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit aaab61de1f1e44a2ab527e935474e2e03a0f6b08 ]
+
+It is allowed to mix Link and Host DMA channels in a way that their index
+is different. In this case we would read the LLP from a channel which is
+not used or used for other operation.
+
+Such case can be reproduced on cAVS2.5 or ACE1 platforms with soundwire
+configuration:
+playback to SDW would take Host channel 0 (stream_tag 1) and no Link DMA
+used
+Second playback to HDMI (HDA) would use Host channel 1 (stream_tag 2) and
+Link channel 0 (stream_tag 1).
+
+In this case reading the LLP from channel 2 is incorrect as that is not the
+Link channel used for the HDMI playback.
+
+To correct this, we should look up the BE and get the channel used on the
+Link side.
+
+Fixes: 67b182bea08a ("ASoC: SOF: Intel: hda: Implement get_stream_position (Linear Link Position)")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://patch.msgid.link/20251002074719.2084-6-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index a34f472ef1751..9c3b3a9aaf83c 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -1129,10 +1129,35 @@ u64 hda_dsp_get_stream_llp(struct snd_sof_dev *sdev,
+ struct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ {
+- struct hdac_stream *hstream = substream->runtime->private_data;
+- struct hdac_ext_stream *hext_stream = stream_to_hdac_ext_stream(hstream);
++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
++ struct snd_soc_pcm_runtime *be_rtd = NULL;
++ struct hdac_ext_stream *hext_stream;
++ struct snd_soc_dai *cpu_dai;
++ struct snd_soc_dpcm *dpcm;
+ u32 llp_l, llp_u;
+
++ /*
++ * The LLP needs to be read from the Link DMA used for this FE as it is
++ * allowed to use any combination of Link and Host channels
++ */
++ for_each_dpcm_be(rtd, substream->stream, dpcm) {
++ if (dpcm->fe != rtd)
++ continue;
++
++ be_rtd = dpcm->be;
++ }
++
++ if (!be_rtd)
++ return 0;
++
++ cpu_dai = snd_soc_rtd_to_cpu(be_rtd, 0);
++ if (!cpu_dai)
++ return 0;
++
++ hext_stream = snd_soc_dai_get_dma_data(cpu_dai, substream);
++ if (!hext_stream)
++ return 0;
++
+ /*
+ * The pplc_addr have been calculated during probe in
+ * hda_dsp_stream_init():
+--
+2.51.0
+
--- /dev/null
+From 86916cace9abe91fb771dc2086cb9431fc4dea03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:51 +0300
+Subject: ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer
+ size
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 3dcf683bf1062d69014fe81b90d285c7eb85ca8a ]
+
+For ChainDMA the firmware allocates 5ms host buffer instead of the standard
+4ms which should be taken into account when setting the constraint on the
+buffer size.
+
+Fixes: 842bb8b62cc6 ("ASoC: SOF: ipc4-topology: Save the DMA maximum burst size for PCMs")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-3-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.c | 9 +++++++--
+ sound/soc/sof/ipc4-topology.h | 3 +++
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
+index c93db452bbc07..16053d224dcdb 100644
+--- a/sound/soc/sof/ipc4-topology.c
++++ b/sound/soc/sof/ipc4-topology.c
+@@ -623,8 +623,13 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget)
+ swidget->tuples,
+ swidget->num_tuples, sizeof(u32), 1);
+ /* Set default DMA buffer size if it is not specified in topology */
+- if (!sps->dsp_max_burst_size_in_ms)
+- sps->dsp_max_burst_size_in_ms = SOF_IPC4_MIN_DMA_BUFFER_SIZE;
++ if (!sps->dsp_max_burst_size_in_ms) {
++ struct snd_sof_widget *pipe_widget = swidget->spipe->pipe_widget;
++ struct sof_ipc4_pipeline *pipeline = pipe_widget->private;
++
++ sps->dsp_max_burst_size_in_ms = pipeline->use_chain_dma ?
++ SOF_IPC4_CHAIN_DMA_BUFFER_SIZE : SOF_IPC4_MIN_DMA_BUFFER_SIZE;
++ }
+ } else {
+ /* Capture data is copied from DSP to host in 1ms bursts */
+ spcm->stream[dir].dsp_max_burst_size_in_ms = 1;
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index ce5c69cb9ea4e..2a2afd0e83338 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -64,6 +64,9 @@
+ /* FW requires minimum 4ms DMA buffer size */
+ #define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4
+
++/* ChainDMA in fw uses 5ms DMA buffer */
++#define SOF_IPC4_CHAIN_DMA_BUFFER_SIZE 5
++
+ /*
+ * The base of multi-gateways. Multi-gateways addressing starts from
+ * ALH_MULTI_GTW_BASE and there are ALH_MULTI_GTW_COUNT multi-sources
+--
+2.51.0
+
--- /dev/null
+From 88f92fa53658c6d5a67651380475dd8eddffdde3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:50 +0300
+Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
+
+The firmware has changed the minimum host buffer size from 2 periods to
+4 periods (1 period is 1ms) which was missed by the kernel side.
+
+Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
+
+Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7
+Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index 659e1ae0a85f9..ce5c69cb9ea4e 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -61,8 +61,8 @@
+ #define SOF_IPC4_CHAIN_DMA_NODE_ID 0x7fffffff
+ #define SOF_IPC4_INVALID_NODE_ID 0xffffffff
+
+-/* FW requires minimum 2ms DMA buffer size */
+-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2
++/* FW requires minimum 4ms DMA buffer size */
++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4
+
+ /*
+ * The base of multi-gateways. Multi-gateways addressing starts from
+--
+2.51.0
+
--- /dev/null
+From aa7aca8378fa61239116f9552edd289ab42a23ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 18:26:26 +0800
+Subject: bpf: Avoid RCU context warning when unpinning htab with internal
+ structs
+
+From: KaFai Wan <kafai.wan@linux.dev>
+
+[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
+
+When unpinning a BPF hash table (htab or htab_lru) that contains internal
+structures (timer, workqueue, or task_work) in its values, a BUG warning
+is triggered:
+ BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0
+ ...
+
+The issue arises from the interaction between BPF object unpinning and
+RCU callback mechanisms:
+1. BPF object unpinning uses ->free_inode() which schedules cleanup via
+ call_rcu(), deferring the actual freeing to an RCU callback that
+ executes within the RCU_SOFTIRQ context.
+2. During cleanup of hash tables containing internal structures,
+ htab_map_free_internal_structs() is invoked, which includes
+ cond_resched() or cond_resched_rcu() calls to yield the CPU during
+ potentially long operations.
+
+However, cond_resched() or cond_resched_rcu() cannot be safely called from
+atomic RCU softirq context, leading to the BUG warning when attempting
+to reschedule.
+
+Fix this by changing from ->free_inode() to ->destroy_inode() and rename
+bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link).
+This allows direct inode freeing without RCU callback scheduling,
+avoiding the invalid context warning.
+
+Reported-by: Le Chen <tom2cat@sjtu.edu.cn>
+Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 5c2e96b19392a..1a31c87234877 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -775,7 +775,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void bpf_free_inode(struct inode *inode)
++static void bpf_destroy_inode(struct inode *inode)
+ {
+ enum bpf_type type;
+
+@@ -790,7 +790,7 @@ const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .free_inode = bpf_free_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+--
+2.51.0
+
--- /dev/null
+From c511da4ad6cc1ac3c124fbb314166a4c9085e3cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 2d326d35c3871..c5cdf3b08341a 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2281,6 +2281,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2389,6 +2390,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 01014f0c90925478838ac92119f5379e948e0654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:15:01 +0200
+Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+
+From: Eric Woudstra <ericwouds@gmail.com>
+
+[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
+
+net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+7 locks held by socat/410:
+ #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
+ #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
+ [..]
+ #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
+
+Call Trace:
+ lockdep_rcu_suspicious.cold+0x4f/0xb1
+ br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
+ br_fill_forward_path+0x7a/0x4d0 [bridge]
+
+Use to correct helper, non _rcu variant requires RTNL mutex.
+
+Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
+Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index 939a3aa78d5c4..54993a05037c1 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,
+ if (!br_opt_get(br, BROPT_VLAN_ENABLED))
+ return;
+
+- vg = br_vlan_group(br);
++ vg = br_vlan_group_rcu(br);
+
+ if (idx >= 0 &&
+ ctx->vlan[idx].proto == br->vlan_proto) {
+--
+2.51.0
+
--- /dev/null
+From 75aec55750180aac6f051bb5bbc8d67fea31bb95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:26:03 +0800
+Subject: cifs: Fix copy_to_iter return value check
+
+From: Fushuai Wang <wangfushuai@baidu.com>
+
+[ Upstream commit 0cc380d0e1d36b8f2703379890e90f896f68e9e8 ]
+
+The return value of copy_to_iter() function will never be negative,
+it is the number of bytes copied, or zero if nothing was copied.
+Update the check to treat 0 as an error, and return -1 in that case.
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Acked-by: Tom Talpey <tom@talpey.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 68286673afc99..328fdeecae29a 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4653,7 +4653,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ unsigned int pad_len;
+ struct cifs_io_subrequest *rdata = mid->callback_data;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
+- int length;
++ size_t copied;
+ bool use_rdma_mr = false;
+
+ if (shdr->Command != SMB2_READ) {
+@@ -4766,10 +4766,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+ } else if (buf_len >= data_offset + data_len) {
+ /* read response payload is in buf */
+ WARN_ONCE(buffer, "read data can be either in buf or in buffer");
+- length = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter);
+- if (length < 0)
+- return length;
+- rdata->got_bytes = data_len;
++ copied = copy_to_iter(buf + data_offset, data_len, &rdata->subreq.io_iter);
++ if (copied == 0)
++ return -EIO;
++ rdata->got_bytes = copied;
+ } else {
+ /* read response payload cannot be in both buf and pages */
+ WARN_ONCE(1, "buf can not contain only a part of read data");
+--
+2.51.0
+
--- /dev/null
+From f61b2b5d2b2cb492cb863cf1a3e53c9e86037261 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jun 2025 18:11:10 +0200
+Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse
+ points
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ]
+
+EA $LXMOD is required for WSL non-symlink reparse points.
+
+Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 60 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c
+index a02d41d1ce4a3..3fdbb71036cff 100644
+--- a/fs/smb/client/smb1ops.c
++++ b/fs/smb/client/smb1ops.c
+@@ -651,14 +651,72 @@ static int cifs_query_path_info(const unsigned int xid,
+ }
+
+ #ifdef CONFIG_CIFS_XATTR
++ /*
++ * For non-symlink WSL reparse points it is required to fetch
++ * EA $LXMOD which contains in its S_DT part the mandatory file type.
++ */
++ if (!rc && data->reparse_point) {
++ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
++
++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE,
++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb);
++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) {
++ ea->next_entry_offset = cpu_to_le32(0);
++ ea->flags = 0;
++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE);
++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1);
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
++ rc = 0;
++ } else if (rc >= 0) {
++ /* It is an error if EA $LXMOD has wrong size. */
++ rc = -EINVAL;
++ } else {
++ /*
++ * In all other cases ignore error if fetching
++ * of EA $LXMOD failed. It is needed only for
++ * non-symlink WSL reparse points and wsl_to_fattr()
++ * handle the case when EA is missing.
++ */
++ rc = 0;
++ }
++ }
++
+ /*
+ * For WSL CHR and BLK reparse points it is required to fetch
+ * EA $LXDEV which contains major and minor device numbers.
+ */
+ if (!rc && data->reparse_point) {
+ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
+
+ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
+ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV,
+ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
+ SMB2_WSL_XATTR_DEV_SIZE, cifs_sb);
+@@ -668,8 +726,8 @@ static int cifs_query_path_info(const unsigned int xid,
+ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
+ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE);
+ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1);
+- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
+- SMB2_WSL_XATTR_DEV_SIZE;
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
+ rc = 0;
+ } else if (rc >= 0) {
+ /* It is an error if EA $LXDEV has wrong size. */
+--
+2.51.0
+
--- /dev/null
+From cbddc84a11e6112835fced8f7266d9810efc52f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index c173a44c800aa..629f050a855aa 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 504d735fd054d22130eeaa883879487a396f4266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:09:31 +0800
+Subject: clk: mediatek: clk-mux: Do not pass flags to
+ clk_mux_determine_rate_flags()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
+
+The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags.
+Passing one to the other is wrong.
+
+Since there aren't any actual users adding CLK_MUX_* flags, just drop it
+for now.
+
+Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mux.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c
+index 60990296450bb..9a12e58230bed 100644
+--- a/drivers/clk/mediatek/clk-mux.c
++++ b/drivers/clk/mediatek/clk-mux.c
+@@ -146,9 +146,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)
+ static int mtk_clk_mux_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw);
+-
+- return clk_mux_determine_rate_flags(hw, req, mux->data->flags);
++ return clk_mux_determine_rate_flags(hw, req, 0);
+ }
+
+ const struct clk_ops mtk_mux_clr_set_upd_ops = {
+--
+2.51.0
+
--- /dev/null
+From 3e0ad475c16d64f8267b423f214b2de263bd09a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:28 +0200
+Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
+
+The infrastructure gate for the HDMI specific crystal needs the
+top_hdmi_xtal clock to be configured in order to ungate the 26m
+clock to the HDMI IP, and it wouldn't work without.
+
+Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
+
+Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+index bb648a88e43af..ad47fdb234607 100644
+--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c
++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {
+ GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28),
+ GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29),
+ /* INFRA_AO1 */
+- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0),
++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0),
+ GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
+--
+2.51.0
+
--- /dev/null
+From d135686b97c6508893976b32bbdae318caf2b49e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:22:37 +0200
+Subject: clk: npcm: select CONFIG_AUXILIARY_BUS
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c123519bffd29e6320d3a8c4977f9e5a86d6b83d ]
+
+There are very rare randconfig builds that turn on this driver but
+don't already select CONFIG_AUXILIARY_BUS from another driver, and
+this results in a build failure:
+
+arm-linux-gnueabi-ld: drivers/clk/clk-npcm8xx.o: in function `npcm8xx_clock_driver_init':
+clk-npcm8xx.c:(.init.text+0x18): undefined reference to `__auxiliary_driver_register'
+
+Select the bus here, as all other clk drivers using it do.
+
+Fixes: e0b255df027e ("clk: npcm8xx: add clock controller")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20250807072241.4190376-1-arnd@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
+index 4d56475f94fc1..b1425aed65938 100644
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -364,6 +364,7 @@ config COMMON_CLK_LOCHNAGAR
+ config COMMON_CLK_NPCM8XX
+ tristate "Clock driver for the NPCM8XX SoC Family"
+ depends on ARCH_NPCM || COMPILE_TEST
++ select AUXILIARY_BUS
+ help
+ This driver supports the clocks on the Nuvoton BMC NPCM8XX SoC Family,
+ all the clocks are initialized by the bootloader, so this driver
+--
+2.51.0
+
--- /dev/null
+From 67b3f59871d60571cc6f9858d220511e96934522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 30e0b283ca608..b9e204d63a972 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -381,7 +381,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -404,7 +404,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 163768c4047e0f6c18d2e8cae0e81630347eb4e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 81efa885069b2..30e0b283ca608 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -370,23 +370,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -443,7 +445,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From dc7cf885642f1cb22589dfce1ba2f694d0a0eb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 09:33:36 +0300
+Subject: clk: qcom: common: Fix NULL vs IS_ERR() check in
+ qcom_cc_icc_register()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 1e50f5c9965252ed6657b8692cd7366784d60616 ]
+
+The devm_clk_hw_get_clk() function doesn't return NULL, it returns error
+pointers. Update the checking to match.
+
+Fixes: 8737ec830ee3 ("clk: qcom: common: Add interconnect clocks support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/aLaPwL2gFS85WsfD@stanley.mountain
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c
+index 37c3008e6c1be..1215918867741 100644
+--- a/drivers/clk/qcom/common.c
++++ b/drivers/clk/qcom/common.c
+@@ -277,8 +277,8 @@ static int qcom_cc_icc_register(struct device *dev,
+ icd[i].slave_id = desc->icc_hws[i].slave_id;
+ hws = &desc->clks[desc->icc_hws[i].clk_id]->hw;
+ icd[i].clk = devm_clk_hw_get_clk(dev, hws, "icc");
+- if (!icd[i].clk)
+- return dev_err_probe(dev, -ENOENT,
++ if (IS_ERR(icd[i].clk))
++ return dev_err_probe(dev, PTR_ERR(icd[i].clk),
+ "(%d) clock entry is null\n", i);
+ icd[i].name = clk_hw_get_name(hws);
+ }
+--
+2.51.0
+
--- /dev/null
+From 69806146d40127167430c1c2c555099735ebf56b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:17:54 +0200
+Subject: clk: qcom: Select the intended config in QCS_DISPCC_615
+
+From: Lukas Bulwahn <lukas.bulwahn@redhat.com>
+
+[ Upstream commit 9524f95c4042545ee8fc3191b9b89c61a1aca6fb ]
+
+Commit 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock
+controller driver") adds the config QCS_DISPCC_615, which selects the
+non-existing config QCM_GCC_615. Probably, this is just a three-letter
+abbreviation mix-up here, though. There is a config named QCS_GCC_615,
+and the related config QCS_CAMCC_615 selects that config.
+
+Fix the typo and use the intended config name in the select command.
+
+Fixes: 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
+Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250902121754.277452-1-lukas.bulwahn@redhat.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
+index 6cb6cd3e1778a..e721b23234ddd 100644
+--- a/drivers/clk/qcom/Kconfig
++++ b/drivers/clk/qcom/Kconfig
+@@ -495,7 +495,7 @@ config QCM_DISPCC_2290
+
+ config QCS_DISPCC_615
+ tristate "QCS615 Display Clock Controller"
+- select QCM_GCC_615
++ select QCS_GCC_615
+ help
+ Support for the display clock controller on Qualcomm Technologies, Inc
+ QCS615 devices.
+--
+2.51.0
+
--- /dev/null
+From bb6f9b0a5630926f6183705cf88ed7f3e5bdd13b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 02:28:10 +0100
+Subject: clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init()
+
+From: Yuan CHen <chenyuan@kylinos.cn>
+
+[ Upstream commit cc55fc58fc1b7f405003fd2ecf79e74653461f0b ]
+
+In case of krealloc_array() failure, the current error handling just
+returns from the function without freeing the original array.
+Fix this memory leak by freeing the original array.
+
+Fixes: 6aa1754764901668 ("clk: renesas: cpg-mssr: Ignore all clocks assigned to non-Linux system")
+Signed-off-by: Yuan CHen <chenyuan@kylinos.cn>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250908012810.4767-1-chenyuan_fl@163.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/renesas-cpg-mssr.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
+index 5ff6ee1f7d4b7..de1cf7ba45b78 100644
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -1082,6 +1082,7 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,
+
+ of_for_each_phandle(&it, rc, node, "clocks", "#clock-cells", -1) {
+ int idx;
++ unsigned int *new_ids;
+
+ if (it.node != priv->np)
+ continue;
+@@ -1092,11 +1093,13 @@ static int __init cpg_mssr_reserved_init(struct cpg_mssr_priv *priv,
+ if (args[0] != CPG_MOD)
+ continue;
+
+- ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL);
+- if (!ids) {
++ new_ids = krealloc_array(ids, (num + 1), sizeof(*ids), GFP_KERNEL);
++ if (!new_ids) {
+ of_node_put(it.node);
++ kfree(ids);
+ return -ENOMEM;
+ }
++ ids = new_ids;
+
+ if (priv->reg_layout == CLK_REG_LAYOUT_RZ_A)
+ idx = MOD_CLK_PACK_10(args[1]); /* for DEF_MOD_STB() */
+--
+2.51.0
+
--- /dev/null
+From 3e367f90ac2ef6218484845a25063336087d132e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 12:21:26 +0300
+Subject: clk: renesas: r9a08g045: Add MSTOP for GPIO
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit f0cb3463d0244765ab66792a88dc5e2152c130e1 ]
+
+The GPIO module also supports MSTOP. Add it in the description of the gpio
+clock.
+
+Fixes: c49695952746 ("clk: renesas: r9a08g045: Drop power domain instantiation")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250806092129.621194-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r9a08g045-cpg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r9a08g045-cpg.c b/drivers/clk/renesas/r9a08g045-cpg.c
+index ed0661997928b..3b28edfabc34e 100644
+--- a/drivers/clk/renesas/r9a08g045-cpg.c
++++ b/drivers/clk/renesas/r9a08g045-cpg.c
+@@ -284,7 +284,8 @@ static const struct rzg2l_mod_clk r9a08g045_mod_clks[] = {
+ MSTOP(BUS_MCPU2, BIT(5))),
+ DEF_MOD("scif5_clk_pck", R9A08G045_SCIF5_CLK_PCK, R9A08G045_CLK_P0, 0x584, 5,
+ MSTOP(BUS_MCPU3, BIT(4))),
+- DEF_MOD("gpio_hclk", R9A08G045_GPIO_HCLK, R9A08G045_OSCCLK, 0x598, 0, 0),
++ DEF_MOD("gpio_hclk", R9A08G045_GPIO_HCLK, R9A08G045_OSCCLK, 0x598, 0,
++ MSTOP(BUS_PERI_CPU, BIT(6))),
+ DEF_MOD("adc_adclk", R9A08G045_ADC_ADCLK, R9A08G045_CLK_TSU, 0x5a8, 0,
+ MSTOP(BUS_MCPU2, BIT(14))),
+ DEF_MOD("adc_pclk", R9A08G045_ADC_PCLK, R9A08G045_CLK_TSU, 0x5a8, 1,
+--
+2.51.0
+
--- /dev/null
+From 7dedd1d8c2e6b00af77e1d2dd14456233ca6edfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Apr 2025 15:54:28 +0300
+Subject: clk: tegra: do not overallocate memory for bpmp clocks
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
+
+struct tegra_bpmp::clocks is a pointer to a dynamically allocated array
+of pointers to 'struct tegra_bpmp_clk'.
+
+But the size of the allocated area is calculated like it is an array
+containing actual 'struct tegra_bpmp_clk' objects - it's not true, there
+are just pointers.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace static
+analysis tool.
+
+Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-bpmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index b2323cb8eddcc..77a2586dbe000 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp,
+
+ bpmp->num_clocks = count;
+
+- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL);
++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL);
+ if (!bpmp->clocks)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 50a5a8cc68941ca05b708800ca8ab937c3c0710d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 17:11:10 +0800
+Subject: clk: thead: Correct parent for DPU pixel clocks
+
+From: Michal Wilczynski <m.wilczynski@samsung.com>
+
+[ Upstream commit c51a37ffea3813374a8f7955abbba6da25357388 ]
+
+The dpu0_pixelclk and dpu1_pixelclk gates were incorrectly parented to
+the video_pll_clk.
+
+According to the TH1520 TRM, the "dpu0_pixelclk" should be sourced from
+"DPU0 PLL DIV CLK". In this driver, "DPU0 PLL DIV CLK" corresponds to
+the `dpu0_clk` clock, which is a divider whose parent is the
+`dpu0_pll_clk`.
+
+This patch corrects the clock hierarchy by reparenting `dpu0_pixelclk`
+to `dpu0_clk`. By symmetry, `dpu1_pixelclk` is also reparented to its
+correct source, `dpu1_clk`.
+
+Fixes: 50d4b157fa96 ("clk: thead: Add clock support for VO subsystem in T-HEAD TH1520 SoC")
+Reported-by: Icenowy Zheng <uwu@icenowy.me>
+Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
+[Icenowy: add Drew's R-b and rebased atop ccu_gate refactor]
+Reviewed-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Signed-off-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/thead/clk-th1520-ap.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c
+index 8a5d699638379..ec52726fbea95 100644
+--- a/drivers/clk/thead/clk-th1520-ap.c
++++ b/drivers/clk/thead/clk-th1520-ap.c
+@@ -761,6 +761,10 @@ static struct ccu_div dpu0_clk = {
+ },
+ };
+
++static const struct clk_parent_data dpu0_clk_pd[] = {
++ { .hw = &dpu0_clk.common.hw }
++};
++
+ static struct ccu_div dpu1_clk = {
+ .div = TH_CCU_DIV_FLAGS(0, 8, CLK_DIVIDER_ONE_BASED),
+ .common = {
+@@ -773,6 +777,10 @@ static struct ccu_div dpu1_clk = {
+ },
+ };
+
++static const struct clk_parent_data dpu1_clk_pd[] = {
++ { .hw = &dpu1_clk.common.hw }
++};
++
+ static CLK_FIXED_FACTOR_HW(emmc_sdio_ref_clk, "emmc-sdio-ref",
+ &video_pll_clk.common.hw, 4, 1, 0);
+
+@@ -853,9 +861,9 @@ static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd,
+ static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk",
+ video_pll_clk_pd, 0x0, 4, 0);
+ static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk",
+- video_pll_clk_pd, 0x0, 5, 0);
++ dpu0_clk_pd, 0x0, 5, 0);
+ static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk",
+- video_pll_clk_pd, 0x0, 6, 0);
++ dpu1_clk_pd, 0x0, 6, 0);
+ static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0,
+ 7, 0);
+ static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0,
+--
+2.51.0
+
--- /dev/null
+From 3f53623131d0fdcc527952dfaf60abd90d1196b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:44:44 +0800
+Subject: clk: thead: th1520-ap: describe gate clocks with clk_gate
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit aaa75cbd5d4f63e4edf8b74118d367361dcf92f7 ]
+
+Similar to previous situation of mux clocks, the gate clocks of
+clk-th1520-ap drivers are also using a helper that creates a temporary
+struct clk_hw and abandons the struct clk_hw in struct ccu_common, which
+prevents clock gates to be clock parents.
+
+Do the similar refactor of dropping struct ccu_common and directly use
+struct clk_gate here.
+
+This patch mimics the refactor done on struct ccu_mux in 54edba916e29
+("clk: thead: th1520-ap: Describe mux clocks with clk_mux").
+
+Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks")
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Reviewed-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/thead/clk-th1520-ap.c | 382 +++++++++++++++---------------
+ 1 file changed, 185 insertions(+), 197 deletions(-)
+
+diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c
+index cf1bba58f641e..4dbd1df9a86d4 100644
+--- a/drivers/clk/thead/clk-th1520-ap.c
++++ b/drivers/clk/thead/clk-th1520-ap.c
+@@ -48,8 +48,9 @@ struct ccu_mux {
+ };
+
+ struct ccu_gate {
+- u32 enable;
+- struct ccu_common common;
++ int clkid;
++ u32 reg;
++ struct clk_gate gate;
+ };
+
+ struct ccu_div {
+@@ -87,12 +88,12 @@ struct ccu_pll {
+ 0), \
+ }
+
+-#define CCU_GATE(_clkid, _struct, _name, _parent, _reg, _gate, _flags) \
++#define CCU_GATE(_clkid, _struct, _name, _parent, _reg, _bit, _flags) \
+ struct ccu_gate _struct = { \
+- .enable = _gate, \
+- .common = { \
+- .clkid = _clkid, \
+- .cfg0 = _reg, \
++ .clkid = _clkid, \
++ .reg = _reg, \
++ .gate = { \
++ .bit_idx = _bit, \
+ .hw.init = CLK_HW_INIT_PARENTS_DATA( \
+ _name, \
+ _parent, \
+@@ -120,13 +121,6 @@ static inline struct ccu_div *hw_to_ccu_div(struct clk_hw *hw)
+ return container_of(common, struct ccu_div, common);
+ }
+
+-static inline struct ccu_gate *hw_to_ccu_gate(struct clk_hw *hw)
+-{
+- struct ccu_common *common = hw_to_ccu_common(hw);
+-
+- return container_of(common, struct ccu_gate, common);
+-}
+-
+ static u8 ccu_get_parent_helper(struct ccu_common *common,
+ struct ccu_internal *mux)
+ {
+@@ -786,128 +780,128 @@ static const struct clk_parent_data emmc_sdio_ref_clk_pd[] = {
+ { .hw = &emmc_sdio_ref_clk.hw },
+ };
+
+-static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, BIT(4), 0);
+-static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, BIT(5), 0);
++static CCU_GATE(CLK_BROM, brom_clk, "brom", ahb2_cpusys_hclk_pd, 0x100, 4, 0);
++static CCU_GATE(CLK_BMU, bmu_clk, "bmu", axi4_cpusys2_aclk_pd, 0x100, 5, 0);
+ static CCU_GATE(CLK_AON2CPU_A2X, aon2cpu_a2x_clk, "aon2cpu-a2x", axi4_cpusys2_aclk_pd,
+- 0x134, BIT(8), 0);
++ 0x134, 8, 0);
+ static CCU_GATE(CLK_X2X_CPUSYS, x2x_cpusys_clk, "x2x-cpusys", axi4_cpusys2_aclk_pd,
+- 0x134, BIT(7), 0);
++ 0x134, 7, 0);
+ static CCU_GATE(CLK_CPU2AON_X2H, cpu2aon_x2h_clk, "cpu2aon-x2h", axi_aclk_pd,
+- 0x138, BIT(8), CLK_IGNORE_UNUSED);
++ 0x138, 8, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_CPU2PERI_X2H, cpu2peri_x2h_clk, "cpu2peri-x2h", axi4_cpusys2_aclk_pd,
+- 0x140, BIT(9), CLK_IGNORE_UNUSED);
++ 0x140, 9, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB1_HCLK, perisys_apb1_hclk, "perisys-apb1-hclk", perisys_ahb_hclk_pd,
+- 0x150, BIT(9), CLK_IGNORE_UNUSED);
++ 0x150, 9, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB2_HCLK, perisys_apb2_hclk, "perisys-apb2-hclk", perisys_ahb_hclk_pd,
+- 0x150, BIT(10), CLK_IGNORE_UNUSED);
++ 0x150, 10, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", perisys_ahb_hclk_pd,
+- 0x150, BIT(11), CLK_IGNORE_UNUSED);
++ 0x150, 11, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd,
+- 0x150, BIT(12), 0);
+-static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, BIT(5), 0);
+-static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, BIT(13), 0);
+-static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, BIT(30), 0);
+-static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, BIT(26), 0);
+-static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, BIT(24), 0);
+-static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, BIT(23), 0);
+-static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, BIT(22), 0);
+-static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, BIT(21), 0);
+-static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, BIT(20), 0);
+-static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, BIT(19), 0);
+-static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, BIT(18), 0);
+-static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, BIT(17), 0);
+-static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, BIT(16), 0);
+-static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, BIT(15), 0);
+-static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, BIT(14), 0);
+-static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, BIT(13), 0);
+-static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, BIT(12), 0);
+-static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, BIT(11), 0);
+-static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, BIT(10), 0);
+-static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, BIT(9), 0);
+-static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, BIT(8), 0);
+-static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, BIT(7), 0);
+-static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, BIT(6), 0);
+-static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, BIT(5), 0);
+-static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, BIT(4), 0);
+-static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, BIT(3), 0);
+-static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, BIT(2), 0);
+-static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, BIT(1), 0);
+-static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, BIT(0), 0);
+-static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, BIT(10), 0);
+-static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, BIT(8), 0);
+-static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, BIT(7), 0);
+-static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, BIT(6), 0);
+-static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, BIT(5), 0);
+-static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, BIT(4), 0);
+-static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, BIT(3), 0);
+-static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, BIT(2), 0);
+-static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, BIT(1), 0);
+-static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, BIT(0), 0);
+-static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, BIT(4), 0);
+-static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, BIT(3), 0);
+-static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, BIT(2), 0);
+-static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, BIT(1), 0);
++ 0x150, 12, 0);
++static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0);
++static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0);
++static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0);
++static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0);
++static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0);
++static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0);
++static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0);
++static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0);
++static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0);
++static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0);
++static CCU_GATE(CLK_PWM, pwm_clk, "pwm", perisys_apb_pclk_pd, 0x204, 18, 0);
++static CCU_GATE(CLK_QSPI0, qspi0_clk, "qspi0", video_pll_clk_pd, 0x204, 17, 0);
++static CCU_GATE(CLK_QSPI1, qspi1_clk, "qspi1", video_pll_clk_pd, 0x204, 16, 0);
++static CCU_GATE(CLK_SPI, spi_clk, "spi", video_pll_clk_pd, 0x204, 15, 0);
++static CCU_GATE(CLK_UART0_PCLK, uart0_pclk, "uart0-pclk", perisys_apb_pclk_pd, 0x204, 14, 0);
++static CCU_GATE(CLK_UART1_PCLK, uart1_pclk, "uart1-pclk", perisys_apb_pclk_pd, 0x204, 13, 0);
++static CCU_GATE(CLK_UART2_PCLK, uart2_pclk, "uart2-pclk", perisys_apb_pclk_pd, 0x204, 12, 0);
++static CCU_GATE(CLK_UART3_PCLK, uart3_pclk, "uart3-pclk", perisys_apb_pclk_pd, 0x204, 11, 0);
++static CCU_GATE(CLK_UART4_PCLK, uart4_pclk, "uart4-pclk", perisys_apb_pclk_pd, 0x204, 10, 0);
++static CCU_GATE(CLK_UART5_PCLK, uart5_pclk, "uart5-pclk", perisys_apb_pclk_pd, 0x204, 9, 0);
++static CCU_GATE(CLK_GPIO0, gpio0_clk, "gpio0-clk", perisys_apb_pclk_pd, 0x204, 8, 0);
++static CCU_GATE(CLK_GPIO1, gpio1_clk, "gpio1-clk", perisys_apb_pclk_pd, 0x204, 7, 0);
++static CCU_GATE(CLK_GPIO2, gpio2_clk, "gpio2-clk", peri2sys_apb_pclk_pd, 0x204, 6, 0);
++static CCU_GATE(CLK_I2C0, i2c0_clk, "i2c0", perisys_apb_pclk_pd, 0x204, 5, 0);
++static CCU_GATE(CLK_I2C1, i2c1_clk, "i2c1", perisys_apb_pclk_pd, 0x204, 4, 0);
++static CCU_GATE(CLK_I2C2, i2c2_clk, "i2c2", perisys_apb_pclk_pd, 0x204, 3, 0);
++static CCU_GATE(CLK_I2C3, i2c3_clk, "i2c3", perisys_apb_pclk_pd, 0x204, 2, 0);
++static CCU_GATE(CLK_I2C4, i2c4_clk, "i2c4", perisys_apb_pclk_pd, 0x204, 1, 0);
++static CCU_GATE(CLK_I2C5, i2c5_clk, "i2c5", perisys_apb_pclk_pd, 0x204, 0, 0);
++static CCU_GATE(CLK_SPINLOCK, spinlock_clk, "spinlock", ahb2_cpusys_hclk_pd, 0x208, 10, 0);
++static CCU_GATE(CLK_DMA, dma_clk, "dma", axi4_cpusys2_aclk_pd, 0x208, 8, 0);
++static CCU_GATE(CLK_MBOX0, mbox0_clk, "mbox0", apb3_cpusys_pclk_pd, 0x208, 7, 0);
++static CCU_GATE(CLK_MBOX1, mbox1_clk, "mbox1", apb3_cpusys_pclk_pd, 0x208, 6, 0);
++static CCU_GATE(CLK_MBOX2, mbox2_clk, "mbox2", apb3_cpusys_pclk_pd, 0x208, 5, 0);
++static CCU_GATE(CLK_MBOX3, mbox3_clk, "mbox3", apb3_cpusys_pclk_pd, 0x208, 4, 0);
++static CCU_GATE(CLK_WDT0, wdt0_clk, "wdt0", apb3_cpusys_pclk_pd, 0x208, 3, 0);
++static CCU_GATE(CLK_WDT1, wdt1_clk, "wdt1", apb3_cpusys_pclk_pd, 0x208, 2, 0);
++static CCU_GATE(CLK_TIMER0, timer0_clk, "timer0", apb3_cpusys_pclk_pd, 0x208, 1, 0);
++static CCU_GATE(CLK_TIMER1, timer1_clk, "timer1", apb3_cpusys_pclk_pd, 0x208, 0, 0);
++static CCU_GATE(CLK_SRAM0, sram0_clk, "sram0", axi_aclk_pd, 0x20c, 4, 0);
++static CCU_GATE(CLK_SRAM1, sram1_clk, "sram1", axi_aclk_pd, 0x20c, 3, 0);
++static CCU_GATE(CLK_SRAM2, sram2_clk, "sram2", axi_aclk_pd, 0x20c, 2, 0);
++static CCU_GATE(CLK_SRAM3, sram3_clk, "sram3", axi_aclk_pd, 0x20c, 1, 0);
+
+ static CCU_GATE(CLK_AXI4_VO_ACLK, axi4_vo_aclk, "axi4-vo-aclk",
+- video_pll_clk_pd, 0x0, BIT(0), 0);
++ video_pll_clk_pd, 0x0, 0, 0);
+ static CCU_GATE(CLK_GPU_CORE, gpu_core_clk, "gpu-core-clk", video_pll_clk_pd,
+- 0x0, BIT(3), 0);
++ 0x0, 3, 0);
+ static CCU_GATE(CLK_GPU_CFG_ACLK, gpu_cfg_aclk, "gpu-cfg-aclk",
+- video_pll_clk_pd, 0x0, BIT(4), 0);
++ video_pll_clk_pd, 0x0, 4, 0);
+ static CCU_GATE(CLK_DPU_PIXELCLK0, dpu0_pixelclk, "dpu0-pixelclk",
+- video_pll_clk_pd, 0x0, BIT(5), 0);
++ video_pll_clk_pd, 0x0, 5, 0);
+ static CCU_GATE(CLK_DPU_PIXELCLK1, dpu1_pixelclk, "dpu1-pixelclk",
+- video_pll_clk_pd, 0x0, BIT(6), 0);
++ video_pll_clk_pd, 0x0, 6, 0);
+ static CCU_GATE(CLK_DPU_HCLK, dpu_hclk, "dpu-hclk", video_pll_clk_pd, 0x0,
+- BIT(7), 0);
++ 7, 0);
+ static CCU_GATE(CLK_DPU_ACLK, dpu_aclk, "dpu-aclk", video_pll_clk_pd, 0x0,
+- BIT(8), 0);
++ 8, 0);
+ static CCU_GATE(CLK_DPU_CCLK, dpu_cclk, "dpu-cclk", video_pll_clk_pd, 0x0,
+- BIT(9), 0);
++ 9, 0);
+ static CCU_GATE(CLK_HDMI_SFR, hdmi_sfr_clk, "hdmi-sfr-clk", video_pll_clk_pd,
+- 0x0, BIT(10), 0);
++ 0x0, 10, 0);
+ static CCU_GATE(CLK_HDMI_PCLK, hdmi_pclk, "hdmi-pclk", video_pll_clk_pd, 0x0,
+- BIT(11), 0);
++ 11, 0);
+ static CCU_GATE(CLK_HDMI_CEC, hdmi_cec_clk, "hdmi-cec-clk", video_pll_clk_pd,
+- 0x0, BIT(12), 0);
++ 0x0, 12, 0);
+ static CCU_GATE(CLK_MIPI_DSI0_PCLK, mipi_dsi0_pclk, "mipi-dsi0-pclk",
+- video_pll_clk_pd, 0x0, BIT(13), 0);
++ video_pll_clk_pd, 0x0, 13, 0);
+ static CCU_GATE(CLK_MIPI_DSI1_PCLK, mipi_dsi1_pclk, "mipi-dsi1-pclk",
+- video_pll_clk_pd, 0x0, BIT(14), 0);
++ video_pll_clk_pd, 0x0, 14, 0);
+ static CCU_GATE(CLK_MIPI_DSI0_CFG, mipi_dsi0_cfg_clk, "mipi-dsi0-cfg-clk",
+- video_pll_clk_pd, 0x0, BIT(15), 0);
++ video_pll_clk_pd, 0x0, 15, 0);
+ static CCU_GATE(CLK_MIPI_DSI1_CFG, mipi_dsi1_cfg_clk, "mipi-dsi1-cfg-clk",
+- video_pll_clk_pd, 0x0, BIT(16), 0);
++ video_pll_clk_pd, 0x0, 16, 0);
+ static CCU_GATE(CLK_MIPI_DSI0_REFCLK, mipi_dsi0_refclk, "mipi-dsi0-refclk",
+- video_pll_clk_pd, 0x0, BIT(17), 0);
++ video_pll_clk_pd, 0x0, 17, 0);
+ static CCU_GATE(CLK_MIPI_DSI1_REFCLK, mipi_dsi1_refclk, "mipi-dsi1-refclk",
+- video_pll_clk_pd, 0x0, BIT(18), 0);
++ video_pll_clk_pd, 0x0, 18, 0);
+ static CCU_GATE(CLK_HDMI_I2S, hdmi_i2s_clk, "hdmi-i2s-clk", video_pll_clk_pd,
+- 0x0, BIT(19), 0);
++ 0x0, 19, 0);
+ static CCU_GATE(CLK_X2H_DPU1_ACLK, x2h_dpu1_aclk, "x2h-dpu1-aclk",
+- video_pll_clk_pd, 0x0, BIT(20), 0);
++ video_pll_clk_pd, 0x0, 20, 0);
+ static CCU_GATE(CLK_X2H_DPU_ACLK, x2h_dpu_aclk, "x2h-dpu-aclk",
+- video_pll_clk_pd, 0x0, BIT(21), 0);
++ video_pll_clk_pd, 0x0, 21, 0);
+ static CCU_GATE(CLK_AXI4_VO_PCLK, axi4_vo_pclk, "axi4-vo-pclk",
+- video_pll_clk_pd, 0x0, BIT(22), 0);
++ video_pll_clk_pd, 0x0, 22, 0);
+ static CCU_GATE(CLK_IOPMP_VOSYS_DPU_PCLK, iopmp_vosys_dpu_pclk,
+- "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, BIT(23), 0);
++ "iopmp-vosys-dpu-pclk", video_pll_clk_pd, 0x0, 23, 0);
+ static CCU_GATE(CLK_IOPMP_VOSYS_DPU1_PCLK, iopmp_vosys_dpu1_pclk,
+- "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, BIT(24), 0);
++ "iopmp-vosys-dpu1-pclk", video_pll_clk_pd, 0x0, 24, 0);
+ static CCU_GATE(CLK_IOPMP_VOSYS_GPU_PCLK, iopmp_vosys_gpu_pclk,
+- "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, BIT(25), 0);
++ "iopmp-vosys-gpu-pclk", video_pll_clk_pd, 0x0, 25, 0);
+ static CCU_GATE(CLK_IOPMP_DPU1_ACLK, iopmp_dpu1_aclk, "iopmp-dpu1-aclk",
+- video_pll_clk_pd, 0x0, BIT(27), 0);
++ video_pll_clk_pd, 0x0, 27, 0);
+ static CCU_GATE(CLK_IOPMP_DPU_ACLK, iopmp_dpu_aclk, "iopmp-dpu-aclk",
+- video_pll_clk_pd, 0x0, BIT(28), 0);
++ video_pll_clk_pd, 0x0, 28, 0);
+ static CCU_GATE(CLK_IOPMP_GPU_ACLK, iopmp_gpu_aclk, "iopmp-gpu-aclk",
+- video_pll_clk_pd, 0x0, BIT(29), 0);
++ video_pll_clk_pd, 0x0, 29, 0);
+ static CCU_GATE(CLK_MIPIDSI0_PIXCLK, mipi_dsi0_pixclk, "mipi-dsi0-pixclk",
+- video_pll_clk_pd, 0x0, BIT(30), 0);
++ video_pll_clk_pd, 0x0, 30, 0);
+ static CCU_GATE(CLK_MIPIDSI1_PIXCLK, mipi_dsi1_pixclk, "mipi-dsi1-pixclk",
+- video_pll_clk_pd, 0x0, BIT(31), 0);
++ video_pll_clk_pd, 0x0, 31, 0);
+ static CCU_GATE(CLK_HDMI_PIXCLK, hdmi_pixclk, "hdmi-pixclk", video_pll_clk_pd,
+- 0x4, BIT(0), 0);
++ 0x4, 0, 0);
+
+ static CLK_FIXED_FACTOR_HW(gmac_pll_clk_100m, "gmac-pll-clk-100m",
+ &gmac_pll_clk.common.hw, 10, 1, 0);
+@@ -963,93 +957,93 @@ static struct ccu_mux *th1520_mux_clks[] = {
+ &uart_sclk,
+ };
+
+-static struct ccu_common *th1520_gate_clks[] = {
+- &emmc_sdio_clk.common,
+- &aon2cpu_a2x_clk.common,
+- &x2x_cpusys_clk.common,
+- &brom_clk.common,
+- &bmu_clk.common,
+- &cpu2aon_x2h_clk.common,
+- &cpu2peri_x2h_clk.common,
+- &cpu2vp_clk.common,
+- &perisys_apb1_hclk.common,
+- &perisys_apb2_hclk.common,
+- &perisys_apb3_hclk.common,
+- &perisys_apb4_hclk.common,
+- &npu_axi_clk.common,
+- &gmac1_clk.common,
+- &padctrl1_clk.common,
+- &dsmart_clk.common,
+- &padctrl0_clk.common,
+- &gmac_axi_clk.common,
+- &gpio3_clk.common,
+- &gmac0_clk.common,
+- &pwm_clk.common,
+- &qspi0_clk.common,
+- &qspi1_clk.common,
+- &spi_clk.common,
+- &uart0_pclk.common,
+- &uart1_pclk.common,
+- &uart2_pclk.common,
+- &uart3_pclk.common,
+- &uart4_pclk.common,
+- &uart5_pclk.common,
+- &gpio0_clk.common,
+- &gpio1_clk.common,
+- &gpio2_clk.common,
+- &i2c0_clk.common,
+- &i2c1_clk.common,
+- &i2c2_clk.common,
+- &i2c3_clk.common,
+- &i2c4_clk.common,
+- &i2c5_clk.common,
+- &spinlock_clk.common,
+- &dma_clk.common,
+- &mbox0_clk.common,
+- &mbox1_clk.common,
+- &mbox2_clk.common,
+- &mbox3_clk.common,
+- &wdt0_clk.common,
+- &wdt1_clk.common,
+- &timer0_clk.common,
+- &timer1_clk.common,
+- &sram0_clk.common,
+- &sram1_clk.common,
+- &sram2_clk.common,
+- &sram3_clk.common,
+-};
+-
+-static struct ccu_common *th1520_vo_gate_clks[] = {
+- &axi4_vo_aclk.common,
+- &gpu_core_clk.common,
+- &gpu_cfg_aclk.common,
+- &dpu0_pixelclk.common,
+- &dpu1_pixelclk.common,
+- &dpu_hclk.common,
+- &dpu_aclk.common,
+- &dpu_cclk.common,
+- &hdmi_sfr_clk.common,
+- &hdmi_pclk.common,
+- &hdmi_cec_clk.common,
+- &mipi_dsi0_pclk.common,
+- &mipi_dsi1_pclk.common,
+- &mipi_dsi0_cfg_clk.common,
+- &mipi_dsi1_cfg_clk.common,
+- &mipi_dsi0_refclk.common,
+- &mipi_dsi1_refclk.common,
+- &hdmi_i2s_clk.common,
+- &x2h_dpu1_aclk.common,
+- &x2h_dpu_aclk.common,
+- &axi4_vo_pclk.common,
+- &iopmp_vosys_dpu_pclk.common,
+- &iopmp_vosys_dpu1_pclk.common,
+- &iopmp_vosys_gpu_pclk.common,
+- &iopmp_dpu1_aclk.common,
+- &iopmp_dpu_aclk.common,
+- &iopmp_gpu_aclk.common,
+- &mipi_dsi0_pixclk.common,
+- &mipi_dsi1_pixclk.common,
+- &hdmi_pixclk.common
++static struct ccu_gate *th1520_gate_clks[] = {
++ &emmc_sdio_clk,
++ &aon2cpu_a2x_clk,
++ &x2x_cpusys_clk,
++ &brom_clk,
++ &bmu_clk,
++ &cpu2aon_x2h_clk,
++ &cpu2peri_x2h_clk,
++ &cpu2vp_clk,
++ &perisys_apb1_hclk,
++ &perisys_apb2_hclk,
++ &perisys_apb3_hclk,
++ &perisys_apb4_hclk,
++ &npu_axi_clk,
++ &gmac1_clk,
++ &padctrl1_clk,
++ &dsmart_clk,
++ &padctrl0_clk,
++ &gmac_axi_clk,
++ &gpio3_clk,
++ &gmac0_clk,
++ &pwm_clk,
++ &qspi0_clk,
++ &qspi1_clk,
++ &spi_clk,
++ &uart0_pclk,
++ &uart1_pclk,
++ &uart2_pclk,
++ &uart3_pclk,
++ &uart4_pclk,
++ &uart5_pclk,
++ &gpio0_clk,
++ &gpio1_clk,
++ &gpio2_clk,
++ &i2c0_clk,
++ &i2c1_clk,
++ &i2c2_clk,
++ &i2c3_clk,
++ &i2c4_clk,
++ &i2c5_clk,
++ &spinlock_clk,
++ &dma_clk,
++ &mbox0_clk,
++ &mbox1_clk,
++ &mbox2_clk,
++ &mbox3_clk,
++ &wdt0_clk,
++ &wdt1_clk,
++ &timer0_clk,
++ &timer1_clk,
++ &sram0_clk,
++ &sram1_clk,
++ &sram2_clk,
++ &sram3_clk,
++};
++
++static struct ccu_gate *th1520_vo_gate_clks[] = {
++ &axi4_vo_aclk,
++ &gpu_core_clk,
++ &gpu_cfg_aclk,
++ &dpu0_pixelclk,
++ &dpu1_pixelclk,
++ &dpu_hclk,
++ &dpu_aclk,
++ &dpu_cclk,
++ &hdmi_sfr_clk,
++ &hdmi_pclk,
++ &hdmi_cec_clk,
++ &mipi_dsi0_pclk,
++ &mipi_dsi1_pclk,
++ &mipi_dsi0_cfg_clk,
++ &mipi_dsi1_cfg_clk,
++ &mipi_dsi0_refclk,
++ &mipi_dsi1_refclk,
++ &hdmi_i2s_clk,
++ &x2h_dpu1_aclk,
++ &x2h_dpu_aclk,
++ &axi4_vo_pclk,
++ &iopmp_vosys_dpu_pclk,
++ &iopmp_vosys_dpu1_pclk,
++ &iopmp_vosys_gpu_pclk,
++ &iopmp_dpu1_aclk,
++ &iopmp_dpu_aclk,
++ &iopmp_gpu_aclk,
++ &mipi_dsi0_pixclk,
++ &mipi_dsi1_pixclk,
++ &hdmi_pixclk
+ };
+
+ static const struct regmap_config th1520_clk_regmap_config = {
+@@ -1063,7 +1057,7 @@ struct th1520_plat_data {
+ struct ccu_common **th1520_pll_clks;
+ struct ccu_common **th1520_div_clks;
+ struct ccu_mux **th1520_mux_clks;
+- struct ccu_common **th1520_gate_clks;
++ struct ccu_gate **th1520_gate_clks;
+
+ int nr_clks;
+ int nr_pll_clks;
+@@ -1102,7 +1096,6 @@ static int th1520_clk_probe(struct platform_device *pdev)
+
+ struct regmap *map;
+ void __iomem *base;
+- struct clk_hw *hw;
+ int ret, i;
+
+ plat_data = device_get_match_data(&pdev->dev);
+@@ -1161,20 +1154,15 @@ static int th1520_clk_probe(struct platform_device *pdev)
+ }
+
+ for (i = 0; i < plat_data->nr_gate_clks; i++) {
+- struct ccu_gate *cg = hw_to_ccu_gate(&plat_data->th1520_gate_clks[i]->hw);
++ struct ccu_gate *cg = plat_data->th1520_gate_clks[i];
+
+- plat_data->th1520_gate_clks[i]->map = map;
++ cg->gate.reg = base + cg->reg;
+
+- hw = devm_clk_hw_register_gate_parent_data(dev,
+- cg->common.hw.init->name,
+- cg->common.hw.init->parent_data,
+- cg->common.hw.init->flags,
+- base + cg->common.cfg0,
+- ffs(cg->enable) - 1, 0, NULL);
+- if (IS_ERR(hw))
+- return PTR_ERR(hw);
++ ret = devm_clk_hw_register(dev, &cg->gate.hw);
++ if (ret)
++ return ret;
+
+- priv->hws[cg->common.clkid] = hw;
++ priv->hws[cg->clkid] = &cg->gate.hw;
+ }
+
+ if (plat_data == &th1520_ap_platdata) {
+--
+2.51.0
+
--- /dev/null
+From a4e727de2064633821d573b2910041b850208b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:44:45 +0800
+Subject: clk: thead: th1520-ap: fix parent of padctrl0 clock
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 9e99b992c8874f323091d50a5e4727bbd138192d ]
+
+The padctrl0 clock seems to be a child of the perisys_apb4_hclk clock,
+gating the later makes padctrl0 registers stuck too.
+
+Fix this relationship.
+
+Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks")
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Reviewed-by: Drew Fustini <fustini@kernel.org>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Signed-off-by: Drew Fustini <fustini@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/thead/clk-th1520-ap.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/thead/clk-th1520-ap.c b/drivers/clk/thead/clk-th1520-ap.c
+index 4dbd1df9a86d4..8a5d699638379 100644
+--- a/drivers/clk/thead/clk-th1520-ap.c
++++ b/drivers/clk/thead/clk-th1520-ap.c
+@@ -798,13 +798,17 @@ static CCU_GATE(CLK_PERISYS_APB3_HCLK, perisys_apb3_hclk, "perisys-apb3-hclk", p
+ 0x150, 11, CLK_IGNORE_UNUSED);
+ static CCU_GATE(CLK_PERISYS_APB4_HCLK, perisys_apb4_hclk, "perisys-apb4-hclk", perisys_ahb_hclk_pd,
+ 0x150, 12, 0);
++static const struct clk_parent_data perisys_apb4_hclk_pd[] = {
++ { .hw = &perisys_apb4_hclk.gate.hw },
++};
++
+ static CCU_GATE(CLK_NPU_AXI, npu_axi_clk, "npu-axi", axi_aclk_pd, 0x1c8, 5, 0);
+ static CCU_GATE(CLK_CPU2VP, cpu2vp_clk, "cpu2vp", axi_aclk_pd, 0x1e0, 13, 0);
+ static CCU_GATE(CLK_EMMC_SDIO, emmc_sdio_clk, "emmc-sdio", emmc_sdio_ref_clk_pd, 0x204, 30, 0);
+ static CCU_GATE(CLK_GMAC1, gmac1_clk, "gmac1", gmac_pll_clk_pd, 0x204, 26, 0);
+ static CCU_GATE(CLK_PADCTRL1, padctrl1_clk, "padctrl1", perisys_apb_pclk_pd, 0x204, 24, 0);
+ static CCU_GATE(CLK_DSMART, dsmart_clk, "dsmart", perisys_apb_pclk_pd, 0x204, 23, 0);
+-static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb_pclk_pd, 0x204, 22, 0);
++static CCU_GATE(CLK_PADCTRL0, padctrl0_clk, "padctrl0", perisys_apb4_hclk_pd, 0x204, 22, 0);
+ static CCU_GATE(CLK_GMAC_AXI, gmac_axi_clk, "gmac-axi", axi4_cpusys2_aclk_pd, 0x204, 21, 0);
+ static CCU_GATE(CLK_GPIO3, gpio3_clk, "gpio3-clk", peri2sys_apb_pclk_pd, 0x204, 20, 0);
+ static CCU_GATE(CLK_GMAC0, gmac0_clk, "gmac0", gmac_pll_clk_pd, 0x204, 19, 0);
+--
+2.51.0
+
--- /dev/null
+From 02d3b72c30a485aacbcc0c825c85e6aca030ff22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:12 -0500
+Subject: cpufreq: tegra186: Set target frequency for all cpus in policy
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
+
+The original commit set all cores in a cluster to a shared policy, but
+did not update set_target to apply a frequency change to all cores for
+the policy. This caused most cores to remain stuck at their boot
+frequency.
+
+Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index cbabb726c6645..6c394b429b618 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -93,10 +93,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+ {
+ struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+ struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset;
++ unsigned int edvd_offset;
+ u32 edvd_val = tbl->driver_data;
++ u32 cpu;
+
+- writel(edvd_val, data->regs + edvd_offset);
++ for_each_cpu(cpu, policy->cpus) {
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 38983261a14e9bb29b00cc2bb4fcc5a693a85699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index d003b78fcd855..a47a3eab69351 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 8565f2bb86aada0ef6de75dc25f0aa6864360be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 19:27:51 +0530
+Subject: crypto: skcipher - Fix reqsize handling
+
+From: T Pratham <t-pratham@ti.com>
+
+[ Upstream commit 229c586b5e86979badb7cb0d38717b88a9e95ddd ]
+
+Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg")
+introduced cra_reqsize field in crypto_alg struct to replace type
+specific reqsize fields. It looks like this was introduced specifically
+for ahash and acomp from the commit description as subsequent commits
+add necessary changes in these alg frameworks.
+
+However, this is being recommended for use in all crypto algs [1]
+instead of setting reqsize using crypto_*_set_reqsize(). Using
+cra_reqsize in skcipher algorithms, hence, causes memory
+corruptions and crashes as the underlying functions in the algorithm
+framework have not been updated to set the reqsize properly from
+cra_reqsize. [2]
+
+Add proper set_reqsize calls in the skcipher init function to
+properly initialize reqsize for these algorithms in the framework.
+
+[1]: https://lore.kernel.org/linux-crypto/aCL8BxpHr5OpT04k@gondor.apana.org.au/
+[2]: https://gist.github.com/Pratham-T/24247446f1faf4b7843e4014d5089f6b
+
+Fixes: afddce13ce81d ("crypto: api - Add reqsize to crypto_alg")
+Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)")
+Signed-off-by: T Pratham <t-pratham@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/skcipher.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/crypto/skcipher.c b/crypto/skcipher.c
+index de5fc91bba267..8fa5d9686d085 100644
+--- a/crypto/skcipher.c
++++ b/crypto/skcipher.c
+@@ -294,6 +294,8 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm)
+ return crypto_init_lskcipher_ops_sg(tfm);
+ }
+
++ crypto_skcipher_set_reqsize(skcipher, crypto_tfm_alg_reqsize(tfm));
++
+ if (alg->exit)
+ skcipher->base.exit = crypto_skcipher_exit_tfm;
+
+--
+2.51.0
+
--- /dev/null
+From def966884617de6b114ad7b7770568232e9f19ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From 298ac1edcd8b2f35ef4a200740b47d3f8ed2c4fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:25 +0200
+Subject: drm/amd/display: Disable scaling on DCE6 for now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 0e190a0446ec517666dab4691b296a9b758e590f ]
+
+Scaling doesn't work on DCE6 at the moment, the current
+register programming produces incorrect output when using
+fractional scaling (between 100-200%) on resolutions higher
+than 1080p.
+
+Disable it until we figure out how to program it properly.
+
+Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+index 53b60044653f8..f887d59da7c6f 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+@@ -403,13 +403,13 @@ static const struct dc_plane_cap plane_cap = {
+ },
+
+ .max_upscale_factor = {
+- .argb8888 = 16000,
++ .argb8888 = 1,
+ .nv12 = 1,
+ .fp16 = 1
+ },
+
+ .max_downscale_factor = {
+- .argb8888 = 250,
++ .argb8888 = 1,
+ .nv12 = 1,
+ .fp16 = 1
+ }
+--
+2.51.0
+
--- /dev/null
+From db58495bfc7f1ae538b72f4e61c635ad32463a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 2b1673d69ea83..e5c2fb134d14d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From 7e8b1d6fb4ebc3883c4a4c525ffb0159528590c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index e5c2fb134d14d..1ab5ae9b5ea51 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 56e960d2d06b9a35ce86b0dcbfeede5cd469d7a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index 2d6a598a6c25c..9317a7afa6211 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8650,6 +8650,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From 7d58d04da7ddc318cc5790573d6e7328e4ca168d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 May 2025 11:09:53 -0400
+Subject: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 58e6fc2fb94f0f409447e5d46cf6a417b6397fbc ]
+
+kfd_lookup_process_by_pid hold the kfd process reference to ensure it
+doesn't get destroyed while sending the segfault event to user space.
+
+Calling kfd_lookup_process_by_pid as function parameter leaks the kfd
+process refcount and miss the NULL pointer check if app process is
+already destroyed.
+
+Fixes: 2d274bf7099b ("amd/amdkfd: Trigger segfault for early userptr unmmapping")
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index b16cce7c22c37..d5f9d48bf8842 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -2583,12 +2583,17 @@ static int update_invalid_user_pages(struct amdkfd_process_info *process_info,
+ * from the KFD, trigger a segmentation fault in VM debug mode.
+ */
+ if (amdgpu_ttm_adev(bo->tbo.bdev)->debug_vm_userptr) {
++ struct kfd_process *p;
++
+ pr_err("Pid %d unmapped memory before destroying userptr at GPU addr 0x%llx\n",
+ pid_nr(process_info->pid), mem->va);
+
+ // Send GPU VM fault to user space
+- kfd_signal_vm_fault_event_with_userptr(kfd_lookup_process_by_pid(process_info->pid),
+- mem->va);
++ p = kfd_lookup_process_by_pid(process_info->pid);
++ if (p) {
++ kfd_signal_vm_fault_event_with_userptr(p, mem->va);
++ kfd_unref_process(p);
++ }
+ }
+
+ ret = 0;
+--
+2.51.0
+
--- /dev/null
+From 4cd98cd1a8b2112d700a747427033b93c2c97a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:36:55 -0400
+Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
+
+Check that the resource which is converted to a surface exists before
+trying to use the cursor snooper on it.
+
+vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers
+because some svga commands accept SVGA3D_INVALID_ID to mean "no surface",
+unfortunately functions that accept the actual surfaces as objects might
+(and in case of the cursor snooper, do not) be able to handle null
+objects. Make sure that we validate not only the identifier (via the
+vmw_cmd_res_check) but also check that the actual resource exists before
+trying to do something with it.
+
+Fixes unchecked null-ptr reference in the snooping code.
+
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 819704ac675d0..d539f25b5fbe0 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1497,6 +1497,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+ SVGA3dCmdHeader *header)
+ {
+ struct vmw_bo *vmw_bo = NULL;
++ struct vmw_resource *res;
+ struct vmw_surface *srf = NULL;
+ VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);
+ int ret;
+@@ -1532,18 +1533,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+
+ dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?
+ VMW_RES_DIRTY_SET : 0;
+- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+- dirty, user_surface_converter,
+- &cmd->body.host.sid, NULL);
++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,
++ user_surface_converter, &cmd->body.host.sid,
++ NULL);
+ if (unlikely(ret != 0)) {
+ if (unlikely(ret != -ERESTARTSYS))
+ VMW_DEBUG_USER("could not find surface for DMA.\n");
+ return ret;
+ }
+
+- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);
++ res = sw_context->res_cache[vmw_res_surface].res;
++ if (!res) {
++ VMW_DEBUG_USER("Invalid DMA surface.\n");
++ return -EINVAL;
++ }
+
+- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header);
++ srf = vmw_res_to_srf(res);
++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,
++ header);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From ad52928021ca6735e3b7ca7641020e681aa68644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:26 -0500
+Subject: drm/vmwgfx: Fix copy-paste typo in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
+
+'entry' should be 'val' which is the loop iterator.
+
+Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index 4d0fb71f62111..35dc94c3db399 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -638,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
+ hash_del_rcu(&val->hash.head);
+
+ list_for_each_entry(val, &ctx->resource_ctx_list, head)
+- hash_del_rcu(&entry->hash.head);
++ hash_del_rcu(&val->hash.head);
+
+ ctx->sw_context = NULL;
+ }
+--
+2.51.0
+
--- /dev/null
+From ac6dbf199fcc704fcd89edd6f6105c52ec0dc4e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index 7ee93e7191c7f..4d0fb71f62111 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From 054bf9b681bb31b8be512113a2a760e2ed3b7cdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 02:31:46 +0000
+Subject: drm/xe/hw_engine_group: Fix double write lock release in error path
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 08fdfd260e641da203f80aff8d3ed19c5ecceb7d ]
+
+In xe_hw_engine_group_get_mode(), a write lock is acquired before
+calling switch_mode(), which in turn invokes
+xe_hw_engine_group_suspend_faulting_lr_jobs().
+
+On failure inside xe_hw_engine_group_suspend_faulting_lr_jobs(),
+the write lock is released there, and then again in
+xe_hw_engine_group_get_mode(), leading to a double release.
+
+Fix this by keeping both acquire and release operation in
+xe_hw_engine_group_get_mode().
+
+Fixes: 770bd1d34113 ("drm/xe/hw_engine_group: Ensure safe transition between execution modes")
+Cc: Francois Dugast <francois.dugast@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://lore.kernel.org/r/20250925023145.1203004-2-shuicheng.lin@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 662d98b8b373007fa1b08ba93fee11f6fd3e387c)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_hw_engine_group.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_hw_engine_group.c b/drivers/gpu/drm/xe/xe_hw_engine_group.c
+index c926f840c87b0..cb1d7ed54f429 100644
+--- a/drivers/gpu/drm/xe/xe_hw_engine_group.c
++++ b/drivers/gpu/drm/xe/xe_hw_engine_group.c
+@@ -213,17 +213,13 @@ static int xe_hw_engine_group_suspend_faulting_lr_jobs(struct xe_hw_engine_group
+
+ err = q->ops->suspend_wait(q);
+ if (err)
+- goto err_suspend;
++ return err;
+ }
+
+ if (need_resume)
+ xe_hw_engine_group_resume_faulting_lr_jobs(group);
+
+ return 0;
+-
+-err_suspend:
+- up_write(&group->mode_sem);
+- return err;
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 6e2f90583e2942763437c86619e26e33360a773e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 16:02:00 +0530
+Subject: drm/xe/i2c: Don't rely on d3cold.allowed flag in system PM path
+
+From: Raag Jadav <raag.jadav@intel.com>
+
+[ Upstream commit 1af59cd5cc2b65d7fc95165f056695ce3f171133 ]
+
+In S3 and above sleep states, the device can loose power regardless of
+d3cold.allowed flag. Bring up I2C controller explicitly in system PM
+path to ensure its normal operation after losing power.
+
+v2: Cover S3 and above states (Rodrigo)
+
+Fixes: 0ea07b69517a ("drm/xe/pm: Wire up suspend/resume for I2C controller")
+Signed-off-by: Raag Jadav <raag.jadav@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://lore.kernel.org/r/20250918103200.2952576-1-raag.jadav@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit e4863f1159befcd70df24fcb5458afaf2feab043)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c
+index bb9b6ecad2afc..3e301e42b2f19 100644
+--- a/drivers/gpu/drm/xe/xe_pm.c
++++ b/drivers/gpu/drm/xe/xe_pm.c
+@@ -194,7 +194,7 @@ int xe_pm_resume(struct xe_device *xe)
+ if (err)
+ goto err;
+
+- xe_i2c_pm_resume(xe, xe->d3cold.allowed);
++ xe_i2c_pm_resume(xe, true);
+
+ xe_irq_resume(xe);
+
+--
+2.51.0
+
--- /dev/null
+From e84e4a1ee31c8f623b5d7cd463ea4fccb7eeae8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index 4af504c23e6ff..572b85e773700 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -103,7 +103,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 564dcdee53dbdf9030a67d57343fd834049bab72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 19:53:36 +0800
+Subject: ice: ice_adapter: release xa entry on adapter allocation failure
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2db687f3469dbc5c59bc53d55acafd75d530b497 ]
+
+When ice_adapter_new() fails, the reserved XArray entry created by
+xa_insert() is not released. This causes subsequent insertions at
+the same index to return -EBUSY, potentially leading to
+NULL pointer dereferences.
+
+Reorder the operations as suggested by Przemek Kitszel:
+1. Check if adapter already exists (xa_load)
+2. Reserve the XArray slot (xa_reserve)
+3. Allocate the adapter (ice_adapter_new)
+4. Store the adapter (xa_store)
+
+Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed")
+Suggested-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adapter.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.c b/drivers/net/ethernet/intel/ice/ice_adapter.c
+index b53561c347082..0a8a48cd4bce6 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adapter.c
++++ b/drivers/net/ethernet/intel/ice/ice_adapter.c
+@@ -99,19 +99,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev)
+
+ index = ice_adapter_xa_index(pdev);
+ scoped_guard(mutex, &ice_adapters_mutex) {
+- err = xa_insert(&ice_adapters, index, NULL, GFP_KERNEL);
+- if (err == -EBUSY) {
+- adapter = xa_load(&ice_adapters, index);
++ adapter = xa_load(&ice_adapters, index);
++ if (adapter) {
+ refcount_inc(&adapter->refcount);
+ WARN_ON_ONCE(adapter->index != ice_adapter_index(pdev));
+ return adapter;
+ }
++ err = xa_reserve(&ice_adapters, index, GFP_KERNEL);
+ if (err)
+ return ERR_PTR(err);
+
+ adapter = ice_adapter_new(pdev);
+- if (!adapter)
++ if (!adapter) {
++ xa_release(&ice_adapters, index);
+ return ERR_PTR(-ENOMEM);
++ }
+ xa_store(&ice_adapters, index, adapter, GFP_KERNEL);
+ }
+ return adapter;
+--
+2.51.0
+
--- /dev/null
+From 62d754661cdc4ef253ebb9fbc16547a80feb2548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 13:39:01 +0100
+Subject: io_uring/zcrx: increment fallback loop src offset
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit e9a9dcb4ccb32446165800a9d83058e95c4833d2 ]
+
+Don't forget to adjust the source offset in io_copy_page(), otherwise
+it'll be copying into the same location in some cases for highmem
+setups.
+
+Fixes: e67645bb7f3f4 ("io_uring/zcrx: prepare fallback for larger pages")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/zcrx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
+index 643a69f9ffe2a..2035c77a16357 100644
+--- a/io_uring/zcrx.c
++++ b/io_uring/zcrx.c
+@@ -993,6 +993,7 @@ static ssize_t io_copy_page(struct io_copy_cache *cc, struct page *src_page,
+
+ cc->size -= n;
+ cc->offset += n;
++ src_offset += n;
+ len -= n;
+ copied += n;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9287f74ff43ddaf256608b0daf12d8b67eaed1f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:46:45 -0700
+Subject: kbuild: Add '.rel.*' strip pattern for vmlinux
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 8ec3af916fe3954381cf3555ea03dc5adf4d0e8e ]
+
+Prior to binutils commit c12d9fa2afe ("Support objcopy
+--remove-section=.relaFOO") [1] in 2.32, stripping relocation sections
+required the trailing period (i.e., '.rel.*') to work properly.
+
+After commit 3e86e4d74c04 ("kbuild: keep .modinfo section in
+vmlinux.unstripped"), there is an error with binutils 2.31.1 or earlier
+because these sections are not properly removed:
+
+ s390-linux-objcopy: st6tO8Ev: symbol `.modinfo' required but not present
+ s390-linux-objcopy:st6tO8Ev: no symbols
+
+Add the old pattern to resolve this issue (along with a comment to allow
+cleaning this when binutils 2.32 or newer is the minimum supported
+version). While the aforementioned kbuild change exposes this, the
+pattern was originally changed by commit 71d815bf5dfd ("kbuild: Strip
+runtime const RELA sections correctly"), where it would still be
+incorrect with binutils older than 2.32.
+
+Fixes: 71d815bf5dfd ("kbuild: Strip runtime const RELA sections correctly")
+Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7 [1]
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Closes: https://lore.kernel.org/CA+G9fYvVktRhFtZXdNgVOL8j+ArsJDpvMLgCitaQvQmCx=hwOQ@mail.gmail.com/
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-2-9fc776c5887c@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.vmlinux | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux
+index 7c6f0e882eabb..ffc7b49e54f70 100644
+--- a/scripts/Makefile.vmlinux
++++ b/scripts/Makefile.vmlinux
+@@ -88,6 +88,9 @@ endif
+
+ remove-section-y := .modinfo
+ remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' '!.rel*.dyn'
++# for compatibility with binutils < 2.32
++# https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c12d9fa2afe7abcbe407a00e15719e1a1350c2a7
++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel.*'
+
+ # To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy,
+ # it is necessary to remove the PT_LOAD flag from the segment.
+--
+2.51.0
+
--- /dev/null
+From 076a271cc7720fc06395bc43dadc3247efc8e42d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:05:46 +0200
+Subject: kbuild: always create intermediate vmlinux.unstripped
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 0ce5139fd96e9d415d3faaef1c575e238f9bbd67 ]
+
+Generate the intermediate vmlinux.unstripped regardless of
+CONFIG_ARCH_VMLINUX_NEEDS_RELOCS.
+
+If CONFIG_ARCH_VMLINUX_NEEDS_RELOCS is unset, vmlinux.unstripped and
+vmlinux are identiacal.
+
+This simplifies the build rule, and allows to strip more sections
+by adding them to remove-section-y.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/a48ca543fa2305bd17324f41606dcaed9b19f2d4.1758182101.git.legion@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.vmlinux | 45 ++++++++++++++++++++--------------------
+ 1 file changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux
+index b64862dc6f08d..4f2d4c3fb7372 100644
+--- a/scripts/Makefile.vmlinux
++++ b/scripts/Makefile.vmlinux
+@@ -9,20 +9,6 @@ include $(srctree)/scripts/Makefile.lib
+
+ targets :=
+
+-ifdef CONFIG_ARCH_VMLINUX_NEEDS_RELOCS
+-vmlinux-final := vmlinux.unstripped
+-
+-quiet_cmd_strip_relocs = RSTRIP $@
+- cmd_strip_relocs = $(OBJCOPY) --remove-section='.rel*' --remove-section=!'.rel*.dyn' $< $@
+-
+-vmlinux: $(vmlinux-final) FORCE
+- $(call if_changed,strip_relocs)
+-
+-targets += vmlinux
+-else
+-vmlinux-final := vmlinux
+-endif
+-
+ %.o: %.c FORCE
+ $(call if_changed_rule,cc_o_c)
+
+@@ -61,19 +47,19 @@ targets += .builtin-dtbs-list
+
+ ifdef CONFIG_GENERIC_BUILTIN_DTB
+ targets += .builtin-dtbs.S .builtin-dtbs.o
+-$(vmlinux-final): .builtin-dtbs.o
++vmlinux.unstripped: .builtin-dtbs.o
+ endif
+
+-# vmlinux
++# vmlinux.unstripped
+ # ---------------------------------------------------------------------------
+
+ ifdef CONFIG_MODULES
+ targets += .vmlinux.export.o
+-$(vmlinux-final): .vmlinux.export.o
++vmlinux.unstripped: .vmlinux.export.o
+ endif
+
+ ifdef CONFIG_ARCH_WANTS_PRE_LINK_VMLINUX
+-$(vmlinux-final): arch/$(SRCARCH)/tools/vmlinux.arch.o
++vmlinux.unstripped: arch/$(SRCARCH)/tools/vmlinux.arch.o
+
+ arch/$(SRCARCH)/tools/vmlinux.arch.o: vmlinux.o FORCE
+ $(Q)$(MAKE) $(build)=arch/$(SRCARCH)/tools $@
+@@ -86,17 +72,30 @@ cmd_link_vmlinux = \
+ $< "$(LD)" "$(KBUILD_LDFLAGS)" "$(LDFLAGS_vmlinux)" "$@"; \
+ $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true)
+
+-targets += $(vmlinux-final)
+-$(vmlinux-final): scripts/link-vmlinux.sh vmlinux.o $(KBUILD_LDS) FORCE
++targets += vmlinux.unstripped
++vmlinux.unstripped: scripts/link-vmlinux.sh vmlinux.o $(KBUILD_LDS) FORCE
+ +$(call if_changed_dep,link_vmlinux)
+ ifdef CONFIG_DEBUG_INFO_BTF
+-$(vmlinux-final): $(RESOLVE_BTFIDS)
++vmlinux.unstripped: $(RESOLVE_BTFIDS)
+ endif
+
+ ifdef CONFIG_BUILDTIME_TABLE_SORT
+-$(vmlinux-final): scripts/sorttable
++vmlinux.unstripped: scripts/sorttable
+ endif
+
++# vmlinux
++# ---------------------------------------------------------------------------
++
++remove-section-y :=
++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*'
++
++quiet_cmd_strip_relocs = OBJCOPY $@
++ cmd_strip_relocs = $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $< $@
++
++targets += vmlinux
++vmlinux: vmlinux.unstripped FORCE
++ $(call if_changed,strip_relocs)
++
+ # modules.builtin.ranges
+ # ---------------------------------------------------------------------------
+ ifdef CONFIG_BUILTIN_MODULE_RANGES
+@@ -110,7 +109,7 @@ modules.builtin.ranges: $(srctree)/scripts/generate_builtin_ranges.awk \
+ modules.builtin vmlinux.map vmlinux.o.map FORCE
+ $(call if_changed,modules_builtin_ranges)
+
+-vmlinux.map: $(vmlinux-final)
++vmlinux.map: vmlinux.unstripped
+ @:
+
+ endif
+--
+2.51.0
+
--- /dev/null
+From deba498e21a8346d3e7c73f769d65c34227b226d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:05:47 +0200
+Subject: kbuild: keep .modinfo section in vmlinux.unstripped
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 3e86e4d74c0490e5fc5a7f8de8f29e7579c9ffe5 ]
+
+Keep the .modinfo section during linking, but strip it from the final
+vmlinux.
+
+Adjust scripts/mksysmap to exclude modinfo symbols from kallsyms.
+
+This change will allow the next commit to extract the .modinfo section
+from the vmlinux.unstripped intermediate.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+Reviewed-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/aaf67c07447215463300fccaa758904bac42f992.1758182101.git.legion@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/vmlinux.lds.h | 2 +-
+ scripts/Makefile.vmlinux | 7 +++++--
+ scripts/mksysmap | 3 +++
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 8efbe8c4874ee..d61a02fce7274 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -832,6 +832,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
+
+ /* Required sections not related to debugging. */
+ #define ELF_DETAILS \
++ .modinfo : { *(.modinfo) } \
+ .comment 0 : { *(.comment) } \
+ .symtab 0 : { *(.symtab) } \
+ .strtab 0 : { *(.strtab) } \
+@@ -1045,7 +1046,6 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
+ *(.discard.*) \
+ *(.export_symbol) \
+ *(.no_trim_symbol) \
+- *(.modinfo) \
+ /* ld.bfd warns about .gnu.version* even when not emitted */ \
+ *(.gnu.version*) \
+
+diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux
+index 4f2d4c3fb7372..70856dab0f541 100644
+--- a/scripts/Makefile.vmlinux
++++ b/scripts/Makefile.vmlinux
+@@ -86,11 +86,14 @@ endif
+ # vmlinux
+ # ---------------------------------------------------------------------------
+
+-remove-section-y :=
++remove-section-y := .modinfo
+ remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*'
+
++# To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy,
++# it is necessary to remove the PT_LOAD flag from the segment.
+ quiet_cmd_strip_relocs = OBJCOPY $@
+- cmd_strip_relocs = $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $< $@
++ cmd_strip_relocs = $(OBJCOPY) $(patsubst %,--set-section-flags %=noload,$(remove-section-y)) $< $@; \
++ $(OBJCOPY) $(addprefix --remove-section=,$(remove-section-y)) $@
+
+ targets += vmlinux
+ vmlinux: vmlinux.unstripped FORCE
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index 3accbdb269ac7..a607a0059d119 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -79,6 +79,9 @@
+ / _SDA_BASE_$/d
+ / _SDA2_BASE_$/d
+
++# MODULE_INFO()
++/ __UNIQUE_ID_modinfo[0-9]*$/d
++
+ # ---------------------------------------------------------------------------
+ # Ignored patterns
+ # (symbols that contain the pattern are ignored)
+--
+2.51.0
+
--- /dev/null
+From 7b86ee5a6c97601167ceb47111a90a5130a3cd19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:46:44 -0700
+Subject: kbuild: Restore pattern to avoid stripping .rela.dyn from vmlinux
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 4b47a3aefb29c523ca66f0d28de8db15a10f9352 ]
+
+Commit 0ce5139fd96e ("kbuild: always create intermediate
+vmlinux.unstripped") removed the pattern to avoid stripping .rela.dyn
+sections added by commit e9d86b8e17e7 ("scripts: Do not strip .rela.dyn
+section"). Restore it so that .rela.dyn sections remain in the final
+vmlinux.
+
+Fixes: 0ce5139fd96e ("kbuild: always create intermediate vmlinux.unstripped")
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-1-9fc776c5887c@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Stable-dep-of: 8ec3af916fe3 ("kbuild: Add '.rel.*' strip pattern for vmlinux")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.vmlinux | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux
+index 70856dab0f541..7c6f0e882eabb 100644
+--- a/scripts/Makefile.vmlinux
++++ b/scripts/Makefile.vmlinux
+@@ -87,7 +87,7 @@ endif
+ # ---------------------------------------------------------------------------
+
+ remove-section-y := .modinfo
+-remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*'
++remove-section-$(CONFIG_ARCH_VMLINUX_NEEDS_RELOCS) += '.rel*' '!.rel*.dyn'
+
+ # To avoid warnings: "empty loadable segment detected at ..." from GNU objcopy,
+ # it is necessary to remove the PT_LOAD flag from the segment.
+--
+2.51.0
+
--- /dev/null
+From 40b1b25a94e89833854bb01e5f89075dc1bbe2ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index 6608f1e3701b4..aa1e91c97a226 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -291,6 +291,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From f51f27f5584973fad3e1a1b621ce909d8fed38da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit abb2a5572264b425e6dd9c213b735a82ab0ca68a ]
+
+Currently, when compiling with GCC, there is no "break 7" instruction
+for zero division due to using the option -mno-check-zero-division, but
+the compiler still generates "break 0" instruction for zero division.
+
+Here is a simple example:
+
+ $ cat test.c
+ int div(int a)
+ {
+ return a / 0;
+ }
+ $ gcc -O2 -S test.c -o test.s
+
+GCC generates "break 0" on LoongArch and "ud2" on x86, objtool decodes
+"ud2" as INSN_BUG for x86, so decode "break 0" as INSN_BUG can fix the
+objtool warnings for LoongArch, but this is not the intention.
+
+When decoding "break 0" as INSN_TRAP in the previous commit, the aim is
+to handle "break 0" as a trap. The generated "break 0" for zero division
+by GCC is not proper, it should generate a break instruction with proper
+bug type, so add the GCC option -fno-isolate-erroneous-paths-dereference
+to avoid generating the unexpected "break 0" instruction for now.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202509200413.7uihAxJ5-lkp@intel.com/
+Fixes: baad7830ee9a ("objtool/LoongArch: Mark types based on break immediate code")
+Suggested-by: WANG Rui <wangrui@loongson.cn>
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile
+index ae419e32f22e2..f2a585b4a9375 100644
+--- a/arch/loongarch/Makefile
++++ b/arch/loongarch/Makefile
+@@ -129,7 +129,7 @@ KBUILD_RUSTFLAGS_KERNEL += -Crelocation-model=pie
+ LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs)
+ endif
+
+-cflags-y += $(call cc-option, -mno-check-zero-division)
++cflags-y += $(call cc-option, -mno-check-zero-division -fno-isolate-erroneous-paths-dereference)
+
+ ifndef CONFIG_KASAN
+ cflags-y += -fno-builtin-memcpy -fno-builtin-memmove -fno-builtin-memset
+--
+2.51.0
+
--- /dev/null
+From d9f4b12a8ffef167b61817697c369dee7bc3ed7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Fix build error for LTO with LLVM-18
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 19baac378a5f4c34e61007023cfcb605cc64c76d ]
+
+Commit b15212824a01 ("LoongArch: Make LTO case independent in Makefile")
+moves "KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump" out of
+CONFIG_CC_HAS_ANNOTATE_TABLEJUMP, which breaks the build for LLVM-18, as
+'--loongarch-annotate-tablejump' is unimplemented there:
+
+ld.lld: error: -mllvm: ld.lld: Unknown command line argument '--loongarch-annotate-tablejump'.
+
+Call ld-option to detect '--loongarch-annotate-tablejump' before use, so
+as to fix the build error.
+
+Fixes: b15212824a01 ("LoongArch: Make LTO case independent in Makefile")
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Nathan Chancellor <nathan@kernel.org> # build
+Suggested-by: WANG Rui <wangrui@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile
+index f2a585b4a9375..dc5bd3f1b8d2c 100644
+--- a/arch/loongarch/Makefile
++++ b/arch/loongarch/Makefile
+@@ -115,7 +115,7 @@ ifdef CONFIG_LTO_CLANG
+ # The annotate-tablejump option can not be passed to LLVM backend when LTO is enabled.
+ # Ensure it is aware of linker with LTO, '--loongarch-annotate-tablejump' also needs to
+ # be passed via '-mllvm' to ld.lld.
+-KBUILD_LDFLAGS += -mllvm --loongarch-annotate-tablejump
++KBUILD_LDFLAGS += $(call ld-option,-mllvm --loongarch-annotate-tablejump)
+ endif
+ endif
+
+--
+2.51.0
+
--- /dev/null
+From f66117b1b68bd8d082280f422878ee9c4942dac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Init acpi_gbl_use_global_lock to false
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
+
+Init acpi_gbl_use_global_lock to false, in order to void error messages
+during boot phase:
+
+ ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182)
+ ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
+
+Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 075b79b2c1d39..69c17d162fff3 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -355,6 +355,7 @@ void __init platform_init(void)
+
+ #ifdef CONFIG_ACPI
+ acpi_table_upgrade();
++ acpi_gbl_use_global_lock = false;
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 9ddff9bd5e9c7b734c091747c2cfeaf31976168b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:15:58 +0800
+Subject: mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
+
+From: Jason-JH Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit 3f39f56520374cf56872644acf9afcc618a4b674 ]
+
+pm_runtime_get_sync() and pm_runtime_put_autosuspend() were previously
+called in cmdq_mbox_send_data(), which is under a spinlock in msg_submit()
+(mailbox.c). This caused lockdep warnings such as "sleeping function
+called from invalid context" when running with lockdebug enabled.
+
+The BUG report:
+ BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1164
+ in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 3616, name: kworker/u17:3
+ preempt_count: 1, expected: 0
+ RCU nest depth: 0, expected: 0
+ INFO: lockdep is turned off.
+ irq event stamp: 0
+ CPU: 1 PID: 3616 Comm: kworker/u17:3 Not tainted 6.1.87-lockdep-14133-g26e933aca785 #1
+ Hardware name: Google Ciri sku0/unprovisioned board (DT)
+ Workqueue: imgsys_runner imgsys_runner_func
+ Call trace:
+ dump_backtrace+0x100/0x120
+ show_stack+0x20/0x2c
+ dump_stack_lvl+0x84/0xb4
+ dump_stack+0x18/0x48
+ __might_resched+0x354/0x4c0
+ __might_sleep+0x98/0xe4
+ __pm_runtime_resume+0x70/0x124
+ cmdq_mbox_send_data+0xe4/0xb1c
+ msg_submit+0x194/0x2dc
+ mbox_send_message+0x190/0x330
+ imgsys_cmdq_sendtask+0x1618/0x2224
+ imgsys_runner_func+0xac/0x11c
+ process_one_work+0x638/0xf84
+ worker_thread+0x808/0xcd0
+ kthread+0x24c/0x324
+ ret_from_fork+0x10/0x20
+
+Additionally, pm_runtime_put_autosuspend() should be invoked from the
+GCE IRQ handler to ensure the hardware has actually completed its work.
+
+To resolve these issues, remove the pm_runtime calls from
+cmdq_mbox_send_data() and delegate power management responsibilities
+to the client driver.
+
+Fixes: 8afe816b0c99 ("mailbox: mtk-cmdq-mailbox: Implement Runtime PM with autosuspend")
+Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index 532929916e998..654a60f63756a 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -379,20 +379,13 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ struct cmdq *cmdq = dev_get_drvdata(chan->mbox->dev);
+ struct cmdq_task *task;
+ unsigned long curr_pa, end_pa;
+- int ret;
+
+ /* Client should not flush new tasks if suspended. */
+ WARN_ON(cmdq->suspended);
+
+- ret = pm_runtime_get_sync(cmdq->mbox.dev);
+- if (ret < 0)
+- return ret;
+-
+ task = kzalloc(sizeof(*task), GFP_ATOMIC);
+- if (!task) {
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
++ if (!task)
+ return -ENOMEM;
+- }
+
+ task->cmdq = cmdq;
+ INIT_LIST_HEAD(&task->list_entry);
+@@ -439,9 +432,6 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ }
+ list_move_tail(&task->list_entry, &thread->task_busy_list);
+
+- pm_runtime_mark_last_busy(cmdq->mbox.dev);
+- pm_runtime_put_autosuspend(cmdq->mbox.dev);
+-
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f0da672f7345445f5f548875d6773b6a998c4490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:22 +0530
+Subject: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 0aead8197fc1a85b0a89646e418feb49a564b029 ]
+
+The cleanup loop was starting at the wrong array index, causing
+out-of-bounds access.
+Start the loop at the correct index for zero-indexed arrays to prevent
+accessing memory beyond the allocated array bounds.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index bdcc6937ee309..dddbef6b2cb8f 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -890,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ if (pdata->irq < MAX_SGI)
+ xlnx_mbox_cleanup_sgi(pdata);
+
+- i = pdata->num_mboxes;
++ i = pdata->num_mboxes - 1;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (device_is_registered(&ipi_mbox->dev))
+--
+2.51.0
+
--- /dev/null
+From 616f7f736b5e82a7d659dcf1323be157b745472c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:23 +0530
+Subject: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit bb160e791ab15b89188a7a19589b8e11f681bef3 ]
+
+The driver incorrectly determines SGI vs SPI interrupts by checking IRQ
+number < 16, which fails with dynamic IRQ allocation. During unbind,
+this causes improper SGI cleanup leading to kernel crash.
+
+Add explicit irq_type field to pdata for reliable identification of SGI
+interrupts (type-2) and only clean up SGI resources when appropriate.
+
+Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index dddbef6b2cb8f..967967b2b8a96 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -62,7 +62,8 @@
+ #define DST_BIT_POS 9U
+ #define SRC_BITMASK GENMASK(11, 8)
+
+-#define MAX_SGI 16
++/* Macro to represent SGI type for IPI IRQs */
++#define IPI_IRQ_TYPE_SGI 2
+
+ /*
+ * Module parameters
+@@ -121,6 +122,7 @@ struct zynqmp_ipi_mbox {
+ * @dev: device pointer corresponding to the Xilinx ZynqMP
+ * IPI agent
+ * @irq: IPI agent interrupt ID
++ * @irq_type: IPI SGI or SPI IRQ type
+ * @method: IPI SMC or HVC is going to be used
+ * @local_id: local IPI agent ID
+ * @virq_sgi: IRQ number mapped to SGI
+@@ -130,6 +132,7 @@ struct zynqmp_ipi_mbox {
+ struct zynqmp_ipi_pdata {
+ struct device *dev;
+ int irq;
++ unsigned int irq_type;
+ unsigned int method;
+ u32 local_id;
+ int virq_sgi;
+@@ -887,7 +890,7 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ struct zynqmp_ipi_mbox *ipi_mbox;
+ int i;
+
+- if (pdata->irq < MAX_SGI)
++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI)
+ xlnx_mbox_cleanup_sgi(pdata);
+
+ i = pdata->num_mboxes - 1;
+@@ -956,14 +959,16 @@ static int zynqmp_ipi_probe(struct platform_device *pdev)
+ dev_err(dev, "failed to parse interrupts\n");
+ goto free_mbox_dev;
+ }
+- ret = out_irq.args[1];
++
++ /* Use interrupt type to distinguish SGI and SPI interrupts */
++ pdata->irq_type = out_irq.args[0];
+
+ /*
+ * If Interrupt number is in SGI range, then request SGI else request
+ * IPI system IRQ.
+ */
+- if (ret < MAX_SGI) {
+- pdata->irq = ret;
++ if (pdata->irq_type == IPI_IRQ_TYPE_SGI) {
++ pdata->irq = out_irq.args[1];
+ ret = xlnx_mbox_init_sgi(pdev, pdata->irq, pdata);
+ if (ret)
+ goto free_mbox_dev;
+--
+2.51.0
+
--- /dev/null
+From f8de28d5d1068edff4c99fabd8c3408c793fe796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 263a3413a8c7f..bdcc6937ee309 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -893,10 +893,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3f80c36bc124ca09ee1b8baeb5fc24f54995058c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 0c143beaafda6..263a3413a8c7f 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -894,7 +894,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From bb8083a0632c6fbb3eec58e1fe84726c5e68cd95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:01:50 -0700
+Subject: mshv: Handle NEED_RESCHED_LAZY before transferring to guest
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 0ebac01a00be972020c002a7fe0bb6b6fca8410f ]
+
+Check for NEED_RESCHED_LAZY, not just NEED_RESCHED, prior to transferring
+control to a guest. Failure to check for lazy resched can unnecessarily
+delay rescheduling until the next tick when using a lazy preemption model.
+
+Note, ideally both the checking and processing of TIF bits would be handled
+in common code, to avoid having to keep three separate paths synchronized,
+but defer such cleanups to the future to keep the fix as standalone as
+possible.
+
+Cc: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Cc: Mukesh R <mrathor@linux.microsoft.com>
+Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Reviewed-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/mshv_common.c | 2 +-
+ drivers/hv/mshv_root_main.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hv/mshv_common.c b/drivers/hv/mshv_common.c
+index 6f227a8a5af71..eb3df3e296bbe 100644
+--- a/drivers/hv/mshv_common.c
++++ b/drivers/hv/mshv_common.c
+@@ -151,7 +151,7 @@ int mshv_do_pre_guest_mode_work(ulong th_flags)
+ if (th_flags & (_TIF_SIGPENDING | _TIF_NOTIFY_SIGNAL))
+ return -EINTR;
+
+- if (th_flags & _TIF_NEED_RESCHED)
++ if (th_flags & (_TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY))
+ schedule();
+
+ if (th_flags & _TIF_NOTIFY_RESUME)
+diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
+index 72df774e410ab..cad09ff5f94dc 100644
+--- a/drivers/hv/mshv_root_main.c
++++ b/drivers/hv/mshv_root_main.c
+@@ -490,7 +490,8 @@ mshv_vp_wait_for_hv_kick(struct mshv_vp *vp)
+ static int mshv_pre_guest_mode_work(struct mshv_vp *vp)
+ {
+ const ulong work_flags = _TIF_NOTIFY_SIGNAL | _TIF_SIGPENDING |
+- _TIF_NEED_RESCHED | _TIF_NOTIFY_RESUME;
++ _TIF_NEED_RESCHED | _TIF_NEED_RESCHED_LAZY |
++ _TIF_NOTIFY_RESUME;
+ ulong th_flags;
+
+ th_flags = read_thread_flags();
+--
+2.51.0
+
--- /dev/null
+From a92137dffc94760f0ae4bb19210b31aff1e1916c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 11:27:43 +0200
+Subject: net: airoha: Fix loopback mode configuration for GDM2 port
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit fea8cdf6738a8b25fccbb7b109b440795a0892cb ]
+
+Add missing configuration for loopback mode in airhoha_set_gdm2_loopback
+routine.
+
+Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20251008-airoha-loopback-mode-fix-v2-1-045694fe7f60@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 4 +++-
+ drivers/net/ethernet/airoha/airoha_regs.h | 3 +++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ethernet/airoha/airoha_eth.c
+index e6b802e3d8449..6d23c5c049b9a 100644
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -1709,7 +1709,9 @@ static void airhoha_set_gdm2_loopback(struct airoha_gdm_port *port)
+ airoha_fe_wr(eth, REG_GDM_RXCHN_EN(2), 0xffff);
+ airoha_fe_rmw(eth, REG_GDM_LPBK_CFG(2),
+ LPBK_CHAN_MASK | LPBK_MODE_MASK | LPBK_EN_MASK,
+- FIELD_PREP(LPBK_CHAN_MASK, chan) | LPBK_EN_MASK);
++ FIELD_PREP(LPBK_CHAN_MASK, chan) |
++ LBK_GAP_MODE_MASK | LBK_LEN_MODE_MASK |
++ LBK_CHAN_MODE_MASK | LPBK_EN_MASK);
+ airoha_fe_rmw(eth, REG_GDM_LEN_CFG(2),
+ GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK,
+ FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
+diff --git a/drivers/net/ethernet/airoha/airoha_regs.h b/drivers/net/ethernet/airoha/airoha_regs.h
+index 150c85995cc1a..0c8f61081699c 100644
+--- a/drivers/net/ethernet/airoha/airoha_regs.h
++++ b/drivers/net/ethernet/airoha/airoha_regs.h
+@@ -151,6 +151,9 @@
+ #define LPBK_LEN_MASK GENMASK(23, 10)
+ #define LPBK_CHAN_MASK GENMASK(8, 4)
+ #define LPBK_MODE_MASK GENMASK(3, 1)
++#define LBK_GAP_MODE_MASK BIT(3)
++#define LBK_LEN_MODE_MASK BIT(2)
++#define LBK_CHAN_MODE_MASK BIT(1)
+ #define LPBK_EN_MASK BIT(0)
+
+ #define REG_GDM_TXCHN_EN(_n) (GDM_BASE(_n) + 0x24)
+--
+2.51.0
+
--- /dev/null
+From 464450de7f9d7d0ed0e0b3880fb106fc30fcb922 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index 577f9b1780ad6..de88776dd2a20 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -479,10 +479,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ba986dd6e8cd2deda5859117044f8436a5e6775c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:03:06 +0200
+Subject: net: mdio: mdio-i2c: Hold the i2c bus lock during smbus transactions
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit 4dc8b26a3ac2cb79f19f252d9077696d3ef0823a ]
+
+When accessing an MDIO register using single-byte smbus accesses, we have to
+perform 2 consecutive operations targeting the same address,
+first accessing the MSB then the LSB of the 16 bit register:
+
+ read_1_byte(addr); <- returns MSB of register at address 'addr'
+ read_1_byte(addr); <- returns LSB
+
+Some PHY devices present in SFP such as the Broadcom 5461 don't like
+seeing foreign i2c transactions in-between these 2 smbus accesses, and
+will return the MSB a second time when trying to read the LSB :
+
+ read_1_byte(addr); <- returns MSB
+
+ i2c_transaction_for_other_device_on_the_bus();
+
+ read_1_byte(addr); <- returns MSB again
+
+Given the already fragile nature of accessing PHYs/SFPs with single-byte
+smbus accesses, it's safe to say that this Broadcom PHY may not be the
+only one acting like this.
+
+Let's therefore hold the i2c bus lock while performing our smbus
+transactions to avoid interleaved accesses.
+
+Fixes: d4bd3aca33c2 ("net: mdio: mdio-i2c: Add support for single-byte SMBus operations")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20251003070311.861135-1-maxime.chevallier@bootlin.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-i2c.c | 39 ++++++++++++++++++++++++-------------
+ 1 file changed, 25 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/mdio/mdio-i2c.c b/drivers/net/mdio/mdio-i2c.c
+index 53e96bfab5422..ed20352a589a3 100644
+--- a/drivers/net/mdio/mdio-i2c.c
++++ b/drivers/net/mdio/mdio-i2c.c
+@@ -116,17 +116,23 @@ static int smbus_byte_mii_read_default_c22(struct mii_bus *bus, int phy_id,
+ if (!i2c_mii_valid_phy_id(phy_id))
+ return 0;
+
+- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
+- I2C_SMBUS_READ, reg,
+- I2C_SMBUS_BYTE_DATA, &smbus_data);
++ i2c_lock_bus(i2c, I2C_LOCK_SEGMENT);
++
++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
++ I2C_SMBUS_READ, reg,
++ I2C_SMBUS_BYTE_DATA, &smbus_data);
+ if (ret < 0)
+- return ret;
++ goto unlock;
+
+ val = (smbus_data.byte & 0xff) << 8;
+
+- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
+- I2C_SMBUS_READ, reg,
+- I2C_SMBUS_BYTE_DATA, &smbus_data);
++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
++ I2C_SMBUS_READ, reg,
++ I2C_SMBUS_BYTE_DATA, &smbus_data);
++
++unlock:
++ i2c_unlock_bus(i2c, I2C_LOCK_SEGMENT);
++
+ if (ret < 0)
+ return ret;
+
+@@ -147,17 +153,22 @@ static int smbus_byte_mii_write_default_c22(struct mii_bus *bus, int phy_id,
+
+ smbus_data.byte = (val & 0xff00) >> 8;
+
+- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
+- I2C_SMBUS_WRITE, reg,
+- I2C_SMBUS_BYTE_DATA, &smbus_data);
++ i2c_lock_bus(i2c, I2C_LOCK_SEGMENT);
++
++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
++ I2C_SMBUS_WRITE, reg,
++ I2C_SMBUS_BYTE_DATA, &smbus_data);
+ if (ret < 0)
+- return ret;
++ goto unlock;
+
+ smbus_data.byte = val & 0xff;
+
+- ret = i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
+- I2C_SMBUS_WRITE, reg,
+- I2C_SMBUS_BYTE_DATA, &smbus_data);
++ ret = __i2c_smbus_xfer(i2c, i2c_mii_phy_addr(phy_id), 0,
++ I2C_SMBUS_WRITE, reg,
++ I2C_SMBUS_BYTE_DATA, &smbus_data);
++
++unlock:
++ i2c_unlock_bus(i2c, I2C_LOCK_SEGMENT);
+
+ return ret < 0 ? ret : 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 60c4b6e57dfbf84af492a73e56e970f139d76e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index d2071aff7b8f3..308b4458e0d44 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1180,9 +1180,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 52d873182640d8448ca9e6978c098c0d9697a391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Oct 2025 11:29:57 +0300
+Subject: net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec
+ tables
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 7593439c13933164f701eed9c83d89358f203469 ]
+
+When creating IPsec flow tables with tunnel mode enabled, the driver
+uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation
+conflicts across different domains (NIC_RX/NIC_TX and FDB), since the
+firmware doesn’t allow both at the same time.
+
+Currently, the driver attempts to reserve tunnel mode unconditionally
+for both NIC and FDB IPsec tables. This can lead to conflicting tunnel
+mode setups, for example, if a flow table was created in the FDB
+domain with tunnel offload enabled, and we later try to create another
+one in the NIC, or vice versa.
+
+To resolve this, adjust the blocking logic so that tunnel mode is only
+reserved by NIC flows. This ensures that tunnel offload is exclusively
+used in either the NIC or the FDB, and avoids unintended offload
+conflicts.
+
+Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode")
+Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode")
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/1759652999-858513-2-git-send-email-tariqt@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 8 ++++++--
+ .../net/ethernet/mellanox/mlx5/core/eswitch.h | 5 +++--
+ .../mellanox/mlx5/core/eswitch_offloads.c | 18 ++++++++++--------
+ 3 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+index 65dc3529283b6..b525f3f21c51f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+@@ -1045,7 +1045,9 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
+
+ /* Create FT */
+ if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL)
+- rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev);
++ rx->allow_tunnel_mode =
++ mlx5_eswitch_block_encap(mdev, rx == ipsec->rx_esw);
++
+ if (rx->allow_tunnel_mode)
+ flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT;
+ ft = ipsec_ft_create(attr.ns, attr.sa_level, attr.prio, 1, 2, flags);
+@@ -1286,7 +1288,9 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx,
+ goto err_status_rule;
+
+ if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL)
+- tx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev);
++ tx->allow_tunnel_mode =
++ mlx5_eswitch_block_encap(mdev, tx == ipsec->tx_esw);
++
+ if (tx->allow_tunnel_mode)
+ flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT;
+ ft = ipsec_ft_create(tx->ns, attr.sa_level, attr.prio, 1, 4, flags);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+index 45506ad568470..53d7e33d6c0b1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+@@ -851,7 +851,7 @@ void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw,
+ struct mlx5_eswitch *slave_esw);
+ int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw);
+
+-bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev);
++bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb);
+ void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev);
+
+ int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev);
+@@ -943,7 +943,8 @@ mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw)
+ return 0;
+ }
+
+-static inline bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev)
++static inline bool
++mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb)
+ {
+ return true;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index bee906661282a..f358e8fe432cf 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -3938,23 +3938,25 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode)
+ return esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode);
+ }
+
+-bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev)
++bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb)
+ {
+ struct mlx5_eswitch *esw = dev->priv.eswitch;
++ enum devlink_eswitch_encap_mode encap;
++ bool allow_tunnel = false;
+
+ if (!mlx5_esw_allowed(esw))
+ return true;
+
+ down_write(&esw->mode_lock);
+- if (esw->mode != MLX5_ESWITCH_LEGACY &&
+- esw->offloads.encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE) {
+- up_write(&esw->mode_lock);
+- return false;
++ encap = esw->offloads.encap;
++ if (esw->mode == MLX5_ESWITCH_LEGACY ||
++ (encap == DEVLINK_ESWITCH_ENCAP_MODE_NONE && !from_fdb)) {
++ allow_tunnel = true;
++ esw->offloads.num_block_encap++;
+ }
+-
+- esw->offloads.num_block_encap++;
+ up_write(&esw->mode_lock);
+- return true;
++
++ return allow_tunnel;
+ }
+
+ void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev)
+--
+2.51.0
+
--- /dev/null
+From 6a6b35c1432cb8c6c74f49faf379ad8dcbce14ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Oct 2025 11:29:58 +0300
+Subject: net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 ]
+
+When configuring IPsec packet offload in tunnel mode, the driver tries
+to create tunnel reformat objects unconditionally. This is incorrect,
+because tunnel mode is only permitted under specific encapsulation
+settings, and that decision is already made when the flow table is
+created.
+
+The offending commit attempted to block this case in the state add
+path, but the check there happens too late and does not prevent the
+reformat from being configured.
+
+Fix by taking short reservations for both the eswitch mode and the
+encap at the start of state setup. This preserves the block ordering
+(mode --> encap) used later: the mode is blocked during RX/TX get, and
+the encap is blocked during flow-table creation. This lets us fail
+early if either reservation cannot be obtained, it means a mode
+transition is underway or a conflicting configuration already owns
+encap. If both succeed, the flow-table path later takes the ownership
+and the reservations are released on exit.
+
+Fixes: 146c196b60e4 ("net/mlx5e: Create IPsec table with tunnel support only when encap is disabled")
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/1759652999-858513-3-git-send-email-tariqt@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en_accel/ipsec.c | 38 +++++++++++++------
+ .../mellanox/mlx5/core/en_accel/ipsec.h | 2 +-
+ .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 24 +++++++-----
+ 3 files changed, 43 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+index 00e77c71e201f..0a4fb8c922684 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+@@ -772,6 +772,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+ struct netlink_ext_ack *extack)
+ {
+ struct mlx5e_ipsec_sa_entry *sa_entry = NULL;
++ bool allow_tunnel_mode = false;
+ struct mlx5e_ipsec *ipsec;
+ struct mlx5e_priv *priv;
+ gfp_t gfp;
+@@ -803,6 +804,20 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+ goto err_xfrm;
+ }
+
++ if (mlx5_eswitch_block_mode(priv->mdev))
++ goto unblock_ipsec;
++
++ if (x->props.mode == XFRM_MODE_TUNNEL &&
++ x->xso.type == XFRM_DEV_OFFLOAD_PACKET) {
++ allow_tunnel_mode = mlx5e_ipsec_fs_tunnel_allowed(sa_entry);
++ if (!allow_tunnel_mode) {
++ NL_SET_ERR_MSG_MOD(extack,
++ "Packet offload tunnel mode is disabled due to encap settings");
++ err = -EINVAL;
++ goto unblock_mode;
++ }
++ }
++
+ /* check esn */
+ if (x->props.flags & XFRM_STATE_ESN)
+ mlx5e_ipsec_update_esn_state(sa_entry);
+@@ -817,7 +832,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+
+ err = mlx5_ipsec_create_work(sa_entry);
+ if (err)
+- goto unblock_ipsec;
++ goto unblock_encap;
+
+ err = mlx5e_ipsec_create_dwork(sa_entry);
+ if (err)
+@@ -832,14 +847,6 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+ if (err)
+ goto err_hw_ctx;
+
+- if (x->props.mode == XFRM_MODE_TUNNEL &&
+- x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
+- !mlx5e_ipsec_fs_tunnel_enabled(sa_entry)) {
+- NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings");
+- err = -EINVAL;
+- goto err_add_rule;
+- }
+-
+ /* We use *_bh() variant because xfrm_timer_handler(), which runs
+ * in softirq context, can reach our state delete logic and we need
+ * xa_erase_bh() there.
+@@ -855,8 +862,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+ queue_delayed_work(ipsec->wq, &sa_entry->dwork->dwork,
+ MLX5_IPSEC_RESCHED);
+
+- if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
+- x->props.mode == XFRM_MODE_TUNNEL) {
++ if (allow_tunnel_mode) {
+ xa_lock_bh(&ipsec->sadb);
+ __xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id,
+ MLX5E_IPSEC_TUNNEL_SA);
+@@ -865,6 +871,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+
+ out:
+ x->xso.offload_handle = (unsigned long)sa_entry;
++ if (allow_tunnel_mode)
++ mlx5_eswitch_unblock_encap(priv->mdev);
++
++ mlx5_eswitch_unblock_mode(priv->mdev);
++
+ return 0;
+
+ err_add_rule:
+@@ -877,6 +888,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
+ if (sa_entry->work)
+ kfree(sa_entry->work->data);
+ kfree(sa_entry->work);
++unblock_encap:
++ if (allow_tunnel_mode)
++ mlx5_eswitch_unblock_encap(priv->mdev);
++unblock_mode:
++ mlx5_eswitch_unblock_mode(priv->mdev);
+ unblock_ipsec:
+ mlx5_eswitch_unblock_ipsec(priv->mdev);
+ err_xfrm:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+index 23703f28386ad..5d7c15abfcaf6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+@@ -319,7 +319,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry);
+ int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry);
+ void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry);
+ void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry);
+-bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry);
++bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry);
+
+ int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
+ void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+index b525f3f21c51f..9e23652535638 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+@@ -2826,18 +2826,24 @@ void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry)
+ memcpy(sa_entry, &sa_entry_shadow, sizeof(*sa_entry));
+ }
+
+-bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry)
++bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry)
+ {
+- struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
+- struct mlx5e_ipsec_rx *rx;
+- struct mlx5e_ipsec_tx *tx;
++ struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
++ struct xfrm_state *x = sa_entry->x;
++ bool from_fdb;
+
+- rx = ipsec_rx(sa_entry->ipsec, attrs->addrs.family, attrs->type);
+- tx = ipsec_tx(sa_entry->ipsec, attrs->type);
+- if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT)
+- return tx->allow_tunnel_mode;
++ if (x->xso.dir == XFRM_DEV_OFFLOAD_OUT) {
++ struct mlx5e_ipsec_tx *tx = ipsec_tx(ipsec, x->xso.type);
++
++ from_fdb = (tx == ipsec->tx_esw);
++ } else {
++ struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, x->props.family,
++ x->xso.type);
++
++ from_fdb = (rx == ipsec->rx_esw);
++ }
+
+- return rx->allow_tunnel_mode;
++ return mlx5_eswitch_block_encap(ipsec->mdev, from_fdb);
+ }
+
+ void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv,
+--
+2.51.0
+
--- /dev/null
+From a3bb774a3f7f28e88ac4d7baa478f06c92208c1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 09:11:49 +0800
+Subject: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit bc9ea787079671cb19a8b25ff9f02be5ef6bfcf5 ]
+
+The origin code calls cancel_delayed_work() in ocelot_stats_deinit()
+to cancel the cyclic delayed work item ocelot->stats_work. However,
+cancel_delayed_work() may fail to cancel the work item if it is already
+executing. While destroy_workqueue() does wait for all pending work items
+in the work queue to complete before destroying the work queue, it cannot
+prevent the delayed work item from being rescheduled within the
+ocelot_check_stats_work() function. This limitation exists because the
+delayed work item is only enqueued into the work queue after its timer
+expires. Before the timer expiration, destroy_workqueue() has no visibility
+of this pending work item. Once the work queue appears empty,
+destroy_workqueue() proceeds with destruction. When the timer eventually
+expires, the delayed work item gets queued again, leading to the following
+warning:
+
+workqueue: cannot queue ocelot_check_stats_work on wq ocelot-switch-stats
+WARNING: CPU: 2 PID: 0 at kernel/workqueue.c:2255 __queue_work+0x875/0xaf0
+...
+RIP: 0010:__queue_work+0x875/0xaf0
+...
+RSP: 0018:ffff88806d108b10 EFLAGS: 00010086
+RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000027
+RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffff88806d123e88
+RBP: ffffffff813c3170 R08: 0000000000000000 R09: ffffed100da247d2
+R10: ffffed100da247d1 R11: ffff88806d123e8b R12: ffff88800c00f000
+R13: ffff88800d7285c0 R14: ffff88806d0a5580 R15: ffff88800d7285a0
+FS: 0000000000000000(0000) GS:ffff8880e5725000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fe18e45ea10 CR3: 0000000005e6c000 CR4: 00000000000006f0
+Call Trace:
+ <IRQ>
+ ? kasan_report+0xc6/0xf0
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ call_timer_fn+0x25/0x1c0
+ __run_timer_base.part.0+0x3be/0x8c0
+ ? __pfx_delayed_work_timer_fn+0x10/0x10
+ ? rcu_sched_clock_irq+0xb06/0x27d0
+ ? __pfx___run_timer_base.part.0+0x10/0x10
+ ? try_to_wake_up+0xb15/0x1960
+ ? _raw_spin_lock_irq+0x80/0xe0
+ ? __pfx__raw_spin_lock_irq+0x10/0x10
+ tmigr_handle_remote_up+0x603/0x7e0
+ ? __pfx_tmigr_handle_remote_up+0x10/0x10
+ ? sched_balance_trigger+0x1c0/0x9f0
+ ? sched_tick+0x221/0x5a0
+ ? _raw_spin_lock_irq+0x80/0xe0
+ ? __pfx__raw_spin_lock_irq+0x10/0x10
+ ? tick_nohz_handler+0x339/0x440
+ ? __pfx_tmigr_handle_remote_up+0x10/0x10
+ __walk_groups.isra.0+0x42/0x150
+ tmigr_handle_remote+0x1f4/0x2e0
+ ? __pfx_tmigr_handle_remote+0x10/0x10
+ ? ktime_get+0x60/0x140
+ ? lapic_next_event+0x11/0x20
+ ? clockevents_program_event+0x1d4/0x2a0
+ ? hrtimer_interrupt+0x322/0x780
+ handle_softirqs+0x16a/0x550
+ irq_exit_rcu+0xaf/0xe0
+ sysvec_apic_timer_interrupt+0x70/0x80
+ </IRQ>
+...
+
+The following diagram reveals the cause of the above warning:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mscc_ocelot_remove() |
+ ocelot_deinit() | ocelot_check_stats_work()
+ ocelot_stats_deinit() |
+ cancel_delayed_work()| ...
+ | queue_delayed_work()
+ destroy_workqueue() | (wait a time)
+ | __queue_work() //UAF
+
+The above scenario actually constitutes a UAF vulnerability.
+
+The ocelot_stats_deinit() is only invoked when initialization
+failure or resource destruction, so we must ensure that any
+delayed work items cannot be rescheduled.
+
+Replace cancel_delayed_work() with disable_delayed_work_sync()
+to guarantee proper cancellation of the delayed work item and
+ensure completion of any currently executing work before the
+workqueue is deallocated.
+
+A deadlock concern was considered: ocelot_stats_deinit() is called
+in a process context and is not holding any locks that the delayed
+work item might also need. Therefore, the use of the _sync() variant
+is safe here.
+
+This bug was identified through static analysis. To reproduce the
+issue and validate the fix, I simulated ocelot-switch device by
+writing a kernel module and prepared the necessary resources for
+the virtual ocelot-switch device's probe process. Then, removing
+the virtual device will trigger the mscc_ocelot_remove() function,
+which in turn destroys the workqueue.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://patch.msgid.link/20251001011149.55073-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c
+index 545710dadcf54..d2be1be377165 100644
+--- a/drivers/net/ethernet/mscc/ocelot_stats.c
++++ b/drivers/net/ethernet/mscc/ocelot_stats.c
+@@ -1021,6 +1021,6 @@ int ocelot_stats_init(struct ocelot *ocelot)
+
+ void ocelot_stats_deinit(struct ocelot *ocelot)
+ {
+- cancel_delayed_work(&ocelot->stats_work);
++ disable_delayed_work_sync(&ocelot->stats_work);
+ destroy_workqueue(ocelot->stats_queue);
+ }
+--
+2.51.0
+
--- /dev/null
+From 93ea5a583722872968868cdbf65ae9fcc694ba1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 22:40:29 +0200
+Subject: net: pse-pd: tps23881: Fix current measurement scaling
+
+From: Thomas Wismer <thomas.wismer@scs.ch>
+
+[ Upstream commit 2c95a756e0cfc19af6d0b32b0c6cf3bada334998 ]
+
+The TPS23881 improves on the TPS23880 with current sense resistors reduced
+from 255 mOhm to 200 mOhm. This has a direct impact on the scaling of the
+current measurement. However, the latest TPS23881 data sheet from May 2023
+still shows the scaling of the TPS23880 model.
+
+Fixes: 7f076ce3f1733 ("net: pse-pd: tps23881: Add support for power limit and measurement features")
+Signed-off-by: Thomas Wismer <thomas.wismer@scs.ch>
+Acked-by: Kory Maincent <kory.maincent@bootlin.com>
+Link: https://patch.msgid.link/20251006204029.7169-2-thomas@wismer.xyz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/pse-pd/tps23881.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/pse-pd/tps23881.c b/drivers/net/pse-pd/tps23881.c
+index 63f8f43062bce..b724b222ab44c 100644
+--- a/drivers/net/pse-pd/tps23881.c
++++ b/drivers/net/pse-pd/tps23881.c
+@@ -62,7 +62,7 @@
+ #define TPS23881_REG_SRAM_DATA 0x61
+
+ #define TPS23881_UV_STEP 3662
+-#define TPS23881_NA_STEP 70190
++#define TPS23881_NA_STEP 89500
+ #define TPS23881_MW_STEP 500
+ #define TPS23881_MIN_PI_PW_LIMIT_MW 2000
+
+--
+2.51.0
+
--- /dev/null
+From 4749addbc9e1e53136a8778ad9c302829e30e3ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index a0524ba8d7878..93cac73472c79 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -885,7 +885,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From 9ff6549e8e9be9ed92d537c084888680f8efd3a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 14:35:59 +0200
+Subject: net: sparx5/lan969x: fix flooding configuration on bridge join/leave
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Machon <daniel.machon@microchip.com>
+
+[ Upstream commit c9d1b0b54258ba13b567dd116ead3c7c30cba7d8 ]
+
+The sparx5 driver programs UC/MC/BC flooding in sparx5_update_fwd() by
+unconditionally applying bridge_fwd_mask to all flood PGIDs. Any bridge
+topology change that triggers sparx5_update_fwd() (for example enslaving
+another port) therefore reinstalls flooding in hardware for already
+bridged ports, regardless of their per-port flood flags.
+
+This results in clobbering of the flood masks, and desynchronization
+between software and hardware: the bridge still reports “flood off” for
+the port, but hardware has flooding enabled due to unconditional PGID
+reprogramming.
+
+Steps to reproduce:
+
+ $ ip link add br0 type bridge
+ $ ip link set br0 up
+ $ ip link set eth0 master br0
+ $ ip link set eth0 up
+ $ bridge link set dev eth0 flood off
+ $ ip link set eth1 master br0
+ $ ip link set eth1 up
+
+At this point, flooding is silently re-enabled for eth0. Software still
+shows “flood off” for eth0, but hardware has flooding enabled.
+
+To fix this, flooding is now set explicitly during bridge join/leave,
+through sparx5_port_attr_bridge_flags():
+
+ On bridge join, UC/MC/BC flooding is enabled by default.
+
+ On bridge leave, UC/MC/BC flooding is disabled.
+
+ sparx5_update_fwd() no longer touches the flood PGIDs, clobbering
+ the flood masks, and desynchronizing software and hardware.
+
+ Initialization of the flooding PGIDs have been moved to
+ sparx5_start(). This is required as flooding PGIDs defaults to
+ 0x3fffffff in hardware and the initialization was previously handled
+ in sparx5_update_fwd(), which was removed.
+
+With this change, user-configured flooding flags persist across bridge
+updates and are no longer overridden by sparx5_update_fwd().
+
+Fixes: d6fce5141929 ("net: sparx5: add switching support")
+Signed-off-by: Daniel Machon <daniel.machon@microchip.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20251003-fix-flood-fwd-v1-1-48eb478b2904@microchip.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/sparx5_main.c | 5 +++++
+ .../net/ethernet/microchip/sparx5/sparx5_switchdev.c | 12 ++++++++++++
+ drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c | 10 ----------
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+index 74ad1d73b4652..40b1bfc600a79 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+@@ -708,6 +708,11 @@ static int sparx5_start(struct sparx5 *sparx5)
+ /* Init masks */
+ sparx5_update_fwd(sparx5);
+
++ /* Init flood masks */
++ for (int pgid = sparx5_get_pgid(sparx5, PGID_UC_FLOOD);
++ pgid <= sparx5_get_pgid(sparx5, PGID_BCAST); pgid++)
++ sparx5_pgid_clear(sparx5, pgid);
++
+ /* CPU copy CPU pgids */
+ spx5_wr(ANA_AC_PGID_MISC_CFG_PGID_CPU_COPY_ENA_SET(1), sparx5,
+ ANA_AC_PGID_MISC_CFG(sparx5_get_pgid(sparx5, PGID_CPU)));
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c b/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c
+index bc9ecb9392cd3..0a71abbd3da58 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c
+@@ -176,6 +176,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,
+ struct net_device *bridge,
+ struct netlink_ext_ack *extack)
+ {
++ struct switchdev_brport_flags flags = {0};
+ struct sparx5 *sparx5 = port->sparx5;
+ struct net_device *ndev = port->ndev;
+ int err;
+@@ -205,6 +206,11 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,
+ */
+ __dev_mc_unsync(ndev, sparx5_mc_unsync);
+
++ /* Enable uc/mc/bc flooding */
++ flags.mask = BR_FLOOD | BR_MCAST_FLOOD | BR_BCAST_FLOOD;
++ flags.val = flags.mask;
++ sparx5_port_attr_bridge_flags(port, flags);
++
+ return 0;
+
+ err_switchdev_offload:
+@@ -215,6 +221,7 @@ static int sparx5_port_bridge_join(struct sparx5_port *port,
+ static void sparx5_port_bridge_leave(struct sparx5_port *port,
+ struct net_device *bridge)
+ {
++ struct switchdev_brport_flags flags = {0};
+ struct sparx5 *sparx5 = port->sparx5;
+
+ switchdev_bridge_port_unoffload(port->ndev, NULL, NULL, NULL);
+@@ -234,6 +241,11 @@ static void sparx5_port_bridge_leave(struct sparx5_port *port,
+
+ /* Port enters in host more therefore restore mc list */
+ __dev_mc_sync(port->ndev, sparx5_mc_sync, sparx5_mc_unsync);
++
++ /* Disable uc/mc/bc flooding */
++ flags.mask = BR_FLOOD | BR_MCAST_FLOOD | BR_BCAST_FLOOD;
++ flags.val = 0;
++ sparx5_port_attr_bridge_flags(port, flags);
+ }
+
+ static int sparx5_port_changeupper(struct net_device *dev,
+diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c b/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c
+index d42097aa60a0e..4947828719038 100644
+--- a/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c
++++ b/drivers/net/ethernet/microchip/sparx5/sparx5_vlan.c
+@@ -167,16 +167,6 @@ void sparx5_update_fwd(struct sparx5 *sparx5)
+ /* Divide up fwd mask in 32 bit words */
+ bitmap_to_arr32(mask, sparx5->bridge_fwd_mask, SPX5_PORTS);
+
+- /* Update flood masks */
+- for (port = sparx5_get_pgid(sparx5, PGID_UC_FLOOD);
+- port <= sparx5_get_pgid(sparx5, PGID_BCAST); port++) {
+- spx5_wr(mask[0], sparx5, ANA_AC_PGID_CFG(port));
+- if (is_sparx5(sparx5)) {
+- spx5_wr(mask[1], sparx5, ANA_AC_PGID_CFG1(port));
+- spx5_wr(mask[2], sparx5, ANA_AC_PGID_CFG2(port));
+- }
+- }
+-
+ /* Update SRC masks */
+ for (port = 0; port < sparx5->data->consts->n_ports; port++) {
+ if (test_bit(port, sparx5->bridge_fwd_mask)) {
+--
+2.51.0
+
--- /dev/null
+From 6f5ac41ee61424b5407adf5c7c3c89b3ef87ad70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 14:19:02 +0530
+Subject: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in
+ lan78xx_read_raw_eeprom
+
+From: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
+
+[ Upstream commit 49bdb63ff64469a6de8ea901aef123c75be9bbe7 ]
+
+Syzbot reported read of uninitialized variable BUG with following call stack.
+
+lan78xx 8-1:1.0 (unnamed net_device) (uninitialized): EEPROM read operation timeout
+=====================================================
+BUG: KMSAN: uninit-value in lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
+BUG: KMSAN: uninit-value in lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
+BUG: KMSAN: uninit-value in lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
+ lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1095 [inline]
+ lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
+ lan78xx_reset+0x999/0x2cd0 drivers/net/usb/lan78xx.c:3241
+ lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
+ lan78xx_probe+0x225c/0x3310 drivers/net/usb/lan78xx.c:4707
+
+Local variable sig.i.i created at:
+ lan78xx_read_eeprom drivers/net/usb/lan78xx.c:1092 [inline]
+ lan78xx_init_mac_address drivers/net/usb/lan78xx.c:1937 [inline]
+ lan78xx_reset+0x77e/0x2cd0 drivers/net/usb/lan78xx.c:3241
+ lan78xx_bind+0x711/0x1690 drivers/net/usb/lan78xx.c:3766
+
+The function lan78xx_read_raw_eeprom failed to properly propagate EEPROM
+read timeout errors (-ETIMEDOUT). In the fallthrough path, it first
+attempted to restore the pin configuration for LED outputs and then
+returned only the status of that restore operation, discarding the
+original timeout error.
+
+As a result, callers could mistakenly treat the data buffer as valid
+even though the EEPROM read had actually timed out with no data or partial
+data.
+
+To fix this, handle errors in restoring the LED pin configuration separately.
+If the restore succeeds, return any prior EEPROM timeout error correctly
+to the caller.
+
+Reported-by: syzbot+62ec8226f01cb4ca19d9@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=62ec8226f01cb4ca19d9
+Fixes: 8b1b2ca83b20 ("net: usb: lan78xx: Improve error handling in EEPROM and OTP operations")
+Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
+Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20250930084902.19062-1-bhanuseshukumar@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 1ff25f57329a8..d75502ebbc0d9 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1079,10 +1079,13 @@ static int lan78xx_read_raw_eeprom(struct lan78xx_net *dev, u32 offset,
+ }
+
+ read_raw_eeprom_done:
+- if (dev->chipid == ID_REV_CHIP_ID_7800_)
+- return lan78xx_write_reg(dev, HW_CFG, saved);
+-
+- return 0;
++ if (dev->chipid == ID_REV_CHIP_ID_7800_) {
++ int rc = lan78xx_write_reg(dev, HW_CFG, saved);
++ /* If USB fails, there is nothing to do */
++ if (rc < 0)
++ return rc;
++ }
++ return ret;
+ }
+
+ static int lan78xx_read_eeprom(struct lan78xx_net *dev, u32 offset,
+--
+2.51.0
+
--- /dev/null
+From 1463749e06aa83213e2924c526204cef640a5a0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 12:08:16 +0200
+Subject: netfilter: nft_objref: validate objref and objrefmap expressions
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
+
+Referencing a synproxy stateful object from OUTPUT hook causes kernel
+crash due to infinite recursive calls:
+
+BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)
+[...]
+Call Trace:
+ __find_rr_leaf+0x99/0x230
+ fib6_table_lookup+0x13b/0x2d0
+ ip6_pol_route+0xa4/0x400
+ fib6_rule_lookup+0x156/0x240
+ ip6_route_output_flags+0xc6/0x150
+ __nf_ip6_route+0x23/0x50
+ synproxy_send_tcp_ipv6+0x106/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+ nft_synproxy_do_eval+0x263/0x310
+ nft_do_chain+0x5a8/0x5f0 [nf_tables
+ nft_do_chain_inet+0x98/0x110
+ nf_hook_slow+0x43/0xc0
+ __ip6_local_out+0xf0/0x170
+ ip6_local_out+0x17/0x70
+ synproxy_send_tcp_ipv6+0x1a2/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+[...]
+
+Implement objref and objrefmap expression validate functions.
+
+Currently, only NFT_OBJECT_SYNPROXY object type requires validation.
+This will also handle a jump to a chain using a synproxy object from the
+OUTPUT hook.
+
+Now when trying to reference a synproxy object in the OUTPUT hook, nft
+will produce the following error:
+
+synproxy_crash.nft: Error: Could not process rule: Operation not supported
+ synproxy name mysynproxy
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Reported-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
+Closes: https://bugzilla.suse.com/1250237
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index 8ee66a86c3bc7..1a62e384766a7 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr,
+ obj->ops->eval(obj, regs, pkt);
+ }
+
++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type)
++{
++ unsigned int hooks;
++
++ switch (type) {
++ case NFT_OBJECT_SYNPROXY:
++ if (ctx->family != NFPROTO_IPV4 &&
++ ctx->family != NFPROTO_IPV6 &&
++ ctx->family != NFPROTO_INET)
++ return -EOPNOTSUPP;
++
++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD);
++
++ return nft_chain_validate_hooks(ctx->chain, hooks);
++ default:
++ break;
++ }
++
++ return 0;
++}
++
++static int nft_objref_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_object *obj = nft_objref_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type);
++}
++
+ static int nft_objref_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = {
+ .activate = nft_objref_activate,
+ .deactivate = nft_objref_deactivate,
+ .dump = nft_objref_dump,
++ .validate = nft_objref_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+@@ -197,6 +227,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+ nf_tables_destroy_set(ctx, priv->set);
+ }
+
++static int nft_objref_map_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ const struct nft_objref_map *priv = nft_expr_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, priv->set->objtype);
++}
++
+ static const struct nft_expr_ops nft_objref_map_ops = {
+ .type = &nft_objref_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
+@@ -206,6 +244,7 @@ static const struct nft_expr_ops nft_objref_map_ops = {
+ .deactivate = nft_objref_map_deactivate,
+ .destroy = nft_objref_map_destroy,
+ .dump = nft_objref_map_dump,
++ .validate = nft_objref_map_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a7db21f6869a681c01500d6e561a89b497d2659c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:30 -0400
+Subject: nfsd: fix assignment of ia_ctime.tv_nsec on delegated mtime update
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 2990b5a47984c27873d165de9e88099deee95c8d ]
+
+The ia_ctime.tv_nsec field should be set to modify.nseconds.
+
+Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4xdr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index ea91bad4eee2c..1f3a20360d0c2 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -538,7 +538,7 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
+ iattr->ia_mtime.tv_sec = modify.seconds;
+ iattr->ia_mtime.tv_nsec = modify.nseconds;
+ iattr->ia_ctime.tv_sec = modify.seconds;
+- iattr->ia_ctime.tv_nsec = modify.seconds;
++ iattr->ia_ctime.tv_nsec = modify.nseconds;
+ iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1788b5a83f24258857a5be4057e67b6862407d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:35 -0400
+Subject: nfsd: fix SETATTR updates for delegated timestamps
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 3952f1cbcbc454b2cb639ddbf165c07068e90371 ]
+
+SETATTRs containing delegated timestamp updates are currently not being
+vetted properly. Since we no longer need to compare the timestamps vs.
+the current timestamps, move the vetting of delegated timestamps wholly
+into nfsd.
+
+Rename the set_cb_time() helper to nfsd4_vet_deleg_time(), and make it
+non-static. Add a new vet_deleg_attrs() helper that is called from
+nfsd4_setattr that uses nfsd4_vet_deleg_time() to properly validate the
+all the timestamps. If the validation indicates that the update should
+be skipped, unset the appropriate flags in ia_valid.
+
+Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 31 ++++++++++++++++++++++++++++++-
+ fs/nfsd/nfs4state.c | 24 +++++++++++-------------
+ fs/nfsd/state.h | 3 +++
+ 3 files changed, 44 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 71b428efcbb59..9bd49783db932 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1133,6 +1133,33 @@ nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)
+ exp_put(u->secinfo_no_name.sin_exp);
+ }
+
++/*
++ * Validate that the requested timestamps are within the acceptable range. If
++ * timestamp appears to be in the future, then it will be clamped to
++ * current_time().
++ */
++static void
++vet_deleg_attrs(struct nfsd4_setattr *setattr, struct nfs4_delegation *dp)
++{
++ struct timespec64 now = current_time(dp->dl_stid.sc_file->fi_inode);
++ struct iattr *iattr = &setattr->sa_iattr;
++
++ if ((setattr->sa_bmval[2] & FATTR4_WORD2_TIME_DELEG_ACCESS) &&
++ !nfsd4_vet_deleg_time(&iattr->ia_atime, &dp->dl_atime, &now))
++ iattr->ia_valid &= ~(ATTR_ATIME | ATTR_ATIME_SET);
++
++ if (setattr->sa_bmval[2] & FATTR4_WORD2_TIME_DELEG_MODIFY) {
++ if (nfsd4_vet_deleg_time(&iattr->ia_mtime, &dp->dl_mtime, &now)) {
++ iattr->ia_ctime = iattr->ia_mtime;
++ if (!nfsd4_vet_deleg_time(&iattr->ia_ctime, &dp->dl_ctime, &now))
++ iattr->ia_valid &= ~(ATTR_CTIME | ATTR_CTIME_SET);
++ } else {
++ iattr->ia_valid &= ~(ATTR_CTIME | ATTR_CTIME_SET |
++ ATTR_MTIME | ATTR_MTIME_SET);
++ }
++ }
++}
++
+ static __be32
+ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ union nfsd4_op_u *u)
+@@ -1170,8 +1197,10 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ struct nfs4_delegation *dp = delegstateid(st);
+
+ /* Only for *_ATTRS_DELEG flavors */
+- if (deleg_attrs_deleg(dp->dl_type))
++ if (deleg_attrs_deleg(dp->dl_type)) {
++ vet_deleg_attrs(setattr, dp);
+ status = nfs_ok;
++ }
+ }
+ }
+ if (st)
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 8737b721daf34..f2fd0cbe256b9 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -9135,25 +9135,25 @@ nfsd4_get_writestateid(struct nfsd4_compound_state *cstate,
+ }
+
+ /**
+- * set_cb_time - vet and set the timespec for a cb_getattr update
+- * @cb: timestamp from the CB_GETATTR response
++ * nfsd4_vet_deleg_time - vet and set the timespec for a delegated timestamp update
++ * @req: timestamp from the client
+ * @orig: original timestamp in the inode
+ * @now: current time
+ *
+- * Given a timestamp in a CB_GETATTR response, check it against the
++ * Given a timestamp from the client response, check it against the
+ * current timestamp in the inode and the current time. Returns true
+ * if the inode's timestamp needs to be updated, and false otherwise.
+- * @cb may also be changed if the timestamp needs to be clamped.
++ * @req may also be changed if the timestamp needs to be clamped.
+ */
+-static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,
+- const struct timespec64 *now)
++bool nfsd4_vet_deleg_time(struct timespec64 *req, const struct timespec64 *orig,
++ const struct timespec64 *now)
+ {
+
+ /*
+ * "When the time presented is before the original time, then the
+ * update is ignored." Also no need to update if there is no change.
+ */
+- if (timespec64_compare(cb, orig) <= 0)
++ if (timespec64_compare(req, orig) <= 0)
+ return false;
+
+ /*
+@@ -9161,10 +9161,8 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,
+ * clamp the new time to the current time, or it may
+ * return NFS4ERR_DELAY to the client, allowing it to retry."
+ */
+- if (timespec64_compare(cb, now) > 0) {
+- /* clamp it */
+- *cb = *now;
+- }
++ if (timespec64_compare(req, now) > 0)
++ *req = *now;
+
+ return true;
+ }
+@@ -9184,10 +9182,10 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation
+ attrs.ia_atime = ncf->ncf_cb_atime;
+ attrs.ia_mtime = ncf->ncf_cb_mtime;
+
+- if (set_cb_time(&attrs.ia_atime, &atime, &now))
++ if (nfsd4_vet_deleg_time(&attrs.ia_atime, &atime, &now))
+ attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
+
+- if (set_cb_time(&attrs.ia_mtime, &mtime, &now)) {
++ if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &mtime, &now)) {
+ attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET |
+ ATTR_MTIME | ATTR_MTIME_SET;
+ attrs.ia_ctime = attrs.ia_mtime;
+diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
+index ce7c0d129ba33..bf9436cdb93c5 100644
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -247,6 +247,9 @@ static inline bool deleg_attrs_deleg(u32 dl_type)
+ dl_type == OPEN_DELEGATE_WRITE_ATTRS_DELEG;
+ }
+
++bool nfsd4_vet_deleg_time(struct timespec64 *cb, const struct timespec64 *orig,
++ const struct timespec64 *now);
++
+ #define cb_to_delegation(cb) \
+ container_of(cb, struct nfs4_delegation, dl_recall)
+
+--
+2.51.0
+
--- /dev/null
+From 0409f114971ba06fa43f2a359836b43165293843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:36 -0400
+Subject: nfsd: fix timestamp updates in CB_GETATTR
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit b40b1ba37ad5b6099c426765c4bc327c08b390b9 ]
+
+When updating the local timestamps from CB_GETATTR, the updated values
+are not being properly vetted.
+
+Compare the update times vs. the saved times in the delegation rather
+than the current times in the inode. Also, ensure that the ctime is
+properly vetted vs. its original value.
+
+Fixes: 6ae30d6eb26b ("nfsd: add support for delegated timestamps")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index f2fd0cbe256b9..205ee8cc6fa2b 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -9175,20 +9175,19 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation
+ int ret;
+
+ if (deleg_attrs_deleg(dp->dl_type)) {
+- struct timespec64 atime = inode_get_atime(inode);
+- struct timespec64 mtime = inode_get_mtime(inode);
+ struct timespec64 now = current_time(inode);
+
+ attrs.ia_atime = ncf->ncf_cb_atime;
+ attrs.ia_mtime = ncf->ncf_cb_mtime;
+
+- if (nfsd4_vet_deleg_time(&attrs.ia_atime, &atime, &now))
++ if (nfsd4_vet_deleg_time(&attrs.ia_atime, &dp->dl_atime, &now))
+ attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
+
+- if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &mtime, &now)) {
+- attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET |
+- ATTR_MTIME | ATTR_MTIME_SET;
++ if (nfsd4_vet_deleg_time(&attrs.ia_mtime, &dp->dl_mtime, &now)) {
++ attrs.ia_valid |= ATTR_MTIME | ATTR_MTIME_SET;
+ attrs.ia_ctime = attrs.ia_mtime;
++ if (nfsd4_vet_deleg_time(&attrs.ia_ctime, &dp->dl_ctime, &now))
++ attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET;
+ }
+ } else {
+ attrs.ia_valid |= ATTR_MTIME | ATTR_CTIME;
+--
+2.51.0
+
--- /dev/null
+From 2c432d461e39d9f46588d0450a3800ae6d9ee19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:31 -0400
+Subject: nfsd: ignore ATTR_DELEG when checking ia_valid before notify_change()
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 5affb498e70bba3053b835c478a199bf92c99c4d ]
+
+If the only flag left is ATTR_DELEG, then there are no changes to be
+made.
+
+Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index edf050766e570..3cd3b9e069f4a 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -467,7 +467,7 @@ static int __nfsd_setattr(struct dentry *dentry, struct iattr *iap)
+ return 0;
+ }
+
+- if (!iap->ia_valid)
++ if ((iap->ia_valid & ~ATTR_DELEG) == 0)
+ return 0;
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 01273981a062a52723997c4c47ea3981b6c0ec0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:34 -0400
+Subject: nfsd: track original timestamps in nfs4_delegation
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 7663e963a51122792811811c8119fd55c9ab254a ]
+
+As Trond points out [1], the "original time" mentioned in RFC 9754
+refers to the timestamps on the files at the time that the delegation
+was granted, and not the current timestamp of the file on the server.
+
+Store the current timestamps for the file in the nfs4_delegation when
+granting one. Add STATX_ATIME and STATX_MTIME to the request mask in
+nfs4_delegation_stat(). When granting OPEN_DELEGATE_READ_ATTRS_DELEG, do
+a nfs4_delegation_stat() and save the correct atime. If the stat() fails
+for any reason, fall back to granting a normal read deleg.
+
+[1]: https://lore.kernel.org/linux-nfs/47a4e40310e797f21b5137e847b06bb203d99e66.camel@kernel.org/
+
+Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 11 ++++++++---
+ fs/nfsd/state.h | 5 +++++
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 77eea2ad93cc0..8737b721daf34 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -6157,7 +6157,8 @@ nfs4_delegation_stat(struct nfs4_delegation *dp, struct svc_fh *currentfh,
+ path.dentry = file_dentry(nf->nf_file);
+
+ rc = vfs_getattr(&path, stat,
+- (STATX_MODE | STATX_SIZE | STATX_CTIME | STATX_CHANGE_COOKIE),
++ STATX_MODE | STATX_SIZE | STATX_ATIME |
++ STATX_MTIME | STATX_CTIME | STATX_CHANGE_COOKIE,
+ AT_STATX_SYNC_AS_STAT);
+
+ nfsd_file_put(nf);
+@@ -6274,10 +6275,14 @@ nfs4_open_delegation(struct svc_rqst *rqstp, struct nfsd4_open *open,
+ OPEN_DELEGATE_WRITE;
+ dp->dl_cb_fattr.ncf_cur_fsize = stat.size;
+ dp->dl_cb_fattr.ncf_initial_cinfo = nfsd4_change_attribute(&stat);
++ dp->dl_atime = stat.atime;
++ dp->dl_ctime = stat.ctime;
++ dp->dl_mtime = stat.mtime;
+ trace_nfsd_deleg_write(&dp->dl_stid.sc_stateid);
+ } else {
+- open->op_delegate_type = deleg_ts ? OPEN_DELEGATE_READ_ATTRS_DELEG :
+- OPEN_DELEGATE_READ;
++ open->op_delegate_type = deleg_ts && nfs4_delegation_stat(dp, currentfh, &stat) ?
++ OPEN_DELEGATE_READ_ATTRS_DELEG : OPEN_DELEGATE_READ;
++ dp->dl_atime = stat.atime;
+ trace_nfsd_deleg_read(&dp->dl_stid.sc_stateid);
+ }
+ nfs4_put_stid(&dp->dl_stid);
+diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
+index 8adc2550129e6..ce7c0d129ba33 100644
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -224,6 +224,11 @@ struct nfs4_delegation {
+
+ /* for CB_GETATTR */
+ struct nfs4_cb_fattr dl_cb_fattr;
++
++ /* For delegated timestamps */
++ struct timespec64 dl_atime;
++ struct timespec64 dl_mtime;
++ struct timespec64 dl_ctime;
+ };
+
+ static inline bool deleg_is_read(u32 dl_type)
+--
+2.51.0
+
--- /dev/null
+From 2a70f1376dff02bc45258800afb3555c82e67202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:33 -0400
+Subject: nfsd: use ATTR_CTIME_SET for delegated ctime updates
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit c066ff58e5d6e5d7400e5fda0c33f95b8c37dd02 ]
+
+Ensure that notify_change() doesn't clobber a delegated ctime update
+with current_time() by setting ATTR_CTIME_SET for those updates.
+
+Don't bother setting the timestamps in cb_getattr_update_times() in the
+non-delegated case. notify_change() will do that itself.
+
+Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 6 +++---
+ fs/nfsd/nfs4xdr.c | 3 ++-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 88c347957da5b..77eea2ad93cc0 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -9167,7 +9167,6 @@ static bool set_cb_time(struct timespec64 *cb, const struct timespec64 *orig,
+ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation *dp)
+ {
+ struct inode *inode = d_inode(dentry);
+- struct timespec64 now = current_time(inode);
+ struct nfs4_cb_fattr *ncf = &dp->dl_cb_fattr;
+ struct iattr attrs = { };
+ int ret;
+@@ -9175,6 +9174,7 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation
+ if (deleg_attrs_deleg(dp->dl_type)) {
+ struct timespec64 atime = inode_get_atime(inode);
+ struct timespec64 mtime = inode_get_mtime(inode);
++ struct timespec64 now = current_time(inode);
+
+ attrs.ia_atime = ncf->ncf_cb_atime;
+ attrs.ia_mtime = ncf->ncf_cb_mtime;
+@@ -9183,12 +9183,12 @@ static int cb_getattr_update_times(struct dentry *dentry, struct nfs4_delegation
+ attrs.ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
+
+ if (set_cb_time(&attrs.ia_mtime, &mtime, &now)) {
+- attrs.ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET;
++ attrs.ia_valid |= ATTR_CTIME | ATTR_CTIME_SET |
++ ATTR_MTIME | ATTR_MTIME_SET;
+ attrs.ia_ctime = attrs.ia_mtime;
+ }
+ } else {
+ attrs.ia_valid |= ATTR_MTIME | ATTR_CTIME;
+- attrs.ia_mtime = attrs.ia_ctime = now;
+ }
+
+ if (!attrs.ia_valid)
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 1f3a20360d0c2..a00300b287754 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -539,7 +539,8 @@ nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
+ iattr->ia_mtime.tv_nsec = modify.nseconds;
+ iattr->ia_ctime.tv_sec = modify.seconds;
+ iattr->ia_ctime.tv_nsec = modify.nseconds;
+- iattr->ia_valid |= ATTR_CTIME | ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG;
++ iattr->ia_valid |= ATTR_CTIME | ATTR_CTIME_SET |
++ ATTR_MTIME | ATTR_MTIME_SET | ATTR_DELEG;
+ }
+
+ /* request sanity: did attrlist4 contain the expected number of words? */
+--
+2.51.0
+
--- /dev/null
+From af8c8c7934236b3aa89df66e094a8e1aecffb64c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:09 +0100
+Subject: perf arm_spe: Correct memory level for remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
+
+For remote accesses, the data source packet does not contain information
+about the memory level. To avoid misinformation, set the memory level to
+NA (Not Available).
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 8ecf7142dcd87..3086dad92965a 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -670,8 +670,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor
+ * socket
+ */
+ case ARM_SPE_COMMON_DS_REMOTE:
+- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+--
+2.51.0
+
--- /dev/null
+From 835dc3441e87287037cc064b4b631c757fc1d843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:08 +0100
+Subject: perf arm_spe: Correct setting remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
+
+Set the mem_remote field for a remote access to appropriately represent
+the event.
+
+Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 8942fa598a84f..8ecf7142dcd87 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -839,7 +839,7 @@ static void arm_spe__synth_memory_level(const struct arm_spe_record *record,
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ }
+
+ static bool arm_spe__synth_ds(struct arm_spe_queue *speq,
+--
+2.51.0
+
--- /dev/null
+From 199c7eb68a844773bb415ebbfdc2f808f55d508d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 22:35:49 -0700
+Subject: perf bpf-filter: Fix opts declaration on older libbpfs
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 3a0f56d72a7575f03187a85b7869c76a862b40ab ]
+
+Building perf with LIBBPF_DYNAMIC (ie not the default static linking of
+libbpf with perf) is breaking as the libbpf isn't version 1.7 or newer,
+where dont_enable is added to bpf_perf_event_opts.
+
+To avoid this breakage add a compile time version check and don't
+declare the variable when not present.
+
+Fixes: 5e2ac8e8571df54d ("perf bpf-filter: Enable events manually")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: bpf@vger.kernel.org
+Cc: Hao Ge <gehao@kylinos.cn>
+Cc: Ilya Leoshkevich <iii@linux.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-filter.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/perf/util/bpf-filter.c b/tools/perf/util/bpf-filter.c
+index a0b11f35395f8..92308c38fbb56 100644
+--- a/tools/perf/util/bpf-filter.c
++++ b/tools/perf/util/bpf-filter.c
+@@ -443,6 +443,10 @@ static int create_idx_hash(struct evsel *evsel, struct perf_bpf_filter_entry *en
+ return -1;
+ }
+
++#define LIBBPF_CURRENT_VERSION_GEQ(major, minor) \
++ (LIBBPF_MAJOR_VERSION > (major) || \
++ (LIBBPF_MAJOR_VERSION == (major) && LIBBPF_MINOR_VERSION >= (minor)))
++
+ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target)
+ {
+ int i, x, y, fd, ret;
+@@ -451,8 +455,12 @@ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target)
+ struct bpf_link *link;
+ struct perf_bpf_filter_entry *entry;
+ bool needs_idx_hash = !target__has_cpu(target);
++#if LIBBPF_CURRENT_VERSION_GEQ(1, 7)
+ DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts,
+ .dont_enable = true);
++#else
++ DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts);
++#endif
+
+ entry = calloc(MAX_FILTERS, sizeof(*entry));
+ if (entry == NULL)
+--
+2.51.0
+
--- /dev/null
+From f2c2b010394e2fbdf30c8df8446c9d156c45ac74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 11:12:28 -0700
+Subject: perf bpf_counter: Fix handling of cpumap fixing hybrid
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b91917c0c6fa6df97ec0222d8d6285ab2d60c21b ]
+
+Don't open evsels on all CPUs, open them just on the CPUs they
+support. This avoids opening say an e-core event on a p-core and
+getting a failure - achieve this by getting rid of the "all_cpu_map".
+
+In install_pe functions don't use the cpu_map_idx as a CPU number,
+translate the cpu_map_idx, which is a dense index into the cpu_map
+skipping holes at the beginning, to a proper CPU number.
+
+Before:
+```
+$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1
+
+ Performance counter stats for 'system wide':
+
+ <not supported> cpu_atom/cycles/
+ 566,270,672 cpu_core/cycles/
+ <not supported> cpu_atom/instructions/
+ 572,792,836 cpu_core/instructions/ # 1.01 insn per cycle
+
+ 1.001595384 seconds time elapsed
+```
+
+After:
+```
+$ perf stat --bpf-counters -a -e cycles,instructions -- sleep 1
+
+ Performance counter stats for 'system wide':
+
+ 443,299,201 cpu_atom/cycles/
+ 1,233,919,737 cpu_core/cycles/
+ 213,634,112 cpu_atom/instructions/ # 0.48 insn per cycle
+ 2,758,965,527 cpu_core/instructions/ # 2.24 insn per cycle
+
+ 1.001699485 seconds time elapsed
+```
+
+Fixes: 7fac83aaf2eecc9e ("perf stat: Introduce 'bperf' to share hardware PMCs with BPF")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: bpf@vger.kernel.org
+Cc: Gabriele Monaco <gmonaco@redhat.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Tengda Wu <wutengda@huaweicloud.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf_counter.c | 26 ++++++++++----------------
+ tools/perf/util/bpf_counter_cgroup.c | 3 ++-
+ 2 files changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c
+index 73fcafbffc6a6..ed88ba570c80a 100644
+--- a/tools/perf/util/bpf_counter.c
++++ b/tools/perf/util/bpf_counter.c
+@@ -278,6 +278,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idx
+ {
+ struct bpf_prog_profiler_bpf *skel;
+ struct bpf_counter *counter;
++ int cpu = perf_cpu_map__cpu(evsel->core.cpus, cpu_map_idx).cpu;
+ int ret;
+
+ list_for_each_entry(counter, &evsel->bpf_counter_list, list) {
+@@ -285,7 +286,7 @@ static int bpf_program_profiler__install_pe(struct evsel *evsel, int cpu_map_idx
+ assert(skel != NULL);
+
+ ret = bpf_map_update_elem(bpf_map__fd(skel->maps.events),
+- &cpu_map_idx, &fd, BPF_ANY);
++ &cpu, &fd, BPF_ANY);
+ if (ret)
+ return ret;
+ }
+@@ -393,7 +394,6 @@ static int bperf_check_target(struct evsel *evsel,
+ return 0;
+ }
+
+-static struct perf_cpu_map *all_cpu_map;
+ static __u32 filter_entry_cnt;
+
+ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,
+@@ -437,7 +437,7 @@ static int bperf_reload_leader_program(struct evsel *evsel, int attr_map_fd,
+ * following evsel__open_per_cpu call
+ */
+ evsel->leader_skel = skel;
+- evsel__open_per_cpu(evsel, all_cpu_map, -1);
++ evsel__open(evsel, evsel->core.cpus, evsel->core.threads);
+
+ out:
+ bperf_leader_bpf__destroy(skel);
+@@ -475,12 +475,6 @@ static int bperf__load(struct evsel *evsel, struct target *target)
+ if (bperf_check_target(evsel, target, &filter_type, &filter_entry_cnt))
+ return -1;
+
+- if (!all_cpu_map) {
+- all_cpu_map = perf_cpu_map__new_online_cpus();
+- if (!all_cpu_map)
+- return -1;
+- }
+-
+ evsel->bperf_leader_prog_fd = -1;
+ evsel->bperf_leader_link_fd = -1;
+
+@@ -598,9 +592,10 @@ static int bperf__load(struct evsel *evsel, struct target *target)
+ static int bperf__install_pe(struct evsel *evsel, int cpu_map_idx, int fd)
+ {
+ struct bperf_leader_bpf *skel = evsel->leader_skel;
++ int cpu = perf_cpu_map__cpu(evsel->core.cpus, cpu_map_idx).cpu;
+
+ return bpf_map_update_elem(bpf_map__fd(skel->maps.events),
+- &cpu_map_idx, &fd, BPF_ANY);
++ &cpu, &fd, BPF_ANY);
+ }
+
+ /*
+@@ -609,13 +604,12 @@ static int bperf__install_pe(struct evsel *evsel, int cpu_map_idx, int fd)
+ */
+ static int bperf_sync_counters(struct evsel *evsel)
+ {
+- int num_cpu, i, cpu;
++ struct perf_cpu cpu;
++ int idx;
++
++ perf_cpu_map__for_each_cpu(cpu, idx, evsel->core.cpus)
++ bperf_trigger_reading(evsel->bperf_leader_prog_fd, cpu.cpu);
+
+- num_cpu = perf_cpu_map__nr(all_cpu_map);
+- for (i = 0; i < num_cpu; i++) {
+- cpu = perf_cpu_map__cpu(all_cpu_map, i).cpu;
+- bperf_trigger_reading(evsel->bperf_leader_prog_fd, cpu);
+- }
+ return 0;
+ }
+
+diff --git a/tools/perf/util/bpf_counter_cgroup.c b/tools/perf/util/bpf_counter_cgroup.c
+index 6ff42619de12b..883ce8a670bcd 100644
+--- a/tools/perf/util/bpf_counter_cgroup.c
++++ b/tools/perf/util/bpf_counter_cgroup.c
+@@ -185,7 +185,8 @@ static int bperf_cgrp__load(struct evsel *evsel,
+ }
+
+ static int bperf_cgrp__install_pe(struct evsel *evsel __maybe_unused,
+- int cpu __maybe_unused, int fd __maybe_unused)
++ int cpu_map_idx __maybe_unused,
++ int fd __maybe_unused)
+ {
+ /* nothing to do */
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 6d543dcaa8625b4443d3cb732032d41766749c9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:24:16 -0700
+Subject: perf build-id: Ensure snprintf string is empty when size is 0
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 0dc96cae063cbf9ebf6631b33b08e9ba02324248 ]
+
+The string result of build_id__snprintf() is unconditionally used in
+places like dsos__fprintf_buildid_cb(). If the build id has size 0 then
+this creates a use of uninitialized memory. Add null termination for the
+size 0 case.
+
+A similar fix was written by Jiri Olsa in commit 6311951d4f8f28c4 ("perf
+tools: Initialize output buffer in build_id__sprintf") but lost in the
+transition to snprintf.
+
+Fixes: fccaaf6fbbc59910 ("perf build-id: Change sprintf functions to snprintf")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/build-id.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
+index bf7f3268b9a2f..35505a1ffd111 100644
+--- a/tools/perf/util/build-id.c
++++ b/tools/perf/util/build-id.c
+@@ -86,6 +86,13 @@ int build_id__snprintf(const struct build_id *build_id, char *bf, size_t bf_size
+ {
+ size_t offs = 0;
+
++ if (build_id->size == 0) {
++ /* Ensure bf is always \0 terminated. */
++ if (bf_size > 0)
++ bf[0] = '\0';
++ return 0;
++ }
++
+ for (size_t i = 0; i < build_id->size && offs < bf_size; ++i)
+ offs += snprintf(bf + offs, bf_size - offs, "%02x", build_id->data[i]);
+
+--
+2.51.0
+
--- /dev/null
+From f0593c7524ab17e88e97dab8b7dd69547ae7a07a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:57:15 +0200
+Subject: perf: Completely remove possibility to override MAX_NR_CPUS
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 6f8fb022ef2c6694e47f6e2f5676eb63be66c208 ]
+
+Commit 21b8732eb447 ("perf tools: Allow overriding MAX_NR_CPUS at
+compile time") added the capability to override MAX_NR_CPUS. At
+that time it was necessary to reduce the huge amount of RAM used
+by static stats variables.
+
+But this has been unnecessary since commit 6a1e2c5c2673 ("perf stat:
+Remove a set of shadow stats static variables"), and
+commit e8399d34d568 ("libperf cpumap: Hide/reduce scope of
+MAX_NR_CPUS") broke the build in that case because it failed to
+add the guard around the new definition of MAX_NR_CPUS.
+
+So cleanup things and remove guards completely to officialise it
+is not necessary anymore to override MAX_NR_CPUS.
+
+Fixes: e8399d34d568d61c ("libperf cpumap: Hide/reduce scope of MAX_NR_CPUS")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Leo Yan <leo.yan@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/all/8c8553387ebf904a9e5a93eaf643cb01164d9fb3.1736188471.git.christophe.leroy@csgroup.eu/
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/perf.h | 2 --
+ tools/perf/util/bpf_skel/kwork_top.bpf.c | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/tools/perf/perf.h b/tools/perf/perf.h
+index 3cb40965549f5..e004178472d9e 100644
+--- a/tools/perf/perf.h
++++ b/tools/perf/perf.h
+@@ -2,9 +2,7 @@
+ #ifndef _PERF_PERF_H
+ #define _PERF_PERF_H
+
+-#ifndef MAX_NR_CPUS
+ #define MAX_NR_CPUS 4096
+-#endif
+
+ enum perf_affinity {
+ PERF_AFFINITY_SYS = 0,
+diff --git a/tools/perf/util/bpf_skel/kwork_top.bpf.c b/tools/perf/util/bpf_skel/kwork_top.bpf.c
+index 73e32e0630301..6673386302e2f 100644
+--- a/tools/perf/util/bpf_skel/kwork_top.bpf.c
++++ b/tools/perf/util/bpf_skel/kwork_top.bpf.c
+@@ -18,9 +18,7 @@ enum kwork_class_type {
+ };
+
+ #define MAX_ENTRIES 102400
+-#ifndef MAX_NR_CPUS
+ #define MAX_NR_CPUS 4096
+-#endif
+ #define PF_KTHREAD 0x00200000
+ #define MAX_COMMAND_LEN 16
+
+--
+2.51.0
+
--- /dev/null
+From a98cfdc4be5abf41993016f6cbdb6242d76f23f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:15 -0700
+Subject: perf disasm: Avoid undefined behavior in incrementing NULL
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 78d853512d6f979cf0cc41566e4f6cd82995ff34 ]
+
+Incrementing NULL is undefined behavior and triggers ubsan during the
+perf annotate test.
+
+Split a compound statement over two lines to avoid this.
+
+Fixes: 98f69a573c668a18 ("perf annotate: Split out util/disasm.c")
+Reviewed-by: Collin Funk <collin.funk1@gmail.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/disasm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
+index b1e4919d016f1..e257bd918c891 100644
+--- a/tools/perf/util/disasm.c
++++ b/tools/perf/util/disasm.c
+@@ -390,13 +390,16 @@ static int jump__parse(struct arch *arch, struct ins_operands *ops, struct map_s
+ * skip over possible up to 2 operands to get to address, e.g.:
+ * tbnz w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
+ */
+- if (c++ != NULL) {
++ if (c != NULL) {
++ c++;
+ ops->target.addr = strtoull(c, NULL, 16);
+ if (!ops->target.addr) {
+ c = strchr(c, ',');
+ c = validate_comma(c, ops);
+- if (c++ != NULL)
++ if (c != NULL) {
++ c++;
+ ops->target.addr = strtoull(c, NULL, 16);
++ }
+ }
+ } else {
+ ops->target.addr = strtoull(ops->raw, NULL, 16);
+--
+2.51.0
+
--- /dev/null
+From d6d0d092a923936e3c12b01eb555daadefa80040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:52:03 +0800
+Subject: perf drm_pmu: Fix fd_dir leaks in for_each_drm_fdinfo_in_dir()
+
+From: GuoHan Zhao <zhaoguohan@kylinos.cn>
+
+[ Upstream commit baa03483fdf3545f2b223a4ca775e1938d956284 ]
+
+Fix file descriptor leak when callback function returns error. The
+function was directly returning without closing fdinfo_dir_fd and
+fd_dir when cb() returned non-zero value.
+
+Fixes: 28917cb17f9df9c2 ("perf drm_pmu: Add a tool like PMU to expose DRM information")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Markus Elfring <Markus.Elfring@web.de>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250908065203.22187-1-zhaoguohan@kylinos.cn
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/drm_pmu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/drm_pmu.c b/tools/perf/util/drm_pmu.c
+index 988890f37ba7a..98d4d2b556d4e 100644
+--- a/tools/perf/util/drm_pmu.c
++++ b/tools/perf/util/drm_pmu.c
+@@ -458,8 +458,10 @@ static int for_each_drm_fdinfo_in_dir(int (*cb)(void *args, int fdinfo_dir_fd, c
+ }
+ ret = cb(args, fdinfo_dir_fd, fd_entry->d_name);
+ if (ret)
+- return ret;
++ goto close_fdinfo;
+ }
++
++close_fdinfo:
+ if (fdinfo_dir_fd != -1)
+ close(fdinfo_dir_fd);
+ closedir(fd_dir);
+--
+2.51.0
+
--- /dev/null
+From aee6f9c13327649a3804ce8f622b4f4d512a6ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:17 -0700
+Subject: perf evsel: Avoid container_of on a NULL leader
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
+
+An evsel should typically have a leader of itself, however, in tests
+like 'Sample parsing' a NULL leader may occur and the container_of
+will return a corrupt pointer.
+
+Avoid this with an explicit NULL test.
+
+Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index d264c143b5925..496f42434327b 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3935,6 +3935,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)
+
+ struct evsel *evsel__leader(const struct evsel *evsel)
+ {
++ if (evsel->core.leader == NULL)
++ return NULL;
+ return container_of(evsel->core.leader, struct evsel, core);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7be5c141c881a52c1ed1948e153a326eb0cf7bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:24:15 -0700
+Subject: perf evsel: Ensure the fallback message is always written to
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
+
+The fallback message is unconditionally printed in places like
+record__open().
+
+If no fallback is attempted this can lead to printing uninitialized
+data, crashes, etc.
+
+Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 9c086d743d344..5df59812b80ca 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3562,7 +3562,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+
+ /* If event has exclude user then don't exclude kernel. */
+ if (evsel->core.attr.exclude_user)
+- return false;
++ goto no_fallback;
+
+ /* Is there already the separator in the name. */
+ if (strchr(name, '/') ||
+@@ -3570,7 +3570,7 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+ sep = "";
+
+ if (asprintf(&new_name, "%s%su", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+@@ -3593,17 +3593,19 @@ bool evsel__fallback(struct evsel *evsel, struct target *target, int err,
+ sep = "";
+
+ if (asprintf(&new_name, "%s%sH", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+ /* Apple M1 requires exclude_guest */
+- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples");
++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples");
+ evsel->core.attr.exclude_guest = 1;
+
+ return true;
+ }
+-
++no_fallback:
++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d",
++ evsel__name(evsel), err);
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 20dbd1e1987c837e5d4b13aa76b57b2d90d20744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:01 -0700
+Subject: perf evsel: Fix uniquification when PMU given without suffix
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 693101792e45eefc888c7ba10b91108047399f5d ]
+
+The PMU name is appearing twice in:
+```
+$ perf stat -e uncore_imc_free_running/data_total/ -A true
+
+ Performance counter stats for 'system wide':
+
+CPU0 1.57 MiB uncore_imc_free_running_0/uncore_imc_free_running,data_total/
+CPU0 1.58 MiB uncore_imc_free_running_1/uncore_imc_free_running,data_total/
+ 0.000892376 seconds time elapsed
+```
+
+Use the pmu_name_len_no_suffix to avoid this problem.
+
+Committer testing:
+
+After this patch:
+
+ root@x1:~# perf stat -e uncore_imc_free_running/data_total/ -A true
+
+ Performance counter stats for 'system wide':
+
+ CPU0 1.69 MiB uncore_imc_free_running_0/data_total/
+ CPU0 1.68 MiB uncore_imc_free_running_1/data_total/
+
+ 0.002141605 seconds time elapsed
+
+ root@x1:~#
+
+Fixes: 7d45f402d3117e0b ("perf evlist: Make uniquifying counter names consistent")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 496f42434327b..9c086d743d344 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -4050,9 +4050,9 @@ bool evsel__set_needs_uniquify(struct evsel *counter, const struct perf_stat_con
+
+ void evsel__uniquify_counter(struct evsel *counter)
+ {
+- const char *name, *pmu_name;
+- char *new_name, *config;
+- int ret;
++ const char *name, *pmu_name, *config;
++ char *new_name;
++ int len, ret;
+
+ /* No uniquification necessary. */
+ if (!counter->needs_uniquify)
+@@ -4066,15 +4066,23 @@ void evsel__uniquify_counter(struct evsel *counter)
+ counter->uniquified_name = true;
+
+ name = evsel__name(counter);
++ config = strchr(name, '/');
+ pmu_name = counter->pmu->name;
+- /* Already prefixed by the PMU name. */
+- if (!strncmp(name, pmu_name, strlen(pmu_name)))
+- return;
+
+- config = strchr(name, '/');
+- if (config) {
+- int len = config - name;
++ /* Already prefixed by the PMU name? */
++ len = pmu_name_len_no_suffix(pmu_name);
++
++ if (!strncmp(name, pmu_name, len)) {
++ /*
++ * If the PMU name is there, then there is no sense in not
++ * having a slash. Do this for robustness.
++ */
++ if (config == NULL)
++ config = name - 1;
+
++ ret = asprintf(&new_name, "%s/%s", pmu_name, config + 1);
++ } else if (config) {
++ len = config - name;
+ if (config[1] == '/') {
+ /* case: event// */
+ ret = asprintf(&new_name, "%s/%.*s/%s", pmu_name, len, name, config + 2);
+@@ -4086,7 +4094,7 @@ void evsel__uniquify_counter(struct evsel *counter)
+ config = strchr(name, ':');
+ if (config) {
+ /* case: event:.. */
+- int len = config - name;
++ len = config - name;
+
+ ret = asprintf(&new_name, "%s/%.*s/%s", pmu_name, len, name, config + 1);
+ } else {
+--
+2.51.0
+
--- /dev/null
+From 3b0d6e523e8139de16f76adecbed9894a34ffb6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 12:03:57 -0700
+Subject: perf parse-events: Handle fake PMUs in CPU terms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 1a461a62fb422db9cf870a4f184885cc69873b7f ]
+
+The "Parsing of PMU event table metrics with fake PMUs" will test
+metrics on machines/models that may be missing a PMU, in such a case
+the fake_pmu should be used to avoid errors.
+
+Metrics that get the cpumask from a different PMU, such as
+"tsc/cpu=cpu_atom/", also need to be resilient in this test.
+
+The parse_events_state fake_pmu is set when missing PMUs should be
+ignored.
+
+So that it can be queried, pass it to the config term functions, as well
+as to get_config_cpu, then ignore failures when fake_pmu is set.
+
+Some minor code refactoring to cut down on the indent and remove some
+redundant checks.
+
+Fixes: bd741d80dc65922c ("perf parse-events: Allow the cpu term to be a PMU or CPU range")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andreas Färber <afaerber@suse.de>
+Cc: Caleb Biggers <caleb.biggers@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: linux-actions@lists.infradead.org
+Cc: Manivannan Sadhasivam <mani@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Falcon <thomas.falcon@intel.com>
+Cc: Weilin Wang <weilin.wang@intel.com>
+Link: https://lore.kernel.org/r/20250818190416.145274-2-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-events.c | 116 +++++++++++++++++----------------
+ 1 file changed, 60 insertions(+), 56 deletions(-)
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 8282ddf68b983..0026cff4d69e4 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -126,7 +126,8 @@ static char *get_config_name(const struct parse_events_terms *head_terms)
+ return get_config_str(head_terms, PARSE_EVENTS__TERM_TYPE_NAME);
+ }
+
+-static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head_terms)
++static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head_terms,
++ bool fake_pmu)
+ {
+ struct parse_events_term *term;
+ struct perf_cpu_map *cpus = NULL;
+@@ -135,24 +136,33 @@ static struct perf_cpu_map *get_config_cpu(const struct parse_events_terms *head
+ return NULL;
+
+ list_for_each_entry(term, &head_terms->terms, list) {
+- if (term->type_term == PARSE_EVENTS__TERM_TYPE_CPU) {
+- struct perf_cpu_map *term_cpus;
++ struct perf_cpu_map *term_cpus;
+
+- if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
+- term_cpus = perf_cpu_map__new_int(term->val.num);
++ if (term->type_term != PARSE_EVENTS__TERM_TYPE_CPU)
++ continue;
++
++ if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
++ term_cpus = perf_cpu_map__new_int(term->val.num);
++ } else {
++ struct perf_pmu *pmu = perf_pmus__find(term->val.str);
++
++ if (pmu) {
++ term_cpus = pmu->is_core && perf_cpu_map__is_empty(pmu->cpus)
++ ? cpu_map__online()
++ : perf_cpu_map__get(pmu->cpus);
+ } else {
+- struct perf_pmu *pmu = perf_pmus__find(term->val.str);
+-
+- if (pmu && perf_cpu_map__is_empty(pmu->cpus))
+- term_cpus = pmu->is_core ? cpu_map__online() : NULL;
+- else if (pmu)
+- term_cpus = perf_cpu_map__get(pmu->cpus);
+- else
+- term_cpus = perf_cpu_map__new(term->val.str);
++ term_cpus = perf_cpu_map__new(term->val.str);
++ if (!term_cpus && fake_pmu) {
++ /*
++ * Assume the PMU string makes sense on a different
++ * machine and fake a value with all online CPUs.
++ */
++ term_cpus = cpu_map__online();
++ }
+ }
+- perf_cpu_map__merge(&cpus, term_cpus);
+- perf_cpu_map__put(term_cpus);
+ }
++ perf_cpu_map__merge(&cpus, term_cpus);
++ perf_cpu_map__put(term_cpus);
+ }
+
+ return cpus;
+@@ -369,13 +379,13 @@ static int parse_aliases(const char *str, const char *const names[][EVSEL__MAX_A
+
+ typedef int config_term_func_t(struct perf_event_attr *attr,
+ struct parse_events_term *term,
+- struct parse_events_error *err);
++ struct parse_events_state *parse_state);
+ static int config_term_common(struct perf_event_attr *attr,
+ struct parse_events_term *term,
+- struct parse_events_error *err);
++ struct parse_events_state *parse_state);
+ static int config_attr(struct perf_event_attr *attr,
+ const struct parse_events_terms *head,
+- struct parse_events_error *err,
++ struct parse_events_state *parse_state,
+ config_term_func_t config_term);
+
+ /**
+@@ -471,7 +481,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name,
+ bool found_supported = false;
+ const char *config_name = get_config_name(parsed_terms);
+ const char *metric_id = get_config_metric_id(parsed_terms);
+- struct perf_cpu_map *cpus = get_config_cpu(parsed_terms);
++ struct perf_cpu_map *cpus = get_config_cpu(parsed_terms, parse_state->fake_pmu);
+ int ret = 0;
+ struct evsel *first_wildcard_match = NULL;
+
+@@ -514,8 +524,7 @@ int parse_events_add_cache(struct list_head *list, int *idx, const char *name,
+ found_supported = true;
+
+ if (parsed_terms) {
+- if (config_attr(&attr, parsed_terms, parse_state->error,
+- config_term_common)) {
++ if (config_attr(&attr, parsed_terms, parse_state, config_term_common)) {
+ ret = -EINVAL;
+ goto out_err;
+ }
+@@ -767,8 +776,7 @@ int parse_events_add_breakpoint(struct parse_events_state *parse_state,
+ attr.sample_period = 1;
+
+ if (head_config) {
+- if (config_attr(&attr, head_config, parse_state->error,
+- config_term_common))
++ if (config_attr(&attr, head_config, parse_state, config_term_common))
+ return -EINVAL;
+
+ if (get_config_terms(head_config, &config_terms))
+@@ -903,12 +911,12 @@ void parse_events__shrink_config_terms(void)
+
+ static int config_term_common(struct perf_event_attr *attr,
+ struct parse_events_term *term,
+- struct parse_events_error *err)
++ struct parse_events_state *parse_state)
+ {
+-#define CHECK_TYPE_VAL(type) \
+-do { \
+- if (check_type_val(term, err, PARSE_EVENTS__TERM_TYPE_ ## type)) \
+- return -EINVAL; \
++#define CHECK_TYPE_VAL(type) \
++do { \
++ if (check_type_val(term, parse_state->error, PARSE_EVENTS__TERM_TYPE_ ## type)) \
++ return -EINVAL; \
+ } while (0)
+
+ switch (term->type_term) {
+@@ -939,7 +947,7 @@ do { \
+ if (strcmp(term->val.str, "no") &&
+ parse_branch_str(term->val.str,
+ &attr->branch_sample_type)) {
+- parse_events_error__handle(err, term->err_val,
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("invalid branch sample type"),
+ NULL);
+ return -EINVAL;
+@@ -948,7 +956,7 @@ do { \
+ case PARSE_EVENTS__TERM_TYPE_TIME:
+ CHECK_TYPE_VAL(NUM);
+ if (term->val.num > 1) {
+- parse_events_error__handle(err, term->err_val,
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("expected 0 or 1"),
+ NULL);
+ return -EINVAL;
+@@ -990,7 +998,7 @@ do { \
+ case PARSE_EVENTS__TERM_TYPE_PERCORE:
+ CHECK_TYPE_VAL(NUM);
+ if ((unsigned int)term->val.num > 1) {
+- parse_events_error__handle(err, term->err_val,
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("expected 0 or 1"),
+ NULL);
+ return -EINVAL;
+@@ -1005,7 +1013,7 @@ do { \
+ case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE:
+ CHECK_TYPE_VAL(NUM);
+ if (term->val.num > UINT_MAX) {
+- parse_events_error__handle(err, term->err_val,
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("too big"),
+ NULL);
+ return -EINVAL;
+@@ -1016,7 +1024,7 @@ do { \
+
+ if (term->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
+ if (term->val.num >= (u64)cpu__max_present_cpu().cpu) {
+- parse_events_error__handle(err, term->err_val,
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("too big"),
+ /*help=*/NULL);
+ return -EINVAL;
+@@ -1028,8 +1036,8 @@ do { \
+ break;
+
+ map = perf_cpu_map__new(term->val.str);
+- if (!map) {
+- parse_events_error__handle(err, term->err_val,
++ if (!map && !parse_state->fake_pmu) {
++ parse_events_error__handle(parse_state->error, term->err_val,
+ strdup("not a valid PMU or CPU number"),
+ /*help=*/NULL);
+ return -EINVAL;
+@@ -1042,7 +1050,7 @@ do { \
+ case PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE:
+ case PARSE_EVENTS__TERM_TYPE_HARDWARE:
+ default:
+- parse_events_error__handle(err, term->err_term,
++ parse_events_error__handle(parse_state->error, term->err_term,
+ strdup(parse_events__term_type_str(term->type_term)),
+ parse_events_formats_error_string(NULL));
+ return -EINVAL;
+@@ -1057,7 +1065,7 @@ do { \
+ * if an invalid config term is provided for legacy events
+ * (for example, instructions/badterm/...), which is confusing.
+ */
+- if (!config_term_avail(term->type_term, err))
++ if (!config_term_avail(term->type_term, parse_state->error))
+ return -EINVAL;
+ return 0;
+ #undef CHECK_TYPE_VAL
+@@ -1065,7 +1073,7 @@ do { \
+
+ static int config_term_pmu(struct perf_event_attr *attr,
+ struct parse_events_term *term,
+- struct parse_events_error *err)
++ struct parse_events_state *parse_state)
+ {
+ if (term->type_term == PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE) {
+ struct perf_pmu *pmu = perf_pmus__find_by_type(attr->type);
+@@ -1074,7 +1082,7 @@ static int config_term_pmu(struct perf_event_attr *attr,
+ char *err_str;
+
+ if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0)
+- parse_events_error__handle(err, term->err_term,
++ parse_events_error__handle(parse_state->error, term->err_term,
+ err_str, /*help=*/NULL);
+ return -EINVAL;
+ }
+@@ -1100,7 +1108,7 @@ static int config_term_pmu(struct perf_event_attr *attr,
+ char *err_str;
+
+ if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0)
+- parse_events_error__handle(err, term->err_term,
++ parse_events_error__handle(parse_state->error, term->err_term,
+ err_str, /*help=*/NULL);
+ return -EINVAL;
+ }
+@@ -1128,12 +1136,12 @@ static int config_term_pmu(struct perf_event_attr *attr,
+ */
+ return 0;
+ }
+- return config_term_common(attr, term, err);
++ return config_term_common(attr, term, parse_state);
+ }
+
+ static int config_term_tracepoint(struct perf_event_attr *attr,
+ struct parse_events_term *term,
+- struct parse_events_error *err)
++ struct parse_events_state *parse_state)
+ {
+ switch (term->type_term) {
+ case PARSE_EVENTS__TERM_TYPE_CALLGRAPH:
+@@ -1147,7 +1155,7 @@ static int config_term_tracepoint(struct perf_event_attr *attr,
+ case PARSE_EVENTS__TERM_TYPE_AUX_OUTPUT:
+ case PARSE_EVENTS__TERM_TYPE_AUX_ACTION:
+ case PARSE_EVENTS__TERM_TYPE_AUX_SAMPLE_SIZE:
+- return config_term_common(attr, term, err);
++ return config_term_common(attr, term, parse_state);
+ case PARSE_EVENTS__TERM_TYPE_USER:
+ case PARSE_EVENTS__TERM_TYPE_CONFIG:
+ case PARSE_EVENTS__TERM_TYPE_CONFIG1:
+@@ -1166,12 +1174,10 @@ static int config_term_tracepoint(struct perf_event_attr *attr,
+ case PARSE_EVENTS__TERM_TYPE_HARDWARE:
+ case PARSE_EVENTS__TERM_TYPE_CPU:
+ default:
+- if (err) {
+- parse_events_error__handle(err, term->err_term,
++ parse_events_error__handle(parse_state->error, term->err_term,
+ strdup(parse_events__term_type_str(term->type_term)),
+ strdup("valid terms: call-graph,stack-size\n")
+ );
+- }
+ return -EINVAL;
+ }
+
+@@ -1180,13 +1186,13 @@ static int config_term_tracepoint(struct perf_event_attr *attr,
+
+ static int config_attr(struct perf_event_attr *attr,
+ const struct parse_events_terms *head,
+- struct parse_events_error *err,
++ struct parse_events_state *parse_state,
+ config_term_func_t config_term)
+ {
+ struct parse_events_term *term;
+
+ list_for_each_entry(term, &head->terms, list)
+- if (config_term(attr, term, err))
++ if (config_term(attr, term, parse_state))
+ return -EINVAL;
+
+ return 0;
+@@ -1378,8 +1384,7 @@ int parse_events_add_tracepoint(struct parse_events_state *parse_state,
+ if (head_config) {
+ struct perf_event_attr attr;
+
+- if (config_attr(&attr, head_config, err,
+- config_term_tracepoint))
++ if (config_attr(&attr, head_config, parse_state, config_term_tracepoint))
+ return -EINVAL;
+ }
+
+@@ -1408,8 +1413,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state,
+ }
+
+ if (head_config) {
+- if (config_attr(&attr, head_config, parse_state->error,
+- config_term_common))
++ if (config_attr(&attr, head_config, parse_state, config_term_common))
+ return -EINVAL;
+
+ if (get_config_terms(head_config, &config_terms))
+@@ -1418,7 +1422,7 @@ static int __parse_events_add_numeric(struct parse_events_state *parse_state,
+
+ name = get_config_name(head_config);
+ metric_id = get_config_metric_id(head_config);
+- cpus = get_config_cpu(head_config);
++ cpus = get_config_cpu(head_config, parse_state->fake_pmu);
+ ret = __add_event(list, &parse_state->idx, &attr, /*init_attr*/true, name,
+ metric_id, pmu, &config_terms, first_wildcard_match,
+ cpus, /*alternate_hw_config=*/PERF_COUNT_HW_MAX) ? 0 : -ENOMEM;
+@@ -1531,7 +1535,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,
+ fix_raw(&parsed_terms, pmu);
+
+ /* Configure attr/terms with a known PMU, this will set hardcoded terms. */
+- if (config_attr(&attr, &parsed_terms, parse_state->error, config_term_pmu)) {
++ if (config_attr(&attr, &parsed_terms, parse_state, config_term_pmu)) {
+ parse_events_terms__exit(&parsed_terms);
+ return -EINVAL;
+ }
+@@ -1555,7 +1559,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,
+
+ /* Configure attr/terms again if an alias was expanded. */
+ if (alias_rewrote_terms &&
+- config_attr(&attr, &parsed_terms, parse_state->error, config_term_pmu)) {
++ config_attr(&attr, &parsed_terms, parse_state, config_term_pmu)) {
+ parse_events_terms__exit(&parsed_terms);
+ return -EINVAL;
+ }
+@@ -1583,7 +1587,7 @@ static int parse_events_add_pmu(struct parse_events_state *parse_state,
+ return -EINVAL;
+ }
+
+- term_cpu = get_config_cpu(&parsed_terms);
++ term_cpu = get_config_cpu(&parsed_terms, parse_state->fake_pmu);
+ evsel = __add_event(list, &parse_state->idx, &attr, /*init_attr=*/true,
+ get_config_name(&parsed_terms),
+ get_config_metric_id(&parsed_terms), pmu,
+--
+2.51.0
+
--- /dev/null
+From 427c051a621e097868476e43dc5b3d77b451b5e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:24 +0100
+Subject: perf python: split Clang options when invoking Popen
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
+
+When passing a list to subprocess.Popen, each element maps to one argv
+token. Current code bundles multiple Clang flags into a single element,
+something like:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+So Clang only sees one long, invalid option instead of separate flags,
+as a result, the script cannot capture any log via PIPE.
+
+Fix this by using shlex.split() to separate the string so each option
+becomes its own argv element. The fixed list will be:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu',
+ '-fintegrated-as',
+ '-Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/setup.py | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
+index dd289d15acfd6..9cae2c472f4ad 100644
+--- a/tools/perf/util/setup.py
++++ b/tools/perf/util/setup.py
+@@ -1,6 +1,7 @@
+ from os import getenv, path
+ from subprocess import Popen, PIPE
+ from re import sub
++import shlex
+
+ cc = getenv("CC")
+ assert cc, "Environment variable CC not set"
+@@ -22,7 +23,9 @@ assert srctree, "Environment variable srctree, for the Linux sources, not set"
+ src_feature_tests = f'{srctree}/tools/build/feature'
+
+ def clang_has_option(option):
+- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines()
++ cmd = shlex.split(f"{cc} {cc_options} {option}")
++ cmd.append(path.join(src_feature_tests, "test-hello.c"))
++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines()
+ return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ]
+
+ if cc_is_clang:
+--
+2.51.0
+
--- /dev/null
+From 3d1d5a69fbba6a65f0b10e2e6770a89d39d80744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 26ae078278cd6..09af486c83e4f 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1402,7 +1402,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ const struct perf_tool *tool = session->tool;
+ struct perf_sample sample;
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ perf_sample__init(&sample, /*all=*/true);
+ if ((event->header.type != PERF_RECORD_COMPRESSED &&
+--
+2.51.0
+
--- /dev/null
+From ac37644019c00b6eb5cbf74392589aac2295f608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 17:03:50 -0700
+Subject: perf test: AMD IBS swfilt skip kernel tests if paranoia is >1
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2e3501212293c5005873c6ca6bb4f963a7eec442 ]
+
+If not root and the perf_event_paranoid is set >1 swfilt will fail to
+open the event failing the test. Add check to skip the test in that
+case.
+
+Fixes: 0e71bcdcf1f0b10b ("perf test: Add AMD IBS sw filter test")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Link: https://lore.kernel.org/r/20250913000350.1306948-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/amd-ibs-swfilt.sh | 51 ++++++++++++++++++------
+ 1 file changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/tools/perf/tests/shell/amd-ibs-swfilt.sh b/tools/perf/tests/shell/amd-ibs-swfilt.sh
+index 7045ec72ba4cf..e7f66df05c4b1 100755
+--- a/tools/perf/tests/shell/amd-ibs-swfilt.sh
++++ b/tools/perf/tests/shell/amd-ibs-swfilt.sh
+@@ -1,6 +1,10 @@
+ #!/bin/bash
+ # AMD IBS software filtering
+
++ParanoidAndNotRoot() {
++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
++}
++
+ echo "check availability of IBS swfilt"
+
+ # check if IBS PMU is available
+@@ -16,6 +20,7 @@ if [ ! -f /sys/bus/event_source/devices/ibs_op/format/swfilt ]; then
+ fi
+
+ echo "run perf record with modifier and swfilt"
++err=0
+
+ # setting any modifiers should fail
+ perf record -B -e ibs_op//u -o /dev/null true 2> /dev/null
+@@ -31,11 +36,17 @@ if [ $? -ne 0 ]; then
+ exit 1
+ fi
+
+-# setting it with swfilt=1 should be fine
+-perf record -B -e ibs_op/swfilt=1/k -o /dev/null true
+-if [ $? -ne 0 ]; then
+- echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user"
+- exit 1
++if ! ParanoidAndNotRoot 1
++then
++ # setting it with swfilt=1 should be fine
++ perf record -B -e ibs_op/swfilt=1/k -o /dev/null true
++ if [ $? -ne 0 ]; then
++ echo "[FAIL] IBS op PMU cannot handle swfilt for exclude_user"
++ exit 1
++ fi
++else
++ echo "[SKIP] not root and perf_event_paranoid too high for exclude_user"
++ err=2
+ fi
+
+ # check ibs_fetch PMU as well
+@@ -46,10 +57,16 @@ if [ $? -ne 0 ]; then
+ fi
+
+ # check system wide recording
+-perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true
+-if [ $? -ne 0 ]; then
+- echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode"
+- exit 1
++if ! ParanoidAndNotRoot 0
++then
++ perf record -aB --synth=no -e ibs_op/swfilt/k -o /dev/null true
++ if [ $? -ne 0 ]; then
++ echo "[FAIL] IBS op PMU cannot handle swfilt in system-wide mode"
++ exit 1
++ fi
++else
++ echo "[SKIP] not root and perf_event_paranoid too high for system-wide/exclude_user"
++ err=2
+ fi
+
+ echo "check number of samples with swfilt"
+@@ -60,8 +77,16 @@ if [ ${kernel_sample} -ne 0 ]; then
+ exit 1
+ fi
+
+-user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U)
+-if [ ${user_sample} -ne 0 ]; then
+- echo "[FAIL] unexpected user samples: " ${user_sample}
+- exit 1
++if ! ParanoidAndNotRoot 1
++then
++ user_sample=$(perf record -e ibs_fetch/swfilt/k -o- true | perf script -i- -F misc | grep -c ^U)
++ if [ ${user_sample} -ne 0 ]; then
++ echo "[FAIL] unexpected user samples: " ${user_sample}
++ exit 1
++ fi
++else
++ echo "[SKIP] not root and perf_event_paranoid too high for exclude_user"
++ err=2
+ fi
++
++exit $err
+--
+2.51.0
+
--- /dev/null
+From 42d39842155d12ca2a3637bcdc1928942398d2b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:02 -0700
+Subject: perf test: Avoid uncore_imc/clockticks in uniquification test
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit edaeb4bcf1511fe4e464fff9dd4a3abf6b0096da ]
+
+The detection of uncore_imc may happen for free running PMUs and the
+clockticks event may be present on uncore_clock. Rewrite the test to
+detect duplicated/deduplicated events from perf list, not hardcoded to
+uncore_imc.
+
+If perf stat fails then assume it is permissions and skip the test.
+
+Committer testing:
+
+Before:
+
+ root@x1:~# perf test -vv uniquifyi
+ 96: perf stat events uniquifying:
+ --- start ---
+ test child forked, pid 220851
+ stat event uniquifying test
+ grep: Unmatched [, [^, [:, [., or [=
+ Event is not uniquified [Failed]
+ perf stat -e clockticks -A -o /tmp/__perf_test.stat_output.X7ChD -- true
+ # started on Fri Sep 19 16:48:38 2025
+
+ Performance counter stats for 'system wide':
+
+ CPU0 2,310,956 uncore_clock/clockticks/
+
+ 0.001746771 seconds time elapsed
+
+ ---- end(-1) ----
+ 96: perf stat events uniquifying : FAILED!
+ root@x1:~#
+
+After:
+
+ root@x1:~# perf test -vv uniquifyi
+ 96: perf stat events uniquifying:
+ --- start ---
+ test child forked, pid 222366
+ Uniquification of PMU sysfs events test
+ Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_0/data_read/
+ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_0/data_total/
+ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_0/data_write/
+ Testing event uncore_imc_free_running/data_read/ is uniquified to uncore_imc_free_running_1/data_read/
+ Testing event uncore_imc_free_running/data_total/ is uniquified to uncore_imc_free_running_1/data_total/
+ Testing event uncore_imc_free_running/data_write/ is uniquified to uncore_imc_free_running_1/data_write/
+ ---- end(0) ----
+ 96: perf stat events uniquifying : Ok
+ root@x1:~#
+
+Fixes: 070b315333ee942f ("perf test: Restrict uniquifying test to machines with 'uncore_imc'")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tests/shell/stat+event_uniquifying.sh | 109 ++++++++----------
+ 1 file changed, 49 insertions(+), 60 deletions(-)
+
+diff --git a/tools/perf/tests/shell/stat+event_uniquifying.sh b/tools/perf/tests/shell/stat+event_uniquifying.sh
+index bf54bd6c3e2e6..b5dec6b6da369 100755
+--- a/tools/perf/tests/shell/stat+event_uniquifying.sh
++++ b/tools/perf/tests/shell/stat+event_uniquifying.sh
+@@ -4,74 +4,63 @@
+
+ set -e
+
+-stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX)
+-perf_tool=perf
+ err=0
++stat_output=$(mktemp /tmp/__perf_test.stat_output.XXXXX)
+
+-test_event_uniquifying() {
+- # We use `clockticks` in `uncore_imc` to verify the uniquify behavior.
+- pmu="uncore_imc"
+- event="clockticks"
+-
+- # If the `-A` option is added, the event should be uniquified.
+- #
+- # $perf list -v clockticks
+- #
+- # List of pre-defined events (to be used in -e or -M):
+- #
+- # uncore_imc_0/clockticks/ [Kernel PMU event]
+- # uncore_imc_1/clockticks/ [Kernel PMU event]
+- # uncore_imc_2/clockticks/ [Kernel PMU event]
+- # uncore_imc_3/clockticks/ [Kernel PMU event]
+- # uncore_imc_4/clockticks/ [Kernel PMU event]
+- # uncore_imc_5/clockticks/ [Kernel PMU event]
+- #
+- # ...
+- #
+- # $perf stat -e clockticks -A -- true
+- #
+- # Performance counter stats for 'system wide':
+- #
+- # CPU0 3,773,018 uncore_imc_0/clockticks/
+- # CPU0 3,609,025 uncore_imc_1/clockticks/
+- # CPU0 0 uncore_imc_2/clockticks/
+- # CPU0 3,230,009 uncore_imc_3/clockticks/
+- # CPU0 3,049,897 uncore_imc_4/clockticks/
+- # CPU0 0 uncore_imc_5/clockticks/
+- #
+- # 0.002029828 seconds time elapsed
+-
+- echo "stat event uniquifying test"
+- uniquified_event_array=()
++cleanup() {
++ rm -f "${stat_output}"
+
+- # Skip if the machine does not have `uncore_imc` device.
+- if ! ${perf_tool} list pmu | grep -q ${pmu}; then
+- echo "Target does not support PMU ${pmu} [Skipped]"
+- err=2
+- return
+- fi
++ trap - EXIT TERM INT
++}
+
+- # Check how many uniquified events.
+- while IFS= read -r line; do
+- uniquified_event=$(echo "$line" | awk '{print $1}')
+- uniquified_event_array+=("${uniquified_event}")
+- done < <(${perf_tool} list -v ${event} | grep ${pmu})
++trap_cleanup() {
++ echo "Unexpected signal in ${FUNCNAME[1]}"
++ cleanup
++ exit 1
++}
++trap trap_cleanup EXIT TERM INT
+
+- perf_command="${perf_tool} stat -e $event -A -o ${stat_output} -- true"
+- $perf_command
++test_event_uniquifying() {
++ echo "Uniquification of PMU sysfs events test"
+
+- # Check the output contains all uniquified events.
+- for uniquified_event in "${uniquified_event_array[@]}"; do
+- if ! cat "${stat_output}" | grep -q "${uniquified_event}"; then
+- echo "Event is not uniquified [Failed]"
+- echo "${perf_command}"
+- cat "${stat_output}"
+- err=1
+- break
+- fi
++ # Read events from perf list with and without -v. With -v the duplicate PMUs
++ # aren't deduplicated. Note, json events are listed by perf list without a
++ # PMU.
++ read -ra pmu_events <<< "$(perf list --raw pmu)"
++ read -ra pmu_v_events <<< "$(perf list -v --raw pmu)"
++ # For all non-deduplicated events.
++ for pmu_v_event in "${pmu_v_events[@]}"; do
++ # If the event matches an event in the deduplicated events then it musn't
++ # be an event with duplicate PMUs, continue the outer loop.
++ for pmu_event in "${pmu_events[@]}"; do
++ if [[ "$pmu_v_event" == "$pmu_event" ]]; then
++ continue 2
++ fi
++ done
++ # Strip the suffix from the non-deduplicated event's PMU.
++ event=$(echo "$pmu_v_event" | sed -E 's/_[0-9]+//')
++ for pmu_event in "${pmu_events[@]}"; do
++ if [[ "$event" == "$pmu_event" ]]; then
++ echo "Testing event ${event} is uniquified to ${pmu_v_event}"
++ if ! perf stat -e "$event" -A -o ${stat_output} -- true; then
++ echo "Error running perf stat for event '$event' [Skip]"
++ if [ $err = 0 ]; then
++ err=2
++ fi
++ continue
++ fi
++ # Ensure the non-deduplicated event appears in the output.
++ if ! grep -q "${pmu_v_event}" "${stat_output}"; then
++ echo "Uniquification of PMU sysfs events test [Failed]"
++ cat "${stat_output}"
++ err=1
++ fi
++ break
++ fi
++ done
+ done
+ }
+
+ test_event_uniquifying
+-rm -f "${stat_output}"
++cleanup
+ exit $err
+--
+2.51.0
+
--- /dev/null
+From 9cea61122d943ed5f07d021ae14f807dfba6236c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 0b3c37e668717..8c79b5166a058 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 63cdc58e3261893912aba400e70e67bc6a4d178f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:18:31 -0700
+Subject: perf test shell lbr: Avoid failures with perf event paranoia
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48314d20fe467d6653783cbf5536cb2fcc9bdd7c ]
+
+When not running as root and with higher perf event paranoia values
+the perf record LBR tests could fail rather than skipping the
+problematic tests.
+
+Add the sensitivity to the test and confirm it passes with paranoia
+values from -1 to 2.
+
+Committer testing:
+
+Testing with '$ perf test -vv lbr', i.e. as non root, and then comparing
+the output shows the mentioned errors before this patch:
+
+ acme@x1:~$ grep -m1 "model name" /proc/cpuinfo
+ model name : 13th Gen Intel(R) Core(TM) i7-1365U
+ acme@x1:~$
+
+Before:
+
+ 132: perf record LBR tests : Skip
+
+After:
+
+ 132: perf record LBR tests : Ok
+
+Fixes: 32559b99e0f59070 ("perf test: Add set of perf record LBR tests")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/record_lbr.sh | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/tools/perf/tests/shell/record_lbr.sh b/tools/perf/tests/shell/record_lbr.sh
+index 6fcb5e52b9b4f..78a02e90ece1e 100755
+--- a/tools/perf/tests/shell/record_lbr.sh
++++ b/tools/perf/tests/shell/record_lbr.sh
+@@ -4,6 +4,10 @@
+
+ set -e
+
++ParanoidAndNotRoot() {
++ [ "$(id -u)" != 0 ] && [ "$(cat /proc/sys/kernel/perf_event_paranoid)" -gt $1 ]
++}
++
+ if [ ! -f /sys/bus/event_source/devices/cpu/caps/branches ] &&
+ [ ! -f /sys/bus/event_source/devices/cpu_core/caps/branches ]
+ then
+@@ -23,6 +27,7 @@ cleanup() {
+ }
+
+ trap_cleanup() {
++ echo "Unexpected signal in ${FUNCNAME[1]}"
+ cleanup
+ exit 1
+ }
+@@ -123,8 +128,11 @@ lbr_test "-j ind_call" "any indirect call" 2
+ lbr_test "-j ind_jmp" "any indirect jump" 100
+ lbr_test "-j call" "direct calls" 2
+ lbr_test "-j ind_call,u" "any indirect user call" 100
+-lbr_test "-a -b" "system wide any branch" 2
+-lbr_test "-a -j any_call" "system wide any call" 2
++if ! ParanoidAndNotRoot 1
++then
++ lbr_test "-a -b" "system wide any branch" 2
++ lbr_test "-a -j any_call" "system wide any call" 2
++fi
+
+ # Parallel
+ parallel_lbr_test "-b" "parallel any branch" 100 &
+@@ -141,10 +149,16 @@ parallel_lbr_test "-j call" "parallel direct calls" 100 &
+ pid6=$!
+ parallel_lbr_test "-j ind_call,u" "parallel any indirect user call" 100 &
+ pid7=$!
+-parallel_lbr_test "-a -b" "parallel system wide any branch" 100 &
+-pid8=$!
+-parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 &
+-pid9=$!
++if ParanoidAndNotRoot 1
++then
++ pid8=
++ pid9=
++else
++ parallel_lbr_test "-a -b" "parallel system wide any branch" 100 &
++ pid8=$!
++ parallel_lbr_test "-a -j any_call" "parallel system wide any call" 100 &
++ pid9=$!
++fi
+
+ for pid in $pid1 $pid2 $pid3 $pid4 $pid5 $pid6 $pid7 $pid8 $pid9
+ do
+--
+2.51.0
+
--- /dev/null
+From 631132a0623fd7a56e3dd9e8997a00fad986fd21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:16 -0700
+Subject: perf test trace_btf_enum: Skip if permissions are insufficient
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 4bd5bd8dbd41a208fb73afb65bda6f38e2b5a637 ]
+
+Modify test behavior to skip if BPF calls fail with "Operation not
+permitted".
+
+Fixes: d66763fed30f0bd8 ("perf test trace_btf_enum: Add regression test for the BTF augmentation of enums in 'perf trace'")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-3-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/trace_btf_enum.sh | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/perf/tests/shell/trace_btf_enum.sh b/tools/perf/tests/shell/trace_btf_enum.sh
+index 572001d75d781..03e9f680a4a69 100755
+--- a/tools/perf/tests/shell/trace_btf_enum.sh
++++ b/tools/perf/tests/shell/trace_btf_enum.sh
+@@ -23,6 +23,14 @@ check_vmlinux() {
+ fi
+ }
+
++check_permissions() {
++ if perf trace -e $syscall $TESTPROG 2>&1 | grep -q "Operation not permitted"
++ then
++ echo "trace+enum test [Skipped permissions]"
++ err=2
++ fi
++}
++
+ trace_landlock() {
+ echo "Tracing syscall ${syscall}"
+
+@@ -56,6 +64,9 @@ trace_non_syscall() {
+ }
+
+ check_vmlinux
++if [ $err = 0 ]; then
++ check_permissions
++fi
+
+ if [ $err = 0 ]; then
+ trace_landlock
+--
+2.51.0
+
--- /dev/null
+From 1abb4dfca4755e745df6b62ce19c83082fbe01d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 07:37:02 +0200
+Subject: perf tools: Fix arm64 libjvmti build by generating unistd_64.h
+
+From: Vincent Minet <v.minet@criteo.com>
+
+[ Upstream commit f3b601f900902ab80902c44f820a8985384ac021 ]
+
+Since commit 22f72088ffe6 ("tools headers: Update the syscall table with
+the kernel sources") the arm64 syscall header is generated at build
+time. Later, commit bfb713ea53c7 ("perf tools: Fix arm64 build by
+generating unistd_64.h") added a dependency to libperf to guarantee that
+this header was created before building libperf or perf itself.
+
+However, libjvmti also requires this header but does not depend on
+libperf, leading to build failures such as:
+
+ In file included from /usr/include/sys/syscall.h:24,
+ from /usr/include/syscall.h:1,
+ from jvmti/jvmti_agent.c:36:
+ tools/arch/arm64/include/uapi/asm/unistd.h:2:10: fatal error: asm/unistd_64.h: No such file or directory
+ 2 | #include <asm/unistd_64.h>
+
+Fix this by ensuring that libperf is built before libjvmti, so that
+unistd_64.h is always available.
+
+Fixes: 22f72088ffe69a37 ("tools headers: Update the syscall table with the kernel sources")
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Vincent Minet <v.minet@criteo.com>
+Link: https://lore.kernel.org/r/20250922053702.2688374-1-v.minet@criteo.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index e2150acc2c133..f561025d4085e 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -941,7 +941,7 @@ $(OUTPUT)dlfilters/%.so: $(OUTPUT)dlfilters/%.o
+ ifndef NO_JVMTI
+ LIBJVMTI_IN := $(OUTPUT)jvmti/jvmti-in.o
+
+-$(LIBJVMTI_IN): FORCE
++$(LIBJVMTI_IN): prepare FORCE
+ $(Q)$(MAKE) -f $(srctree)/tools/build/Makefile.build dir=jvmti obj=jvmti
+
+ $(OUTPUT)$(LIBJVMTI): $(LIBJVMTI_IN)
+--
+2.51.0
+
--- /dev/null
+From 6726f584009826377d2bb429ecb487cbd3d77396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 17:54:22 +0800
+Subject: perf trace: Fix IS_ERR() vs NULL check bug
+
+From: Fushuai Wang <wangfushuai@baidu.com>
+
+[ Upstream commit b0f4ade163e551d0c470ead7ac57eaf373eec71a ]
+
+The alloc_syscall_stats() function always returns an error pointer
+(ERR_PTR) on failure.
+
+So replace NULL check with IS_ERR() check after calling
+alloc_syscall_stats() function.
+
+Fixes: fc00897c8a3f7f57 ("perf trace: Add --summary-mode option")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index fe737b3ac6e67..25c41b89f8abb 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -4440,7 +4440,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
+
+ if (trace->summary_mode == SUMMARY__BY_TOTAL && !trace->summary_bpf) {
+ trace->syscall_stats = alloc_syscall_stats();
+- if (trace->syscall_stats == NULL)
++ if (IS_ERR(trace->syscall_stats))
+ goto out_delete_evlist;
+ }
+
+@@ -4748,7 +4748,7 @@ static int trace__replay(struct trace *trace)
+
+ if (trace->summary_mode == SUMMARY__BY_TOTAL) {
+ trace->syscall_stats = alloc_syscall_stats();
+- if (trace->syscall_stats == NULL)
++ if (IS_ERR(trace->syscall_stats))
+ goto out;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fe1d0135931a68caae330f9201b73b0fad957625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index bbcd2ffcf4bd1..c355757ed3911 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -120,7 +120,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 02f1cd5912b21cdab6296e7c7e878fd7a79e78e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:52:12 -0700
+Subject: perf vendor events arm64 AmpereOneX: Fix typo - should be
+ l1d_cache_access_prefetches
+
+From: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+
+[ Upstream commit 97996580da08f06f8b09a86f3384ed9fa7a52e32 ]
+
+Add missing 'h' to l1d_cache_access_prefetces
+
+Also fix a couple of typos and use consistent term in brief descriptions
+
+Fixes: 16438b652b464ef7 ("perf vendor events arm64 AmpereOneX: Add core PMU events and metrics")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arch/arm64/ampere/ampereonex/metrics.json | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
+index 5228f94a793f9..6817cac149e0b 100644
+--- a/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
++++ b/tools/perf/pmu-events/arch/arm64/ampere/ampereonex/metrics.json
+@@ -113,7 +113,7 @@
+ {
+ "MetricName": "load_store_spec_rate",
+ "MetricExpr": "LDST_SPEC / INST_SPEC",
+- "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speclatively executed",
++ "BriefDescription": "The rate of load or store instructions speculatively executed to overall instructions speculatively executed",
+ "MetricGroup": "Operation_Mix",
+ "ScaleUnit": "100percent of operations"
+ },
+@@ -132,7 +132,7 @@
+ {
+ "MetricName": "pc_write_spec_rate",
+ "MetricExpr": "PC_WRITE_SPEC / INST_SPEC",
+- "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speclatively executed",
++ "BriefDescription": "The rate of software change of the PC speculatively executed to overall instructions speculatively executed",
+ "MetricGroup": "Operation_Mix",
+ "ScaleUnit": "100percent of operations"
+ },
+@@ -195,14 +195,14 @@
+ {
+ "MetricName": "stall_frontend_cache_rate",
+ "MetricExpr": "STALL_FRONTEND_CACHE / CPU_CYCLES",
+- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and cache miss",
++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and cache miss",
+ "MetricGroup": "Stall",
+ "ScaleUnit": "100percent of cycles"
+ },
+ {
+ "MetricName": "stall_frontend_tlb_rate",
+ "MetricExpr": "STALL_FRONTEND_TLB / CPU_CYCLES",
+- "BriefDescription": "Proportion of cycles stalled and no ops delivered from frontend and TLB miss",
++ "BriefDescription": "Proportion of cycles stalled and no operations delivered from frontend and TLB miss",
+ "MetricGroup": "Stall",
+ "ScaleUnit": "100percent of cycles"
+ },
+@@ -391,7 +391,7 @@
+ "ScaleUnit": "100percent of cache acceses"
+ },
+ {
+- "MetricName": "l1d_cache_access_prefetces",
++ "MetricName": "l1d_cache_access_prefetches",
+ "MetricExpr": "L1D_CACHE_PRFM / L1D_CACHE",
+ "BriefDescription": "L1D cache access - prefetch",
+ "MetricGroup": "Cache",
+--
+2.51.0
+
--- /dev/null
+From 5c61177f5c837ace70b6bf49f0c0f48028d94022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:45:14 +0200
+Subject: PM: core: Add two macros for walking device links
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 3ce3f569991347d2085925041f4932232da43bcf ]
+
+Add separate macros for walking links to suppliers and consumers of a
+device to help device links users to avoid exposing the internals of
+struct dev_links_info in their code and possible coding mistakes related
+to that.
+
+Accordingly, use the new macros to replace open-coded device links list
+walks in the core power management code.
+
+No intentional functional impact.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/1944671.tdWV9SEqCh@rafael.j.wysocki
+Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/base.h | 8 ++++++++
+ drivers/base/power/main.c | 18 +++++++-----------
+ drivers/base/power/runtime.c | 3 +--
+ 3 files changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/base/base.h b/drivers/base/base.h
+index 123031a757d91..700aecd22fd34 100644
+--- a/drivers/base/base.h
++++ b/drivers/base/base.h
+@@ -251,6 +251,14 @@ void device_links_unbind_consumers(struct device *dev);
+ void fw_devlink_drivers_done(void);
+ void fw_devlink_probing_done(void);
+
++#define dev_for_each_link_to_supplier(__link, __dev) \
++ list_for_each_entry_srcu(__link, &(__dev)->links.suppliers, c_node, \
++ device_links_read_lock_held())
++
++#define dev_for_each_link_to_consumer(__link, __dev) \
++ list_for_each_entry_srcu(__link, &(__dev)->links.consumers, s_node, \
++ device_links_read_lock_held())
++
+ /* device pm support */
+ void device_pm_move_to_tail(struct device *dev);
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index b6ab41265d7a3..b9a34c3425ecf 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -40,10 +40,6 @@
+
+ typedef int (*pm_callback_t)(struct device *);
+
+-#define list_for_each_entry_srcu_locked(pos, head, member) \
+- list_for_each_entry_srcu(pos, head, member, \
+- device_links_read_lock_held())
+-
+ /*
+ * The entries in the dpm_list list are in a depth first order, simply
+ * because children are guaranteed to be discovered after parents, and
+@@ -281,7 +277,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)
+ * callbacks freeing the link objects for the links in the list we're
+ * walking.
+ */
+- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
++ dev_for_each_link_to_supplier(link, dev)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_wait(link->supplier, async);
+
+@@ -338,7 +334,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)
+ * continue instead of trying to continue in parallel with its
+ * unregistration).
+ */
+- list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node)
++ dev_for_each_link_to_consumer(link, dev)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_wait(link->consumer, async);
+
+@@ -675,7 +671,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func)
+ idx = device_links_read_lock();
+
+ /* Start processing the device's "async" consumers. */
+- list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node)
++ dev_for_each_link_to_consumer(link, dev)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_async_with_cleanup(link->consumer, func);
+
+@@ -1342,7 +1338,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func)
+ idx = device_links_read_lock();
+
+ /* Start processing the device's "async" suppliers. */
+- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
++ dev_for_each_link_to_supplier(link, dev)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_async_with_cleanup(link->supplier, func);
+
+@@ -1396,7 +1392,7 @@ static void dpm_superior_set_must_resume(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
++ dev_for_each_link_to_supplier(link, dev)
+ link->supplier->power.must_resume = true;
+
+ device_links_read_unlock(idx);
+@@ -1825,7 +1821,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) {
++ dev_for_each_link_to_supplier(link, dev) {
+ spin_lock_irq(&link->supplier->power.lock);
+ link->supplier->power.direct_complete = false;
+ spin_unlock_irq(&link->supplier->power.lock);
+@@ -2077,7 +2073,7 @@ static bool device_prepare_smart_suspend(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) {
++ dev_for_each_link_to_supplier(link, dev) {
+ if (!device_link_test(link, DL_FLAG_PM_RUNTIME))
+ continue;
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 8c23a11e80176..7420b9851fe0f 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1903,8 +1903,7 @@ void pm_runtime_get_suppliers(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_srcu(link, &dev->links.suppliers, c_node,
+- device_links_read_lock_held())
++ dev_for_each_link_to_supplier(link, dev)
+ if (device_link_test(link, DL_FLAG_PM_RUNTIME)) {
+ link->supplier_preactivated = true;
+ pm_runtime_get_sync(link->supplier);
+--
+2.51.0
+
--- /dev/null
+From ad6517da7d76c75cd555dadba377b0bd2003283d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:43:50 +0200
+Subject: PM: core: Annotate loops walking device links as _srcu
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit fdd9ae23bb989fa9ed1beebba7d3e0c82c7c81ae ]
+
+Since SRCU is used for the protection of device link lists, the loops
+over device link lists in multiple places in drivers/base/power/main.c
+and in pm_runtime_get_suppliers() should be annotated as _srcu rather
+than as _rcu which is the case currently.
+
+Change the annotations accordingly.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/2393512.ElGaqSPkdT@rafael.j.wysocki
+Stable-dep-of: 632d31067be2 ("PM: sleep: Do not wait on SYNC_STATE_ONLY device links")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 18 +++++++++---------
+ drivers/base/power/runtime.c | 4 ++--
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index c883b01ffbddc..b6ab41265d7a3 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -40,8 +40,8 @@
+
+ typedef int (*pm_callback_t)(struct device *);
+
+-#define list_for_each_entry_rcu_locked(pos, head, member) \
+- list_for_each_entry_rcu(pos, head, member, \
++#define list_for_each_entry_srcu_locked(pos, head, member) \
++ list_for_each_entry_srcu(pos, head, member, \
+ device_links_read_lock_held())
+
+ /*
+@@ -281,7 +281,7 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)
+ * callbacks freeing the link objects for the links in the list we're
+ * walking.
+ */
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node)
++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_wait(link->supplier, async);
+
+@@ -338,7 +338,7 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)
+ * continue instead of trying to continue in parallel with its
+ * unregistration).
+ */
+- list_for_each_entry_rcu_locked(link, &dev->links.consumers, s_node)
++ list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_wait(link->consumer, async);
+
+@@ -675,7 +675,7 @@ static void dpm_async_resume_subordinate(struct device *dev, async_func_t func)
+ idx = device_links_read_lock();
+
+ /* Start processing the device's "async" consumers. */
+- list_for_each_entry_rcu_locked(link, &dev->links.consumers, s_node)
++ list_for_each_entry_srcu_locked(link, &dev->links.consumers, s_node)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_async_with_cleanup(link->consumer, func);
+
+@@ -1342,7 +1342,7 @@ static void dpm_async_suspend_superior(struct device *dev, async_func_t func)
+ idx = device_links_read_lock();
+
+ /* Start processing the device's "async" suppliers. */
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node)
++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
+ if (READ_ONCE(link->status) != DL_STATE_DORMANT)
+ dpm_async_with_cleanup(link->supplier, func);
+
+@@ -1396,7 +1396,7 @@ static void dpm_superior_set_must_resume(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node)
++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node)
+ link->supplier->power.must_resume = true;
+
+ device_links_read_unlock(idx);
+@@ -1825,7 +1825,7 @@ static void dpm_clear_superiors_direct_complete(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) {
++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) {
+ spin_lock_irq(&link->supplier->power.lock);
+ link->supplier->power.direct_complete = false;
+ spin_unlock_irq(&link->supplier->power.lock);
+@@ -2077,7 +2077,7 @@ static bool device_prepare_smart_suspend(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) {
++ list_for_each_entry_srcu_locked(link, &dev->links.suppliers, c_node) {
+ if (!device_link_test(link, DL_FLAG_PM_RUNTIME))
+ continue;
+
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 3e84dc4122def..8c23a11e80176 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1903,8 +1903,8 @@ void pm_runtime_get_suppliers(struct device *dev)
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_rcu(link, &dev->links.suppliers, c_node,
+- device_links_read_lock_held())
++ list_for_each_entry_srcu(link, &dev->links.suppliers, c_node,
++ device_links_read_lock_held())
+ if (device_link_test(link, DL_FLAG_PM_RUNTIME)) {
+ link->supplier_preactivated = true;
+ pm_runtime_get_sync(link->supplier);
+--
+2.51.0
+
--- /dev/null
+From 078d5e332701e3fce94e3ad2ae5e14c17474eb41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 18:23:18 +0800
+Subject: PM: sleep: Do not wait on SYNC_STATE_ONLY device links
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 632d31067be2f414c57955efcf29c79290cc749b ]
+
+Device links with DL_FLAG_SYNC_STATE_ONLY should not affect system
+suspend and resume, and functions like device_reorder_to_tail() and
+device_link_add() don't try to reorder the consumers with that flag.
+
+However, dpm_wait_for_consumers() and dpm_wait_for_suppliers() don't
+check thas flag before triggering dpm_wait(), leading to potential hang
+during suspend/resume.
+
+This can be reproduced on MT8186 Corsola Chromebook with devicetree like:
+
+usb-a-connector {
+ compatible = "usb-a-connector";
+ port {
+ usb_a_con: endpoint {
+ remote-endpoint = <&usb_hs>;
+ };
+ };
+};
+
+usb_host {
+ compatible = "mediatek,mt8186-xhci", "mediatek,mtk-xhci";
+ port {
+ usb_hs: endpoint {
+ remote-endpoint = <&usb_a_con>;
+ };
+ };
+};
+
+In this case, the two nodes form a cycle and a SYNC_STATE_ONLY devlink
+between usb_host (supplier) and usb-a-connector (consumer) is created.
+
+Address this by exporting device_link_flag_is_sync_state_only() and
+making dpm_wait_for_consumers() and dpm_wait_for_suppliers() use it
+when deciding if dpm_wait() should be called.
+
+Fixes: 05ef983e0d65a ("driver core: Add device link support for SYNC_STATE_ONLY flag")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Link: https://patch.msgid.link/20250926102320.4053167-1-treapking@chromium.org
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/base.h | 1 +
+ drivers/base/core.c | 2 +-
+ drivers/base/power/main.c | 6 ++++--
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/base.h b/drivers/base/base.h
+index 700aecd22fd34..86fa7fbb35489 100644
+--- a/drivers/base/base.h
++++ b/drivers/base/base.h
+@@ -248,6 +248,7 @@ void device_links_driver_cleanup(struct device *dev);
+ void device_links_no_driver(struct device *dev);
+ bool device_links_busy(struct device *dev);
+ void device_links_unbind_consumers(struct device *dev);
++bool device_link_flag_is_sync_state_only(u32 flags);
+ void fw_devlink_drivers_done(void);
+ void fw_devlink_probing_done(void);
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index d22d6b23e7589..a54ec6df1058f 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -287,7 +287,7 @@ static bool device_is_ancestor(struct device *dev, struct device *target)
+ #define DL_MARKER_FLAGS (DL_FLAG_INFERRED | \
+ DL_FLAG_CYCLE | \
+ DL_FLAG_MANAGED)
+-static inline bool device_link_flag_is_sync_state_only(u32 flags)
++bool device_link_flag_is_sync_state_only(u32 flags)
+ {
+ return (flags & ~DL_MARKER_FLAGS) == DL_FLAG_SYNC_STATE_ONLY;
+ }
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index b9a34c3425ecf..e83503bdc1fdb 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -278,7 +278,8 @@ static void dpm_wait_for_suppliers(struct device *dev, bool async)
+ * walking.
+ */
+ dev_for_each_link_to_supplier(link, dev)
+- if (READ_ONCE(link->status) != DL_STATE_DORMANT)
++ if (READ_ONCE(link->status) != DL_STATE_DORMANT &&
++ !device_link_flag_is_sync_state_only(link->flags))
+ dpm_wait(link->supplier, async);
+
+ device_links_read_unlock(idx);
+@@ -335,7 +336,8 @@ static void dpm_wait_for_consumers(struct device *dev, bool async)
+ * unregistration).
+ */
+ dev_for_each_link_to_consumer(link, dev)
+- if (READ_ONCE(link->status) != DL_STATE_DORMANT)
++ if (READ_ONCE(link->status) != DL_STATE_DORMANT &&
++ !device_link_flag_is_sync_state_only(link->flags))
+ dpm_wait(link->consumer, async);
+
+ device_links_read_unlock(idx);
+--
+2.51.0
+
--- /dev/null
+From 0b253dea575ff13bdb7f62f739476a3c9ff71503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 May 2025 09:23:36 +0200
+Subject: rtc: isl12022: Fix initial enable_irq/disable_irq balance
+
+From: Esben Haabendal <esben@geanix.com>
+
+[ Upstream commit 9ffe06b6ccd7a8eaa31d31625db009ea26a22a3c ]
+
+Interrupts are automatically enabled when requested, so we need to
+initialize irq_enabled accordingly to avoid causing an unbalanced enable
+warning.
+
+Fixes: c62d658e5253 ("rtc: isl12022: Add alarm support")
+Signed-off-by: Esben Haabendal <esben@geanix.com>
+Link: https://lore.kernel.org/r/20250516-rtc-uie-irq-fixes-v2-2-3de8e530a39e@geanix.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-isl12022.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-isl12022.c b/drivers/rtc/rtc-isl12022.c
+index 9b44839a7402c..5fc52dc642130 100644
+--- a/drivers/rtc/rtc-isl12022.c
++++ b/drivers/rtc/rtc-isl12022.c
+@@ -413,6 +413,7 @@ static int isl12022_setup_irq(struct device *dev, int irq)
+ if (ret)
+ return ret;
+
++ isl12022->irq_enabled = true;
+ ret = devm_request_threaded_irq(dev, irq, NULL,
+ isl12022_rtc_interrupt,
+ IRQF_SHARED | IRQF_ONESHOT,
+--
+2.51.0
+
--- /dev/null
+From e6b2dcc53811fc398e6eaeafe4796b5ab5661f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:07:13 +0200
+Subject: rtc: optee: fix memory leak on driver removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
+
+Fix a memory leak in case of driver removal.
+Free the shared memory used for arguments exchanges between kernel and
+OP-TEE RTC PTA.
+
+Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-optee.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c
+index 9f8b5d4a8f6b6..6b77c122fdc10 100644
+--- a/drivers/rtc/rtc-optee.c
++++ b/drivers/rtc/rtc-optee.c
+@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev)
+ {
+ struct optee_rtc *priv = dev_get_drvdata(dev);
+
++ tee_shm_free(priv->shm);
+ tee_client_close_session(priv->ctx, priv->session_id);
+ tee_client_close_context(priv->ctx);
+
+--
+2.51.0
+
--- /dev/null
+From 150813b0af40ffe84d644ddca7ed1c76cbcdd62b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index 4bcd7ca32f27b..b8a0fccef14e0 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From 109531d033db7ede6044ef5bb5f79c8b73ec3af5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 15:38:17 +0200
+Subject: s390/cio: Update purge function to unregister the unused subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
+
+Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers")', cio no longer unregisters
+subchannels when the attached device is invalid or unavailable.
+
+As an unintended side-effect, the cio_ignore purge function no longer
+removes subchannels for devices on the cio_ignore list if no CCW device
+is attached. This situation occurs when a CCW device is non-operational
+or unavailable
+
+To ensure the same outcome of the purge function as when the
+current cio_ignore list had been active during boot, update the purge
+function to remove I/O subchannels without working CCW devices if the
+associated device number is found on the cio_ignore list.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index fb2c07cb4d3dd..4b2dae6eb3760 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1316,23 +1316,34 @@ void ccw_device_schedule_recovery(void)
+ spin_unlock_irqrestore(&recovery_lock, flags);
+ }
+
+-static int purge_fn(struct device *dev, void *data)
++static int purge_fn(struct subchannel *sch, void *data)
+ {
+- struct ccw_device *cdev = to_ccwdev(dev);
+- struct ccw_dev_id *id = &cdev->private->dev_id;
+- struct subchannel *sch = to_subchannel(cdev->dev.parent);
++ struct ccw_device *cdev;
+
+- spin_lock_irq(cdev->ccwlock);
+- if (is_blacklisted(id->ssid, id->devno) &&
+- (cdev->private->state == DEV_STATE_OFFLINE) &&
+- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
+- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+- id->devno);
++ spin_lock_irq(&sch->lock);
++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv)
++ goto unlock;
++
++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev))
++ goto unlock;
++
++ cdev = sch_get_cdev(sch);
++ if (cdev) {
++ if (cdev->private->state != DEV_STATE_OFFLINE)
++ goto unlock;
++
++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
++ goto unlock;
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+- css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+- spin_unlock_irq(cdev->ccwlock);
++
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid,
++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)");
++
++unlock:
++ spin_unlock_irq(&sch->lock);
+ /* Abort loop in case of pending signal. */
+ if (signal_pending(current))
+ return -EINTR;
+@@ -1348,7 +1359,7 @@ static int purge_fn(struct device *dev, void *data)
+ int ccw_purge_blacklisted(void)
+ {
+ CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n");
+- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn);
++ for_each_subchannel_staged(purge_fn, NULL, NULL);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b5c6b2a2b70a24e46ce23bb137b5add1d0e0edda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:46:46 -0700
+Subject: s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 9338d660b79a0dfe4eb3fe9bd748054cded87d4f ]
+
+When building s390 defconfig with binutils older than 2.32, there are
+several warnings during the final linking stage:
+
+ s390-linux-ld: .tmp_vmlinux1: warning: allocated section `.got.plt' not in segment
+ s390-linux-ld: .tmp_vmlinux2: warning: allocated section `.got.plt' not in segment
+ s390-linux-ld: vmlinux.unstripped: warning: allocated section `.got.plt' not in segment
+ s390-linux-objcopy: vmlinux: warning: allocated section `.got.plt' not in segment
+ s390-linux-objcopy: st7afZyb: warning: allocated section `.got.plt' not in segment
+
+binutils commit afca762f598 ("S/390: Improve partial relro support for
+64 bit") [1] in 2.32 changed where .got.plt is emitted, avoiding the
+warning.
+
+The :NONE in the .vmlinux.info output section description changes the
+segment for subsequent allocated sections. Move .vmlinux.info right
+above the discards section to place all other sections in the previously
+defined segment, .data.
+
+Fixes: 30226853d6ec ("s390: vmlinux.lds.S: explicitly handle '.got' and '.plt' sections")
+Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=afca762f598d453c563f244cd3777715b1a0cb72 [1]
+Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Nicolas Schier <nsc@kernel.org>
+Link: https://patch.msgid.link/20251008-kbuild-fix-modinfo-regressions-v1-3-9fc776c5887c@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 44 +++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index feecf1a6ddb44..d74d4c52ccd05 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -214,6 +214,28 @@ SECTIONS
+ DWARF_DEBUG
+ ELF_DETAILS
+
++ /*
++ * Make sure that the .got.plt is either completely empty or it
++ * contains only the three reserved double words.
++ */
++ .got.plt : {
++ *(.got.plt)
++ }
++ ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!")
++
++ /*
++ * Sections that should stay zero sized, which is safer to
++ * explicitly check instead of blindly discarding.
++ */
++ .plt : {
++ *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
++ }
++ ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
++ .rela.dyn : {
++ *(.rela.*) *(.rela_*)
++ }
++ ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!")
++
+ /*
+ * uncompressed image info used by the decompressor
+ * it should match struct vmlinux_info
+@@ -244,28 +266,6 @@ SECTIONS
+ #endif
+ } :NONE
+
+- /*
+- * Make sure that the .got.plt is either completely empty or it
+- * contains only the three reserved double words.
+- */
+- .got.plt : {
+- *(.got.plt)
+- }
+- ASSERT(SIZEOF(.got.plt) == 0 || SIZEOF(.got.plt) == 0x18, "Unexpected GOT/PLT entries detected!")
+-
+- /*
+- * Sections that should stay zero sized, which is safer to
+- * explicitly check instead of blindly discarding.
+- */
+- .plt : {
+- *(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
+- }
+- ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
+- .rela.dyn : {
+- *(.rela.*) *(.rela_*)
+- }
+- ASSERT(SIZEOF(.rela.dyn) == 0, "Unexpected run-time relocations (.rela) detected!")
+-
+ /* Sections to be discarded */
+ DISCARDS
+ /DISCARD/ : {
+--
+2.51.0
+
--- /dev/null
+From 106cf24aac7413e5fb6aa632707ff81451a202c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:05:45 +0200
+Subject: s390: vmlinux.lds.S: Reorder sections
+
+From: Alexey Gladkov <legion@kernel.org>
+
+[ Upstream commit 8d18ef04f940a8d336fe7915b5ea419c3eb0c0a6 ]
+
+In the upcoming changes, the ELF_DETAILS macro will be extended with
+the ".modinfo" section, which will cause an error:
+
+>> s390x-linux-ld: .tmp_vmlinux1: warning: allocated section `.modinfo' not in segment
+>> s390x-linux-ld: .tmp_vmlinux2: warning: allocated section `.modinfo' not in segment
+>> s390x-linux-ld: vmlinux.unstripped: warning: allocated section `.modinfo' not in segment
+
+This happens because the .vmlinux.info use :NONE to override the default
+segment and tell the linker to not put the section in any segment at all.
+
+To avoid this, we need to change the sections order that will be placed
+in the default segment.
+
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506062053.zbkFBEnJ-lkp@intel.com/
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Link: https://patch.msgid.link/20d40a7a3a053ba06a54155e777dcde7fdada1db.1758182101.git.legion@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Stable-dep-of: 9338d660b79a ("s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 1c606dfa595d8..feecf1a6ddb44 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -209,6 +209,11 @@ SECTIONS
+ . = ALIGN(PAGE_SIZE);
+ _end = . ;
+
++ /* Debugging sections. */
++ STABS_DEBUG
++ DWARF_DEBUG
++ ELF_DETAILS
++
+ /*
+ * uncompressed image info used by the decompressor
+ * it should match struct vmlinux_info
+@@ -239,11 +244,6 @@ SECTIONS
+ #endif
+ } :NONE
+
+- /* Debugging sections. */
+- STABS_DEBUG
+- DWARF_DEBUG
+- ELF_DETAILS
+-
+ /*
+ * Make sure that the .got.plt is either completely empty or it
+ * contains only the three reserved double words.
+--
+2.51.0
+
--- /dev/null
+From 2d512eda492dac3db66e7c3dfd02e837764c3cf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 2c72da6b8cf0c..7f1ad305eee63 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -124,7 +124,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
--- /dev/null
+From f86b3407ad9aeabc190907fd43ece7f4b5955cdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 18:09:39 -0700
+Subject: scsi: ufs: sysfs: Make HID attributes visible
+
+From: Daniel Lee <chullee@google.com>
+
+[ Upstream commit bb7663dec67b691528f104894429b3859fb16c14 ]
+
+Call sysfs_update_group() after reading the device descriptor to ensure
+the HID sysfs attributes are visible when the feature is supported.
+
+Fixes: ae7795a8c258 ("scsi: ufs: core: Add HID support")
+Signed-off-by: Daniel Lee <chullee@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs-sysfs.c | 2 +-
+ drivers/ufs/core/ufs-sysfs.h | 1 +
+ drivers/ufs/core/ufshcd.c | 2 ++
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufs-sysfs.c b/drivers/ufs/core/ufs-sysfs.c
+index 0086816b27cd9..c040afc6668e8 100644
+--- a/drivers/ufs/core/ufs-sysfs.c
++++ b/drivers/ufs/core/ufs-sysfs.c
+@@ -1949,7 +1949,7 @@ static umode_t ufs_sysfs_hid_is_visible(struct kobject *kobj,
+ return hba->dev_info.hid_sup ? attr->mode : 0;
+ }
+
+-static const struct attribute_group ufs_sysfs_hid_group = {
++const struct attribute_group ufs_sysfs_hid_group = {
+ .name = "hid",
+ .attrs = ufs_sysfs_hid,
+ .is_visible = ufs_sysfs_hid_is_visible,
+diff --git a/drivers/ufs/core/ufs-sysfs.h b/drivers/ufs/core/ufs-sysfs.h
+index 8d94af3b80771..6efb82a082fdd 100644
+--- a/drivers/ufs/core/ufs-sysfs.h
++++ b/drivers/ufs/core/ufs-sysfs.h
+@@ -14,5 +14,6 @@ void ufs_sysfs_remove_nodes(struct device *dev);
+
+ extern const struct attribute_group ufs_sysfs_unit_descriptor_group;
+ extern const struct attribute_group ufs_sysfs_lun_attributes_group;
++extern const struct attribute_group ufs_sysfs_hid_group;
+
+ #endif
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 96a0f5fcc0e57..465e66dbe08e8 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -8482,6 +8482,8 @@ static int ufs_get_device_desc(struct ufs_hba *hba)
+ DEVICE_DESC_PARAM_EXT_UFS_FEATURE_SUP) &
+ UFS_DEV_HID_SUPPORT;
+
++ sysfs_update_group(&hba->dev->kobj, &ufs_sysfs_hid_group);
++
+ model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME];
+
+ err = ufshcd_read_string_desc(hba, model_index,
+--
+2.51.0
+
--- /dev/null
+From 656df4fcfd24bde9c16541d5d4bf69a6fbb31bfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 18:01:08 +0530
+Subject: selftest: net: ovpn: Fix uninit return values
+
+From: Sidharth Seela <sidharthseela@gmail.com>
+
+[ Upstream commit 7fc25c5a5ae6230d14b4c088fc94dbd58b2a9f3a ]
+
+Fix functions that return undefined values. These issues were caught by
+running clang using LLVM=1 option.
+
+Clang warnings are as follows:
+ovpn-cli.c:1587:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
+ 1587 | if (!sock) {
+ | ^~~~~
+ovpn-cli.c:1635:9: note: uninitialized use occurs here
+ 1635 | return ret;
+ | ^~~
+ovpn-cli.c:1587:2: note: remove the 'if' if its condition is always false
+ 1587 | if (!sock) {
+ | ^~~~~~~~~~~~
+ 1588 | fprintf(stderr, "cannot allocate netlink socket\n");
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 1589 | goto err_free;
+ | ~~~~~~~~~~~~~~
+ 1590 | }
+ | ~
+ovpn-cli.c:1584:15: note: initialize the variable 'ret' to silence this warning
+ 1584 | int mcid, ret;
+ | ^
+ | = 0
+ovpn-cli.c:2107:7: warning: variable 'ret' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized]
+ 2107 | case CMD_INVALID:
+ | ^~~~~~~~~~~
+ovpn-cli.c:2111:9: note: uninitialized use occurs here
+ 2111 | return ret;
+ | ^~~
+ovpn-cli.c:1939:12: note: initialize the variable 'ret' to silence this warning
+ 1939 | int n, ret;
+ | ^
+ |
+
+Fixes: 959bc330a439 ("testing/selftests: add test tool and scripts for ovpn module")
+Signed-off-by: Sidharth Seela <sidharthseela@gmail.com>
+Link: https://patch.msgid.link/20251001123107.96244-2-sidharthseela@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/ovpn/ovpn-cli.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/ovpn/ovpn-cli.c b/tools/testing/selftests/net/ovpn/ovpn-cli.c
+index 9201f2905f2ce..8d0f2f61923c9 100644
+--- a/tools/testing/selftests/net/ovpn/ovpn-cli.c
++++ b/tools/testing/selftests/net/ovpn/ovpn-cli.c
+@@ -1586,6 +1586,7 @@ static int ovpn_listen_mcast(void)
+ sock = nl_socket_alloc();
+ if (!sock) {
+ fprintf(stderr, "cannot allocate netlink socket\n");
++ ret = -ENOMEM;
+ goto err_free;
+ }
+
+@@ -2105,6 +2106,7 @@ static int ovpn_run_cmd(struct ovpn_ctx *ovpn)
+ ret = ovpn_listen_mcast();
+ break;
+ case CMD_INVALID:
++ ret = -EINVAL;
+ break;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e3e36450dff34aa12e6ed772b06dc378a3523753 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 15:00:06 +0200
+Subject: selftests: netfilter: nft_fib.sh: fix spurious test failures
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit a126ab6b26f107f4eb100c8c77e9f10b706f26e6 ]
+
+Jakub reports spurious failure of nft_fib.sh test.
+This is caused by a subtle bug inherited when i moved faulty ping
+from one test case to another.
+
+nft_fib.sh not only checks that the fib expression matched, it also
+records the number of matches and then validates we have the expected
+count. When I did this it was under the assumption that we would
+have 0 to n matching packets. In case of the failure, the entry has
+n+1 matching packets.
+
+This happens because ping_unreachable helper uses "ping -c 1 -w 1",
+instead of the intended "-W". -w alters the meaning of -c (count),
+namely, its then treated as number of wanted *replies* instead of
+"number of packets to send".
+
+So, in some cases, ping -c 1 -w 1 ends up sending two packets which then
+makes the test fail due to the higher-than-expected packet count.
+
+Fix the actual bug (s/-w/-W) and also change the error handling:
+1. Show the number of expected packets in the error message
+2. Always try to delete the key from the set.
+ Else, later test that makes sure we don't have unexpected keys
+ in there will always fail as well.
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Closes: https://lore.kernel.org/netfilter-devel/20250927090709.0b3cd783@kernel.org/
+Fixes: 98287045c979 ("selftests: netfilter: move fib vrf test to nft_fib.sh")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/netfilter/nft_fib.sh | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/net/netfilter/nft_fib.sh b/tools/testing/selftests/net/netfilter/nft_fib.sh
+index 9929a9ffef652..04544905c2164 100755
+--- a/tools/testing/selftests/net/netfilter/nft_fib.sh
++++ b/tools/testing/selftests/net/netfilter/nft_fib.sh
+@@ -256,12 +256,12 @@ test_ping_unreachable() {
+ local daddr4=$1
+ local daddr6=$2
+
+- if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr4" > /dev/null; then
++ if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr4" > /dev/null; then
+ echo "FAIL: ${ns1} could reach $daddr4" 1>&2
+ return 1
+ fi
+
+- if ip netns exec "$ns1" ping -c 1 -w 1 -q "$daddr6" > /dev/null; then
++ if ip netns exec "$ns1" ping -c 1 -W 0.1 -q "$daddr6" > /dev/null; then
+ echo "FAIL: ${ns1} could reach $daddr6" 1>&2
+ return 1
+ fi
+@@ -437,14 +437,17 @@ check_type()
+ local addr="$3"
+ local type="$4"
+ local count="$5"
++ local lret=0
+
+ [ -z "$count" ] && count=1
+
+ if ! ip netns exec "$nsrouter" nft get element inet t "$setname" { "$iifname" . "$addr" . "$type" } |grep -q "counter packets $count";then
+- echo "FAIL: did not find $iifname . $addr . $type in $setname"
++ echo "FAIL: did not find $iifname . $addr . $type in $setname with $count packets"
+ ip netns exec "$nsrouter" nft list set inet t "$setname"
+ ret=1
+- return 1
++ # do not fail right away, delete entry if it exists so later test that
++ # checks for unwanted keys don't get confused by this *expected* key.
++ lret=1
+ fi
+
+ # delete the entry, this allows to check if anything unexpected appeared
+@@ -456,7 +459,7 @@ check_type()
+ return 1
+ fi
+
+- return 0
++ return $lret
+ }
+
+ check_local()
+--
+2.51.0
+
--- /dev/null
+From b64c87e19c70a4c95fbb6a831a4cae5f253c4c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 15:05:41 +0200
+Subject: selftests: netfilter: query conntrack state to check for port clash
+ resolution
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit e84945bdc619ed4243ba4298dbb8ca2062026474 ]
+
+Jakub reported this self test flaking occasionally (fails, but passes on
+re-run) on debug kernels.
+
+This is because the test checks for elapsed time to determine if both
+connections were established in parallel.
+
+Rework this to no longer depend on timing.
+Use busywait helper to check that both sockets have moved to established
+state and then query the conntrack engine for the two entries.
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Closes: https://lore.kernel.org/netfilter-devel/20250926163318.40d1a502@kernel.org/
+Fixes: 117e149e26d1 ("selftests: netfilter: test nat source port clash resolution interaction with tcp early demux")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/netfilter/nf_nat_edemux.sh | 58 +++++++++++++------
+ 1 file changed, 41 insertions(+), 17 deletions(-)
+
+diff --git a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+index 1014551dd7694..6731fe1eaf2e9 100755
+--- a/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
++++ b/tools/testing/selftests/net/netfilter/nf_nat_edemux.sh
+@@ -17,9 +17,31 @@ cleanup()
+
+ checktool "socat -h" "run test without socat"
+ checktool "iptables --version" "run test without iptables"
++checktool "conntrack --version" "run test without conntrack"
+
+ trap cleanup EXIT
+
++connect_done()
++{
++ local ns="$1"
++ local port="$2"
++
++ ip netns exec "$ns" ss -nt -o state established "dport = :$port" | grep -q "$port"
++}
++
++check_ctstate()
++{
++ local ns="$1"
++ local dp="$2"
++
++ if ! ip netns exec "$ns" conntrack --get -s 192.168.1.2 -d 192.168.1.1 -p tcp \
++ --sport 10000 --dport "$dp" --state ESTABLISHED > /dev/null 2>&1;then
++ echo "FAIL: Did not find expected state for dport $2"
++ ip netns exec "$ns" bash -c 'conntrack -L; conntrack -S; ss -nt'
++ ret=1
++ fi
++}
++
+ setup_ns ns1 ns2
+
+ # Connect the namespaces using a veth pair
+@@ -44,15 +66,18 @@ socatpid=$!
+ ip netns exec "$ns2" sysctl -q net.ipv4.ip_local_port_range="10000 10000"
+
+ # add a virtual IP using DNAT
+-ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201
++ip netns exec "$ns2" iptables -t nat -A OUTPUT -d 10.96.0.1/32 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.1:5201 || exit 1
+
+ # ... and route it to the other namespace
+ ip netns exec "$ns2" ip route add 10.96.0.1 via 192.168.1.1
+
+-# add a persistent connection from the other namespace
+-ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
++# listener should be up by now, wait if it isn't yet.
++wait_local_port_listen "$ns1" 5201 tcp
+
+-sleep 1
++# add a persistent connection from the other namespace
++sleep 10 | ip netns exec "$ns2" socat -t 10 - TCP:192.168.1.1:5201 > /dev/null &
++cpid0=$!
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" "5201"
+
+ # ip daddr:dport will be rewritten to 192.168.1.1 5201
+ # NAT must reallocate source port 10000 because
+@@ -71,26 +96,25 @@ fi
+ ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5202 -j REDIRECT --to-ports 5201
+ ip netns exec "$ns1" iptables -t nat -A PREROUTING -p tcp --dport 5203 -j REDIRECT --to-ports 5201
+
+-sleep 5 | ip netns exec "$ns2" socat -t 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null &
++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5202,connect-timeout=5 >/dev/null &
++cpid1=$!
+
+-# if connect succeeds, client closes instantly due to EOF on stdin.
+-# if connect hangs, it will time out after 5s.
+-echo | ip netns exec "$ns2" socat -t 3 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null &
++sleep 5 | ip netns exec "$ns2" socat -T 5 -u STDIN TCP:192.168.1.1:5203,connect-timeout=5 >/dev/null &
+ cpid2=$!
+
+-time_then=$(date +%s)
+-wait $cpid2
+-rv=$?
+-time_now=$(date +%s)
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5202
++busywait "$BUSYWAIT_TIMEOUT" connect_done "$ns2" 5203
+
+-# Check how much time has elapsed, expectation is for
+-# 'cpid2' to connect and then exit (and no connect delay).
+-delta=$((time_now - time_then))
++check_ctstate "$ns1" 5202
++check_ctstate "$ns1" 5203
+
+-if [ $delta -lt 2 ] && [ $rv -eq 0 ]; then
++kill $socatpid $cpid0 $cpid1 $cpid2
++socatpid=0
++
++if [ $ret -eq 0 ]; then
+ echo "PASS: could connect to service via redirected ports"
+ else
+- echo "FAIL: socat cannot connect to service via redirect ($delta seconds elapsed, returned $rv)"
++ echo "FAIL: socat cannot connect to service via redirect"
+ ret=1
+ fi
+
+--
+2.51.0
+
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
+clk-npcm-select-config_auxiliary_bus.patch
+clk-thead-th1520-ap-describe-gate-clocks-with-clk_ga.patch
+clk-thead-th1520-ap-fix-parent-of-padctrl0-clock.patch
+clk-thead-correct-parent-for-dpu-pixel-clocks.patch
+clk-renesas-r9a08g045-add-mstop-for-gpio.patch
+perf-disasm-avoid-undefined-behavior-in-incrementing.patch
+perf-test-trace_btf_enum-skip-if-permissions-are-ins.patch
+perf-evsel-avoid-container_of-on-a-null-leader.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-qcom-common-fix-null-vs-is_err-check-in-qcom_cc_.patch
+clk-qcom-select-the-intended-config-in-qcs_dispcc_61.patch
+perf-parse-events-handle-fake-pmus-in-cpu-terms.patch
+clk-at91-peripheral-fix-return-value.patch
+clk-renesas-cpg-mssr-fix-memory-leak-in-cpg_mssr_res.patch
+perf-completely-remove-possibility-to-override-max_n.patch
+perf-drm_pmu-fix-fd_dir-leaks-in-for_each_drm_fdinfo.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+rtc-optee-fix-memory-leak-on-driver-removal.patch
+perf-arm_spe-correct-setting-remote-access.patch
+perf-arm_spe-correct-memory-level-for-remote-access.patch
+perf-vendor-events-arm64-ampereonex-fix-typo-should-.patch
+perf-test-amd-ibs-swfilt-skip-kernel-tests-if-parano.patch
+perf-test-shell-lbr-avoid-failures-with-perf-event-p.patch
+perf-trace-fix-is_err-vs-null-check-bug.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+perf-evsel-fix-uniquification-when-pmu-given-without.patch
+perf-test-avoid-uncore_imc-clockticks-in-uniquificat.patch
+perf-evsel-ensure-the-fallback-message-is-always-wri.patch
+perf-build-id-ensure-snprintf-string-is-empty-when-s.patch
+clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch
+clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch
+nfsd-fix-assignment-of-ia_ctime.tv_nsec-on-delegated.patch
+nfsd-ignore-attr_deleg-when-checking-ia_valid-before.patch
+vfs-add-attr_ctime_set-flag.patch
+nfsd-use-attr_ctime_set-for-delegated-ctime-updates.patch
+nfsd-track-original-timestamps-in-nfs4_delegation.patch
+nfsd-fix-setattr-updates-for-delegated-timestamps.patch
+nfsd-fix-timestamp-updates-in-cb_getattr.patch
+tracing-fix-the-bug-where-bpf_get_stackid-returns-ef.patch
+pm-core-annotate-loops-walking-device-links-as-_srcu.patch
+pm-core-add-two-macros-for-walking-device-links.patch
+pm-sleep-do-not-wait-on-sync_state_only-device-links.patch
+cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+perf-bpf-filter-fix-opts-declaration-on-older-libbpf.patch
+scsi-ufs-sysfs-make-hid-attributes-visible.patch
+mshv-handle-need_resched_lazy-before-transferring-to.patch
+perf-bpf_counter-fix-handling-of-cpumap-fixing-hybri.patch
+asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch
+asoc-sof-ipc4-topology-account-for-different-chaindm.patch
+asoc-sof-intel-hda-pcm-place-the-constraint-on-perio.patch
+loongarch-add-cflag-fno-isolate-erroneous-paths-dere.patch
+loongarch-fix-build-error-for-lto-with-llvm-18.patch
+loongarch-init-acpi_gbl_use_global_lock-to-false.patch
+asoc-sof-intel-read-the-llp-via-the-associated-link-.patch
+net-usb-lan78xx-fix-lost-eeprom-read-timeout-error-e.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+drm-xe-hw_engine_group-fix-double-write-lock-release.patch
+drm-xe-i2c-don-t-rely-on-d3cold.allowed-flag-in-syst.patch
+s390-cio-update-purge-function-to-unregister-the-unu.patch
+drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+drm-vmwgfx-fix-copy-paste-typo-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-mscc-ocelot-fix-use-after-free-caused-by-cyclic-.patch
+selftest-net-ovpn-fix-uninit-return-values.patch
+ice-ice_adapter-release-xa-entry-on-adapter-allocati.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+perf-python-split-clang-options-when-invoking-popen.patch
+tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch
+perf-tools-fix-arm64-libjvmti-build-by-generating-un.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+mailbox-zynqmp-ipi-fix-out-of-bounds-access-in-mailb.patch
+mailbox-zynqmp-ipi-fix-sgi-cleanup-on-unbind.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+net-mdio-mdio-i2c-hold-the-i2c-bus-lock-during-smbus.patch
+net-sparx5-lan969x-fix-flooding-configuration-on-bri.patch
+net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-a.patch
+net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-n.patch
+mailbox-mtk-cmdq-remove-pm_runtime-apis-from-cmdq_mb.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+drm-amd-display-disable-scaling-on-dce6-for-now.patch
+drm-amdkfd-fix-kfd-process-ref-leaking-when-userptr-.patch
+net-pse-pd-tps23881-fix-current-measurement-scaling.patch
+crypto-skcipher-fix-reqsize-handling.patch
+netfilter-nft_objref-validate-objref-and-objrefmap-e.patch
+bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch
+selftests-netfilter-nft_fib.sh-fix-spurious-test-fai.patch
+selftests-netfilter-query-conntrack-state-to-check-f.patch
+io_uring-zcrx-increment-fallback-loop-src-offset.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+net-airoha-fix-loopback-mode-configuration-for-gdm2-.patch
+cifs-fix-copy_to_iter-return-value-check.patch
+smb-client-fix-missing-timestamp-updates-after-utime.patch
+rtc-isl12022-fix-initial-enable_irq-disable_irq-bala.patch
+cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
+bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch
+kbuild-always-create-intermediate-vmlinux.unstripped.patch
+kbuild-keep-.modinfo-section-in-vmlinux.unstripped.patch
+kbuild-restore-pattern-to-avoid-stripping-.rela.dyn-.patch
+kbuild-add-.rel.-strip-pattern-for-vmlinux.patch
+s390-vmlinux.lds.s-reorder-sections.patch
+s390-vmlinux.lds.s-move-.vmlinux.info-to-end-of-allo.patch
--- /dev/null
+From 421052dd94cb1d32fa8a6b9a3e1390385d4ca4cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:23:24 -0300
+Subject: smb: client: fix missing timestamp updates after utime(2)
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ]
+
+Don't reuse open handle when changing timestamps to prevent the server
+from disabling automatic timestamp updates as per MS-FSA 2.1.4.17.
+
+---8<---
+import os
+import time
+
+filename = '/mnt/foo'
+
+def print_stat(prefix):
+ st = os.stat(filename)
+ print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime))
+
+fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644)
+print_stat('old')
+os.utime(fd, None)
+time.sleep(2)
+os.write(fd, b'foo')
+os.close(fd)
+time.sleep(2)
+print_stat('new')
+---8<---
+
+Before patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+
+After patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025
+new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025
+
+Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 0985db9f86e51..e441fa2e76897 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1382,31 +1382,33 @@ int
+ smb2_set_file_info(struct inode *inode, const char *full_path,
+ FILE_BASIC_INFO *buf, const unsigned int xid)
+ {
+- struct cifs_open_parms oparms;
++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++ struct cifsFileInfo *cfile = NULL;
++ struct cifs_open_parms oparms;
+ struct tcon_link *tlink;
+ struct cifs_tcon *tcon;
+- struct cifsFileInfo *cfile;
+- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+- int rc;
+-
+- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
+- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) &&
+- (buf->Attributes == 0))
+- return 0; /* would be a no op, no sense sending this */
++ int rc = 0;
+
+ tlink = cifs_sb_tlink(cifs_sb);
+ if (IS_ERR(tlink))
+ return PTR_ERR(tlink);
+ tcon = tlink_tcon(tlink);
+
+- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) {
++ if (buf->Attributes == 0)
++ goto out; /* would be a no op, no sense sending this */
++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ }
++
+ oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES,
+ FILE_OPEN, 0, ACL_NO_MODE);
+ rc = smb2_compound_op(xid, tcon, cifs_sb,
+ full_path, &oparms, &in_iov,
+ &(int){SMB2_OP_SET_INFO}, 1,
+ cfile, NULL, NULL, NULL);
++out:
+ cifs_put_tlink(tlink);
+ return rc;
+ }
+--
+2.51.0
+
--- /dev/null
+From fa5edc9b80118b623c94a1c4048f1819b5f4f644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 64f93668a8452..a88e82f7ec485 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7275,7 +7275,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From d67b8e98569398275c1e3be85761c32775313793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 18:41:19 +0000
+Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
+
+Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT
+on their listener, before accept().
+
+This has an unfortunate effect on wscale selection in
+tcp_select_initial_window() during 3WHS.
+
+For instance, tcp_mmap was negotiating wscale 4, regardless
+of tcp_rmem[2] and sysctl_rmem_max.
+
+Do not change tp->window_clamp if it is zero
+or bigger than our computed value.
+
+Zero value is special, it allows tcp_select_initial_window()
+to enable autotuning.
+
+Note that SO_RCVLOWAT use on listener is probably not wise,
+because tp->scaling_ratio has a default value, possibly wrong.
+
+Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 89040007c7b70..ba36f558f144c 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1771,6 +1771,7 @@ EXPORT_IPV6_MOD(tcp_peek_len);
+ /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */
+ int tcp_set_rcvlowat(struct sock *sk, int val)
+ {
++ struct tcp_sock *tp = tcp_sk(sk);
+ int space, cap;
+
+ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
+@@ -1789,7 +1790,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
+ space = tcp_space_from_win(sk, val);
+ if (space > sk->sk_rcvbuf) {
+ WRITE_ONCE(sk->sk_rcvbuf, space);
+- WRITE_ONCE(tcp_sk(sk)->window_clamp, val);
++
++ if (tp->window_clamp && tp->window_clamp < val)
++ WRITE_ONCE(tp->window_clamp, val);
+ }
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From f656ca700cd15b067b05e1de273e192163aed761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index b41a42818d8ac..bd615a708a0aa 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -316,10 +316,10 @@ $(OUTPUT)test-libcapstone.bin:
+ $(BUILD) # -lcapstone provided by $(FEATURE_CHECK_LDFLAGS-libcapstone)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From a93f20a8d1e8aca2927eaa48bcef30a3baaf01ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 4b12c4b9da8be..8954a8660ffc5 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -978,8 +978,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c3325e2ad717a59f4df47b6b63f1c513b3a2b6b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:08:22 +0800
+Subject: tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the
+ ARM64
+
+From: Feng Yang <yangfeng@kylinos.cn>
+
+[ Upstream commit fd2f74f8f3d3c1a524637caf5bead9757fae4332 ]
+
+When using bpf_program__attach_kprobe_multi_opts on ARM64 to hook a BPF program
+that contains the bpf_get_stackid function, the BPF program fails
+to obtain the stack trace and returns -EFAULT.
+
+This is because ftrace_partial_regs omits the configuration of the pstate register,
+leaving pstate at the default value of 0. When get_perf_callchain executes,
+it uses user_mode(regs) to determine whether it is in kernel mode.
+This leads to a misjudgment that the code is in user mode,
+so perf_callchain_kernel is not executed and the function returns directly.
+As a result, trace->nr becomes 0, and finally -EFAULT is returned.
+
+Therefore, the assignment of the pstate register is added here.
+
+Fixes: b9b55c8912ce ("tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs")
+Closes: https://lore.kernel.org/bpf/20250919071902.554223-1-yangfeng59949@163.com/
+Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
+Tested-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/ftrace.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
+index bfe3ce9df1978..ba7cf7fec5e97 100644
+--- a/arch/arm64/include/asm/ftrace.h
++++ b/arch/arm64/include/asm/ftrace.h
+@@ -153,6 +153,7 @@ ftrace_partial_regs(const struct ftrace_regs *fregs, struct pt_regs *regs)
+ regs->pc = afregs->pc;
+ regs->regs[29] = afregs->fp;
+ regs->regs[30] = afregs->lr;
++ regs->pstate = PSR_MODE_EL1h;
+ return regs;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4650ec53c9d142f0a801eadc593fa964425a26e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 09:24:32 -0400
+Subject: vfs: add ATTR_CTIME_SET flag
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit afc5b36e29b95fbd31a60b9630d148857e5e513d ]
+
+When ATTR_ATIME_SET and ATTR_MTIME_SET are set in the ia_valid mask, the
+notify_change() logic takes that to mean that the request should set
+those values explicitly, and not override them with "now".
+
+With the advent of delegated timestamps, similar functionality is needed
+for the ctime. Add a ATTR_CTIME_SET flag, and use that to indicate that
+the ctime should be accepted as-is. Also, clean up the if statements to
+eliminate the extra negatives.
+
+In setattr_copy() and setattr_copy_mgtime() use inode_set_ctime_deleg()
+when ATTR_CTIME_SET is set, instead of basing the decision on ATTR_DELEG.
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Stable-dep-of: c066ff58e5d6 ("nfsd: use ATTR_CTIME_SET for delegated ctime updates")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/attr.c | 44 +++++++++++++++++++-------------------------
+ include/linux/fs.h | 1 +
+ 2 files changed, 20 insertions(+), 25 deletions(-)
+
+diff --git a/fs/attr.c b/fs/attr.c
+index 5425c1dbbff92..795f231d00e8e 100644
+--- a/fs/attr.c
++++ b/fs/attr.c
+@@ -286,20 +286,12 @@ static void setattr_copy_mgtime(struct inode *inode, const struct iattr *attr)
+ unsigned int ia_valid = attr->ia_valid;
+ struct timespec64 now;
+
+- if (ia_valid & ATTR_CTIME) {
+- /*
+- * In the case of an update for a write delegation, we must respect
+- * the value in ia_ctime and not use the current time.
+- */
+- if (ia_valid & ATTR_DELEG)
+- now = inode_set_ctime_deleg(inode, attr->ia_ctime);
+- else
+- now = inode_set_ctime_current(inode);
+- } else {
+- /* If ATTR_CTIME isn't set, then ATTR_MTIME shouldn't be either. */
+- WARN_ON_ONCE(ia_valid & ATTR_MTIME);
++ if (ia_valid & ATTR_CTIME_SET)
++ now = inode_set_ctime_deleg(inode, attr->ia_ctime);
++ else if (ia_valid & ATTR_CTIME)
++ now = inode_set_ctime_current(inode);
++ else
+ now = current_time(inode);
+- }
+
+ if (ia_valid & ATTR_ATIME_SET)
+ inode_set_atime_to_ts(inode, attr->ia_atime);
+@@ -359,12 +351,11 @@ void setattr_copy(struct mnt_idmap *idmap, struct inode *inode,
+ inode_set_atime_to_ts(inode, attr->ia_atime);
+ if (ia_valid & ATTR_MTIME)
+ inode_set_mtime_to_ts(inode, attr->ia_mtime);
+- if (ia_valid & ATTR_CTIME) {
+- if (ia_valid & ATTR_DELEG)
+- inode_set_ctime_deleg(inode, attr->ia_ctime);
+- else
+- inode_set_ctime_to_ts(inode, attr->ia_ctime);
+- }
++
++ if (ia_valid & ATTR_CTIME_SET)
++ inode_set_ctime_deleg(inode, attr->ia_ctime);
++ else if (ia_valid & ATTR_CTIME)
++ inode_set_ctime_to_ts(inode, attr->ia_ctime);
+ }
+ EXPORT_SYMBOL(setattr_copy);
+
+@@ -463,15 +454,18 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry,
+
+ now = current_time(inode);
+
+- attr->ia_ctime = now;
+- if (!(ia_valid & ATTR_ATIME_SET))
+- attr->ia_atime = now;
+- else
++ if (ia_valid & ATTR_ATIME_SET)
+ attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
+- if (!(ia_valid & ATTR_MTIME_SET))
+- attr->ia_mtime = now;
+ else
++ attr->ia_atime = now;
++ if (ia_valid & ATTR_CTIME_SET)
++ attr->ia_ctime = timestamp_truncate(attr->ia_ctime, inode);
++ else
++ attr->ia_ctime = now;
++ if (ia_valid & ATTR_MTIME_SET)
+ attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
++ else
++ attr->ia_mtime = now;
+
+ if (ia_valid & ATTR_KILL_PRIV) {
+ error = security_inode_need_killpriv(dentry);
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 601d036a6c78e..74f2bfc519263 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -238,6 +238,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
+ #define ATTR_ATIME_SET (1 << 7)
+ #define ATTR_MTIME_SET (1 << 8)
+ #define ATTR_FORCE (1 << 9) /* Not a change, but a change it */
++#define ATTR_CTIME_SET (1 << 10)
+ #define ATTR_KILL_SUID (1 << 11)
+ #define ATTR_KILL_SGID (1 << 12)
+ #define ATTR_FILE (1 << 13)
+--
+2.51.0
+
--- /dev/null
+From 8774a788ebbe8d695ac2458f9d2e43fd41f63015 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 16:57:50 +0300
+Subject: ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit a7fe5ff832d61d9393095bc3dd5f06f4af7da3c1 ]
+
+The firmware has changed the minimum host buffer size from 2 periods to
+4 periods (1 period is 1ms) which was missed by the kernel side.
+
+Adjust the SOF_IPC4_MIN_DMA_BUFFER_SIZE to 4 ms to align with firmware.
+
+Link: https://github.com/thesofproject/sof/commit/f0a14a3f410735db18a79eb7a5f40dc49fdee7a7
+Fixes: 594c1bb9ff73 ("ASoC: SOF: ipc4-topology: Do not parse the DMA_BUFFER_SIZE token")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20251002135752.2430-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index 0fb759c6eeaf9..07bd84204baa7 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -59,8 +59,8 @@
+
+ #define SOF_IPC4_INVALID_NODE_ID 0xffffffff
+
+-/* FW requires minimum 2ms DMA buffer size */
+-#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 2
++/* FW requires minimum 4ms DMA buffer size */
++#define SOF_IPC4_MIN_DMA_BUFFER_SIZE 4
+
+ /*
+ * The base of multi-gateways. Multi-gateways addressing starts from
+--
+2.51.0
+
--- /dev/null
+From 5a2436e08f7b75565f6c36b59952f3a743dce014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 18:26:26 +0800
+Subject: bpf: Avoid RCU context warning when unpinning htab with internal
+ structs
+
+From: KaFai Wan <kafai.wan@linux.dev>
+
+[ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ]
+
+When unpinning a BPF hash table (htab or htab_lru) that contains internal
+structures (timer, workqueue, or task_work) in its values, a BUG warning
+is triggered:
+ BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0
+ ...
+
+The issue arises from the interaction between BPF object unpinning and
+RCU callback mechanisms:
+1. BPF object unpinning uses ->free_inode() which schedules cleanup via
+ call_rcu(), deferring the actual freeing to an RCU callback that
+ executes within the RCU_SOFTIRQ context.
+2. During cleanup of hash tables containing internal structures,
+ htab_map_free_internal_structs() is invoked, which includes
+ cond_resched() or cond_resched_rcu() calls to yield the CPU during
+ potentially long operations.
+
+However, cond_resched() or cond_resched_rcu() cannot be safely called from
+atomic RCU softirq context, leading to the BUG warning when attempting
+to reschedule.
+
+Fix this by changing from ->free_inode() to ->destroy_inode() and rename
+bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link).
+This allows direct inode freeing without RCU callback scheduling,
+avoiding the invalid context warning.
+
+Reported-by: Le Chen <tom2cat@sjtu.edu.cn>
+Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbra@sjtu.edu.cn/
+Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 99d0625b6c828..9a9630adcba4f 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
+-static void bpf_free_inode(struct inode *inode)
++static void bpf_destroy_inode(struct inode *inode)
+ {
+ enum bpf_type type;
+
+@@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .show_options = bpf_show_options,
+- .free_inode = bpf_free_inode,
++ .destroy_inode = bpf_destroy_inode,
+ };
+
+ enum {
+--
+2.51.0
+
--- /dev/null
+From ac4398b502e8a5e50754bd3ac1709dc853e669ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 09:34:18 +0200
+Subject: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ]
+
+Cilium has a BPF egress gateway feature which forces outgoing K8s Pod
+traffic to pass through dedicated egress gateways which then SNAT the
+traffic in order to interact with stable IPs outside the cluster.
+
+The traffic is directed to the gateway via vxlan tunnel in collect md
+mode. A recent BPF change utilized the bpf_redirect_neigh() helper to
+forward packets after the arrival and decap on vxlan, which turned out
+over time that the kmalloc-256 slab usage in kernel was ever-increasing.
+
+The issue was that vxlan allocates the metadata_dst object and attaches
+it through a fake dst entry to the skb. The latter was never released
+though given bpf_redirect_neigh() was merely setting the new dst entry
+via skb_dst_set() without dropping an existing one first.
+
+Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in")
+Reported-by: Yusuke Suzuki <yusuke.suzuki@isovalent.com>
+Reported-by: Julian Wiedmann <jwi@isovalent.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Martin KaFai Lau <martin.lau@kernel.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Jordan Rife <jrife@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Jordan Rife <jrife@google.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b6dbcef649654..c2e888ea54abb 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2273,6 +2273,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev,
+ if (IS_ERR(dst))
+ goto out_drop;
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, dst);
+ } else if (nh->nh_family != AF_INET6) {
+ goto out_drop;
+@@ -2382,6 +2383,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev,
+ goto out_drop;
+ }
+
++ skb_dst_drop(skb);
+ skb_dst_set(skb, &rt->dst);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e0d6d74dfa0dedef404b673d6b6351293e1c65ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 10:15:01 +0200
+Subject: bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
+
+From: Eric Woudstra <ericwouds@gmail.com>
+
+[ Upstream commit bbf0c98b3ad9edaea1f982de6c199cc11d3b7705 ]
+
+net/bridge/br_private.h:1627 suspicious rcu_dereference_protected() usage!
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+7 locks held by socat/410:
+ #0: ffff88800d7a9c90 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_stream_connect+0x43/0xa0
+ #1: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x62/0x1830
+ [..]
+ #6: ffffffff9a779900 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x8a/0x440
+
+Call Trace:
+ lockdep_rcu_suspicious.cold+0x4f/0xb1
+ br_vlan_fill_forward_path_pvid+0x32c/0x410 [bridge]
+ br_fill_forward_path+0x7a/0x4d0 [bridge]
+
+Use to correct helper, non _rcu variant requires RTNL mutex.
+
+Fixes: bcf2766b1377 ("net: bridge: resolve forwarding path for VLAN tag actions in bridge devices")
+Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index a1c22eab71ffe..cc54b8267bcc7 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -1455,7 +1455,7 @@ void br_vlan_fill_forward_path_pvid(struct net_bridge *br,
+ if (!br_opt_get(br, BROPT_VLAN_ENABLED))
+ return;
+
+- vg = br_vlan_group(br);
++ vg = br_vlan_group_rcu(br);
+
+ if (idx >= 0 &&
+ ctx->vlan[idx].proto == br->vlan_proto) {
+--
+2.51.0
+
--- /dev/null
+From 2c9569ff7796745fcfa9c14a510d1d46f6f89a3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jun 2025 18:11:10 +0200
+Subject: cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse
+ points
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 057ac50638bcece64b3b436d3a61b70ed6c01a34 ]
+
+EA $LXMOD is required for WSL non-symlink reparse points.
+
+Fixes: ef86ab131d91 ("cifs: Fix querying of WSL CHR and BLK reparse points over SMB1")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb1ops.c | 62 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 60 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c
+index e62d9cc592e0c..c80b291a14a57 100644
+--- a/fs/smb/client/smb1ops.c
++++ b/fs/smb/client/smb1ops.c
+@@ -671,14 +671,72 @@ static int cifs_query_path_info(const unsigned int xid,
+ }
+
+ #ifdef CONFIG_CIFS_XATTR
++ /*
++ * For non-symlink WSL reparse points it is required to fetch
++ * EA $LXMOD which contains in its S_DT part the mandatory file type.
++ */
++ if (!rc && data->reparse_point) {
++ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
++
++ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
++ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_MODE,
++ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
++ SMB2_WSL_XATTR_MODE_SIZE, cifs_sb);
++ if (rc == SMB2_WSL_XATTR_MODE_SIZE) {
++ ea->next_entry_offset = cpu_to_le32(0);
++ ea->flags = 0;
++ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
++ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_MODE_SIZE);
++ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_MODE, SMB2_WSL_XATTR_NAME_LEN + 1);
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
++ rc = 0;
++ } else if (rc >= 0) {
++ /* It is an error if EA $LXMOD has wrong size. */
++ rc = -EINVAL;
++ } else {
++ /*
++ * In all other cases ignore error if fetching
++ * of EA $LXMOD failed. It is needed only for
++ * non-symlink WSL reparse points and wsl_to_fattr()
++ * handle the case when EA is missing.
++ */
++ rc = 0;
++ }
++ }
++
+ /*
+ * For WSL CHR and BLK reparse points it is required to fetch
+ * EA $LXDEV which contains major and minor device numbers.
+ */
+ if (!rc && data->reparse_point) {
+ struct smb2_file_full_ea_info *ea;
++ u32 next = 0;
+
+ ea = (struct smb2_file_full_ea_info *)data->wsl.eas;
++ do {
++ ea = (void *)((u8 *)ea + next);
++ next = le32_to_cpu(ea->next_entry_offset);
++ } while (next);
++ if (le16_to_cpu(ea->ea_value_length)) {
++ ea->next_entry_offset = cpu_to_le32(ALIGN(sizeof(*ea) +
++ ea->ea_name_length + 1 +
++ le16_to_cpu(ea->ea_value_length), 4));
++ ea = (void *)((u8 *)ea + le32_to_cpu(ea->next_entry_offset));
++ }
++
+ rc = CIFSSMBQAllEAs(xid, tcon, full_path, SMB2_WSL_XATTR_DEV,
+ &ea->ea_data[SMB2_WSL_XATTR_NAME_LEN + 1],
+ SMB2_WSL_XATTR_DEV_SIZE, cifs_sb);
+@@ -688,8 +746,8 @@ static int cifs_query_path_info(const unsigned int xid,
+ ea->ea_name_length = SMB2_WSL_XATTR_NAME_LEN;
+ ea->ea_value_length = cpu_to_le16(SMB2_WSL_XATTR_DEV_SIZE);
+ memcpy(&ea->ea_data[0], SMB2_WSL_XATTR_DEV, SMB2_WSL_XATTR_NAME_LEN + 1);
+- data->wsl.eas_len = sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
+- SMB2_WSL_XATTR_DEV_SIZE;
++ data->wsl.eas_len += ALIGN(sizeof(*ea) + SMB2_WSL_XATTR_NAME_LEN + 1 +
++ SMB2_WSL_XATTR_MODE_SIZE, 4);
+ rc = 0;
+ } else if (rc >= 0) {
+ /* It is an error if EA $LXDEV has wrong size. */
+--
+2.51.0
+
--- /dev/null
+From 8d5b867c7006c43dcd60da89d899afe74c695d5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:17:53 -0400
+Subject: clk: at91: peripheral: fix return value
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 47b13635dabc14f1c2fdcaa5468b47ddadbdd1b5 ]
+
+determine_rate() is expected to return an error code, or 0 on success.
+clk_sam9x5_peripheral_determine_rate() has a branch that returns the
+parent rate on a certain case. This is the behavior of round_rate(),
+so let's go ahead and fix this by setting req->rate.
+
+Fixes: b4c115c76184f ("clk: at91: clk-peripheral: add support for changeable parent rate")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-peripheral.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
+index c173a44c800aa..629f050a855aa 100644
+--- a/drivers/clk/at91/clk-peripheral.c
++++ b/drivers/clk/at91/clk-peripheral.c
+@@ -279,8 +279,11 @@ static int clk_sam9x5_peripheral_determine_rate(struct clk_hw *hw,
+ long best_diff = LONG_MIN;
+ u32 shift;
+
+- if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max)
+- return parent_rate;
++ if (periph->id < PERIPHERAL_ID_MIN || !periph->range.max) {
++ req->rate = parent_rate;
++
++ return 0;
++ }
+
+ /* Fist step: check the available dividers. */
+ for (shift = 0; shift <= PERIPHERAL_MAX_SHIFT; shift++) {
+--
+2.51.0
+
--- /dev/null
+From 8e3ea810c770da4d4bba39af474209535919297b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:09:31 +0800
+Subject: clk: mediatek: clk-mux: Do not pass flags to
+ clk_mux_determine_rate_flags()
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 5e121370a7ad3414c7f3a77002e2b18abe5c6fe1 ]
+
+The `flags` in |struct mtk_mux| are core clk flags, not mux clk flags.
+Passing one to the other is wrong.
+
+Since there aren't any actual users adding CLK_MUX_* flags, just drop it
+for now.
+
+Fixes: b05ea3314390 ("clk: mediatek: clk-mux: Add .determine_rate() callback")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mux.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mux.c b/drivers/clk/mediatek/clk-mux.c
+index c93bc7f926e5d..359f92df826b5 100644
+--- a/drivers/clk/mediatek/clk-mux.c
++++ b/drivers/clk/mediatek/clk-mux.c
+@@ -132,9 +132,7 @@ static int mtk_clk_mux_set_parent_setclr_lock(struct clk_hw *hw, u8 index)
+ static int mtk_clk_mux_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+- struct mtk_clk_mux *mux = to_mtk_clk_mux(hw);
+-
+- return clk_mux_determine_rate_flags(hw, req, mux->data->flags);
++ return clk_mux_determine_rate_flags(hw, req, 0);
+ }
+
+ const struct clk_ops mtk_mux_clr_set_upd_ops = {
+--
+2.51.0
+
--- /dev/null
+From fed887ce8f5ec1e43018be7aae1837dd0b178fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 10:38:28 +0200
+Subject: clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 6c4c26b624790098988c1034541087e3e5ed5bed ]
+
+The infrastructure gate for the HDMI specific crystal needs the
+top_hdmi_xtal clock to be configured in order to ungate the 26m
+clock to the HDMI IP, and it wouldn't work without.
+
+Reparent the infra_ao_hdmi_26m clock to top_hdmi_xtal to fix that.
+
+Fixes: e2edf59dec0b ("clk: mediatek: Add MT8195 infrastructure clock support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8195-infra_ao.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8195-infra_ao.c b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+index dfba6eb61ccfe..4ecdf9ae02443 100644
+--- a/drivers/clk/mediatek/clk-mt8195-infra_ao.c
++++ b/drivers/clk/mediatek/clk-mt8195-infra_ao.c
+@@ -103,7 +103,7 @@ static const struct mtk_gate infra_ao_clks[] = {
+ GATE_INFRA_AO0(CLK_INFRA_AO_CQ_DMA_FPC, "infra_ao_cq_dma_fpc", "fpc", 28),
+ GATE_INFRA_AO0(CLK_INFRA_AO_UART5, "infra_ao_uart5", "top_uart", 29),
+ /* INFRA_AO1 */
+- GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "clk26m", 0),
++ GATE_INFRA_AO1(CLK_INFRA_AO_HDMI_26M, "infra_ao_hdmi_26m", "top_hdmi_xtal", 0),
+ GATE_INFRA_AO1(CLK_INFRA_AO_SPI0, "infra_ao_spi0", "top_spi", 1),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC0, "infra_ao_msdc0", "top_msdc50_0_hclk", 2),
+ GATE_INFRA_AO1(CLK_INFRA_AO_MSDC1, "infra_ao_msdc1", "top_axi", 4),
+--
+2.51.0
+
--- /dev/null
+From a4c00d35581dd6036ef246bd2bc2f3fda92d5417 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 13:11:55 -0700
+Subject: clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 1624dead9a4d288a594fdf19735ebfe4bb567cb8 ]
+
+The conditional check for the PLL0 multiplier 'm' used a logical AND
+instead of OR, making the range check ineffective. This patch replaces
+&& with || to correctly reject invalid values of 'm' that are either
+less than or equal to 0 or greater than LPC18XX_PLL0_MSEL_MAX.
+
+This ensures proper bounds checking during clk rate setting and rounding.
+
+Fixes: b04e0b8fd544 ("clk: add lpc18xx cgu clk driver")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+[sboyd@kernel.org: 'm' is unsigned so remove < condition]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 821155f79b015..bbd7d64038fab 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -382,7 +382,7 @@ static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
+ }
+
+ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+@@ -405,7 +405,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+ }
+
+ m = DIV_ROUND_UP_ULL(parent_rate, rate * 2);
+- if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
++ if (m == 0 || m > LPC18XX_PLL0_MSEL_MAX) {
+ pr_warn("%s: unable to support rate %lu\n", __func__, rate);
+ return -EINVAL;
+ }
+--
+2.51.0
+
--- /dev/null
+From bca610af3c1e998cd60ab219b703c70b11043dae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:18:29 -0400
+Subject: clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit b46a3d323a5b7942e65025254c13801d0f475f02 ]
+
+The round_rate() clk ops is deprecated, so migrate this driver from
+round_rate() to determine_rate() using the Coccinelle semantic patch
+on the cover letter of this series.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Stable-dep-of: 1624dead9a4d ("clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/nxp/clk-lpc18xx-cgu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/nxp/clk-lpc18xx-cgu.c b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+index 69ebf65081b81..821155f79b015 100644
+--- a/drivers/clk/nxp/clk-lpc18xx-cgu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-cgu.c
+@@ -371,23 +371,25 @@ static unsigned long lpc18xx_pll0_recalc_rate(struct clk_hw *hw,
+ return 0;
+ }
+
+-static long lpc18xx_pll0_round_rate(struct clk_hw *hw, unsigned long rate,
+- unsigned long *prate)
++static int lpc18xx_pll0_determine_rate(struct clk_hw *hw,
++ struct clk_rate_request *req)
+ {
+ unsigned long m;
+
+- if (*prate < rate) {
++ if (req->best_parent_rate < req->rate) {
+ pr_warn("%s: pll dividers not supported\n", __func__);
+ return -EINVAL;
+ }
+
+- m = DIV_ROUND_UP_ULL(*prate, rate * 2);
++ m = DIV_ROUND_UP_ULL(req->best_parent_rate, req->rate * 2);
+ if (m <= 0 && m > LPC18XX_PLL0_MSEL_MAX) {
+- pr_warn("%s: unable to support rate %lu\n", __func__, rate);
++ pr_warn("%s: unable to support rate %lu\n", __func__, req->rate);
+ return -EINVAL;
+ }
+
+- return 2 * *prate * m;
++ req->rate = 2 * req->best_parent_rate * m;
++
++ return 0;
+ }
+
+ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+@@ -444,7 +446,7 @@ static int lpc18xx_pll0_set_rate(struct clk_hw *hw, unsigned long rate,
+
+ static const struct clk_ops lpc18xx_pll0_ops = {
+ .recalc_rate = lpc18xx_pll0_recalc_rate,
+- .round_rate = lpc18xx_pll0_round_rate,
++ .determine_rate = lpc18xx_pll0_determine_rate,
+ .set_rate = lpc18xx_pll0_set_rate,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 5b25b374b98ea1b812a53e6a7069a40d1402343d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Apr 2025 15:54:28 +0300
+Subject: clk: tegra: do not overallocate memory for bpmp clocks
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 49ef6491106209c595476fc122c3922dfd03253f ]
+
+struct tegra_bpmp::clocks is a pointer to a dynamically allocated array
+of pointers to 'struct tegra_bpmp_clk'.
+
+But the size of the allocated area is calculated like it is an array
+containing actual 'struct tegra_bpmp_clk' objects - it's not true, there
+are just pointers.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace static
+analysis tool.
+
+Fixes: 2db12b15c6f3 ("clk: tegra: Register clocks from root to leaf")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-bpmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c
+index 7bfba0afd7783..4ec408c3a26aa 100644
+--- a/drivers/clk/tegra/clk-bpmp.c
++++ b/drivers/clk/tegra/clk-bpmp.c
+@@ -635,7 +635,7 @@ static int tegra_bpmp_register_clocks(struct tegra_bpmp *bpmp,
+
+ bpmp->num_clocks = count;
+
+- bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(struct tegra_bpmp_clk), GFP_KERNEL);
++ bpmp->clocks = devm_kcalloc(bpmp->dev, count, sizeof(*bpmp->clocks), GFP_KERNEL);
+ if (!bpmp->clocks)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From bbf40874408bee5bfe2ef502812020ae184e52a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 21:48:12 -0500
+Subject: cpufreq: tegra186: Set target frequency for all cpus in policy
+
+From: Aaron Kling <webgeek1234@gmail.com>
+
+[ Upstream commit 0b1bb980fd7cae126ee3d59f817068a13e321b07 ]
+
+The original commit set all cores in a cluster to a shared policy, but
+did not update set_target to apply a frequency change to all cores for
+the policy. This caused most cores to remain stuck at their boot
+frequency.
+
+Fixes: be4ae8c19492 ("cpufreq: tegra186: Share policy per cluster")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/tegra186-cpufreq.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/tegra186-cpufreq.c b/drivers/cpufreq/tegra186-cpufreq.c
+index 7b8fcfa55038b..39186008afbfd 100644
+--- a/drivers/cpufreq/tegra186-cpufreq.c
++++ b/drivers/cpufreq/tegra186-cpufreq.c
+@@ -86,10 +86,14 @@ static int tegra186_cpufreq_set_target(struct cpufreq_policy *policy,
+ {
+ struct tegra186_cpufreq_data *data = cpufreq_get_driver_data();
+ struct cpufreq_frequency_table *tbl = policy->freq_table + index;
+- unsigned int edvd_offset = data->cpus[policy->cpu].edvd_offset;
++ unsigned int edvd_offset;
+ u32 edvd_val = tbl->driver_data;
++ u32 cpu;
+
+- writel(edvd_val, data->regs + edvd_offset);
++ for_each_cpu(cpu, policy->cpus) {
++ edvd_offset = data->cpus[cpu].edvd_offset;
++ writel(edvd_val, data->regs + edvd_offset);
++ }
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 180a07eab4626678ae7c073a54b2f7c84552b59e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:54:20 +0800
+Subject: crypto: essiv - Check ssize for decryption and in-place encryption
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f ]
+
+Move the ssize check to the start in essiv_aead_crypt so that
+it's also checked for decryption and in-place encryption.
+
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/essiv.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/essiv.c b/crypto/essiv.c
+index f7d4ef4837e54..4dbec116ddc3e 100644
+--- a/crypto/essiv.c
++++ b/crypto/essiv.c
+@@ -186,9 +186,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm);
+ struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ struct aead_request *subreq = &rctx->aead_req;
++ int ivsize = crypto_aead_ivsize(tfm);
++ int ssize = req->assoclen - ivsize;
+ struct scatterlist *src = req->src;
+ int err;
+
++ if (ssize < 0)
++ return -EINVAL;
++
+ crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv);
+
+ /*
+@@ -198,19 +203,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
+ */
+ rctx->assoc = NULL;
+ if (req->src == req->dst || !enc) {
+- scatterwalk_map_and_copy(req->iv, req->dst,
+- req->assoclen - crypto_aead_ivsize(tfm),
+- crypto_aead_ivsize(tfm), 1);
++ scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1);
+ } else {
+ u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset;
+- int ivsize = crypto_aead_ivsize(tfm);
+- int ssize = req->assoclen - ivsize;
+ struct scatterlist *sg;
+ int nents;
+
+- if (ssize < 0)
+- return -EINVAL;
+-
+ nents = sg_nents_for_len(req->src, ssize);
+ if (nents < 0)
+ return -EINVAL;
+--
+2.51.0
+
--- /dev/null
+From 58317fa2f28d6343afb6d515fcdb669341e2bf17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:22 +0200
+Subject: drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit d60f9c45d1bff7e20ecd57492ef7a5e33c94a37c ]
+
+Without these, it's impossible to program these registers.
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index cbce194ec7b82..ff746fba850bc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,8 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
++ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_SCALE_RATIO, SCL, id), \
+ SRI(SCL_VERT_FILTER_INIT, SCL, id), \
+--
+2.51.0
+
--- /dev/null
+From 5bd59e78d912645f36b2aec61a6e0eee47efaeca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:23 +0200
+Subject: drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit c0aa7cf49dd6cb302fe28e7183992b772cb7420c ]
+
+Previously, the code would set a bit field which didn't exist
+on DCE6 so it would be effectively a no-op.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 670d5ab9d9984..b761dda491d54 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -527,8 +527,7 @@ static void dce60_transform_set_scaler(
+ if (coeffs_v != xfm_dce->filter_v || coeffs_h != xfm_dce->filter_h) {
+ /* 4. Program vertical filters */
+ if (xfm_dce->filter_v == NULL)
+- REG_SET(SCL_VERT_FILTER_CONTROL, 0,
+- SCL_V_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_VERT_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.v_taps,
+@@ -542,8 +541,7 @@ static void dce60_transform_set_scaler(
+
+ /* 5. Program horizontal filters */
+ if (xfm_dce->filter_h == NULL)
+- REG_SET(SCL_HORZ_FILTER_CONTROL, 0,
+- SCL_H_2TAP_HARDCODE_COEF_EN, 0);
++ REG_WRITE(SCL_HORZ_FILTER_CONTROL, 0);
+ program_multi_taps_filter(
+ xfm_dce,
+ data->taps.h_taps,
+--
+2.51.0
+
--- /dev/null
+From 2b44f195f7abdbfa9388335d6e1f5a33b5eb1104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:24 +0200
+Subject: drm/amd/display: Properly disable scaling on DCE6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit a7dc87f3448bea5ebe054f14e861074b9c289c65 ]
+
+SCL_SCALER_ENABLE can be used to enable/disable the scaler
+on DCE6. Program it to 0 when scaling isn't used, 1 when used.
+Additionally, clear some other registers when scaling is
+disabled and program the SCL_UPDATE register as recommended.
+
+This fixes visible glitches for users whose BIOS sets up a
+mode with scaling at boot, which DC was unable to clean up.
+
+Fixes: b70aaf5586f2 ("drm/amd/display: dce_transform: add DCE6 specific macros,functions")
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce/dce_transform.c | 15 +++++++++++----
+ .../gpu/drm/amd/display/dc/dce/dce_transform.h | 2 ++
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index b761dda491d54..f97c182677082 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -154,10 +154,13 @@ static bool dce60_setup_scaling_configuration(
+ REG_SET(SCL_BYPASS_CONTROL, 0, SCL_BYPASS_MODE, 0);
+
+ if (data->taps.h_taps + data->taps.v_taps <= 2) {
+- /* Set bypass */
+-
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ /* Disable scaler functionality */
++ REG_WRITE(SCL_SCALER_ENABLE, 0);
+
++ /* Clear registers that can cause glitches even when the scaler is off */
++ REG_WRITE(SCL_TAP_CONTROL, 0);
++ REG_WRITE(SCL_AUTOMATIC_MODE_CONTROL, 0);
++ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+ return false;
+ }
+
+@@ -165,7 +168,7 @@ static bool dce60_setup_scaling_configuration(
+ SCL_H_NUM_OF_TAPS, data->taps.h_taps - 1,
+ SCL_V_NUM_OF_TAPS, data->taps.v_taps - 1);
+
+- /* DCE6 has no SCL_MODE register, skip scale mode programming */
++ REG_WRITE(SCL_SCALER_ENABLE, 1);
+
+ /* DCE6 has no SCL_BOUNDARY_MODE bit, skip replace out of bound pixels */
+
+@@ -502,6 +505,8 @@ static void dce60_transform_set_scaler(
+ REG_SET(DC_LB_MEM_SIZE, 0,
+ DC_LB_MEM_SIZE, xfm_dce->lb_memory_size);
+
++ REG_WRITE(SCL_UPDATE, 0x00010000);
++
+ /* Clear SCL_F_SHARP_CONTROL value to 0 */
+ REG_WRITE(SCL_F_SHARP_CONTROL, 0);
+
+@@ -564,6 +569,8 @@ static void dce60_transform_set_scaler(
+ /* DCE6 has no SCL_COEF_UPDATE_COMPLETE bit to flip to new coefficient memory */
+
+ /* DCE6 DATA_FORMAT register does not support ALPHA_EN */
++
++ REG_WRITE(SCL_UPDATE, 0);
+ }
+ #endif
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+index ff746fba850bc..eb716e8337e23 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.h
+@@ -155,6 +155,7 @@
+ SRI(SCL_COEF_RAM_TAP_DATA, SCL, id), \
+ SRI(VIEWPORT_START, SCL, id), \
+ SRI(VIEWPORT_SIZE, SCL, id), \
++ SRI(SCL_SCALER_ENABLE, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_RGB_LUMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_INIT_CHROMA, SCL, id), \
+ SRI(SCL_HORZ_FILTER_SCALE_RATIO, SCL, id), \
+@@ -592,6 +593,7 @@ struct dce_transform_registers {
+ uint32_t SCL_VERT_FILTER_SCALE_RATIO;
+ uint32_t SCL_HORZ_FILTER_INIT;
+ #if defined(CONFIG_DRM_AMD_DC_SI)
++ uint32_t SCL_SCALER_ENABLE;
+ uint32_t SCL_HORZ_FILTER_INIT_RGB_LUMA;
+ uint32_t SCL_HORZ_FILTER_INIT_CHROMA;
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 414d215de397e335ac8c7edd98b6126a74ad3897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 20:45:21 +0200
+Subject: drm/amdgpu: Add additional DCE6 SCL registers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 507296328b36ffd00ec1f4fde5b8acafb7222ec7 ]
+
+Fixes: 102b2f587ac8 ("drm/amd/display: dce_transform: DCE6 Scaling Horizontal Filter Init (v2)")
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h | 7 +++++++
+ drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+index 9de01ae574c03..067eddd9c62d8 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_d.h
+@@ -4115,6 +4115,7 @@
+ #define mmSCL0_SCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL0_SCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL0_SCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL0_SCL_SCALER_ENABLE 0x1B42
+ #define mmSCL0_SCL_CONTROL 0x1B44
+ #define mmSCL0_SCL_DEBUG 0x1B6A
+ #define mmSCL0_SCL_DEBUG2 0x1B69
+@@ -4144,6 +4145,7 @@
+ #define mmSCL1_SCL_COEF_RAM_CONFLICT_STATUS 0x1E55
+ #define mmSCL1_SCL_COEF_RAM_SELECT 0x1E40
+ #define mmSCL1_SCL_COEF_RAM_TAP_DATA 0x1E41
++#define mmSCL1_SCL_SCALER_ENABLE 0x1E42
+ #define mmSCL1_SCL_CONTROL 0x1E44
+ #define mmSCL1_SCL_DEBUG 0x1E6A
+ #define mmSCL1_SCL_DEBUG2 0x1E69
+@@ -4173,6 +4175,7 @@
+ #define mmSCL2_SCL_COEF_RAM_CONFLICT_STATUS 0x4155
+ #define mmSCL2_SCL_COEF_RAM_SELECT 0x4140
+ #define mmSCL2_SCL_COEF_RAM_TAP_DATA 0x4141
++#define mmSCL2_SCL_SCALER_ENABLE 0x4142
+ #define mmSCL2_SCL_CONTROL 0x4144
+ #define mmSCL2_SCL_DEBUG 0x416A
+ #define mmSCL2_SCL_DEBUG2 0x4169
+@@ -4202,6 +4205,7 @@
+ #define mmSCL3_SCL_COEF_RAM_CONFLICT_STATUS 0x4455
+ #define mmSCL3_SCL_COEF_RAM_SELECT 0x4440
+ #define mmSCL3_SCL_COEF_RAM_TAP_DATA 0x4441
++#define mmSCL3_SCL_SCALER_ENABLE 0x4442
+ #define mmSCL3_SCL_CONTROL 0x4444
+ #define mmSCL3_SCL_DEBUG 0x446A
+ #define mmSCL3_SCL_DEBUG2 0x4469
+@@ -4231,6 +4235,7 @@
+ #define mmSCL4_SCL_COEF_RAM_CONFLICT_STATUS 0x4755
+ #define mmSCL4_SCL_COEF_RAM_SELECT 0x4740
+ #define mmSCL4_SCL_COEF_RAM_TAP_DATA 0x4741
++#define mmSCL4_SCL_SCALER_ENABLE 0x4742
+ #define mmSCL4_SCL_CONTROL 0x4744
+ #define mmSCL4_SCL_DEBUG 0x476A
+ #define mmSCL4_SCL_DEBUG2 0x4769
+@@ -4260,6 +4265,7 @@
+ #define mmSCL5_SCL_COEF_RAM_CONFLICT_STATUS 0x4A55
+ #define mmSCL5_SCL_COEF_RAM_SELECT 0x4A40
+ #define mmSCL5_SCL_COEF_RAM_TAP_DATA 0x4A41
++#define mmSCL5_SCL_SCALER_ENABLE 0x4A42
+ #define mmSCL5_SCL_CONTROL 0x4A44
+ #define mmSCL5_SCL_DEBUG 0x4A6A
+ #define mmSCL5_SCL_DEBUG2 0x4A69
+@@ -4287,6 +4293,7 @@
+ #define mmSCL_COEF_RAM_CONFLICT_STATUS 0x1B55
+ #define mmSCL_COEF_RAM_SELECT 0x1B40
+ #define mmSCL_COEF_RAM_TAP_DATA 0x1B41
++#define mmSCL_SCALER_ENABLE 0x1B42
+ #define mmSCL_CONTROL 0x1B44
+ #define mmSCL_DEBUG 0x1B6A
+ #define mmSCL_DEBUG2 0x1B69
+diff --git a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+index bd8085ec54ed5..da5596fbfdcb3 100644
+--- a/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
++++ b/drivers/gpu/drm/amd/include/asic_reg/dce/dce_6_0_sh_mask.h
+@@ -8648,6 +8648,8 @@
+ #define REGAMMA_LUT_INDEX__REGAMMA_LUT_INDEX__SHIFT 0x00000000
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK_MASK 0x00000007L
+ #define REGAMMA_LUT_WRITE_EN_MASK__REGAMMA_LUT_WRITE_EN_MASK__SHIFT 0x00000000
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN_MASK 0x00000001L
++#define SCL_SCALER_ENABLE__SCL_SCALE_EN__SHIFT 0x00000000
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE_MASK 0x00000001L
+ #define SCL_ALU_CONTROL__SCL_ALU_DISABLE__SHIFT 0x00000000
+ #define SCL_BYPASS_CONTROL__SCL_BYPASS_MODE_MASK 0x00000003L
+--
+2.51.0
+
--- /dev/null
+From 60a5a43c29831574f91e8189752101b6bb73ba92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:36:55 -0400
+Subject: drm/vmwgfx: Fix a null-ptr access in the cursor snooper
+
+From: Zack Rusin <zack.rusin@broadcom.com>
+
+[ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ]
+
+Check that the resource which is converted to a surface exists before
+trying to use the cursor snooper on it.
+
+vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers
+because some svga commands accept SVGA3D_INVALID_ID to mean "no surface",
+unfortunately functions that accept the actual surfaces as objects might
+(and in case of the cursor snooper, do not) be able to handle null
+objects. Make sure that we validate not only the identifier (via the
+vmw_cmd_res_check) but also check that the actual resource exists before
+trying to do something with it.
+
+Fixes unchecked null-ptr reference in the snooping code.
+
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
+Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index b129ce873af3f..b235e7cc41f3f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+ SVGA3dCmdHeader *header)
+ {
+ struct vmw_bo *vmw_bo = NULL;
++ struct vmw_resource *res;
+ struct vmw_surface *srf = NULL;
+ VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA);
+ int ret;
+@@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+
+ dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ?
+ VMW_RES_DIRTY_SET : 0;
+- ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+- dirty, user_surface_converter,
+- &cmd->body.host.sid, NULL);
++ ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty,
++ user_surface_converter, &cmd->body.host.sid,
++ NULL);
+ if (unlikely(ret != 0)) {
+ if (unlikely(ret != -ERESTARTSYS))
+ VMW_DEBUG_USER("could not find surface for DMA.\n");
+ return ret;
+ }
+
+- srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res);
++ res = sw_context->res_cache[vmw_res_surface].res;
++ if (!res) {
++ VMW_DEBUG_USER("Invalid DMA surface.\n");
++ return -EINVAL;
++ }
+
+- vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header);
++ srf = vmw_res_to_srf(res);
++ vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo,
++ header);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 250465e016445860a80ef2fb56df914881791712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:26 -0500
+Subject: drm/vmwgfx: Fix copy-paste typo in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 228c5d44dffe8c293cd2d2f0e7ea45e64565b1c4 ]
+
+'entry' should be 'val' which is the loop iterator.
+
+Fixes: 9e931f2e0970 ("drm/vmwgfx: Refactor resource validation hashtable to use linux/hashtable implementation.")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-2-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index a4a11e725d183..946f166d6fc76 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -656,7 +656,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx)
+ hash_del_rcu(&val->hash.head);
+
+ list_for_each_entry(val, &ctx->resource_ctx_list, head)
+- hash_del_rcu(&entry->hash.head);
++ hash_del_rcu(&val->hash.head);
+
+ ctx->sw_context = NULL;
+ }
+--
+2.51.0
+
--- /dev/null
+From 243fdc3f62dcc2ab25bf0a78060a09723cf2f18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 14:54:25 -0500
+Subject: drm/vmwgfx: Fix Use-after-free in validation
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]
+
+Nodes stored in the validation duplicates hashtable come from an arena
+allocator that is cleared at the end of vmw_execbuf_process. All nodes
+are expected to be cleared in vmw_validation_drop_ht but this node escaped
+because its resource was destroyed prematurely.
+
+Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
+Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+index aaacbdcbd742f..a4a11e725d183 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
+@@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
+ hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key);
+ }
+ node->res = vmw_resource_reference_unless_doomed(res);
+- if (!node->res)
++ if (!node->res) {
++ hash_del_rcu(&node->hash.head);
+ return -ESRCH;
++ }
+
+ node->first_usage = 1;
+ if (!res->dev_priv->has_mob) {
+--
+2.51.0
+
--- /dev/null
+From 2718ead6dd7f159be888459541805543f025f507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:51:29 +0200
+Subject: gpio: wcd934x: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit b5f8aa8d4bde0cf3e4595af5a536da337e5f1c78 ]
+
+The slimbus regmap passed to the GPIO driver down from MFD does not use
+fast_io. This means a mutex is used for locking and thus this GPIO chip
+must not be used in atomic context. Change the can_sleep switch in
+struct gpio_chip to true.
+
+Fixes: 59c324683400 ("gpio: wcd934x: Add support to wcd934x gpio controller")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-wcd934x.c b/drivers/gpio/gpio-wcd934x.c
+index cfa7b0a50c8e3..03b16b8f639ad 100644
+--- a/drivers/gpio/gpio-wcd934x.c
++++ b/drivers/gpio/gpio-wcd934x.c
+@@ -102,7 +102,7 @@ static int wcd_gpio_probe(struct platform_device *pdev)
+ chip->base = -1;
+ chip->ngpio = WCD934X_NPINS;
+ chip->label = dev_name(dev);
+- chip->can_sleep = false;
++ chip->can_sleep = true;
+
+ return devm_gpiochip_add_data(dev, chip, data);
+ }
+--
+2.51.0
+
--- /dev/null
+From 3b2b954470c72c4cc407ae9f264ec69475ba5d8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:19 -0700
+Subject: libperf event: Ensure tracing data is multiple of 8 sized
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit b39c915a4f365cce6bdc0e538ed95d31823aea8f ]
+
+Perf's synthetic-events.c will ensure 8-byte alignment of tracing
+data, writing it after a perf_record_header_tracing_data event.
+
+Add padding to struct perf_record_header_tracing_data to make it 16-byte
+rather than 12-byte sized.
+
+Fixes: 055c67ed39887c55 ("perf tools: Move event synthesizing routines to separate .c file")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-6-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/include/perf/event.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/perf/include/perf/event.h b/tools/lib/perf/include/perf/event.h
+index ae64090184d32..b50960cce23f2 100644
+--- a/tools/lib/perf/include/perf/event.h
++++ b/tools/lib/perf/include/perf/event.h
+@@ -285,6 +285,7 @@ struct perf_record_header_event_type {
+ struct perf_record_header_tracing_data {
+ struct perf_event_header header;
+ __u32 size;
++ __u32 pad;
+ };
+
+ #define PERF_RECORD_MISC_BUILD_ID_SIZE (1 << 15)
+--
+2.51.0
+
--- /dev/null
+From 50159db5e7de2e07a85c89e44f1365e8a10047e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 22:38:57 +0800
+Subject: LoongArch: Init acpi_gbl_use_global_lock to false
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 98662be7ef20d2b88b598f72e7ce9b6ac26a40f9 ]
+
+Init acpi_gbl_use_global_lock to false, in order to void error messages
+during boot phase:
+
+ ACPI Error: Could not enable GlobalLock event (20240827/evxfevnt-182)
+ ACPI Error: No response from Global Lock hardware, disabling lock (20240827/evglock-59)
+
+Fixes: 628c3bb40e9a8cefc0a6 ("LoongArch: Add boot and setup routines")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index a494b13c9e90c..31be0d00976e2 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -365,6 +365,7 @@ void __init platform_init(void)
+
+ #ifdef CONFIG_ACPI
+ acpi_table_upgrade();
++ acpi_gbl_use_global_lock = false;
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From f1865fad188d3c8a08287fbdb8abe2978916b563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2024 15:45:53 +0800
+Subject: LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6c3ca6654a74dd396bc477839ba8d9792eced441 ]
+
+Both acpi_table_upgrade() and acpi_boot_table_init() are defined as
+empty functions under !CONFIG_ACPI_TABLE_UPGRADE and !CONFIG_ACPI in
+include/linux/acpi.h, there are no implicit declaration errors with
+various configs.
+
+ #ifdef CONFIG_ACPI_TABLE_UPGRADE
+ void acpi_table_upgrade(void);
+ #else
+ static inline void acpi_table_upgrade(void) { }
+ #endif
+
+ #ifdef CONFIG_ACPI
+ ...
+ void acpi_boot_table_init (void);
+ ...
+ #else /* !CONFIG_ACPI */
+ ...
+ static inline void acpi_boot_table_init(void)
+ {
+ }
+ ...
+ #endif /* !CONFIG_ACPI */
+
+As Huacai suggested, CONFIG_ACPI_TABLE_UPGRADE is ugly and not necessary
+here, just remove it. At the same time, just keep CONFIG_ACPI to prevent
+potential build errors in future, and give a signal to indicate the code
+is ACPI-specific. For the same reason, we also put acpi_table_upgrade()
+under CONFIG_ACPI.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Stable-dep-of: 98662be7ef20 ("LoongArch: Init acpi_gbl_use_global_lock to false")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/setup.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 655dc2b1616f2..a494b13c9e90c 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -363,10 +363,8 @@ void __init platform_init(void)
+ arch_reserve_vmcore();
+ arch_parse_crashkernel();
+
+-#ifdef CONFIG_ACPI_TABLE_UPGRADE
+- acpi_table_upgrade();
+-#endif
+ #ifdef CONFIG_ACPI
++ acpi_table_upgrade();
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 2303ebcd4a4fe88b1534c9dd8e60e5a4ff0c40c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:21 +0530
+Subject: mailbox: zynqmp-ipi: Remove dev.parent check in
+ zynqmp_ipi_free_mboxes
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 019e3f4550fc7d319a7fd03eff487255f8e8aecd ]
+
+The ipi_mbox->dev.parent check is unreliable proxy for registration
+status as it fails to protect against probe failures that occur after
+the parent is assigned but before device_register() completes.
+
+device_is_registered() is the canonical and robust method to verify the
+registration status.
+
+Remove ipi_mbox->dev.parent check in zynqmp_ipi_free_mboxes().
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index 06529dc0daf3f..90f248ef2a1fc 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -616,10 +616,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ i = pdata->num_mboxes;
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+- if (ipi_mbox->dev.parent) {
+- if (device_is_registered(&ipi_mbox->dev))
+- device_unregister(&ipi_mbox->dev);
+- }
++ if (device_is_registered(&ipi_mbox->dev))
++ device_unregister(&ipi_mbox->dev);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 20f450a39a77e06135610480c35a7258c0cb8c35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 13:07:20 +0530
+Subject: mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
+ call
+
+From: Harini T <harini.t@amd.com>
+
+[ Upstream commit 341867f730d3d3bb54491ee64e8b1a0c446656e7 ]
+
+The controller is registered using the device-managed function
+'devm_mbox_controller_register()'. As documented in mailbox.c, this
+ensures the devres framework automatically calls
+mbox_controller_unregister() when device_unregister() is invoked, making
+the explicit call unnecessary.
+
+Remove redundant mbox_controller_unregister() call as
+device_unregister() handles controller cleanup.
+
+Fixes: 4981b82ba2ff ("mailbox: ZynqMP IPI mailbox controller")
+Signed-off-by: Harini T <harini.t@amd.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/zynqmp-ipi-mailbox.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mailbox/zynqmp-ipi-mailbox.c b/drivers/mailbox/zynqmp-ipi-mailbox.c
+index e4fcac97dbfaa..06529dc0daf3f 100644
+--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
++++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
+@@ -617,7 +617,6 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
+ for (; i >= 0; i--) {
+ ipi_mbox = &pdata->ipi_mboxes[i];
+ if (ipi_mbox->dev.parent) {
+- mbox_controller_unregister(&ipi_mbox->mbox);
+ if (device_is_registered(&ipi_mbox->dev))
+ device_unregister(&ipi_mbox->dev);
+ }
+--
+2.51.0
+
--- /dev/null
+From aed6c9dfa379dccab7909869b6c0c94f90a1db02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 20:46:17 +0300
+Subject: net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
+
+From: Erick Karanja <karanja99erick@gmail.com>
+
+[ Upstream commit 521405cb54cd2812bbb6dedd5afc14bca1e7e98a ]
+
+Add missing of_node_put call to release device node tbi obtained
+via for_each_child_of_node.
+
+Fixes: afae5ad78b342 ("net/fsl_pq_mdio: streamline probing of MDIO nodes")
+Signed-off-by: Erick Karanja <karanja99erick@gmail.com>
+Link: https://patch.msgid.link/20251002174617.960521-1-karanja99erick@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fsl_pq_mdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index eee675a25b2c3..ef9adecb639ae 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -483,10 +483,12 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ "missing 'reg' property in node %pOF\n",
+ tbi);
+ err = -EBUSY;
++ of_node_put(tbi);
+ goto error;
+ }
+ set_tbipa(*prop, pdev,
+ data->get_tbipa, priv->map, &res);
++ of_node_put(tbi);
+ }
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8e93e1382a320ecff7ad5d6d93de79670dee38bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:25:01 +0300
+Subject: net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 4f0d91ba72811fd5dd577bcdccd7fed649aae62c ]
+
+Print "entry->mac" before freeing "entry". The "entry" pointer is
+freed with kfree_rcu() so it's unlikely that we would trigger this
+in real life, but it's safer to re-order it.
+
+Fixes: cc5387f7346a ("net/mlx4_en: Add unicast MAC filtering")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/aNvMHX4g8RksFFvV@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 33bbcced81059..275561272721e 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1177,9 +1177,9 @@ static void mlx4_en_do_uc_filter(struct mlx4_en_priv *priv,
+ mlx4_unregister_mac(mdev->dev, priv->port, mac);
+
+ hlist_del_rcu(&entry->hlist);
+- kfree_rcu(entry, rcu);
+ en_dbg(DRV, priv, "Removed MAC %pM on port:%d\n",
+ entry->mac, priv->port);
++ kfree_rcu(entry, rcu);
+ ++removed;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 78a6b228cba6b73c19d4f7a5409e7f011ba3ef6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Oct 2025 12:14:47 +0300
+Subject: net/sctp: fix a null dereference in sctp_disposition
+ sctp_sf_do_5_1D_ce()
+
+From: Alexandr Sapozhnikov <alsp705@gmail.com>
+
+[ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ]
+
+If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
+and sctp_ulpevent_make_authkey() returns 0, then the variable
+ai_ev remains zero and the zero will be dereferenced
+in the sctp_ulpevent_free() function.
+
+Signed-off-by: Alexandr Sapozhnikov <alsp705@gmail.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT")
+Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 808863e047e0c..2d88654e8d8e7 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -884,7 +884,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
+ return SCTP_DISPOSITION_CONSUME;
+
+ nomem_authev:
+- sctp_ulpevent_free(ai_ev);
++ if (ai_ev)
++ sctp_ulpevent_free(ai_ev);
+ nomem_aiev:
+ sctp_ulpevent_free(ev);
+ nomem_ev:
+--
+2.51.0
+
--- /dev/null
+From f9d29e33a563575e27f639ff15ee848b2b03d7fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2024 11:34:02 +0200
+Subject: netfilter: nf_tables: drop unused 3rd argument from validate callback
+ ops
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit eaf9b2c875ece22768b78aa38da8b232e5de021b ]
+
+Since commit a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
+the validate() callback no longer needs the return pointer argument.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: f359b809d54c ("netfilter: nft_objref: validate objref and objrefmap expressions")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 3 +--
+ include/net/netfilter/nft_fib.h | 4 +---
+ include/net/netfilter/nft_meta.h | 3 +--
+ include/net/netfilter/nft_reject.h | 3 +--
+ net/bridge/netfilter/nft_meta_bridge.c | 5 ++---
+ net/bridge/netfilter/nft_reject_bridge.c | 3 +--
+ net/netfilter/nf_tables_api.c | 3 +--
+ net/netfilter/nft_compat.c | 6 ++----
+ net/netfilter/nft_fib.c | 3 +--
+ net/netfilter/nft_flow_offload.c | 3 +--
+ net/netfilter/nft_fwd_netdev.c | 3 +--
+ net/netfilter/nft_immediate.c | 3 +--
+ net/netfilter/nft_lookup.c | 3 +--
+ net/netfilter/nft_masq.c | 3 +--
+ net/netfilter/nft_meta.c | 6 ++----
+ net/netfilter/nft_nat.c | 3 +--
+ net/netfilter/nft_osf.c | 3 +--
+ net/netfilter/nft_queue.c | 3 +--
+ net/netfilter/nft_redir.c | 3 +--
+ net/netfilter/nft_reject.c | 3 +--
+ net/netfilter/nft_reject_inet.c | 3 +--
+ net/netfilter/nft_reject_netdev.c | 3 +--
+ net/netfilter/nft_rt.c | 3 +--
+ net/netfilter/nft_socket.c | 3 +--
+ net/netfilter/nft_synproxy.c | 3 +--
+ net/netfilter/nft_tproxy.c | 3 +--
+ net/netfilter/nft_xfrm.c | 3 +--
+ 27 files changed, 30 insertions(+), 60 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index c0f4b91e4f5ec..32606d5430605 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -955,8 +955,7 @@ struct nft_expr_ops {
+ const struct nft_expr *expr,
+ bool reset);
+ int (*validate)(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data);
++ const struct nft_expr *expr);
+ bool (*reduce)(struct nft_regs_track *track,
+ const struct nft_expr *expr);
+ bool (*gc)(struct net *net,
+diff --git a/include/net/netfilter/nft_fib.h b/include/net/netfilter/nft_fib.h
+index 167640b843ef8..38cae7113de46 100644
+--- a/include/net/netfilter/nft_fib.h
++++ b/include/net/netfilter/nft_fib.h
+@@ -21,9 +21,7 @@ nft_fib_is_loopback(const struct sk_buff *skb, const struct net_device *in)
+ int nft_fib_dump(struct sk_buff *skb, const struct nft_expr *expr, bool reset);
+ int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ const struct nlattr * const tb[]);
+-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+- const struct nft_data **data);
+-
++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr);
+
+ void nft_fib4_eval_type(const struct nft_expr *expr, struct nft_regs *regs,
+ const struct nft_pktinfo *pkt);
+diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
+index ba1238f12a487..d602263590fed 100644
+--- a/include/net/netfilter/nft_meta.h
++++ b/include/net/netfilter/nft_meta.h
+@@ -41,8 +41,7 @@ void nft_meta_set_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr);
+
+ int nft_meta_set_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data);
++ const struct nft_expr *expr);
+
+ bool nft_meta_get_reduce(struct nft_regs_track *track,
+ const struct nft_expr *expr);
+diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
+index 6d9ba62efd750..19060212988a1 100644
+--- a/include/net/netfilter/nft_reject.h
++++ b/include/net/netfilter/nft_reject.h
+@@ -15,8 +15,7 @@ struct nft_reject {
+ extern const struct nla_policy nft_reject_policy[];
+
+ int nft_reject_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data);
++ const struct nft_expr *expr);
+
+ int nft_reject_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
+index bd4d1b4d745f6..affb740c8685e 100644
+--- a/net/bridge/netfilter/nft_meta_bridge.c
++++ b/net/bridge/netfilter/nft_meta_bridge.c
+@@ -168,8 +168,7 @@ static bool nft_meta_bridge_set_reduce(struct nft_regs_track *track,
+ }
+
+ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ struct nft_meta *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+@@ -179,7 +178,7 @@ static int nft_meta_bridge_set_validate(const struct nft_ctx *ctx,
+ hooks = 1 << NF_BR_PRE_ROUTING;
+ break;
+ default:
+- return nft_meta_set_validate(ctx, expr, data);
++ return nft_meta_set_validate(ctx, expr);
+ }
+
+ return nft_chain_validate_hooks(ctx->chain, hooks);
+diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
+index 71b54fed7263d..1cb5c16e97b7f 100644
+--- a/net/bridge/netfilter/nft_reject_bridge.c
++++ b/net/bridge/netfilter/nft_reject_bridge.c
+@@ -170,8 +170,7 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_reject_bridge_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_BR_PRE_ROUTING) |
+ (1 << NF_BR_LOCAL_IN));
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 4ffb5ef79ca13..5ca1d775e976d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3793,7 +3793,6 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r
+ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
+ {
+ struct nft_expr *expr, *last;
+- const struct nft_data *data;
+ struct nft_rule *rule;
+ int err;
+
+@@ -3814,7 +3813,7 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
+ /* This may call nft_chain_validate() recursively,
+ * callers that do so must increment ctx->level.
+ */
+- err = expr->ops->validate(ctx, expr, &data);
++ err = expr->ops->validate(ctx, expr);
+ if (err < 0)
+ return err;
+ }
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index d3d11dede5450..52cdfee17f73f 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -350,8 +350,7 @@ static int nft_target_dump(struct sk_buff *skb,
+ }
+
+ static int nft_target_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ struct xt_target *target = expr->ops->data;
+ unsigned int hook_mask = 0;
+@@ -611,8 +610,7 @@ static int nft_match_large_dump(struct sk_buff *skb,
+ }
+
+ static int nft_match_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ struct xt_match *match = expr->ops->data;
+ unsigned int hook_mask = 0;
+diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c
+index bf825f6cb974e..507b7eba9bcdc 100644
+--- a/net/netfilter/nft_fib.c
++++ b/net/netfilter/nft_fib.c
+@@ -26,8 +26,7 @@ const struct nla_policy nft_fib_policy[NFTA_FIB_MAX + 1] = {
+ };
+ EXPORT_SYMBOL(nft_fib_policy);
+
+-int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+- const struct nft_data **data)
++int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+ const struct nft_fib *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 5a3d685420420..1894032a7971c 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -385,8 +385,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ unsigned int hook_mask = (1 << NF_INET_FORWARD);
+
+diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
+index a5268e6dd32f1..fa9e4ae00b16a 100644
+--- a/net/netfilter/nft_fwd_netdev.c
++++ b/net/netfilter/nft_fwd_netdev.c
+@@ -204,8 +204,7 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb,
+ }
+
+ static int nft_fwd_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS) |
+ (1 << NF_NETDEV_EGRESS));
+diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
+index ac2422c215e54..02ee5fb69871f 100644
+--- a/net/netfilter/nft_immediate.c
++++ b/net/netfilter/nft_immediate.c
+@@ -244,8 +244,7 @@ static int nft_immediate_dump(struct sk_buff *skb,
+ }
+
+ static int nft_immediate_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **d)
++ const struct nft_expr *expr)
+ {
+ const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+ struct nft_ctx *pctx = (struct nft_ctx *)ctx;
+diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
+index 1b9edf2b33937..dd5441f92fdb0 100644
+--- a/net/netfilter/nft_lookup.c
++++ b/net/netfilter/nft_lookup.c
+@@ -206,8 +206,7 @@ static int nft_lookup_dump(struct sk_buff *skb,
+ }
+
+ static int nft_lookup_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **d)
++ const struct nft_expr *expr)
+ {
+ const struct nft_lookup *priv = nft_expr_priv(expr);
+ struct nft_set_iter iter;
+diff --git a/net/netfilter/nft_masq.c b/net/netfilter/nft_masq.c
+index 8a14aaca93bbd..eee05394c5339 100644
+--- a/net/netfilter/nft_masq.c
++++ b/net/netfilter/nft_masq.c
+@@ -27,8 +27,7 @@ static const struct nla_policy nft_masq_policy[NFTA_MASQ_MAX + 1] = {
+ };
+
+ static int nft_masq_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ int err;
+
+diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
+index 9139ce38ea7b9..dec76d28a0ac6 100644
+--- a/net/netfilter/nft_meta.c
++++ b/net/netfilter/nft_meta.c
+@@ -581,8 +581,7 @@ static int nft_meta_get_validate_xfrm(const struct nft_ctx *ctx)
+ }
+
+ static int nft_meta_get_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ const struct nft_meta *priv = nft_expr_priv(expr);
+
+@@ -600,8 +599,7 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx,
+ }
+
+ int nft_meta_set_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ struct nft_meta *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
+index 808f5802c2704..3d3e639a7a837 100644
+--- a/net/netfilter/nft_nat.c
++++ b/net/netfilter/nft_nat.c
+@@ -137,8 +137,7 @@ static const struct nla_policy nft_nat_policy[NFTA_NAT_MAX + 1] = {
+ };
+
+ static int nft_nat_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ struct nft_nat *priv = nft_expr_priv(expr);
+ int err;
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index 7f61506e5b44b..123b4f47ccef4 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -113,8 +113,7 @@ static int nft_osf_dump(struct sk_buff *skb,
+ }
+
+ static int nft_osf_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ unsigned int hooks;
+
+diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c
+index b2b8127c8d438..b8ebb187814f2 100644
+--- a/net/netfilter/nft_queue.c
++++ b/net/netfilter/nft_queue.c
+@@ -69,8 +69,7 @@ static void nft_queue_sreg_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_queue_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) |
+ (1 << NF_INET_LOCAL_IN) |
+diff --git a/net/netfilter/nft_redir.c b/net/netfilter/nft_redir.c
+index a58bd8d291ff2..9051863509f31 100644
+--- a/net/netfilter/nft_redir.c
++++ b/net/netfilter/nft_redir.c
+@@ -27,8 +27,7 @@ static const struct nla_policy nft_redir_policy[NFTA_REDIR_MAX + 1] = {
+ };
+
+ static int nft_redir_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ int err;
+
+diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
+index ed2e668474d67..196a92c7ea09b 100644
+--- a/net/netfilter/nft_reject.c
++++ b/net/netfilter/nft_reject.c
+@@ -24,8 +24,7 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
+ EXPORT_SYMBOL_GPL(nft_reject_policy);
+
+ int nft_reject_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ return nft_chain_validate_hooks(ctx->chain,
+ (1 << NF_INET_LOCAL_IN) |
+diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
+index 973fa31a9dd6c..49020e67304ad 100644
+--- a/net/netfilter/nft_reject_inet.c
++++ b/net/netfilter/nft_reject_inet.c
+@@ -61,8 +61,7 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_reject_inet_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ return nft_chain_validate_hooks(ctx->chain,
+ (1 << NF_INET_LOCAL_IN) |
+diff --git a/net/netfilter/nft_reject_netdev.c b/net/netfilter/nft_reject_netdev.c
+index 7865cd8b11bb6..2558ce1505d98 100644
+--- a/net/netfilter/nft_reject_netdev.c
++++ b/net/netfilter/nft_reject_netdev.c
+@@ -145,8 +145,7 @@ static void nft_reject_netdev_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_reject_netdev_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
+ }
+diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
+index 2434c624aafde..9525f1e02a7d8 100644
+--- a/net/netfilter/nft_rt.c
++++ b/net/netfilter/nft_rt.c
+@@ -160,8 +160,7 @@ static int nft_rt_get_dump(struct sk_buff *skb,
+ return -1;
+ }
+
+-static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+- const struct nft_data **data)
++static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+ const struct nft_rt *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
+index 187b667bad6c3..35d0409b00950 100644
+--- a/net/netfilter/nft_socket.c
++++ b/net/netfilter/nft_socket.c
+@@ -275,8 +275,7 @@ static bool nft_socket_reduce(struct nft_regs_track *track,
+ }
+
+ static int nft_socket_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ if (ctx->family != NFPROTO_IPV4 &&
+ ctx->family != NFPROTO_IPV6 &&
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 1d737f89dfc18..5d3e518259859 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -248,8 +248,7 @@ static void nft_synproxy_eval(const struct nft_expr *expr,
+ }
+
+ static int nft_synproxy_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ if (ctx->family != NFPROTO_IPV4 &&
+ ctx->family != NFPROTO_IPV6 &&
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index 71412adb73d41..ed344af2a439b 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -313,8 +313,7 @@ static int nft_tproxy_dump(struct sk_buff *skb,
+ }
+
+ static int nft_tproxy_validate(const struct nft_ctx *ctx,
+- const struct nft_expr *expr,
+- const struct nft_data **data)
++ const struct nft_expr *expr)
+ {
+ if (ctx->family != NFPROTO_IPV4 &&
+ ctx->family != NFPROTO_IPV6 &&
+diff --git a/net/netfilter/nft_xfrm.c b/net/netfilter/nft_xfrm.c
+index 1c866757db552..8a07b46cc8fb7 100644
+--- a/net/netfilter/nft_xfrm.c
++++ b/net/netfilter/nft_xfrm.c
+@@ -229,8 +229,7 @@ static int nft_xfrm_get_dump(struct sk_buff *skb,
+ return 0;
+ }
+
+-static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr,
+- const struct nft_data **data)
++static int nft_xfrm_validate(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+ const struct nft_xfrm *priv = nft_expr_priv(expr);
+ unsigned int hooks;
+--
+2.51.0
+
--- /dev/null
+From 463dac4587a3d1920e0d80708f5a19e97ad4cb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 12:08:16 +0200
+Subject: netfilter: nft_objref: validate objref and objrefmap expressions
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit f359b809d54c6e3dd1d039b97e0b68390b0e53e4 ]
+
+Referencing a synproxy stateful object from OUTPUT hook causes kernel
+crash due to infinite recursive calls:
+
+BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)
+[...]
+Call Trace:
+ __find_rr_leaf+0x99/0x230
+ fib6_table_lookup+0x13b/0x2d0
+ ip6_pol_route+0xa4/0x400
+ fib6_rule_lookup+0x156/0x240
+ ip6_route_output_flags+0xc6/0x150
+ __nf_ip6_route+0x23/0x50
+ synproxy_send_tcp_ipv6+0x106/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+ nft_synproxy_do_eval+0x263/0x310
+ nft_do_chain+0x5a8/0x5f0 [nf_tables
+ nft_do_chain_inet+0x98/0x110
+ nf_hook_slow+0x43/0xc0
+ __ip6_local_out+0xf0/0x170
+ ip6_local_out+0x17/0x70
+ synproxy_send_tcp_ipv6+0x1a2/0x200
+ synproxy_send_client_synack_ipv6+0x1aa/0x1f0
+[...]
+
+Implement objref and objrefmap expression validate functions.
+
+Currently, only NFT_OBJECT_SYNPROXY object type requires validation.
+This will also handle a jump to a chain using a synproxy object from the
+OUTPUT hook.
+
+Now when trying to reference a synproxy object in the OUTPUT hook, nft
+will produce the following error:
+
+synproxy_crash.nft: Error: Could not process rule: Operation not supported
+ synproxy name mysynproxy
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Reported-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
+Closes: https://bugzilla.suse.com/1250237
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_objref.c | 39 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
+index 509011b1ef597..08a27433e2f5f 100644
+--- a/net/netfilter/nft_objref.c
++++ b/net/netfilter/nft_objref.c
+@@ -22,6 +22,35 @@ void nft_objref_eval(const struct nft_expr *expr,
+ obj->ops->eval(obj, regs, pkt);
+ }
+
++static int nft_objref_validate_obj_type(const struct nft_ctx *ctx, u32 type)
++{
++ unsigned int hooks;
++
++ switch (type) {
++ case NFT_OBJECT_SYNPROXY:
++ if (ctx->family != NFPROTO_IPV4 &&
++ ctx->family != NFPROTO_IPV6 &&
++ ctx->family != NFPROTO_INET)
++ return -EOPNOTSUPP;
++
++ hooks = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD);
++
++ return nft_chain_validate_hooks(ctx->chain, hooks);
++ default:
++ break;
++ }
++
++ return 0;
++}
++
++static int nft_objref_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ struct nft_object *obj = nft_objref_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, obj->ops->type->type);
++}
++
+ static int nft_objref_init(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nlattr * const tb[])
+@@ -93,6 +122,7 @@ static const struct nft_expr_ops nft_objref_ops = {
+ .activate = nft_objref_activate,
+ .deactivate = nft_objref_deactivate,
+ .dump = nft_objref_dump,
++ .validate = nft_objref_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+@@ -198,6 +228,14 @@ static void nft_objref_map_destroy(const struct nft_ctx *ctx,
+ nf_tables_destroy_set(ctx, priv->set);
+ }
+
++static int nft_objref_map_validate(const struct nft_ctx *ctx,
++ const struct nft_expr *expr)
++{
++ const struct nft_objref_map *priv = nft_expr_priv(expr);
++
++ return nft_objref_validate_obj_type(ctx, priv->set->objtype);
++}
++
+ static const struct nft_expr_ops nft_objref_map_ops = {
+ .type = &nft_objref_type,
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_objref_map)),
+@@ -207,6 +245,7 @@ static const struct nft_expr_ops nft_objref_map_ops = {
+ .deactivate = nft_objref_map_deactivate,
+ .destroy = nft_objref_map_destroy,
+ .dump = nft_objref_map_dump,
++ .validate = nft_objref_map_validate,
+ .reduce = NFT_REDUCE_READONLY,
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e1e7b3ff7de578cc0001c3bfb674d8964b4dfcd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 19:53:17 +0100
+Subject: perf arm-spe: Rename the common data source encoding
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 50b8f1d5bf4ad7f09ef8012ccf5f94f741df827b ]
+
+The Neoverse CPUs follow the common data source encoding, and other
+CPU variants can share the same format.
+
+Rename the CPU list and data source definitions as common data source
+names. This change prepares for appending more CPU variants.
+
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20241003185322.192357-3-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: cb300e351505 ("perf arm_spe: Correct memory level for remote access")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/arm-spe-decoder/arm-spe-decoder.h | 18 ++++++------
+ tools/perf/util/arm-spe.c | 28 +++++++++----------
+ 2 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+index 1443c28545a94..358c611eeddbb 100644
+--- a/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
++++ b/tools/perf/util/arm-spe-decoder/arm-spe-decoder.h
+@@ -56,15 +56,15 @@ enum arm_spe_op_type {
+ ARM_SPE_OP_BR_INDIRECT = 1 << 17,
+ };
+
+-enum arm_spe_neoverse_data_source {
+- ARM_SPE_NV_L1D = 0x0,
+- ARM_SPE_NV_L2 = 0x8,
+- ARM_SPE_NV_PEER_CORE = 0x9,
+- ARM_SPE_NV_LOCAL_CLUSTER = 0xa,
+- ARM_SPE_NV_SYS_CACHE = 0xb,
+- ARM_SPE_NV_PEER_CLUSTER = 0xc,
+- ARM_SPE_NV_REMOTE = 0xd,
+- ARM_SPE_NV_DRAM = 0xe,
++enum arm_spe_common_data_source {
++ ARM_SPE_COMMON_DS_L1D = 0x0,
++ ARM_SPE_COMMON_DS_L2 = 0x8,
++ ARM_SPE_COMMON_DS_PEER_CORE = 0x9,
++ ARM_SPE_COMMON_DS_LOCAL_CLUSTER = 0xa,
++ ARM_SPE_COMMON_DS_SYS_CACHE = 0xb,
++ ARM_SPE_COMMON_DS_PEER_CLUSTER = 0xc,
++ ARM_SPE_COMMON_DS_REMOTE = 0xd,
++ ARM_SPE_COMMON_DS_DRAM = 0xe,
+ };
+
+ struct arm_spe_record {
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 0faa4cfaf1f91..ba83cd13ff756 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -411,15 +411,15 @@ static int arm_spe__synth_instruction_sample(struct arm_spe_queue *speq,
+ return arm_spe_deliver_synth_event(spe, speq, event, &sample);
+ }
+
+-static const struct midr_range neoverse_spe[] = {
++static const struct midr_range common_ds_encoding_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2),
+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1),
+ {},
+ };
+
+-static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *record,
+- union perf_mem_data_src *data_src)
++static void arm_spe__synth_data_source_common(const struct arm_spe_record *record,
++ union perf_mem_data_src *data_src)
+ {
+ /*
+ * Even though four levels of cache hierarchy are possible, no known
+@@ -441,17 +441,17 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ }
+
+ switch (record->source) {
+- case ARM_SPE_NV_L1D:
++ case ARM_SPE_COMMON_DS_L1D:
+ data_src->mem_lvl = PERF_MEM_LVL_L1 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L1;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_L2:
++ case ARM_SPE_COMMON_DS_L2:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+ break;
+- case ARM_SPE_NV_PEER_CORE:
++ case ARM_SPE_COMMON_DS_PEER_CORE:
+ data_src->mem_lvl = PERF_MEM_LVL_L2 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L2;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -460,8 +460,8 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know if this is L1, L2 but we do know it was a cache-2-cache
+ * transfer, so set SNOOPX_PEER
+ */
+- case ARM_SPE_NV_LOCAL_CLUSTER:
+- case ARM_SPE_NV_PEER_CLUSTER:
++ case ARM_SPE_COMMON_DS_LOCAL_CLUSTER:
++ case ARM_SPE_COMMON_DS_PEER_CLUSTER:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+@@ -469,7 +469,7 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ /*
+ * System cache is assumed to be L3
+ */
+- case ARM_SPE_NV_SYS_CACHE:
++ case ARM_SPE_COMMON_DS_SYS_CACHE:
+ data_src->mem_lvl = PERF_MEM_LVL_L3 | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_L3;
+ data_src->mem_snoop = PERF_MEM_SNOOP_HIT;
+@@ -478,13 +478,13 @@ static void arm_spe__synth_data_source_neoverse(const struct arm_spe_record *rec
+ * We don't know what level it hit in, except it came from the other
+ * socket
+ */
+- case ARM_SPE_NV_REMOTE:
++ case ARM_SPE_COMMON_DS_REMOTE:
+ data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+- case ARM_SPE_NV_DRAM:
++ case ARM_SPE_COMMON_DS_DRAM:
+ data_src->mem_lvl = PERF_MEM_LVL_LOC_RAM | PERF_MEM_LVL_HIT;
+ data_src->mem_lvl_num = PERF_MEM_LVLNUM_RAM;
+ data_src->mem_snoop = PERF_MEM_SNOOP_NONE;
+@@ -520,7 +520,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+ {
+ union perf_mem_data_src data_src = { .mem_op = PERF_MEM_OP_NA };
+- bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
++ bool is_common = is_midr_in_range_list(midr, common_ds_encoding_cpus);
+
+ /* Only synthesize data source for LDST operations */
+ if (!is_ldst_op(record->op))
+@@ -533,8 +533,8 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m
+ else
+ return 0;
+
+- if (is_neoverse)
+- arm_spe__synth_data_source_neoverse(record, &data_src);
++ if (is_common)
++ arm_spe__synth_data_source_common(record, &data_src);
+ else
+ arm_spe__synth_data_source_generic(record, &data_src);
+
+--
+2.51.0
+
--- /dev/null
+From f7ee4ec3e2a59df91abbc023e2a692b16dc57172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:09 +0100
+Subject: perf arm_spe: Correct memory level for remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit cb300e3515057fb555983ce47e8acc86a5c69c3c ]
+
+For remote accesses, the data source packet does not contain information
+about the memory level. To avoid misinformation, set the memory level to
+NA (Not Available).
+
+Fixes: 4e6430cbb1a9f1dc ("perf arm-spe: Use SPE data source for neoverse cores")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index ba83cd13ff756..0302e6407b5a2 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -479,8 +479,8 @@ static void arm_spe__synth_data_source_common(const struct arm_spe_record *recor
+ * socket
+ */
+ case ARM_SPE_COMMON_DS_REMOTE:
+- data_src->mem_lvl = PERF_MEM_LVL_REM_CCE1;
+- data_src->mem_lvl_num = PERF_MEM_LVLNUM_ANY_CACHE;
++ data_src->mem_lvl = PERF_MEM_LVL_NA;
++ data_src->mem_lvl_num = PERF_MEM_LVLNUM_NA;
+ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ data_src->mem_snoopx = PERF_MEM_SNOOPX_PEER;
+ break;
+--
+2.51.0
+
--- /dev/null
+From b591d4fd11517c990203005507250102b0cd4b0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:42:08 +0100
+Subject: perf arm_spe: Correct setting remote access
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 039fd0634a0629132432632d7ac9a14915406b5c ]
+
+Set the mem_remote field for a remote access to appropriately represent
+the event.
+
+Fixes: a89dbc9b988f3ba8 ("perf arm-spe: Set sample's data source field")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ali Saidi <alisaidi@amazon.com>
+Cc: German Gomez <german.gomez@arm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index 9848310cee5f3..0faa4cfaf1f91 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -514,7 +514,7 @@ static void arm_spe__synth_data_source_generic(const struct arm_spe_record *reco
+ }
+
+ if (record->type & ARM_SPE_REMOTE_ACCESS)
+- data_src->mem_lvl |= PERF_MEM_LVL_REM_CCE1;
++ data_src->mem_remote = PERF_MEM_REMOTE_REMOTE;
+ }
+
+ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 midr)
+--
+2.51.0
+
--- /dev/null
+From 7ffc53f14dc7734a85c95d2b5f2e8a49152b1c38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:38:17 -0700
+Subject: perf evsel: Avoid container_of on a NULL leader
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2354479026d726954ff86ce82f4b649637319661 ]
+
+An evsel should typically have a leader of itself, however, in tests
+like 'Sample parsing' a NULL leader may occur and the container_of
+will return a corrupt pointer.
+
+Avoid this with an explicit NULL test.
+
+Fixes: fba7c86601e2e42d ("libperf: Move 'leader' from tools/perf to perf_evsel::leader")
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Blake Jones <blakejones@google.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Collin Funk <collin.funk1@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Li Huafei <lihuafei1@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nam Cao <namcao@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20250821163820.1132977-4-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 2a6295f1ac1bc..cdd13f576c191 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -3131,6 +3131,8 @@ bool evsel__is_hybrid(const struct evsel *evsel)
+
+ struct evsel *evsel__leader(const struct evsel *evsel)
+ {
++ if (evsel->core.leader == NULL)
++ return NULL;
+ return container_of(evsel->core.leader, struct evsel, core);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ac8d90acdcbe39ae7a7315945cd326dae9e44e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:24:15 -0700
+Subject: perf evsel: Ensure the fallback message is always written to
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 24937ee839e4bbc097acde73eeed67812bad2d99 ]
+
+The fallback message is unconditionally printed in places like
+record__open().
+
+If no fallback is attempted this can lead to printing uninitialized
+data, crashes, etc.
+
+Fixes: c0a54341c0e89333 ("perf evsel: Introduce event fallback method")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index c37faef63df99..6d1327f8c6043 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2874,7 +2874,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize)
+
+ /* If event has exclude user then don't exclude kernel. */
+ if (evsel->core.attr.exclude_user)
+- return false;
++ goto no_fallback;
+
+ /* Is there already the separator in the name. */
+ if (strchr(name, '/') ||
+@@ -2882,7 +2882,7 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize)
+ sep = "";
+
+ if (asprintf(&new_name, "%s%su", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+@@ -2905,17 +2905,19 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize)
+ sep = "";
+
+ if (asprintf(&new_name, "%s%sH", name, sep) < 0)
+- return false;
++ goto no_fallback;
+
+ free(evsel->name);
+ evsel->name = new_name;
+ /* Apple M1 requires exclude_guest */
+- scnprintf(msg, msgsize, "trying to fall back to excluding guest samples");
++ scnprintf(msg, msgsize, "Trying to fall back to excluding guest samples");
+ evsel->core.attr.exclude_guest = 1;
+
+ return true;
+ }
+-
++no_fallback:
++ scnprintf(msg, msgsize, "No fallback found for '%s' for error %d",
++ evsel__name(evsel), err);
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d53c785aaaf684d0c7f5990ab874270aee00dfce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:24 +0100
+Subject: perf python: split Clang options when invoking Popen
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c6a43bc3e8f6102a47da0d2e53428d08f00172fb ]
+
+When passing a list to subprocess.Popen, each element maps to one argv
+token. Current code bundles multiple Clang flags into a single element,
+something like:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu -fintegrated-as -Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+So Clang only sees one long, invalid option instead of separate flags,
+as a result, the script cannot capture any log via PIPE.
+
+Fix this by using shlex.split() to separate the string so each option
+becomes its own argv element. The fixed list will be:
+
+ cmd = ['clang',
+ '--target=x86_64-linux-gnu',
+ '-fintegrated-as',
+ '-Wno-cast-function-type-mismatch',
+ 'test-hello.c']
+
+Fixes: 09e6f9f98370 ("perf python: Fix splitting CC into compiler and options")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-2-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/setup.py | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
+index e837132d5031b..eecb462c021cd 100644
+--- a/tools/perf/util/setup.py
++++ b/tools/perf/util/setup.py
+@@ -1,6 +1,7 @@
+ from os import getenv, path
+ from subprocess import Popen, PIPE
+ from re import sub
++import shlex
+
+ cc = getenv("CC")
+
+@@ -16,7 +17,9 @@ cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline
+ src_feature_tests = getenv('srctree') + '/tools/build/feature'
+
+ def clang_has_option(option):
+- cc_output = Popen([cc, cc_options + option, path.join(src_feature_tests, "test-hello.c") ], stderr=PIPE).stderr.readlines()
++ cmd = shlex.split(f"{cc} {cc_options} {option}")
++ cmd.append(path.join(src_feature_tests, "test-hello.c"))
++ cc_output = Popen(cmd, stderr=PIPE).stderr.readlines()
+ return [o for o in cc_output if ((b"unknown argument" in o) or (b"is not supported" in o) or (b"unknown warning option" in o))] == [ ]
+
+ if cc_is_clang:
+--
+2.51.0
+
--- /dev/null
+From 9d4c7a475f280ea574cbe4795ac122e53c1dd44e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:24:40 +0100
+Subject: perf session: Fix handling when buffer exceeds 2 GiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit c17dda8013495d8132c976cbf349be9949d0fbd1 ]
+
+If a user specifies an AUX buffer larger than 2 GiB, the returned size
+may exceed 0x80000000. Since the err variable is defined as a signed
+32-bit integer, such a value overflows and becomes negative.
+
+As a result, the perf record command reports an error:
+
+ 0x146e8 [0x30]: failed to process type: 71 [Unknown error 183711232]
+
+Change the type of the err variable to a signed 64-bit integer to
+accommodate large buffer sizes correctly.
+
+Fixes: d5652d865ea734a1 ("perf session: Add ability to skip 4GiB or more")
+Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20250808-perf_fix_big_buffer_size-v1-1-45f45444a9a4@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 277b2cbd51861..e4d57e7df7ae1 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1662,7 +1662,7 @@ static s64 perf_session__process_user_event(struct perf_session *session,
+ struct perf_tool *tool = session->tool;
+ struct perf_sample sample = { .time = 0, };
+ int fd = perf_data__fd(session->data);
+- int err;
++ s64 err;
+
+ if (event->header.type != PERF_RECORD_COMPRESSED ||
+ tool->compressed == perf_session__process_compressed_event_stub)
+--
+2.51.0
+
--- /dev/null
+From f904b1eda0fc7d9fbc107aca0e03601af984cd43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:48:38 +0100
+Subject: perf test: Add a test for default perf stat command
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 65d11821910bd910a2b4b5b005360d036c76ecef ]
+
+Test that one cycles event is opened for each core PMU when "perf stat"
+is run without arguments.
+
+The event line can either be output as "pmu/cycles/" or just "cycles" if
+there is only one PMU. Include 2 spaces for padding in the one PMU case
+to avoid matching when the word cycles is included in metric
+descriptions.
+
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Cc: Yang Jihong <yangjihong@bytedance.com>
+Cc: Dominique Martinet <asmadeus@codewreck.org>
+Cc: Colin Ian King <colin.i.king@gmail.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ze Gao <zegao2021@gmail.com>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Cc: Weilin Wang <weilin.wang@intel.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Jing Zhang <renyu.zj@linux.alibaba.com>
+Cc: Yang Li <yang.lee@linux.alibaba.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: ak@linux.intel.com
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Yanteng Si <siyanteng@loongson.cn>
+Cc: Sun Haiyong <sunhaiyong@loongson.cn>
+Cc: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20240926144851.245903-8-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/stat.sh | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index 3f1e67795490a..c6df7eec96b98 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -146,6 +146,30 @@ test_cputype() {
+ echo "cputype test [Success]"
+ }
+
++test_hybrid() {
++ # Test the default stat command on hybrid devices opens one cycles event for
++ # each CPU type.
++ echo "hybrid test"
++
++ # Count the number of core PMUs, assume minimum of 1
++ pmus=$(ls /sys/bus/event_source/devices/*/cpus 2>/dev/null | wc -l)
++ if [ "$pmus" -lt 1 ]
++ then
++ pmus=1
++ fi
++
++ # Run default Perf stat
++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l)
++
++ if [ "$pmus" -ne "$cycles_events" ]
++ then
++ echo "hybrid test [Found $pmus PMUs but $cycles_events cycles events. Failed]"
++ err=1
++ return
++ fi
++ echo "hybrid test [Success]"
++}
++
+ test_default_stat
+ test_stat_record_report
+ test_stat_record_script
+@@ -153,4 +177,5 @@ test_stat_repeat_weak_groups
+ test_topdown_groups
+ test_topdown_weak_groups
+ test_cputype
++test_hybrid
+ exit $err
+--
+2.51.0
+
--- /dev/null
+From f4ca823b2a6531a31a260b48481902cc41732161 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 15:22:00 -0700
+Subject: perf test: Don't leak workload gopipe in PERF_RECORD_*
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 48918cacefd226af44373e914e63304927c0e7dc ]
+
+The test starts a workload and then opens events. If the events fail
+to open, for example because of perf_event_paranoid, the gopipe of the
+workload is leaked and the file descriptor leak check fails when the
+test exits. To avoid this cancel the workload when opening the events
+fails.
+
+Before:
+```
+$ perf test -vv 7
+ 7: PERF_RECORD_* events & perf_sample fields:
+ --- start ---
+test child forked, pid 1189568
+Using CPUID GenuineIntel-6-B7-1
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0xa00000000 (cpu_atom/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+ ------------------------------------------------------------
+perf_event_attr:
+ type 0 (PERF_TYPE_HARDWARE)
+ config 0x400000000 (cpu_core/PERF_COUNT_HW_CPU_CYCLES/)
+ disabled 1
+ exclude_kernel 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 3
+Attempt to add: software/cpu-clock/
+..after resolving event: software/config=0/
+cpu-clock -> software/cpu-clock/
+ ------------------------------------------------------------
+perf_event_attr:
+ type 1 (PERF_TYPE_SOFTWARE)
+ size 136
+ config 0x9 (PERF_COUNT_SW_DUMMY)
+ sample_type IP|TID|TIME|CPU
+ read_format ID|LOST
+ disabled 1
+ inherit 1
+ mmap 1
+ comm 1
+ enable_on_exec 1
+ task 1
+ sample_id_all 1
+ mmap2 1
+ comm_exec 1
+ ksymbol 1
+ bpf_event 1
+ { wakeup_events, wakeup_watermark } 1
+ ------------------------------------------------------------
+sys_perf_event_open: pid 1189569 cpu 0 group_fd -1 flags 0x8
+sys_perf_event_open failed, error -13
+perf_evlist__open: Permission denied
+ ---- end(-2) ----
+Leak of file descriptor 6 that opened: 'pipe:[14200347]'
+ ---- unexpected signal (6) ----
+iFailed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+Failed to read build ID for //anon
+ #0 0x565358f6666e in child_test_sig_handler builtin-test.c:311
+ #1 0x7f29ce849df0 in __restore_rt libc_sigaction.c:0
+ #2 0x7f29ce89e95c in __pthread_kill_implementation pthread_kill.c:44
+ #3 0x7f29ce849cc2 in raise raise.c:27
+ #4 0x7f29ce8324ac in abort abort.c:81
+ #5 0x565358f662d4 in check_leaks builtin-test.c:226
+ #6 0x565358f6682e in run_test_child builtin-test.c:344
+ #7 0x565358ef7121 in start_command run-command.c:128
+ #8 0x565358f67273 in start_test builtin-test.c:545
+ #9 0x565358f6771d in __cmd_test builtin-test.c:647
+ #10 0x565358f682bd in cmd_test builtin-test.c:849
+ #11 0x565358ee5ded in run_builtin perf.c:349
+ #12 0x565358ee6085 in handle_internal_command perf.c:401
+ #13 0x565358ee61de in run_argv perf.c:448
+ #14 0x565358ee6527 in main perf.c:555
+ #15 0x7f29ce833ca8 in __libc_start_call_main libc_start_call_main.h:74
+ #16 0x7f29ce833d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128
+ #17 0x565358e391c1 in _start perf[851c1]
+ 7: PERF_RECORD_* events & perf_sample fields : FAILED!
+```
+
+After:
+```
+$ perf test 7
+ 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions)
+```
+
+Fixes: 16d00fee703866c6 ("perf tests: Move test__PERF_RECORD into separate object")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Chun-Tse Shao <ctshao@google.com>
+Cc: Howard Chu <howardchu95@gmail.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/perf-record.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
+index 1c4feec1adff1..6e7f053006b4f 100644
+--- a/tools/perf/tests/perf-record.c
++++ b/tools/perf/tests/perf-record.c
+@@ -115,6 +115,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -126,6 +127,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -137,6 +139,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("perf_evlist__open: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+@@ -149,6 +152,7 @@ static int test__PERF_RECORD(struct test_suite *test __maybe_unused, int subtest
+ if (err < 0) {
+ pr_debug("evlist__mmap: %s\n",
+ str_error_r(errno, sbuf, sizeof(sbuf)));
++ evlist__cancel_workload(evlist);
+ goto out_delete_evlist;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1c864d1857446825b387b61e4051dffe06eb12e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 23:23:51 -0700
+Subject: perf tools: Add fallback for exclude_guest
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit bb6e7cb11d97ce1957894d30d13bfad3e8bfefe9 ]
+
+Commit 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default")
+changed to parse "cycles:P" event instead of creating a new cycles
+event for perf record. But it also changed the way how modifiers are
+handled so it doesn't set the exclude_guest bit by default.
+
+It seems Apple M1 PMU requires exclude_guest set and returns EOPNOTSUPP
+if not. Let's add a fallback so that it can work with default events.
+
+Also update perf stat hybrid tests to handle possible u or H modifiers.
+
+Reviewed-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com>
+Acked-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Atish Patra <atishp@atishpatra.org>
+Cc: Mingwei Zhang <mizhang@google.com>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Palmer Dabbelt <palmer@rivosinc.com>
+Link: https://lore.kernel.org/r/20241016062359.264929-2-namhyung@kernel.org
+Fixes: 7b100989b4f6bce70 ("perf evlist: Remove __evlist__add_default")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 24937ee839e4 ("perf evsel: Ensure the fallback message is always written to")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 18 +++++++++++++++---
+ tools/perf/tests/shell/stat.sh | 2 +-
+ tools/perf/util/evsel.c | 21 +++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 9692ebdd7f11e..1512fedd90cf9 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -638,8 +638,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ * (behavior changed with commit b0a873e).
+ */
+ if (errno == EINVAL || errno == ENOSYS ||
+- errno == ENOENT || errno == EOPNOTSUPP ||
+- errno == ENXIO) {
++ errno == ENOENT || errno == ENXIO) {
+ if (verbose > 0)
+ ui__warning("%s event is not supported by the kernel.\n",
+ evsel__name(counter));
+@@ -657,7 +656,7 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ if (verbose > 0)
+ ui__warning("%s\n", msg);
+ return COUNTER_RETRY;
+- } else if (target__has_per_thread(&target) &&
++ } else if (target__has_per_thread(&target) && errno != EOPNOTSUPP &&
+ evsel_list->core.threads &&
+ evsel_list->core.threads->err_thread != -1) {
+ /*
+@@ -678,6 +677,19 @@ static enum counter_recovery stat_handle_error(struct evsel *counter)
+ return COUNTER_SKIP;
+ }
+
++ if (errno == EOPNOTSUPP) {
++ if (verbose > 0) {
++ ui__warning("%s event is not supported by the kernel.\n",
++ evsel__name(counter));
++ }
++ counter->supported = false;
++ counter->errored = true;
++
++ if ((evsel__leader(counter) != counter) ||
++ !(counter->core.leader->nr_members > 1))
++ return COUNTER_SKIP;
++ }
++
+ evsel__open_strerror(counter, &target, errno, msg, sizeof(msg));
+ ui__error("%s\n", msg);
+
+diff --git a/tools/perf/tests/shell/stat.sh b/tools/perf/tests/shell/stat.sh
+index c6df7eec96b98..c4bef71568970 100755
+--- a/tools/perf/tests/shell/stat.sh
++++ b/tools/perf/tests/shell/stat.sh
+@@ -159,7 +159,7 @@ test_hybrid() {
+ fi
+
+ # Run default Perf stat
+- cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/| cycles " | wc -l)
++ cycles_events=$(perf stat -- true 2>&1 | grep -E "/cycles/[uH]*| cycles[:uH]* " -c)
+
+ if [ "$pmus" -ne "$cycles_events" ]
+ then
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index cdd13f576c191..c37faef63df99 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2892,6 +2892,27 @@ bool evsel__fallback(struct evsel *evsel, int err, char *msg, size_t msgsize)
+ evsel->core.attr.exclude_kernel = 1;
+ evsel->core.attr.exclude_hv = 1;
+
++ return true;
++ } else if (err == EOPNOTSUPP && !evsel->core.attr.exclude_guest &&
++ !evsel->exclude_GH) {
++ const char *name = evsel__name(evsel);
++ char *new_name;
++ const char *sep = ":";
++
++ /* Is there already the separator in the name. */
++ if (strchr(name, '/') ||
++ (strchr(name, ':') && !evsel->is_libpfm_event))
++ sep = "";
++
++ if (asprintf(&new_name, "%s%sH", name, sep) < 0)
++ return false;
++
++ free(evsel->name);
++ evsel->name = new_name;
++ /* Apple M1 requires exclude_guest */
++ scnprintf(msg, msgsize, "trying to fall back to excluding guest samples");
++ evsel->core.attr.exclude_guest = 1;
++
+ return true;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 27eff733fe268b11c94867b2ee327ae680371a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 16:25:08 +0000
+Subject: perf util: Fix compression checks returning -1 as bool
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 43fa1141e2c1af79c91aaa4df03e436c415a6fc3 ]
+
+The lzma_is_compressed and gzip_is_compressed functions are declared
+to return a "bool" type, but in case of an error (e.g., file open
+failure), they incorrectly returned -1.
+
+A bool type is a boolean value that is either true or false.
+Returning -1 for a bool return type can lead to unexpected behavior
+and may violate strict type-checking in some compilers.
+
+Fix the return value to be false in error cases, ensuring the function
+adheres to its declared return type improves for preventing potential
+bugs related to type mismatch.
+
+Fixes: 4b57fd44b61beb51 ("perf tools: Add lzma_is_compressed function")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephen Brennan <stephen.s.brennan@oracle.com>
+Link: https://lore.kernel.org/r/20250822162506.316844-3-ysk@kzalloc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/lzma.c | 2 +-
+ tools/perf/util/zlib.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/lzma.c b/tools/perf/util/lzma.c
+index af9a97612f9df..f61574d1581e3 100644
+--- a/tools/perf/util/lzma.c
++++ b/tools/perf/util/lzma.c
+@@ -113,7 +113,7 @@ bool lzma_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+diff --git a/tools/perf/util/zlib.c b/tools/perf/util/zlib.c
+index 78d2297c1b674..1f7c065230599 100644
+--- a/tools/perf/util/zlib.c
++++ b/tools/perf/util/zlib.c
+@@ -88,7 +88,7 @@ bool gzip_is_compressed(const char *input)
+ ssize_t rc;
+
+ if (fd < 0)
+- return -1;
++ return false;
+
+ rc = read(fd, buf, sizeof(buf));
+ close(fd);
+--
+2.51.0
+
--- /dev/null
+From 5c82d0c1904b95e488c2c454cc4100f3c0c0bc15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:07:13 +0200
+Subject: rtc: optee: fix memory leak on driver removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Le Goffic <clement.legoffic@foss.st.com>
+
+[ Upstream commit a531350d2fe58f7fc4516e555f22391dee94efd9 ]
+
+Fix a memory leak in case of driver removal.
+Free the shared memory used for arguments exchanges between kernel and
+OP-TEE RTC PTA.
+
+Fixes: 81c2f059ab90 ("rtc: optee: add RTC driver for OP-TEE RTC PTA")
+Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
+Link: https://lore.kernel.org/r/20250715-upstream-optee-rtc-v1-1-e0fdf8aae545@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-optee.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-optee.c b/drivers/rtc/rtc-optee.c
+index 9f8b5d4a8f6b6..6b77c122fdc10 100644
+--- a/drivers/rtc/rtc-optee.c
++++ b/drivers/rtc/rtc-optee.c
+@@ -320,6 +320,7 @@ static int optee_rtc_remove(struct device *dev)
+ {
+ struct optee_rtc *priv = dev_get_drvdata(dev);
+
++ tee_shm_free(priv->shm);
+ tee_client_close_session(priv->ctx, priv->session_id);
+ tee_client_close_context(priv->ctx);
+
+--
+2.51.0
+
--- /dev/null
+From 578c8c68044d09d27c54eaf9e47ee73dcabe7164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 16:57:02 -0500
+Subject: rtc: x1205: Fix Xicor X1205 vendor prefix
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 606d19ee37de3a72f1b6e95a4ea544f6f20dbb46 ]
+
+The vendor for the X1205 RTC is not Xircom, but Xicor which was acquired
+by Intersil. Since the I2C subsystem drops the vendor prefix for driver
+matching, the vendor prefix hasn't mattered.
+
+Fixes: 6875404fdb44 ("rtc: x1205: Add DT probing support")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20250821215703.869628-2-robh@kernel.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-x1205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
+index 807f953ae0aed..b7a7ea036f7ad 100644
+--- a/drivers/rtc/rtc-x1205.c
++++ b/drivers/rtc/rtc-x1205.c
+@@ -669,7 +669,7 @@ static const struct i2c_device_id x1205_id[] = {
+ MODULE_DEVICE_TABLE(i2c, x1205_id);
+
+ static const struct of_device_id x1205_dt_ids[] = {
+- { .compatible = "xircom,x1205", },
++ { .compatible = "xicor,x1205", },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, x1205_dt_ids);
+--
+2.51.0
+
--- /dev/null
+From 71dcc2d598c665b5ed9024b2da55750049efac57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 15:38:17 +0200
+Subject: s390/cio: Update purge function to unregister the unused subchannels
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 9daa5a8795865f9a3c93d8d1066785b07ded6073 ]
+
+Starting with 'commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers")', cio no longer unregisters
+subchannels when the attached device is invalid or unavailable.
+
+As an unintended side-effect, the cio_ignore purge function no longer
+removes subchannels for devices on the cio_ignore list if no CCW device
+is attached. This situation occurs when a CCW device is non-operational
+or unavailable
+
+To ensure the same outcome of the purge function as when the
+current cio_ignore list had been active during boot, update the purge
+function to remove I/O subchannels without working CCW devices if the
+associated device number is found on the cio_ignore list.
+
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/device.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 6b374026cd4f4..31f46b56e049d 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1318,23 +1318,34 @@ void ccw_device_schedule_recovery(void)
+ spin_unlock_irqrestore(&recovery_lock, flags);
+ }
+
+-static int purge_fn(struct device *dev, void *data)
++static int purge_fn(struct subchannel *sch, void *data)
+ {
+- struct ccw_device *cdev = to_ccwdev(dev);
+- struct ccw_dev_id *id = &cdev->private->dev_id;
+- struct subchannel *sch = to_subchannel(cdev->dev.parent);
++ struct ccw_device *cdev;
+
+- spin_lock_irq(cdev->ccwlock);
+- if (is_blacklisted(id->ssid, id->devno) &&
+- (cdev->private->state == DEV_STATE_OFFLINE) &&
+- (atomic_cmpxchg(&cdev->private->onoff, 0, 1) == 0)) {
+- CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+- id->devno);
++ spin_lock_irq(&sch->lock);
++ if (sch->st != SUBCHANNEL_TYPE_IO || !sch->schib.pmcw.dnv)
++ goto unlock;
++
++ if (!is_blacklisted(sch->schid.ssid, sch->schib.pmcw.dev))
++ goto unlock;
++
++ cdev = sch_get_cdev(sch);
++ if (cdev) {
++ if (cdev->private->state != DEV_STATE_OFFLINE)
++ goto unlock;
++
++ if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
++ goto unlock;
+ ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+- css_sched_sch_todo(sch, SCH_TODO_UNREG);
+ atomic_set(&cdev->private->onoff, 0);
+ }
+- spin_unlock_irq(cdev->ccwlock);
++
++ css_sched_sch_todo(sch, SCH_TODO_UNREG);
++ CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x%s\n", sch->schid.ssid,
++ sch->schib.pmcw.dev, cdev ? "" : " (no cdev)");
++
++unlock:
++ spin_unlock_irq(&sch->lock);
+ /* Abort loop in case of pending signal. */
+ if (signal_pending(current))
+ return -EINTR;
+@@ -1350,7 +1361,7 @@ static int purge_fn(struct device *dev, void *data)
+ int ccw_purge_blacklisted(void)
+ {
+ CIO_MSG_EVENT(2, "ccw: purging blacklisted devices\n");
+- bus_for_each_dev(&ccw_bus_type, NULL, NULL, purge_fn);
++ for_each_subchannel_staged(purge_fn, NULL, NULL);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a51d5d4e325c79b977e753e23d8dd0b0afb402c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 21:42:01 +0800
+Subject: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 60cd16a3b7439ccb699d0bf533799eeb894fd217 ]
+
+During the detaching of Marvell's SAS/SATA controller, the original code
+calls cancel_delayed_work() in mvs_free() to cancel the delayed work
+item mwq->work_q. However, if mwq->work_q is already running, the
+cancel_delayed_work() may fail to cancel it. This can lead to
+use-after-free scenarios where mvs_free() frees the mvs_info while
+mvs_work_queue() is still executing and attempts to access the
+already-freed mvs_info.
+
+A typical race condition is illustrated below:
+
+CPU 0 (remove) | CPU 1 (delayed work callback)
+mvs_pci_remove() |
+ mvs_free() | mvs_work_queue()
+ cancel_delayed_work() |
+ kfree(mvi) |
+ | mvi-> // UAF
+
+Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
+that the delayed work item is properly canceled and any executing
+delayed work item completes before the mvs_info is deallocated.
+
+This bug was found by static analysis.
+
+Fixes: 20b09c2992fe ("[SCSI] mvsas: add support for 94xx; layout change; bug fixes")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
+index 43ebb331e2167..47c4434dc7e79 100644
+--- a/drivers/scsi/mvsas/mv_init.c
++++ b/drivers/scsi/mvsas/mv_init.c
+@@ -139,7 +139,7 @@ static void mvs_free(struct mvs_info *mvi)
+ if (mvi->shost)
+ scsi_host_put(mvi->shost);
+ list_for_each_entry(mwq, &mvi->wq_list, entry)
+- cancel_delayed_work(&mwq->work_q);
++ cancel_delayed_work_sync(&mwq->work_q);
+ kfree(mvi->rsvd_tags);
+ kfree(mvi);
+ }
+--
+2.51.0
+
iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
asm-generic-io.h-skip-trace-helpers-if-rwmmio-events-are-disabled.patch
+perf-evsel-avoid-container_of-on-a-null-leader.patch
+libperf-event-ensure-tracing-data-is-multiple-of-8-s.patch
+clk-at91-peripheral-fix-return-value.patch
+perf-util-fix-compression-checks-returning-1-as-bool.patch
+rtc-x1205-fix-xicor-x1205-vendor-prefix.patch
+rtc-optee-fix-memory-leak-on-driver-removal.patch
+perf-arm_spe-correct-setting-remote-access.patch
+perf-arm-spe-rename-the-common-data-source-encoding.patch
+perf-arm_spe-correct-memory-level-for-remote-access.patch
+perf-session-fix-handling-when-buffer-exceeds-2-gib.patch
+perf-test-don-t-leak-workload-gopipe-in-perf_record_.patch
+perf-test-add-a-test-for-default-perf-stat-command.patch
+perf-tools-add-fallback-for-exclude_guest.patch
+perf-evsel-ensure-the-fallback-message-is-always-wri.patch
+clk-mediatek-mt8195-infra_ao-fix-parent-for-infra_ao.patch
+clk-mediatek-clk-mux-do-not-pass-flags-to-clk_mux_de.patch
+clk-nxp-lpc18xx-cgu-convert-from-round_rate-to-deter.patch
+clk-nxp-fix-pll0-rate-check-condition-in-lpc18xx-cgu.patch
+clk-tegra-do-not-overallocate-memory-for-bpmp-clocks.patch
+cpufreq-tegra186-set-target-frequency-for-all-cpus-i.patch
+scsi-mvsas-fix-use-after-free-bugs-in-mvs_work_queue.patch
+asoc-sof-ipc4-topology-correct-the-minimum-host-dma-.patch
+loongarch-remove-config_acpi_table_upgrade-in-platfo.patch
+loongarch-init-acpi_gbl_use_global_lock-to-false.patch
+net-mlx4-prevent-potential-use-after-free-in-mlx4_en.patch
+s390-cio-update-purge-function-to-unregister-the-unu.patch
+drm-vmwgfx-fix-a-null-ptr-access-in-the-cursor-snoop.patch
+drm-vmwgfx-fix-use-after-free-in-validation.patch
+drm-vmwgfx-fix-copy-paste-typo-in-validation.patch
+net-sctp-fix-a-null-dereference-in-sctp_disposition-.patch
+tcp-don-t-call-reqsk_fastopen_remove-in-tcp_conn_req.patch
+net-fsl_pq_mdio-fix-device-node-reference-leak-in-fs.patch
+tools-build-align-warning-options-with-perf.patch
+perf-python-split-clang-options-when-invoking-popen.patch
+tcp-take-care-of-zero-tp-window_clamp-in-tcp_set_rcv.patch
+mailbox-zynqmp-ipi-remove-redundant-mbox_controller_.patch
+mailbox-zynqmp-ipi-remove-dev.parent-check-in-zynqmp.patch
+bpf-fix-metadata_dst-leak-__bpf_redirect_neigh_v-4-6.patch
+drm-amdgpu-add-additional-dce6-scl-registers.patch
+drm-amd-display-add-missing-dce6-scl_horz_filter_ini.patch
+drm-amd-display-properly-clear-scl_-_filter_control-.patch
+drm-amd-display-properly-disable-scaling-on-dce6.patch
+netfilter-nf_tables-drop-unused-3rd-argument-from-va.patch
+netfilter-nft_objref-validate-objref-and-objrefmap-e.patch
+bridge-br_vlan_fill_forward_path_pvid-use-br_vlan_gr.patch
+crypto-essiv-check-ssize-for-decryption-and-in-place.patch
+smb-client-fix-missing-timestamp-updates-after-utime.patch
+cifs-query-ea-lxmod-in-cifs_query_path_info-for-wsl-.patch
+tpm_tis-fix-incorrect-arguments-in-tpm_tis_probe_irq.patch
+gpio-wcd934x-mark-the-gpio-controller-as-sleeping.patch
+bpf-avoid-rcu-context-warning-when-unpinning-htab-wi.patch
--- /dev/null
+From 2b027885d634356c37ea0e153d35596568b51235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Oct 2025 16:23:24 -0300
+Subject: smb: client: fix missing timestamp updates after utime(2)
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit b95cd1bdf5aa9221c98fc9259014b8bb8d1829d7 ]
+
+Don't reuse open handle when changing timestamps to prevent the server
+from disabling automatic timestamp updates as per MS-FSA 2.1.4.17.
+
+---8<---
+import os
+import time
+
+filename = '/mnt/foo'
+
+def print_stat(prefix):
+ st = os.stat(filename)
+ print(prefix, ': ', time.ctime(st.st_atime), time.ctime(st.st_ctime))
+
+fd = os.open(filename, os.O_CREAT|os.O_TRUNC|os.O_WRONLY, 0o644)
+print_stat('old')
+os.utime(fd, None)
+time.sleep(2)
+os.write(fd, b'foo')
+os.close(fd)
+time.sleep(2)
+print_stat('new')
+---8<---
+
+Before patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+new : Fri Oct 3 14:01:21 2025 Fri Oct 3 14:01:21 2025
+
+After patch:
+
+$ mount.cifs //srv/share /mnt -o ...
+$ python3 run.py
+old : Fri Oct 3 17:03:34 2025 Fri Oct 3 17:03:34 2025
+new : Fri Oct 3 17:03:36 2025 Fri Oct 3 17:03:36 2025
+
+Fixes: b6f2a0f89d7e ("cifs: for compound requests, use open handle if possible")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 79641d1ee8675..232a3c2890556 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1216,31 +1216,33 @@ int
+ smb2_set_file_info(struct inode *inode, const char *full_path,
+ FILE_BASIC_INFO *buf, const unsigned int xid)
+ {
+- struct cifs_open_parms oparms;
++ struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++ struct cifsFileInfo *cfile = NULL;
++ struct cifs_open_parms oparms;
+ struct tcon_link *tlink;
+ struct cifs_tcon *tcon;
+- struct cifsFileInfo *cfile;
+- struct kvec in_iov = { .iov_base = buf, .iov_len = sizeof(*buf), };
+- int rc;
+-
+- if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
+- (buf->LastWriteTime == 0) && (buf->ChangeTime == 0) &&
+- (buf->Attributes == 0))
+- return 0; /* would be a no op, no sense sending this */
++ int rc = 0;
+
+ tlink = cifs_sb_tlink(cifs_sb);
+ if (IS_ERR(tlink))
+ return PTR_ERR(tlink);
+ tcon = tlink_tcon(tlink);
+
+- cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ if ((buf->CreationTime == 0) && (buf->LastAccessTime == 0) &&
++ (buf->LastWriteTime == 0) && (buf->ChangeTime == 0)) {
++ if (buf->Attributes == 0)
++ goto out; /* would be a no op, no sense sending this */
++ cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
++ }
++
+ oparms = CIFS_OPARMS(cifs_sb, tcon, full_path, FILE_WRITE_ATTRIBUTES,
+ FILE_OPEN, 0, ACL_NO_MODE);
+ rc = smb2_compound_op(xid, tcon, cifs_sb,
+ full_path, &oparms, &in_iov,
+ &(int){SMB2_OP_SET_INFO}, 1,
+ cfile, NULL, NULL, NULL);
++out:
+ cifs_put_tlink(tlink);
+ return rc;
+ }
+--
+2.51.0
+
--- /dev/null
+From 505887d35ecafeac1f1818a78a5ef98d8aa39ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Oct 2025 23:37:54 +0000
+Subject: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 2e7cbbbe3d61c63606994b7ff73c72537afe2e1c ]
+
+syzbot reported the splat below in tcp_conn_request(). [0]
+
+If a listener is close()d while a TFO socket is being processed in
+tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk
+and calls inet_child_forget(), which calls tcp_disconnect() for the
+TFO socket.
+
+After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(),
+where reqsk_put() is called due to !reqsk->sk.
+
+Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the
+last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the
+drop_and_free label causes the refcount underflow for the listener
+and double-free of the reqsk.
+
+Let's remove reqsk_fastopen_remove() in tcp_conn_request().
+
+Note that other callers make sure tp->fastopen_rsk is not NULL.
+
+[0]:
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28)
+Modules linked in:
+CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
+RIP: 0010:refcount_warn_saturate (lib/refcount.c:28)
+Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6
+RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246
+RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900
+RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280
+RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280
+R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100
+R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8
+FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0
+Call Trace:
+ <IRQ>
+ tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301)
+ tcp_rcv_state_process (net/ipv4/tcp_input.c:6708)
+ tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670)
+ tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906)
+ ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438)
+ ip6_input (net/ipv6/ip6_input.c:500)
+ ipv6_rcv (net/ipv6/ip6_input.c:311)
+ __netif_receive_skb (net/core/dev.c:6104)
+ process_backlog (net/core/dev.c:6456)
+ __napi_poll (net/core/dev.c:7506)
+ net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696)
+ handle_softirqs (kernel/softirq.c:579)
+ do_softirq (kernel/softirq.c:480)
+ </IRQ>
+
+Fixes: 45c8a6cc2bcd ("tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20251001233755.1340927-1-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index c6d00817ad3fd..8834cd41b3840 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -7200,7 +7200,6 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
+ &foc, TCP_SYNACK_FASTOPEN, skb);
+ /* Add the child socket directly into the accept queue */
+ if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+- reqsk_fastopen_remove(fastopen_sk, req, false);
+ bh_unlock_sock(fastopen_sk);
+ sock_put(fastopen_sk);
+ goto drop_and_free;
+--
+2.51.0
+
--- /dev/null
+From fd934eb77932988d473ba21792b54f9b3ac115e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Oct 2025 18:41:19 +0000
+Subject: tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 21b29e74ffe5a6c851c235bb80bf5ee26292c67b ]
+
+Some applications (like selftests/net/tcp_mmap.c) call SO_RCVLOWAT
+on their listener, before accept().
+
+This has an unfortunate effect on wscale selection in
+tcp_select_initial_window() during 3WHS.
+
+For instance, tcp_mmap was negotiating wscale 4, regardless
+of tcp_rmem[2] and sysctl_rmem_max.
+
+Do not change tp->window_clamp if it is zero
+or bigger than our computed value.
+
+Zero value is special, it allows tcp_select_initial_window()
+to enable autotuning.
+
+Note that SO_RCVLOWAT use on listener is probably not wise,
+because tp->scaling_ratio has a default value, possibly wrong.
+
+Fixes: d1361840f8c5 ("tcp: fix SO_RCVLOWAT and RCVBUF autotuning")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Link: https://patch.msgid.link/20251003184119.2526655-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 7d824578f217a..5dde0aed31440 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1724,6 +1724,7 @@ EXPORT_SYMBOL(tcp_peek_len);
+ /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */
+ int tcp_set_rcvlowat(struct sock *sk, int val)
+ {
++ struct tcp_sock *tp = tcp_sk(sk);
+ int space, cap;
+
+ if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
+@@ -1742,7 +1743,9 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
+ space = tcp_space_from_win(sk, val);
+ if (space > sk->sk_rcvbuf) {
+ WRITE_ONCE(sk->sk_rcvbuf, space);
+- WRITE_ONCE(tcp_sk(sk)->window_clamp, val);
++
++ if (tp->window_clamp && tp->window_clamp < val)
++ WRITE_ONCE(tp->window_clamp, val);
+ }
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 542b44d79f37ca8281686cf6d598417b0708418e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Oct 2025 17:21:23 +0100
+Subject: tools build: Align warning options with perf
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 53d067feb8c4f16d1f24ce3f4df4450bb18c555f ]
+
+The feature test programs are built without enabling '-Wall -Werror'
+options. As a result, a feature may appear to be available, but later
+building in perf can fail with stricter checks.
+
+Make the feature test program use the same warning options as perf.
+
+Fixes: 1925459b4d92 ("tools build: Fix feature Makefile issues with 'O='")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20251006-perf_build_android_ndk-v3-1-4305590795b2@arm.com
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexandre Ghiti <alex@ghiti.fr>
+Cc: Nick Desaulniers <nick.desaulniers+lkml@gmail.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: linux-riscv@lists.infradead.org
+Cc: llvm@lists.linux.dev
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 4f869fff28fe4..17e03236e3461 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -306,10 +306,10 @@ $(OUTPUT)test-libbabeltrace.bin:
+ $(BUILD) # -lbabeltrace provided by $(FEATURE_CHECK_LDFLAGS-libbabeltrace)
+
+ $(OUTPUT)test-compile-32.bin:
+- $(CC) -m32 -o $@ test-compile.c
++ $(CC) -m32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-compile-x32.bin:
+- $(CC) -mx32 -o $@ test-compile.c
++ $(CC) -mx32 -Wall -Werror -o $@ test-compile.c
+
+ $(OUTPUT)test-zlib.bin:
+ $(BUILD) -lz
+--
+2.51.0
+
--- /dev/null
+From cabb605c1d9875dcb4b944854b0b7491333b3b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:49:40 +0300
+Subject: tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
+
+From: Gunnar Kudrjavets <gunnarku@amazon.com>
+
+[ Upstream commit 8a81236f2cb0882c7ea6c621ce357f7f3f601fe5 ]
+
+The tpm_tis_write8() call specifies arguments in wrong order. Should be
+(data, addr, value) not (data, value, addr). The initial correct order
+was changed during the major refactoring when the code was split.
+
+Fixes: 41a5e1cf1fe1 ("tpm/tpm_tis: Split tpm_tis driver into a core and TCG TIS compliant phy")
+Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
+Reviewed-by: Justinien Bouron <jbouron@amazon.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index c71e61ccb95a2..5e6ee5b82b8ff 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -977,8 +977,8 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
++ tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality),
++ original_int_vec);
+ rc = -1;
+ }
+
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
