--- /dev/null
+From de4e4fda67a37c0e14648416136dc7b12b8dce9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 10:19:59 -0700
+Subject: accel/qaic: Fix possible data corruption in BOs > 2G
+
+From: Jeffrey Hugo <quic_jhugo@quicinc.com>
+
+[ Upstream commit 84a833d90635e4b846333e2df0ae72f9cbecac39 ]
+
+When slicing a BO, we need to iterate through the BO's sgt to find the
+right pieces to construct the slice. Some of the data types chosen for
+this process are incorrectly too small, and can overflow. This can
+result in the incorrect slice construction, which can lead to data
+corruption in workload execution.
+
+The device can only handle 32-bit sized transfers, and the scatterlist
+struct only supports 32-bit buffer sizes, so our upper limit for an
+individual transfer is an unsigned int. Using an int is incorrect due to
+the reservation of the sign bit. Upgrade the length of a scatterlist
+entry and the offsets into a scatterlist entry to unsigned int for a
+correct representation.
+
+While each transfer may be limited to 32-bits, the overall BO may exceed
+that size. For counting the total length of the BO, we need a type that
+can represent the largest allocation possible on the system. That is the
+definition of size_t, so use it.
+
+Fixes: ff13be830333 ("accel/qaic: Add datapath")
+Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Troy Hanson <quic_thanson@quicinc.com>
+Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250306171959.853466-1-jeff.hugo@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_data.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
+index c20eb63750f51..ffcdf5738d099 100644
+--- a/drivers/accel/qaic/qaic_data.c
++++ b/drivers/accel/qaic/qaic_data.c
+@@ -172,9 +172,10 @@ static void free_slice(struct kref *kref)
+ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_table **sgt_out,
+ struct sg_table *sgt_in, u64 size, u64 offset)
+ {
+- int total_len, len, nents, offf = 0, offl = 0;
+ struct scatterlist *sg, *sgn, *sgf, *sgl;
++ unsigned int len, nents, offf, offl;
+ struct sg_table *sgt;
++ size_t total_len;
+ int ret, j;
+
+ /* find out number of relevant nents needed for this mem */
+@@ -182,6 +183,8 @@ static int clone_range_of_sgt_for_slice(struct qaic_device *qdev, struct sg_tabl
+ sgf = NULL;
+ sgl = NULL;
+ nents = 0;
++ offf = 0;
++ offl = 0;
+
+ size = size ? size : PAGE_SIZE;
+ for_each_sgtable_dma_sg(sgt_in, sg, j) {
+--
+2.39.5
+
--- /dev/null
+From 40c15ae791c27f8e4490c0d3c362622fc943f7a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2024 10:09:46 -0500
+Subject: ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 45d5fe1c53baaed1fb3043f45d1e15ebb4bbe86a ]
+
+Chips in the DA850 family need to have ARCH_DAVINCI_DA8XX to be selected
+in order to enable some peripheral drivers.
+
+This was accidentally removed in a previous commit.
+
+Fixes: dec85a95167a ("ARM: davinci: clean up platform support")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
+index 2a8a9fe46586d..3fa15f3422409 100644
+--- a/arch/arm/mach-davinci/Kconfig
++++ b/arch/arm/mach-davinci/Kconfig
+@@ -27,6 +27,7 @@ config ARCH_DAVINCI_DA830
+
+ config ARCH_DAVINCI_DA850
+ bool "DA850/OMAP-L138/AM18x based system"
++ select ARCH_DAVINCI_DA8XX
+ select DAVINCI_CP_INTC
+
+ config ARCH_DAVINCI_DA8XX
+--
+2.39.5
+
--- /dev/null
+From e218f2335b593ad8fbee8f3d11bed4b29717ad02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Feb 2025 10:41:13 +0100
+Subject: ARM: dts: bcm2711: Don't mark timer regs unconfigured
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ]
+
+During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs
+didn't configured the ARM architectural timer. This firmware issue has
+been fixed in 2020, which gave users enough time to update their system.
+
+So drop this property to allow the use of the vDSO version of
+clock_gettime.
+
+Link: https://github.com/raspberrypi/tools/pull/113
+Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support")
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20250222094113.48198-1-wahrenst@gmx.net
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+index 4fd0732a34d32..c06d9f5e53c80 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -451,8 +451,6 @@ IRQ_TYPE_LEVEL_LOW)>,
+ IRQ_TYPE_LEVEL_LOW)>,
+ <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
+ IRQ_TYPE_LEVEL_LOW)>;
+- /* This only applies to the ARMv7 stub */
+- arm,cpu-registers-not-fw-configured;
+ };
+
+ cpus: cpus {
+--
+2.39.5
+
--- /dev/null
+From c3d7b9ec4beab4744ca1b8a21863f3f41c01fc11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2025 12:27:29 +0100
+Subject: ARM: dts: bcm2711: Fix xHCI power-domain
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f44fa354a0715577ca32b085f6f60bcf32c748dd ]
+
+During s2idle tests on the Raspberry CM4 the VPU firmware always crashes
+on xHCI power-domain resume:
+
+root@raspberrypi:/sys/power# echo freeze > state
+[ 70.724347] xhci_suspend finished
+[ 70.727730] xhci_plat_suspend finished
+[ 70.755624] bcm2835-power bcm2835-power: Power grafx off
+[ 70.761127] USB: Set power to 0
+
+[ 74.653040] USB: Failed to set power to 1 (-110)
+
+This seems to be caused because of the mixed usage of
+raspberrypi-power and bcm2835-power at the same time. So avoid
+the usage of the VPU firmware power-domain driver, which
+prevents the VPU crash.
+
+Fixes: 522c35e08b53 ("ARM: dts: bcm2711: Add BCM2711 xHCI support")
+Link: https://github.com/raspberrypi/linux/issues/6537
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250201112729.31509-1-wahrenst@gmx.net
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi | 5 -----
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi | 1 +
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
+index 6bf4241fe3b73..c78ed064d1667 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi.dtsi
+@@ -1,7 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "bcm2835-rpi.dtsi"
+
+-#include <dt-bindings/power/raspberrypi-power.h>
+ #include <dt-bindings/reset/raspberrypi,firmware-reset.h>
+
+ / {
+@@ -101,7 +100,3 @@ &v3d {
+ &vchiq {
+ interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+ };
+-
+-&xhci {
+- power-domains = <&power RPI_POWER_DOMAIN_USB>;
+-};
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+index e4e42af21ef3a..5eaec6c6a1df3 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -610,6 +610,7 @@ xhci: usb@7e9c0000 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>;
++ power-domains = <&pm BCM2835_POWER_DOMAIN_USB>;
+ /* DWC2 and this IP block share the same USB PHY,
+ * enabling both at the same time results in lockups.
+ * So keep this node disabled and let the bootloader
+--
+2.39.5
+
--- /dev/null
+From 4add6d9f06102097676655be993f974bbbbb2381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Feb 2025 13:56:13 +0100
+Subject: ARM: dts: bcm2711: PL011 UARTs are actually r1p5
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ]
+
+The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250223125614.3592-2-wahrenst@gmx.net
+Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm2711.dtsi b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+index 5eaec6c6a1df3..4fd0732a34d32 100644
+--- a/arch/arm/boot/dts/broadcom/bcm2711.dtsi
++++ b/arch/arm/boot/dts/broadcom/bcm2711.dtsi
+@@ -134,7 +134,7 @@ uart2: serial@7e201400 {
+ clocks = <&clocks BCM2835_CLOCK_UART>,
+ <&clocks BCM2835_CLOCK_VPU>;
+ clock-names = "uartclk", "apb_pclk";
+- arm,primecell-periphid = <0x00241011>;
++ arm,primecell-periphid = <0x00341011>;
+ status = "disabled";
+ };
+
+@@ -145,7 +145,7 @@ uart3: serial@7e201600 {
+ clocks = <&clocks BCM2835_CLOCK_UART>,
+ <&clocks BCM2835_CLOCK_VPU>;
+ clock-names = "uartclk", "apb_pclk";
+- arm,primecell-periphid = <0x00241011>;
++ arm,primecell-periphid = <0x00341011>;
+ status = "disabled";
+ };
+
+@@ -156,7 +156,7 @@ uart4: serial@7e201800 {
+ clocks = <&clocks BCM2835_CLOCK_UART>,
+ <&clocks BCM2835_CLOCK_VPU>;
+ clock-names = "uartclk", "apb_pclk";
+- arm,primecell-periphid = <0x00241011>;
++ arm,primecell-periphid = <0x00341011>;
+ status = "disabled";
+ };
+
+@@ -167,7 +167,7 @@ uart5: serial@7e201a00 {
+ clocks = <&clocks BCM2835_CLOCK_UART>,
+ <&clocks BCM2835_CLOCK_VPU>;
+ clock-names = "uartclk", "apb_pclk";
+- arm,primecell-periphid = <0x00241011>;
++ arm,primecell-periphid = <0x00341011>;
+ status = "disabled";
+ };
+
+@@ -1178,6 +1178,7 @@ &txp {
+ };
+
+ &uart0 {
++ arm,primecell-periphid = <0x00341011>;
+ interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 522c351e720a3d0e363fa4fdfe4df274f2d1b9bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 13:06:50 +0000
+Subject: ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC5300
+
+From: Chester A. Unal <chester.a.unal@arinc9.com>
+
+[ Upstream commit 56e12d0c8d395b6e48f128858d4f725c1ded6c95 ]
+
+After using the device for a while, Tom reports that he initially described
+the switch port labels incorrectly. Correct them.
+
+Reported-by: Tom Brautaset <tbrautaset@gmail.com>
+Fixes: 961dedc6b4e4 ("ARM: dts: BCM5301X: Add DT for ASUS RT-AC5300")
+Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20250303-for-broadcom-fix-rt-ac5300-switch-ports-v1-1-e058856ef4d3@arinc9.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts b/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts
+index 6c666dc7ad23e..01ec8c03686a6 100644
+--- a/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts
++++ b/arch/arm/boot/dts/broadcom/bcm47094-asus-rt-ac5300.dts
+@@ -126,11 +126,11 @@ &srab {
+
+ ports {
+ port@0 {
+- label = "lan4";
++ label = "wan";
+ };
+
+ port@1 {
+- label = "lan3";
++ label = "lan1";
+ };
+
+ port@2 {
+@@ -138,11 +138,11 @@ port@2 {
+ };
+
+ port@3 {
+- label = "lan1";
++ label = "lan3";
+ };
+
+ port@4 {
+- label = "wan";
++ label = "lan4";
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 6e2666b600ac9badade16d506b0e9c582877bcdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 15:55:36 +0000
+Subject: ARM: dts: BCM5301X: Fix switch port labels of ASUS RT-AC3200
+
+From: Chester A. Unal <chester.a.unal@arinc9.com>
+
+[ Upstream commit 24d4c56dd68906bf55ff8fc2e2d36760f97dce5f ]
+
+After using the device for a while, Tom reports that he initially described
+the switch port labels incorrectly. Apparently, ASUS's own firmware also
+describes them incorrectly. Correct them to what is seen on the chassis.
+
+Reported-by: Tom Brautaset <tbrautaset@gmail.com>
+Fixes: b116239094d8 ("ARM: dts: BCM5301X: Add DT for ASUS RT-AC3200")
+Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
+Link: https://lore.kernel.org/r/20250304-for-broadcom-fix-rt-ac3200-switch-ports-v1-1-7e249a19a13e@arinc9.com
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts b/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts
+index 53cb0c58f6d05..3da2daee0c849 100644
+--- a/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts
++++ b/arch/arm/boot/dts/broadcom/bcm4709-asus-rt-ac3200.dts
+@@ -124,19 +124,19 @@ port@0 {
+ };
+
+ port@1 {
+- label = "lan1";
++ label = "lan4";
+ };
+
+ port@2 {
+- label = "lan2";
++ label = "lan3";
+ };
+
+ port@3 {
+- label = "lan3";
++ label = "lan2";
+ };
+
+ port@4 {
+- label = "lan4";
++ label = "lan1";
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 00ecd83a128fee441dbb69b0cc7577efcae25309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 13:11:33 +0100
+Subject: ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 98f3ab18a0a55aa1ff2cd6b74bd0c02c8f76f17e ]
+
+When GENERIC_IRQ_CHIP is disabled, OMAP1 kernels fail to link:
+
+arm-linux-gnueabi-ld: arch/arm/mach-omap1/irq.o: in function `omap1_init_irq':
+irq.c:(.init.text+0x1e8): undefined reference to `irq_alloc_generic_chip'
+arm-linux-gnueabi-ld: irq.c:(.init.text+0x228): undefined reference to `irq_setup_generic_chip'
+arm-linux-gnueabi-ld: irq.c:(.init.text+0x2a8): undefined reference to `irq_gc_set_wake'
+arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b0): undefined reference to `irq_gc_mask_set_bit'
+arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b4): undefined reference to `irq_gc_mask_clr_bit'
+
+This has apparently been the case for many years, but I never caught it
+in randconfig builds until now, as there are dozens of other drivers
+that also 'select GENERIC_IRQ_CHIP' and statistically there is almost
+always one of them enabled.
+
+Fixes: 55b447744389 ("ARM: OMAP1: Switch to use generic irqchip in preparation for sparse IRQ")
+Link: https://lore.kernel.org/r/20250205121151.289535-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig
+index a643b71e30a35..08ec6bd84ada5 100644
+--- a/arch/arm/mach-omap1/Kconfig
++++ b/arch/arm/mach-omap1/Kconfig
+@@ -8,6 +8,7 @@ menuconfig ARCH_OMAP1
+ select ARCH_OMAP
+ select CLKSRC_MMIO
+ select FORCE_PCI if PCCARD
++ select GENERIC_IRQ_CHIP
+ select GPIOLIB
+ help
+ Support for older TI OMAP1 (omap7xx, omap15xx or omap16xx)
+--
+2.39.5
+
--- /dev/null
+From dc6a76c1e82be77d34e3107b0003f1b3b41b58cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Feb 2025 13:56:14 +0100
+Subject: arm64: dts: bcm2712: PL011 UARTs are actually r1p5
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 768953614c1c13fdf771be5742f1be573eea8fa4 ]
+
+The ARM PL011 UART instances in BCM2712 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250223125614.3592-3-wahrenst@gmx.net
+Fixes: faa3381267d0 ("arm64: dts: broadcom: Add minimal support for Raspberry Pi 5")
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+index 26a29e5e5078d..447bfa060918c 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -232,7 +232,7 @@ uart10: serial@7d001000 {
+ interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_uart>, <&clk_vpu>;
+ clock-names = "uartclk", "apb_pclk";
+- arm,primecell-periphid = <0x00241011>;
++ arm,primecell-periphid = <0x00341011>;
+ status = "disabled";
+ };
+
+--
+2.39.5
+
--- /dev/null
+From c961aa2dfc4c9e43298f8d53c016d5bb75e1b3e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2025 16:03:09 +0100
+Subject: arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 38f59e0e8bd2b3e1319716e4aeaeb9a6223b006d ]
+
+eMMC is supplied by BUCK5 rail. Use the actual regulator instead of
+a virtual fixed regulator.
+
+Fixes: 418d1d840e421 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi
+index 336785a9fba89..3ddc5aaa7c5f0 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi
+@@ -1,7 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+ /*
+- * Copyright 2021-2022 TQ-Systems GmbH
+- * Author: Alexander Stein <alexander.stein@tq-group.com>
++ * Copyright 2021-2025 TQ-Systems GmbH <linux@ew.tq-group.com>,
++ * D-82229 Seefeld, Germany.
++ * Author: Alexander Stein
+ */
+
+ #include "imx8mp.dtsi"
+@@ -23,15 +24,6 @@ reg_vcc3v3: regulator-vcc3v3 {
+ regulator-max-microvolt = <3300000>;
+ regulator-always-on;
+ };
+-
+- /* e-MMC IO, needed for HS modes */
+- reg_vcc1v8: regulator-vcc1v8 {
+- compatible = "regulator-fixed";
+- regulator-name = "VCC1V8";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
+- regulator-always-on;
+- };
+ };
+
+ &A53_0 {
+@@ -197,7 +189,7 @@ &usdhc3 {
+ no-sd;
+ no-sdio;
+ vmmc-supply = <®_vcc3v3>;
+- vqmmc-supply = <®_vcc1v8>;
++ vqmmc-supply = <&buck5_reg>;
+ status = "okay";
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 472d41503f84b8f50f700c1d2c50e90d1c589b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:33:02 +0100
+Subject: arm64: dts: rockchip: remove supports-cqe from rk3588 jaguar
+
+From: Heiko Stuebner <heiko.stuebner@cherry.de>
+
+[ Upstream commit 304b0a60d38dc24bfbfc9adc7d254d1cf8f98317 ]
+
+The sdhci controller supports cqe it seems and necessary code also is in
+place - in theory.
+
+At this point Jaguar and Tiger are the only boards enabling cqe support
+on the rk3588 and we are seeing reliability issues under load.
+
+This can be caused by either a controller-, hw- or driver-issue and
+definitly needs more investigation to work properly it seems.
+
+So disable cqe support on Jaguar for now.
+
+Fixes: d1b8b36a2cc5 ("arm64: dts: rockchip: add Theobroma Jaguar SBC")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
+Link: https://lore.kernel.org/r/20250219093303.2320517-1-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts b/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts
+index 31d2f8994f851..e61c5731fb99f 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3588-jaguar.dts
+@@ -455,7 +455,6 @@ &sdhci {
+ non-removable;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk &emmc_data_strobe>;
+- supports-cqe;
+ vmmc-supply = <&vcc_3v3_s3>;
+ vqmmc-supply = <&vcc_1v8_s3>;
+ status = "okay";
+--
+2.39.5
+
--- /dev/null
+From d98023ec2b0ef50d4c2c0a92f0309d9e003a79da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:33:03 +0100
+Subject: arm64: dts: rockchip: remove supports-cqe from rk3588 tiger
+
+From: Heiko Stuebner <heiko.stuebner@cherry.de>
+
+[ Upstream commit 3e0711f89e5e7b0c7b2ab4843dc92dcbbdbba777 ]
+
+The sdhci controller supports cqe it seems and necessary code also is in
+place - in theory.
+
+At this point Jaguar and Tiger are the only boards enabling cqe support
+on the rk3588 and we are seeing reliability issues under load.
+
+This can be caused by either a controller-, hw- or driver-issue and
+definitly needs more investigation to work properly it seems.
+
+So disable cqe support on Tiger for now.
+
+Fixes: 6173ef24b35b ("arm64: dts: rockchip: add RK3588-Q7 (Tiger) SoM")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
+Link: https://lore.kernel.org/r/20250219093303.2320517-2-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi
+index 615094bb8ba38..a82fe75bda55c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-tiger.dtsi
+@@ -367,7 +367,6 @@ &sdhci {
+ non-removable;
+ pinctrl-names = "default";
+ pinctrl-0 = <&emmc_bus8 &emmc_cmd &emmc_clk &emmc_data_strobe>;
+- supports-cqe;
+ vmmc-supply = <&vcc_3v3_s3>;
+ vqmmc-supply = <&vcc_1v8_s3>;
+ status = "okay";
+--
+2.39.5
+
--- /dev/null
+From 593af9a0b8af8580ce242632bb28eda42fdf7950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 16:31:18 +0000
+Subject: arm64: dts: rockchip: Remove undocumented sdmmc property from
+ lubancat-1
+
+From: Yao Zi <ziyao@disroot.org>
+
+[ Upstream commit 43c854c65e47d2f3763345683b06257b4d12e4e3 ]
+
+Property "supports-sd" isn't documented anywhere and is unnecessary for
+mainline driver to function. It seems a property used by downstream
+kernel was brought into mainline.
+
+This should be reported by dtbs_check, but mmc-controller-common.yaml
+defaults additionalProperties to true thus allows it. Remove the
+property to clean the devicetree up and avoid possible confusion.
+
+Fixes: 8d94da58de53 ("arm64: dts: rockchip: Add EmbedFire LubanCat 1")
+Signed-off-by: Yao Zi <ziyao@disroot.org>
+Link: https://lore.kernel.org/r/20250228163117.47318-2-ziyao@disroot.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+index 9a2f59a351dee..48ccdd6b47118 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+@@ -512,7 +512,6 @@ &sdhci {
+
+ &sdmmc0 {
+ max-frequency = <150000000>;
+- supports-sd;
+ bus-width = <4>;
+ cap-mmc-highspeed;
+ cap-sd-highspeed;
+--
+2.39.5
+
--- /dev/null
+From 9c5c5abeee5592dd7a2780db702fe75f489194f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 18:03:49 +0100
+Subject: ata: libata-core: Add ATA_QUIRK_NO_LPM_ON_ATI for certain Samsung
+ SSDs
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit f2aac4c73c9945cce156fd58a9a2f31f2c8a90c7 ]
+
+Before commit 7627a0edef54 ("ata: ahci: Drop low power policy board type")
+the ATI AHCI controllers specified board type 'board_ahci' rather than
+board type 'board_ahci'. This means that LPM was historically not enabled
+for the ATI AHCI controllers.
+
+By looking at commit 7a8526a5cd51 ("libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI
+for Samsung 860 and 870 SSD."), it is clear that, for some unknown reason,
+that Samsung SSDs do not play nice with ATI AHCI controllers. (When using
+other AHCI controllers, NCQ can be enabled on these Samsung SSDs without
+issues.)
+
+In a similar way, from user reports, it is clear the ATI AHCI controllers
+can enable LPM on e.g. Maxtor HDDs perfectly fine, but when enabling LPM
+on certain Samsung SSDs, things break. (E.g. the SSDs will not get detected
+by the ATI AHCI controller even after a COMRESET.)
+
+Yet, when using LPM on these Samsung SSDs with other AHCI controllers, e.g.
+Intel AHCI controllers, these Samsung drives appear to work perfectly fine.
+
+Considering that the combination of ATI + Samsung, for some unknown reason,
+does not seem to work well, disable LPM when detecting an ATI AHCI
+controller with a problematic Samsung SSD.
+
+Apply this new ATA_QUIRK_NO_LPM_ON_ATI quirk for all Samsung SSDs that have
+already been reported to not play nice with ATI (ATA_QUIRK_NO_NCQ_ON_ATI).
+
+Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type")
+Suggested-by: Hans de Goede <hdegoede@redhat.com>
+Reported-by: Eric <eric.4.debian@grabatoulnz.fr>
+Closes: https://lore.kernel.org/linux-ide/Z8SBZMBjvVXA7OAK@eldamar.lan/
+Tested-by: Eric <eric.4.debian@grabatoulnz.fr>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250317170348.1748671-2-cassel@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 14 +++++++++++---
+ include/linux/libata.h | 2 ++
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index c085dd81ebe7f..d956735e2a764 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2845,6 +2845,10 @@ int ata_dev_configure(struct ata_device *dev)
+ (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2)
+ dev->quirks |= ATA_QUIRK_NOLPM;
+
++ if (dev->quirks & ATA_QUIRK_NO_LPM_ON_ATI &&
++ ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI))
++ dev->quirks |= ATA_QUIRK_NOLPM;
++
+ if (ap->flags & ATA_FLAG_NO_LPM)
+ dev->quirks |= ATA_QUIRK_NOLPM;
+
+@@ -3897,6 +3901,7 @@ static const char * const ata_quirk_names[] = {
+ [__ATA_QUIRK_MAX_SEC_1024] = "maxsec1024",
+ [__ATA_QUIRK_MAX_TRIM_128M] = "maxtrim128m",
+ [__ATA_QUIRK_NO_NCQ_ON_ATI] = "noncqonati",
++ [__ATA_QUIRK_NO_LPM_ON_ATI] = "nolpmonati",
+ [__ATA_QUIRK_NO_ID_DEV_LOG] = "noiddevlog",
+ [__ATA_QUIRK_NO_LOG_DIR] = "nologdir",
+ [__ATA_QUIRK_NO_FUA] = "nofua",
+@@ -4142,13 +4147,16 @@ static const struct ata_dev_quirks_entry __ata_dev_quirks[] = {
+ ATA_QUIRK_ZERO_AFTER_TRIM },
+ { "Samsung SSD 860*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
+ ATA_QUIRK_ZERO_AFTER_TRIM |
+- ATA_QUIRK_NO_NCQ_ON_ATI },
++ ATA_QUIRK_NO_NCQ_ON_ATI |
++ ATA_QUIRK_NO_LPM_ON_ATI },
+ { "Samsung SSD 870*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
+ ATA_QUIRK_ZERO_AFTER_TRIM |
+- ATA_QUIRK_NO_NCQ_ON_ATI },
++ ATA_QUIRK_NO_NCQ_ON_ATI |
++ ATA_QUIRK_NO_LPM_ON_ATI },
+ { "SAMSUNG*MZ7LH*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
+ ATA_QUIRK_ZERO_AFTER_TRIM |
+- ATA_QUIRK_NO_NCQ_ON_ATI, },
++ ATA_QUIRK_NO_NCQ_ON_ATI |
++ ATA_QUIRK_NO_LPM_ON_ATI },
+ { "FCCT*M500*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
+ ATA_QUIRK_ZERO_AFTER_TRIM },
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 9b4a6ff03235b..79974a99265fc 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -88,6 +88,7 @@ enum ata_quirks {
+ __ATA_QUIRK_MAX_SEC_1024, /* Limit max sects to 1024 */
+ __ATA_QUIRK_MAX_TRIM_128M, /* Limit max trim size to 128M */
+ __ATA_QUIRK_NO_NCQ_ON_ATI, /* Disable NCQ on ATI chipset */
++ __ATA_QUIRK_NO_LPM_ON_ATI, /* Disable LPM on ATI chipset */
+ __ATA_QUIRK_NO_ID_DEV_LOG, /* Identify device log missing */
+ __ATA_QUIRK_NO_LOG_DIR, /* Do not read log directory */
+ __ATA_QUIRK_NO_FUA, /* Do not use FUA */
+@@ -434,6 +435,7 @@ enum {
+ ATA_QUIRK_MAX_SEC_1024 = (1U << __ATA_QUIRK_MAX_SEC_1024),
+ ATA_QUIRK_MAX_TRIM_128M = (1U << __ATA_QUIRK_MAX_TRIM_128M),
+ ATA_QUIRK_NO_NCQ_ON_ATI = (1U << __ATA_QUIRK_NO_NCQ_ON_ATI),
++ ATA_QUIRK_NO_LPM_ON_ATI = (1U << __ATA_QUIRK_NO_LPM_ON_ATI),
+ ATA_QUIRK_NO_ID_DEV_LOG = (1U << __ATA_QUIRK_NO_ID_DEV_LOG),
+ ATA_QUIRK_NO_LOG_DIR = (1U << __ATA_QUIRK_NO_LOG_DIR),
+ ATA_QUIRK_NO_FUA = (1U << __ATA_QUIRK_NO_FUA),
+--
+2.39.5
+
--- /dev/null
+From 2d491754004e9738b74f6591c0e6d440aef591fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 22:46:56 +0300
+Subject: Bluetooth: Fix error code in chan_alloc_skb_cb()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ]
+
+The chan_alloc_skb_cb() function is supposed to return error pointers on
+error. Returning NULL will lead to a NULL dereference.
+
+Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/6lowpan.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
+index 50cfec8ccac4f..3c29778171c58 100644
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan,
+ unsigned long hdr_len,
+ unsigned long len, int nb)
+ {
++ struct sk_buff *skb;
++
+ /* Note that we must allocate using GFP_ATOMIC here as
+ * this function is called originally from netdev hard xmit
+ * function in atomic context.
+ */
+- return bt_skb_alloc(hdr_len + len, GFP_ATOMIC);
++ skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC);
++ if (!skb)
++ return ERR_PTR(-ENOMEM);
++ return skb;
+ }
+
+ static void chan_suspend_cb(struct l2cap_chan *chan)
+--
+2.39.5
+
--- /dev/null
+From ecbda9e27e8df9e51e2e5171f080c9cb1432c2ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 20:09:43 +0100
+Subject: Bluetooth: hci_event: Fix connection regression between LE and non-LE
+ adapters
+
+From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+
+[ Upstream commit f6685a96c8c8a07e260e39bac86d4163cfb38a4d ]
+
+Due to a typo during defining HCI errors it is not possible to connect
+LE-capable device with BR/EDR only adapter. The connection is terminated
+by the LE adapter because the invalid LL params error code is treated
+as unsupported remote feature.
+
+Fixes: 79c0868ad65a ("Bluetooth: hci_event: Use HCI error defines instead of magic values")
+Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index 5bb4eaa52e14c..dd10e02bfc746 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -683,7 +683,7 @@ enum {
+ #define HCI_ERROR_REMOTE_POWER_OFF 0x15
+ #define HCI_ERROR_LOCAL_HOST_TERM 0x16
+ #define HCI_ERROR_PAIRING_NOT_ALLOWED 0x18
+-#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1e
++#define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE 0x1a
+ #define HCI_ERROR_INVALID_LL_PARAMS 0x1e
+ #define HCI_ERROR_UNSPECIFIED 0x1f
+ #define HCI_ERROR_ADVERTISING_TIMEOUT 0x3c
+--
+2.39.5
+
--- /dev/null
+From 2298ba717880e3766dc4a1af9a21a68c84014016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 10:52:49 +0100
+Subject: devlink: fix xa_alloc_cyclic() error handling
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit f3b97b7d4bf316c3991e5634c9f4847c2df35478 ]
+
+In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
+be returned, which will cause IS_ERR() to be false. Which can lead to
+dereference not allocated pointer (rel).
+
+Fix it by checking if err is lower than zero.
+
+This wasn't found in real usecase, only noticed. Credit to Pierre.
+
+Fixes: c137743bce02 ("devlink: introduce object and nested devlink relationship infra")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/devlink/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/devlink/core.c b/net/devlink/core.c
+index f49cd83f1955f..7203c39532fcc 100644
+--- a/net/devlink/core.c
++++ b/net/devlink/core.c
+@@ -117,7 +117,7 @@ static struct devlink_rel *devlink_rel_alloc(void)
+
+ err = xa_alloc_cyclic(&devlink_rels, &rel->index, rel,
+ xa_limit_32b, &next, GFP_KERNEL);
+- if (err) {
++ if (err < 0) {
+ kfree(rel);
+ return ERR_PTR(err);
+ }
+--
+2.39.5
+
--- /dev/null
+From 88383fa19ffdcdf4f59a19a2a0cf417f2d62fd91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 11:03:50 +0800
+Subject: dma-mapping: fix missing clear bdr in check_ram_in_range_map()
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit 8324993f60305e50f27b98358b01b9837e10d159 ]
+
+As discussed in [1], if 'bdr' is set once, it would never get
+cleared, hence 0 is always returned.
+
+Refactor the range check hunk into a new helper dma_find_range(),
+which allows 'bdr' to be cleared in each iteration.
+
+Link: https://lore.kernel.org/all/64931fac-085b-4ff3-9314-84bac2fa9bdb@quicinc.com/ # [1]
+Fixes: a409d9600959 ("dma-mapping: fix dma_addressing_limited() if dma_range_map can't cover all system RAM")
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Link: https://lore.kernel.org/r/20250307030350.69144-1-quic_bqiang@quicinc.com
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/direct.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
+index 5b4e6d3bf7bcc..b8fe0b3d0ffb6 100644
+--- a/kernel/dma/direct.c
++++ b/kernel/dma/direct.c
+@@ -584,6 +584,22 @@ int dma_direct_supported(struct device *dev, u64 mask)
+ return mask >= phys_to_dma_unencrypted(dev, min_mask);
+ }
+
++static const struct bus_dma_region *dma_find_range(struct device *dev,
++ unsigned long start_pfn)
++{
++ const struct bus_dma_region *m;
++
++ for (m = dev->dma_range_map; PFN_DOWN(m->size); m++) {
++ unsigned long cpu_start_pfn = PFN_DOWN(m->cpu_start);
++
++ if (start_pfn >= cpu_start_pfn &&
++ start_pfn - cpu_start_pfn < PFN_DOWN(m->size))
++ return m;
++ }
++
++ return NULL;
++}
++
+ /*
+ * To check whether all ram resource ranges are covered by dma range map
+ * Returns 0 when further check is needed
+@@ -593,20 +609,12 @@ static int check_ram_in_range_map(unsigned long start_pfn,
+ unsigned long nr_pages, void *data)
+ {
+ unsigned long end_pfn = start_pfn + nr_pages;
+- const struct bus_dma_region *bdr = NULL;
+- const struct bus_dma_region *m;
+ struct device *dev = data;
+
+ while (start_pfn < end_pfn) {
+- for (m = dev->dma_range_map; PFN_DOWN(m->size); m++) {
+- unsigned long cpu_start_pfn = PFN_DOWN(m->cpu_start);
++ const struct bus_dma_region *bdr;
+
+- if (start_pfn >= cpu_start_pfn &&
+- start_pfn - cpu_start_pfn < PFN_DOWN(m->size)) {
+- bdr = m;
+- break;
+- }
+- }
++ bdr = dma_find_range(dev, start_pfn);
+ if (!bdr)
+ return 1;
+
+--
+2.39.5
+
--- /dev/null
+From 841f69df56953abd557e4164410396d1bbfda142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 10:52:50 +0100
+Subject: dpll: fix xa_alloc_cyclic() error handling
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit 3614bf90130d60f191a5fe218d04f6251c678e13 ]
+
+In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
+be returned, which will cause IS_ERR() to be false. Which can lead to
+dereference not allocated pointer (pin).
+
+Fix it by checking if err is lower than zero.
+
+This wasn't found in real usecase, only noticed. Credit to Pierre.
+
+Fixes: 97f265ef7f5b ("dpll: allocate pin ids in cycle")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dpll/dpll_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c
+index 32019dc33cca7..1877201d1aa9f 100644
+--- a/drivers/dpll/dpll_core.c
++++ b/drivers/dpll/dpll_core.c
+@@ -505,7 +505,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module,
+ xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC);
+ ret = xa_alloc_cyclic(&dpll_pin_xa, &pin->id, pin, xa_limit_32b,
+ &dpll_pin_xa_id, GFP_KERNEL);
+- if (ret)
++ if (ret < 0)
+ goto err_xa_alloc;
+ return pin;
+ err_xa_alloc:
+--
+2.39.5
+
--- /dev/null
+From b4647f1b0c802975a6032609d501ad922e20b69e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:34:56 +0900
+Subject: firmware: imx-scu: fix OF node leak in .probe()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ]
+
+imx_scu_probe() calls of_parse_phandle_with_args(), but does not
+release the OF node reference obtained by it. Add a of_node_put() call
+after done with the node.
+
+Fixes: f25a066d1a07 ("firmware: imx-scu: Support one TX and one RX")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c
+index 1dd4362ef9a3f..8c28e25ddc8a6 100644
+--- a/drivers/firmware/imx/imx-scu.c
++++ b/drivers/firmware/imx/imx-scu.c
+@@ -280,6 +280,7 @@ static int imx_scu_probe(struct platform_device *pdev)
+ return ret;
+
+ sc_ipc->fast_ipc = of_device_is_compatible(args.np, "fsl,imx8-mu-scu");
++ of_node_put(args.np);
+
+ num_channel = sc_ipc->fast_ipc ? 2 : SCU_MU_CHAN_NUM;
+ for (i = 0; i < num_channel; i++) {
+--
+2.39.5
+
--- /dev/null
+From 142c20afd5c0231d432ee016d20859c0fa4e7640 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 09:52:53 +0300
+Subject: firmware: qcom: scm: Fix error code in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 7f048b202333b967782a98aa21bb3354dc379bbf ]
+
+Set the error code if devm_qcom_tzmem_pool_new() fails. Don't return
+success.
+
+Fixes: 1e76b546e6fc ("firmware: qcom: scm: Cleanup global '__scm' on probe failures")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/a0845467-4f83-4070-ab1e-ff7e6764609f@stanley.mountain
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom/qcom_scm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
+index 2e093c39b610a..23aefbf6fca58 100644
+--- a/drivers/firmware/qcom/qcom_scm.c
++++ b/drivers/firmware/qcom/qcom_scm.c
+@@ -2054,8 +2054,8 @@ static int qcom_scm_probe(struct platform_device *pdev)
+
+ __scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config);
+ if (IS_ERR(__scm->mempool)) {
+- dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),
+- "Failed to create the SCM memory pool\n");
++ ret = dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),
++ "Failed to create the SCM memory pool\n");
+ goto err;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From e16eeaae05e2abf18e53f72b70c158c81c1010e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2025 15:18:19 -0400
+Subject: gpu: host1x: Do not assume that a NULL domain means no DMA IOMMU
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit cb83f4b965a66d85e9a03621ef3b22c044f4a033 ]
+
+Previously with tegra-smmu, even with CONFIG_IOMMU_DMA, the default domain
+could have been left as NULL. The NULL domain is specially recognized by
+host1x_iommu_attach() as meaning it is not the DMA domain and
+should be replaced with the special shared domain.
+
+This happened prior to the below commit because tegra-smmu was using the
+NULL domain to mean IDENTITY.
+
+Now that the domain is properly labled the test in DRM doesn't see NULL.
+Check for IDENTITY as well to enable the special domains.
+
+This is the same issue and basic fix as seen in
+commit fae6e669cdc5 ("drm/tegra: Do not assume that a NULL domain means no
+DMA IOMMU").
+
+Fixes: c8cc2655cc6c ("iommu/tegra-smmu: Implement an IDENTITY domain")
+Reported-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Closes: https://lore.kernel.org/all/c6a6f114-3acd-4d56-a13b-b88978e927dc@tecnico.ulisboa.pt/
+Tested-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/0-v1-10dcc8ce3869+3a7-host1x_identity_jgg@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/dev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
+index 710674ef40a97..3f23a7d91519f 100644
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -367,6 +367,10 @@ static bool host1x_wants_iommu(struct host1x *host1x)
+ return true;
+ }
+
++/*
++ * Returns ERR_PTR on failure, NULL if the translation is IDENTITY, otherwise a
++ * valid paging domain.
++ */
+ static struct iommu_domain *host1x_iommu_attach(struct host1x *host)
+ {
+ struct iommu_domain *domain = iommu_get_domain_for_dev(host->dev);
+@@ -391,6 +395,8 @@ static struct iommu_domain *host1x_iommu_attach(struct host1x *host)
+ * Similarly, if host1x is already attached to an IOMMU (via the DMA
+ * API), don't try to attach again.
+ */
++ if (domain && domain->type == IOMMU_DOMAIN_IDENTITY)
++ domain = NULL;
+ if (!host1x_wants_iommu(host) || domain)
+ return domain;
+
+--
+2.39.5
+
--- /dev/null
+From e29cdeb5aa2a0643d33373547ba78897d11db012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 18:03:25 -0700
+Subject: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ]
+
+fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything
+when it fails.
+
+Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh")
+moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init()
+but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in
+case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.
+
+Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the
+error path.
+
+Note that we can remove the fib6_nh_release() call in nh_create_ipv6()
+later in net-next.git.
+
+Fixes: 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://patch.msgid.link/20250312010333.56001-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 2736dea77575b..e9a30978abac1 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3644,7 +3644,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
+ in6_dev_put(idev);
+
+ if (err) {
+- lwtstate_put(fib6_nh->fib_nh_lws);
++ fib_nh_common_release(&fib6_nh->nh_common);
++ fib6_nh->nh_common.nhc_pcpu_rth_output = NULL;
+ fib6_nh->fib_nh_lws = NULL;
+ netdev_put(dev, dev_tracker);
+ }
+--
+2.39.5
+
--- /dev/null
+From fa0958d43a6d88a015f2f1209aae3ef0024ea5a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 18:38:48 -0700
+Subject: ipv6: Set errno after ip_fib_metrics_init() in
+ ip6_route_info_create().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ]
+
+While creating a new IPv6, we could get a weird -ENOMEM when
+RTA_NH_ID is set and either of the conditions below is true:
+
+ 1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified
+ 2) nexthop_get() fails
+
+e.g.)
+
+ # strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from ::
+ recvmsg(3, {msg_iov=[{iov_base=[...[
+ {error=-ENOMEM, msg=[... [...]]},
+ [{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...]
+ ]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148
+
+Let's set err explicitly after ip_fib_metrics_init() in
+ip6_route_info_create().
+
+Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250312013854.61125-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index e9a30978abac1..b393c37d24245 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3803,10 +3803,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
+ if (nh) {
+ if (rt->fib6_src.plen) {
+ NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing");
++ err = -EINVAL;
+ goto out_free;
+ }
+ if (!nexthop_get(nh)) {
+ NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
++ err = -ENOENT;
+ goto out_free;
+ }
+ rt->nh = nh;
+--
+2.39.5
+
--- /dev/null
+From 2fd39f4bf0cb7a731f23358b7916cb0a4860743d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 11:44:17 +0800
+Subject: libfs: Fix duplicate directory entry in offset_dir_lookup
+
+From: Yongjian Sun <sunyongjian1@huawei.com>
+
+[ Upstream commit f70681e9e6066ab7b102e6b46a336a8ed67812ae ]
+
+There is an issue in the kernel:
+
+In tmpfs, when using the "ls" command to list the contents
+of a directory with a large number of files, glibc performs
+the getdents call in multiple rounds. If a concurrent unlink
+occurs between these getdents calls, it may lead to duplicate
+directory entries in the ls output. One possible reproduction
+scenario is as follows:
+
+Create 1026 files and execute ls and rm concurrently:
+
+for i in {1..1026}; do
+ echo "This is file $i" > /tmp/dir/file$i
+done
+
+ls /tmp/dir rm /tmp/dir/file4
+ ->getdents(file1026-file5)
+ ->unlink(file4)
+
+ ->getdents(file5,file3,file2,file1)
+
+It is expected that the second getdents call to return file3
+through file1, but instead it returns an extra file5.
+
+The root cause of this problem is in the offset_dir_lookup
+function. It uses mas_find to determine the starting position
+for the current getdents call. Since mas_find locates the first
+position that is greater than or equal to mas->index, when file4
+is deleted, it ends up returning file5.
+
+It can be fixed by replacing mas_find with mas_find_rev, which
+finds the first position that is less than or equal to mas->index.
+
+Fixes: b9b588f22a0c ("libfs: Use d_children list to iterate simple_offset directories")
+Signed-off-by: Yongjian Sun <sunyongjian1@huawei.com>
+Link: https://lore.kernel.org/r/20250320034417.555810-1-sunyongjian@huaweicloud.com
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index b0f262223b535..3cb49463a8496 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -492,7 +492,7 @@ offset_dir_lookup(struct dentry *parent, loff_t offset)
+ found = find_positive_dentry(parent, NULL, false);
+ else {
+ rcu_read_lock();
+- child = mas_find(&mas, DIR_OFFSET_MAX);
++ child = mas_find_rev(&mas, DIR_OFFSET_MIN);
+ found = find_positive_dentry(parent, child, false);
+ rcu_read_unlock();
+ }
+--
+2.39.5
+
--- /dev/null
+From c1554bc31ade96f07392c608ba990c383cb8e63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 13:10:57 +0300
+Subject: net: atm: fix use after free in lec_send()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ]
+
+The ->send() operation frees skb so save the length before calling
+->send() to avoid a use after free.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/atm/lec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index ffef658862db1..a948dd47c3f34 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -181,6 +181,7 @@ static void
+ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+ struct net_device *dev = skb->dev;
++ unsigned int len = skb->len;
+
+ ATM_SKB(skb)->vcc = vcc;
+ atm_account_tx(vcc, skb);
+@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ }
+
+ dev->stats.tx_packets++;
+- dev->stats.tx_bytes += skb->len;
++ dev->stats.tx_bytes += len;
+ }
+
+ static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue)
+--
+2.39.5
+
--- /dev/null
+From 23038404bbd1f351b90983ed4f788a155229687a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 21:12:59 +0530
+Subject: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 5f079290e5913a0060e059500b7d440990ac1066 ]
+
+Registering the interrupts for TX or RX DMA Channels prior to registering
+their respective NAPI callbacks can result in a NULL pointer dereference.
+This is seen in practice as a random occurrence since it depends on the
+randomness associated with the generation of traffic by Linux and the
+reception of traffic from the wire.
+
+Fixes: 681eb2beb3ef ("net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Co-developed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Link: https://patch.msgid.link/20250311154259.102865-1-s-vadapalli@ti.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 32 +++++++++++++-----------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 3e090f87f97eb..308a2b72a65de 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2225,14 +2225,18 @@ static void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common)
+ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common)
+ {
+ struct device *dev = common->dev;
++ struct am65_cpsw_tx_chn *tx_chn;
+ int i, ret = 0;
+
+ for (i = 0; i < common->tx_ch_num; i++) {
+- struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
++ tx_chn = &common->tx_chns[i];
+
+ hrtimer_init(&tx_chn->tx_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_PINNED);
+ tx_chn->tx_hrtimer.function = &am65_cpsw_nuss_tx_timer_callback;
+
++ netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx,
++ am65_cpsw_nuss_tx_poll);
++
+ ret = devm_request_irq(dev, tx_chn->irq,
+ am65_cpsw_nuss_tx_irq,
+ IRQF_TRIGGER_HIGH,
+@@ -2242,19 +2246,16 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common)
+ tx_chn->id, tx_chn->irq, ret);
+ goto err;
+ }
+-
+- netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx,
+- am65_cpsw_nuss_tx_poll);
+ }
+
+ return 0;
+
+ err:
+- for (--i ; i >= 0 ; i--) {
+- struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
+-
+- netif_napi_del(&tx_chn->napi_tx);
++ netif_napi_del(&tx_chn->napi_tx);
++ for (--i; i >= 0; i--) {
++ tx_chn = &common->tx_chns[i];
+ devm_free_irq(dev, tx_chn->irq, tx_chn);
++ netif_napi_del(&tx_chn->napi_tx);
+ }
+
+ return ret;
+@@ -2488,6 +2489,9 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
+ HRTIMER_MODE_REL_PINNED);
+ flow->rx_hrtimer.function = &am65_cpsw_nuss_rx_timer_callback;
+
++ netif_napi_add(common->dma_ndev, &flow->napi_rx,
++ am65_cpsw_nuss_rx_poll);
++
+ ret = devm_request_irq(dev, flow->irq,
+ am65_cpsw_nuss_rx_irq,
+ IRQF_TRIGGER_HIGH,
+@@ -2496,11 +2500,8 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
+ dev_err(dev, "failure requesting rx %d irq %u, %d\n",
+ i, flow->irq, ret);
+ flow->irq = -EINVAL;
+- goto err_flow;
++ goto err_request_irq;
+ }
+-
+- netif_napi_add(common->dma_ndev, &flow->napi_rx,
+- am65_cpsw_nuss_rx_poll);
+ }
+
+ /* setup classifier to route priorities to flows */
+@@ -2508,11 +2509,14 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
+
+ return 0;
+
++err_request_irq:
++ netif_napi_del(&flow->napi_rx);
++
+ err_flow:
+- for (--i; i >= 0 ; i--) {
++ for (--i; i >= 0; i--) {
+ flow = &rx_chn->flows[i];
+- netif_napi_del(&flow->napi_rx);
+ devm_free_irq(dev, flow->irq, flow);
++ netif_napi_del(&flow->napi_rx);
+ }
+
+ err:
+--
+2.39.5
+
--- /dev/null
+From c41e3b62e03580eb389d4fd84733cdfa32bee992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 22:25:30 +0100
+Subject: net: ipv6: fix TCP GSO segmentation with NAT
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit daa624d3c2ddffdcbad140a9625a4064371db44f ]
+
+When updating the source/destination address, the TCP/UDP checksum needs to
+be updated as well.
+
+Fixes: bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://patch.msgid.link/20250311212530.91519-1-nbd@nbd.name
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/tcpv6_offload.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
+index a45bf17cb2a17..ae2da28f9dfb1 100644
+--- a/net/ipv6/tcpv6_offload.c
++++ b/net/ipv6/tcpv6_offload.c
+@@ -94,14 +94,23 @@ INDIRECT_CALLABLE_SCOPE int tcp6_gro_complete(struct sk_buff *skb, int thoff)
+ }
+
+ static void __tcpv6_gso_segment_csum(struct sk_buff *seg,
++ struct in6_addr *oldip,
++ const struct in6_addr *newip,
+ __be16 *oldport, __be16 newport)
+ {
+- struct tcphdr *th;
++ struct tcphdr *th = tcp_hdr(seg);
++
++ if (!ipv6_addr_equal(oldip, newip)) {
++ inet_proto_csum_replace16(&th->check, seg,
++ oldip->s6_addr32,
++ newip->s6_addr32,
++ true);
++ *oldip = *newip;
++ }
+
+ if (*oldport == newport)
+ return;
+
+- th = tcp_hdr(seg);
+ inet_proto_csum_replace2(&th->check, seg, *oldport, newport, false);
+ *oldport = newport;
+ }
+@@ -129,10 +138,10 @@ static struct sk_buff *__tcpv6_gso_segment_list_csum(struct sk_buff *segs)
+ th2 = tcp_hdr(seg);
+ iph2 = ipv6_hdr(seg);
+
+- iph2->saddr = iph->saddr;
+- iph2->daddr = iph->daddr;
+- __tcpv6_gso_segment_csum(seg, &th2->source, th->source);
+- __tcpv6_gso_segment_csum(seg, &th2->dest, th->dest);
++ __tcpv6_gso_segment_csum(seg, &iph2->saddr, &iph->saddr,
++ &th2->source, th->source);
++ __tcpv6_gso_segment_csum(seg, &iph2->daddr, &iph->daddr,
++ &th2->dest, th->dest);
+ }
+
+ return segs;
+--
+2.39.5
+
--- /dev/null
+From 41b6a098dc09ee0783f03b09af2ac69b032824dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 13:00:47 +0100
+Subject: net: ipv6: ioam6: fix lwtunnel_output() loop
+
+From: Justin Iurman <justin.iurman@uliege.be>
+
+[ Upstream commit 3e7a60b368eadf6c30a4a79dea1eb8f88b6d620d ]
+
+Fix the lwtunnel_output() reentry loop in ioam6_iptunnel when the
+destination is the same after transformation. Note that a check on the
+destination address was already performed, but it was not enough. This
+is the example of a lwtunnel user taking care of loops without relying
+only on the last resort detection offered by lwtunnel.
+
+Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation")
+Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
+Link: https://patch.msgid.link/20250314120048.12569-3-justin.iurman@uliege.be
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ioam6_iptunnel.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
+index 4215cebe7d85a..647dd8417c6cf 100644
+--- a/net/ipv6/ioam6_iptunnel.c
++++ b/net/ipv6/ioam6_iptunnel.c
+@@ -339,7 +339,6 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
+ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb), *cache_dst = NULL;
+- struct in6_addr orig_daddr;
+ struct ioam6_lwt *ilwt;
+ int err = -EINVAL;
+ u32 pkt_cnt;
+@@ -354,8 +353,6 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k)
+ goto out;
+
+- orig_daddr = ipv6_hdr(skb)->daddr;
+-
+ local_bh_disable();
+ cache_dst = dst_cache_get(&ilwt->cache);
+ local_bh_enable();
+@@ -424,7 +421,10 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ goto drop;
+ }
+
+- if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {
++ /* avoid lwtunnel_output() reentry loop when destination is the same
++ * after transformation (e.g., with the inline mode)
++ */
++ if (dst->lwtstate != cache_dst->lwtstate) {
+ skb_dst_drop(skb);
+ skb_dst_set(skb, cache_dst);
+ return dst_output(net, sk, skb);
+--
+2.39.5
+
--- /dev/null
+From 02d14ee576b4777ec191b2cfdab4e88ff8678948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 13:00:46 +0100
+Subject: net: lwtunnel: fix recursion loops
+
+From: Justin Iurman <justin.iurman@uliege.be>
+
+[ Upstream commit 986ffb3a57c5650fb8bf6d59a8f0f07046abfeb6 ]
+
+This patch acts as a parachute, catch all solution, by detecting
+recursion loops in lwtunnel users and taking care of them (e.g., a loop
+between routes, a loop within the same route, etc). In general, such
+loops are the consequence of pathological configurations. Each lwtunnel
+user is still free to catch such loops early and do whatever they want
+with them. It will be the case in a separate patch for, e.g., seg6 and
+seg6_local, in order to provide drop reasons and update statistics.
+Another example of a lwtunnel user taking care of loops is ioam6, which
+has valid use cases that include loops (e.g., inline mode), and which is
+addressed by the next patch in this series. Overall, this patch acts as
+a last resort to catch loops and drop packets, since we don't want to
+leak something unintentionally because of a pathological configuration
+in lwtunnels.
+
+The solution in this patch reuses dev_xmit_recursion(),
+dev_xmit_recursion_inc(), and dev_xmit_recursion_dec(), which seems fine
+considering the context.
+
+Closes: https://lore.kernel.org/netdev/2bc9e2079e864a9290561894d2a602d6@akamai.com/
+Closes: https://lore.kernel.org/netdev/Z7NKYMY7fJT5cYWu@shredder/
+Fixes: ffce41962ef6 ("lwtunnel: support dst output redirect function")
+Fixes: 2536862311d2 ("lwt: Add support to redirect dst.input")
+Fixes: 14972cbd34ff ("net: lwtunnel: Handle fragmentation")
+Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
+Link: https://patch.msgid.link/20250314120048.12569-2-justin.iurman@uliege.be
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/lwtunnel.c | 65 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 53 insertions(+), 12 deletions(-)
+
+diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
+index 711cd3b4347a7..4417a18b3e951 100644
+--- a/net/core/lwtunnel.c
++++ b/net/core/lwtunnel.c
+@@ -23,6 +23,8 @@
+ #include <net/ip6_fib.h>
+ #include <net/rtnh.h>
+
++#include "dev.h"
++
+ DEFINE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled);
+ EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_enabled);
+
+@@ -325,13 +327,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_cmp_encap);
+
+ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+- struct dst_entry *dst = skb_dst(skb);
+ const struct lwtunnel_encap_ops *ops;
+ struct lwtunnel_state *lwtstate;
+- int ret = -EINVAL;
++ struct dst_entry *dst;
++ int ret;
++
++ if (dev_xmit_recursion()) {
++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
++ __func__);
++ ret = -ENETDOWN;
++ goto drop;
++ }
+
+- if (!dst)
++ dst = skb_dst(skb);
++ if (!dst) {
++ ret = -EINVAL;
+ goto drop;
++ }
+ lwtstate = dst->lwtstate;
+
+ if (lwtstate->type == LWTUNNEL_ENCAP_NONE ||
+@@ -341,8 +353,11 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb)
+ ret = -EOPNOTSUPP;
+ rcu_read_lock();
+ ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
+- if (likely(ops && ops->output))
++ if (likely(ops && ops->output)) {
++ dev_xmit_recursion_inc();
+ ret = ops->output(net, sk, skb);
++ dev_xmit_recursion_dec();
++ }
+ rcu_read_unlock();
+
+ if (ret == -EOPNOTSUPP)
+@@ -359,13 +374,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_output);
+
+ int lwtunnel_xmit(struct sk_buff *skb)
+ {
+- struct dst_entry *dst = skb_dst(skb);
+ const struct lwtunnel_encap_ops *ops;
+ struct lwtunnel_state *lwtstate;
+- int ret = -EINVAL;
++ struct dst_entry *dst;
++ int ret;
++
++ if (dev_xmit_recursion()) {
++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
++ __func__);
++ ret = -ENETDOWN;
++ goto drop;
++ }
+
+- if (!dst)
++ dst = skb_dst(skb);
++ if (!dst) {
++ ret = -EINVAL;
+ goto drop;
++ }
+
+ lwtstate = dst->lwtstate;
+
+@@ -376,8 +401,11 @@ int lwtunnel_xmit(struct sk_buff *skb)
+ ret = -EOPNOTSUPP;
+ rcu_read_lock();
+ ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
+- if (likely(ops && ops->xmit))
++ if (likely(ops && ops->xmit)) {
++ dev_xmit_recursion_inc();
+ ret = ops->xmit(skb);
++ dev_xmit_recursion_dec();
++ }
+ rcu_read_unlock();
+
+ if (ret == -EOPNOTSUPP)
+@@ -394,13 +422,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_xmit);
+
+ int lwtunnel_input(struct sk_buff *skb)
+ {
+- struct dst_entry *dst = skb_dst(skb);
+ const struct lwtunnel_encap_ops *ops;
+ struct lwtunnel_state *lwtstate;
+- int ret = -EINVAL;
++ struct dst_entry *dst;
++ int ret;
+
+- if (!dst)
++ if (dev_xmit_recursion()) {
++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
++ __func__);
++ ret = -ENETDOWN;
+ goto drop;
++ }
++
++ dst = skb_dst(skb);
++ if (!dst) {
++ ret = -EINVAL;
++ goto drop;
++ }
+ lwtstate = dst->lwtstate;
+
+ if (lwtstate->type == LWTUNNEL_ENCAP_NONE ||
+@@ -410,8 +448,11 @@ int lwtunnel_input(struct sk_buff *skb)
+ ret = -EOPNOTSUPP;
+ rcu_read_lock();
+ ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
+- if (likely(ops && ops->input))
++ if (likely(ops && ops->input)) {
++ dev_xmit_recursion_inc();
+ ret = ops->input(skb);
++ dev_xmit_recursion_dec();
++ }
+ rcu_read_unlock();
+
+ if (ret == -EOPNOTSUPP)
+--
+2.39.5
+
--- /dev/null
+From 0993b503bbee58cd077f487fffe984af86bf66c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Mar 2025 00:51:13 +0800
+Subject: net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ]
+
+Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits")
+introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent
+approximative value for deprecated QUEUE_LEN. However, it forgot to add
+the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one
+simple NLA_U32 type policy.
+
+Fixes: 8b5c171bb3dc ("neigh: new unresolved queue limits")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Link: https://patch.msgid.link/20250315165113.37600-1-linma@zju.edu.cn
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index c7f7ea61b524a..8082cc6be4fc1 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2301,6 +2301,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
+ static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
+ [NDTPA_IFINDEX] = { .type = NLA_U32 },
+ [NDTPA_QUEUE_LEN] = { .type = NLA_U32 },
++ [NDTPA_QUEUE_LENBYTES] = { .type = NLA_U32 },
+ [NDTPA_PROXY_QLEN] = { .type = NLA_U32 },
+ [NDTPA_APP_PROBES] = { .type = NLA_U32 },
+ [NDTPA_UCAST_PROBES] = { .type = NLA_U32 },
+--
+2.39.5
+
--- /dev/null
+From d4aff454dbc6b50642c9ef877f3b8979d97050f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 15:57:21 +0530
+Subject: net: ti: icssg-prueth: Add lock to stats
+
+From: MD Danish Anwar <danishanwar@ti.com>
+
+[ Upstream commit 47a9b5e52abd2b717dfc8b9460589f89936d93cf ]
+
+Currently the API emac_update_hardware_stats() reads different ICSSG
+stats without any lock protection.
+
+This API gets called by .ndo_get_stats64() which is only under RCU
+protection and nothing else. Add lock to this API so that the reading of
+statistics happens during lock.
+
+Fixes: c1e10d5dc7a1 ("net: ti: icssg-prueth: Add ICSSG Stats")
+Signed-off-by: MD Danish Anwar <danishanwar@ti.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250314102721.1394366-1-danishanwar@ti.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/icssg/icssg_prueth.c | 1 +
+ drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 ++
+ drivers/net/ethernet/ti/icssg/icssg_stats.c | 4 ++++
+ 3 files changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c
+index cb11635a8d120..6f0700d156e71 100644
+--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c
++++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c
+@@ -1555,6 +1555,7 @@ static int prueth_probe(struct platform_device *pdev)
+ }
+
+ spin_lock_init(&prueth->vtbl_lock);
++ spin_lock_init(&prueth->stats_lock);
+ /* setup netdev interfaces */
+ if (eth0_node) {
+ ret = prueth_netdev_init(prueth, eth0_node);
+diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.h b/drivers/net/ethernet/ti/icssg/icssg_prueth.h
+index 5473315ea2040..e456a11c5d4e3 100644
+--- a/drivers/net/ethernet/ti/icssg/icssg_prueth.h
++++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.h
+@@ -297,6 +297,8 @@ struct prueth {
+ int default_vlan;
+ /** @vtbl_lock: Lock for vtbl in shared memory */
+ spinlock_t vtbl_lock;
++ /** @stats_lock: Lock for reading icssg stats */
++ spinlock_t stats_lock;
+ };
+
+ struct emac_tx_ts_response {
+diff --git a/drivers/net/ethernet/ti/icssg/icssg_stats.c b/drivers/net/ethernet/ti/icssg/icssg_stats.c
+index 8800bd3a8d074..6f0edae38ea24 100644
+--- a/drivers/net/ethernet/ti/icssg/icssg_stats.c
++++ b/drivers/net/ethernet/ti/icssg/icssg_stats.c
+@@ -26,6 +26,8 @@ void emac_update_hardware_stats(struct prueth_emac *emac)
+ u32 val, reg;
+ int i;
+
++ spin_lock(&prueth->stats_lock);
++
+ for (i = 0; i < ARRAY_SIZE(icssg_all_miig_stats); i++) {
+ regmap_read(prueth->miig_rt,
+ base + icssg_all_miig_stats[i].offset,
+@@ -51,6 +53,8 @@ void emac_update_hardware_stats(struct prueth_emac *emac)
+ emac->pa_stats[i] += val;
+ }
+ }
++
++ spin_unlock(&prueth->stats_lock);
+ }
+
+ void icssg_stats_work_handler(struct work_struct *work)
+--
+2.39.5
+
--- /dev/null
+From 03bb5078e07a4fa34aca71b8576553cb80222880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 10:52:51 +0100
+Subject: phy: fix xa_alloc_cyclic() error handling
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit 3178d2b048365fe2c078cd53f85f2abf1487733b ]
+
+xa_alloc_cyclic() can return 1, which isn't an error. To prevent
+situation when the caller of this function will treat it as no error do
+a check only for negative here.
+
+Fixes: 384968786909 ("net: phy: Introduce ethernet link topology representation")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_link_topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phy_link_topology.c b/drivers/net/phy/phy_link_topology.c
+index 4a5d73002a1a8..0e9e987f37dd8 100644
+--- a/drivers/net/phy/phy_link_topology.c
++++ b/drivers/net/phy/phy_link_topology.c
+@@ -73,7 +73,7 @@ int phy_link_topo_add_phy(struct net_device *dev,
+ xa_limit_32b, &topo->next_phy_index,
+ GFP_KERNEL);
+
+- if (ret)
++ if (ret < 0)
+ goto err;
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 769856595a21b46066004e7cec3ae2bcbd74b691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 08:59:37 -0800
+Subject: RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ]
+
+The modulo operation returns wrong result without the
+paranthesis and that resulted in wrong QP table indexing.
+
+Fixes: 84cf229f4001 ("RDMA/bnxt_re: Fix the qp table indexing")
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://patch.msgid.link/1741021178-2569-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+index 07779aeb75759..a4deb45ec849f 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+@@ -283,9 +283,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
+ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
+ struct bnxt_qplib_ctx *ctx, int is_virtfn);
+ void bnxt_qplib_mark_qp_error(void *qp_handle);
++
+ static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw)
+ {
+ /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/
+- return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2;
++ return (qid == 1) ? rcfw->qp_tbl_size - 1 : (qid % (rcfw->qp_tbl_size - 2));
+ }
+ #endif /* __BNXT_QPLIB_RCFW_H__ */
+--
+2.39.5
+
--- /dev/null
+From 554656fbcec8502c3e513ad4498e0795b95c095d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 22:16:36 -0700
+Subject: RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
+
+From: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+
+[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ]
+
+Driver is always clearing the mask that sets the VLAN ID/Service Level
+in the adapter. Recent change for supporting multiple traffic class
+exposed this issue.
+
+Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Fixes: c64b16a37b6d ("RDMA/bnxt_re: Support different traffic class")
+Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://patch.msgid.link/1741670196-2919-1-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 613b5fc70e13e..7436ce5515797 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -1216,8 +1216,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp)
+ qp->path_mtu =
+ CMDQ_MODIFY_QP_PATH_MTU_MTU_2048;
+ }
+- qp->modify_flags &=
+- ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID;
+ /* Bono FW require the max_dest_rd_atomic to be >= 1 */
+ if (qp->max_dest_rd_atomic < 1)
+ qp->max_dest_rd_atomic = 1;
+--
+2.39.5
+
--- /dev/null
+From cac6f8e6610dbcfec6600e3d4dc904ac2f0808c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:55 +0800
+Subject: RDMA/hns: Fix a missing rollback in error path of
+ hns_roce_create_qp_common()
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 444907dd45cbe62fd69398805b6e2c626fab5b3a ]
+
+When ib_copy_to_udata() fails in hns_roce_create_qp_common(),
+hns_roce_qp_remove() should be called in the error path to
+clean up resources in hns_roce_qp_store().
+
+Fixes: 0f00571f9433 ("RDMA/hns: Use new SQ doorbell register for HIP09")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 8408f9a5c309d..52b671156246b 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1220,7 +1220,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
+ min(udata->outlen, sizeof(resp)));
+ if (ret) {
+ ibdev_err(ibdev, "copy qp resp failed!\n");
+- goto err_store;
++ goto err_flow_ctrl;
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 7056ae7b74325398cc4f965b04ef8bc19b82c598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:54 +0800
+Subject: RDMA/hns: Fix invalid sq params not being blocked
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 13c90c222049764bb7e6a1689bd785f424bd8bd5 ]
+
+SQ params from userspace are checked in by set_user_sq_size(). But
+when the check fails, the function doesn't return but instead keep
+running and overwrite 'ret'. As a result, the invalid params will
+not get blocked actually.
+
+Add a return right after the failed check. Besides, although the
+check result of kernel sq params will not be overwritten, to keep
+coding style unified, move default_congest_type() before
+set_kernel_sq_size().
+
+Fixes: 6ec429d5887a ("RDMA/hns: Support userspace configuring congestion control algorithm with QP granularity")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-5-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index a97348a1c61f1..8408f9a5c309d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1121,24 +1121,23 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
+ ibucontext);
+ hr_qp->config = uctx->config;
+ ret = set_user_sq_size(hr_dev, &init_attr->cap, hr_qp, ucmd);
+- if (ret)
++ if (ret) {
+ ibdev_err(ibdev,
+ "failed to set user SQ size, ret = %d.\n",
+ ret);
++ return ret;
++ }
+
+ ret = set_congest_param(hr_dev, hr_qp, ucmd);
+- if (ret)
+- return ret;
+ } else {
+ if (hr_dev->pci_dev->revision >= PCI_REVISION_ID_HIP09)
+ hr_qp->config = HNS_ROCE_EXSGE_FLAGS;
++ default_congest_type(hr_dev, hr_qp);
+ ret = set_kernel_sq_size(hr_dev, &init_attr->cap, hr_qp);
+ if (ret)
+ ibdev_err(ibdev,
+ "failed to set kernel SQ size, ret = %d.\n",
+ ret);
+-
+- default_congest_type(hr_dev, hr_qp);
+ }
+
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 08854ddd07095259cb62855412f1a521ced12a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:56 +0800
+Subject: RDMA/hns: Fix missing xa_destroy()
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit eda0a2fdbc24c35cd8d61d9c9111cafd5f89b2dc ]
+
+Add xa_destroy() for xarray in driver.
+
+Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08")
+Fixes: 27e19f451089 ("RDMA/hns: Convert cq_table to XArray")
+Fixes: 736b5a70db98 ("RDMA/hns: Convert qp_table_tree to XArray")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-7-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +++-
+ drivers/infiniband/hw/hns/hns_roce_cq.c | 1 +
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 1 +
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c
+index 950c133d4220e..6ee911f6885b5 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c
++++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c
+@@ -175,8 +175,10 @@ void hns_roce_cleanup_bitmap(struct hns_roce_dev *hr_dev)
+ if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC)
+ ida_destroy(&hr_dev->xrcd_ida.ida);
+
+- if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
++ if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ) {
+ ida_destroy(&hr_dev->srq_table.srq_ida.ida);
++ xa_destroy(&hr_dev->srq_table.xa);
++ }
+ hns_roce_cleanup_qp_table(hr_dev);
+ hns_roce_cleanup_cq_table(hr_dev);
+ ida_destroy(&hr_dev->mr_table.mtpt_ida.ida);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
+index 4106423a1b399..3a5c93c9fb3e6 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
+@@ -537,5 +537,6 @@ void hns_roce_cleanup_cq_table(struct hns_roce_dev *hr_dev)
+
+ for (i = 0; i < HNS_ROCE_CQ_BANK_NUM; i++)
+ ida_destroy(&hr_dev->cq_table.bank[i].ida);
++ xa_destroy(&hr_dev->cq_table.array);
+ mutex_destroy(&hr_dev->cq_table.bank_mutex);
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 52b671156246b..8901c142c1b65 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -1603,6 +1603,7 @@ void hns_roce_cleanup_qp_table(struct hns_roce_dev *hr_dev)
+ for (i = 0; i < HNS_ROCE_QP_BANK_NUM; i++)
+ ida_destroy(&hr_dev->qp_table.bank[i].ida);
+ xa_destroy(&hr_dev->qp_table.dip_xa);
++ xa_destroy(&hr_dev->qp_table_xa);
+ mutex_destroy(&hr_dev->qp_table.bank_mutex);
+ mutex_destroy(&hr_dev->qp_table.scc_mutex);
+ }
+--
+2.39.5
+
--- /dev/null
+From ae0a1bd77712df8ba5da3fe5aa0f94c5b398c927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:52 +0800
+Subject: RDMA/hns: Fix soft lockup during bt pages loop
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ]
+
+Driver runs a for-loop when allocating bt pages and mapping them with
+buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,
+it may require a considerable loop count. This will lead to soft lockup:
+
+ watchdog: BUG: soft lockup - CPU#27 stuck for 22s!
+ ...
+ Call trace:
+ hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]
+ hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]
+ hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]
+ alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]
+ hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]
+ ib_uverbs_reg_mr+0x118/0x290
+
+ watchdog: BUG: soft lockup - CPU#35 stuck for 23s!
+ ...
+ Call trace:
+ hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]
+ mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]
+ hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]
+ alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]
+ hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]
+ ib_uverbs_reg_mr+0x120/0x2bc
+
+Add a cond_resched() to fix soft lockup during these loops. In order not
+to affect the allocation performance of normal-size buffer, set the loop
+count of a 100GB MR as the threshold to call cond_resched().
+
+Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-3-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index 605562122ecce..ca0798224e565 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -1361,6 +1361,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,
+ return ret;
+ }
+
++/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming
++ * the bt page size is not expanded by cal_best_bt_pg_sz()
++ */
++#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800
++
+ /* construct the base address table and link them by address hop config */
+ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev,
+ struct hns_roce_hem_list *hem_list,
+@@ -1369,6 +1374,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev,
+ {
+ const struct hns_roce_buf_region *r;
+ int ofs, end;
++ int loop;
+ int unit;
+ int ret;
+ int i;
+@@ -1386,7 +1392,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev,
+ continue;
+
+ end = r->offset + r->count;
+- for (ofs = r->offset; ofs < end; ofs += unit) {
++ for (ofs = r->offset, loop = 1; ofs < end; ofs += unit, loop++) {
++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K))
++ cond_resched();
++
+ ret = hem_list_alloc_mid_bt(hr_dev, r, unit, ofs,
+ hem_list->mid_bt[i],
+ &hem_list->btm_bt);
+@@ -1443,9 +1452,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev,
+ struct list_head *head = &hem_list->btm_bt;
+ struct hns_roce_hem_item *hem, *temp_hem;
+ void *cpu_base = NULL;
++ int loop = 1;
+ int nr = 0;
+
+ list_for_each_entry_safe(hem, temp_hem, head, sibling) {
++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K))
++ cond_resched();
++ loop++;
++
+ if (hem_list_page_is_in_range(hem, offset)) {
+ nr = offset - hem->start;
+ cpu_base = hem->addr + nr * BA_BYTE_LEN;
+--
+2.39.5
+
--- /dev/null
+From be9b47aca32662020615f3b805f40b9319c61993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:53 +0800
+Subject: RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit b9f59a24ba35a7d955a9f8e148dd9f85b7b40a01 ]
+
+Currently the condition of unmapping sdb in error path is not exactly
+the same as the condition of mapping in alloc_user_qp_db(). This may
+cause a problem of unmapping an unmapped db in some case, such as
+when the QP is XRC TGT. Unified the two conditions.
+
+Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-4-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 9e2e76c594063..a97348a1c61f1 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -868,12 +868,14 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev,
+ struct hns_roce_ib_create_qp *ucmd,
+ struct hns_roce_ib_create_qp_resp *resp)
+ {
++ bool has_sdb = user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd);
+ struct hns_roce_ucontext *uctx = rdma_udata_to_drv_context(udata,
+ struct hns_roce_ucontext, ibucontext);
++ bool has_rdb = user_qp_has_rdb(hr_dev, init_attr, udata, resp);
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+ int ret;
+
+- if (user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd)) {
++ if (has_sdb) {
+ ret = hns_roce_db_map_user(uctx, ucmd->sdb_addr, &hr_qp->sdb);
+ if (ret) {
+ ibdev_err(ibdev,
+@@ -884,7 +886,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev,
+ hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
+ }
+
+- if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) {
++ if (has_rdb) {
+ ret = hns_roce_db_map_user(uctx, ucmd->db_addr, &hr_qp->rdb);
+ if (ret) {
+ ibdev_err(ibdev,
+@@ -898,7 +900,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev,
+ return 0;
+
+ err_sdb:
+- if (hr_qp->en_flags & HNS_ROCE_QP_CAP_SQ_RECORD_DB)
++ if (has_sdb)
+ hns_roce_db_unmap_user(uctx, &hr_qp->sdb);
+ err_out:
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From e9190478f26777399ed06cae22c259d3db21d1a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 16:48:57 +0800
+Subject: RDMA/hns: Fix wrong value of max_sge_rd
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ]
+
+There is no difference between the sge of READ and non-READ
+operations in hns RoCE. Set max_sge_rd to the same value as
+max_send_sge.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250311084857.3803665-8-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index ae24c81c9812d..cf89a8db4f64c 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -183,7 +183,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev,
+ IB_DEVICE_RC_RNR_NAK_GEN;
+ props->max_send_sge = hr_dev->caps.max_sq_sg;
+ props->max_recv_sge = hr_dev->caps.max_rq_sg;
+- props->max_sge_rd = 1;
++ props->max_sge_rd = hr_dev->caps.max_sq_sg;
+ props->max_cq = hr_dev->caps.num_cqs;
+ props->max_cqe = hr_dev->caps.max_cqes;
+ props->max_mr = hr_dev->caps.num_mtpts;
+--
+2.39.5
+
--- /dev/null
+From f559f6c77a78ce59130bc27c9a0cf323c738d77e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 14:02:46 +0000
+Subject: RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+[ Upstream commit 556f93b90c1872ad85e216e613c0b33803e621cb ]
+
+In function create_ib_ah() the following line attempts
+to left shift the return value of mlx5r_ib_rate() by 4
+and store it in the stat_rate_sl member of av:
+
+However the code overlooks the fact that mlx5r_ib_rate()
+may return -EINVAL if the rate passed to it is less than
+IB_RATE_2_5_GBPS or greater than IB_RATE_800_GBPS.
+
+Because of this, the code may invoke undefined behaviour when
+shifting a signed negative value when doing "-EINVAL << 4".
+
+To fix this check for errors before assigning stat_rate_sl and
+propagate any error value to the callers.
+
+Fixes: c534ffda781f ("RDMA/mlx5: Fix AH static rate parsing")
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Link: https://patch.msgid.link/20250304140246.205919-1-qasdev00@gmail.com
+Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/ah.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/ah.c b/drivers/infiniband/hw/mlx5/ah.c
+index 99036afb3aef0..531a57f9ee7e8 100644
+--- a/drivers/infiniband/hw/mlx5/ah.c
++++ b/drivers/infiniband/hw/mlx5/ah.c
+@@ -50,11 +50,12 @@ static __be16 mlx5_ah_get_udp_sport(const struct mlx5_ib_dev *dev,
+ return sport;
+ }
+
+-static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,
++static int create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,
+ struct rdma_ah_init_attr *init_attr)
+ {
+ struct rdma_ah_attr *ah_attr = init_attr->ah_attr;
+ enum ib_gid_type gid_type;
++ int rate_val;
+
+ if (rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH) {
+ const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr);
+@@ -67,8 +68,10 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,
+ ah->av.tclass = grh->traffic_class;
+ }
+
+- ah->av.stat_rate_sl =
+- (mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4);
++ rate_val = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr));
++ if (rate_val < 0)
++ return rate_val;
++ ah->av.stat_rate_sl = rate_val << 4;
+
+ if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) {
+ if (init_attr->xmit_slave)
+@@ -89,6 +92,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,
+ ah->av.fl_mlid = rdma_ah_get_path_bits(ah_attr) & 0x7f;
+ ah->av.stat_rate_sl |= (rdma_ah_get_sl(ah_attr) & 0xf);
+ }
++
++ return 0;
+ }
+
+ int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+@@ -121,8 +126,7 @@ int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
+ return err;
+ }
+
+- create_ib_ah(dev, ah, init_attr);
+- return 0;
++ return create_ib_ah(dev, ah, init_attr);
+ }
+
+ int mlx5_ib_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)
+--
+2.39.5
+
--- /dev/null
+From 2773c3a66cad680c65a2a9e5dfcbbce813087d3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Mar 2025 22:54:44 +0100
+Subject: RDMA/rxe: Fix the failure of ibv_query_device() and
+ ibv_query_device_ex() tests
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit 8ce2eb9dfac8743d1c423b86339336a5b6a6069e ]
+
+In rdma-core, the following failures appear.
+
+"
+$ ./build/bin/run_tests.py -k device
+ssssssss....FF........s
+======================================================================
+FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device)
+Test ibv_query_device()
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in
+ test_query_device
+ self.verify_device_attr(attr, dev)
+ File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
+ verify_device_attr
+ assert attr.sys_image_guid != 0
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+AssertionError
+
+======================================================================
+FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex)
+Test ibv_query_device_ex()
+----------------------------------------------------------------------
+Traceback (most recent call last):
+ File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in
+ test_query_device_ex
+ self.verify_device_attr(attr_ex.orig_attr, dev)
+ File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in
+ verify_device_attr
+ assert attr.sys_image_guid != 0
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+AssertionError
+"
+
+The root cause is: before a net device is set with rxe, this net device
+is used to generate a sys_image_guid.
+
+Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev
+Reviewed-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
+Tested-by: Daisuke Matsuda <matsuda-daisuke@fujitsu.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 25 ++++++-------------------
+ 1 file changed, 6 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 1ba4a0c8726ae..e27478fe9456c 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -38,10 +38,8 @@ void rxe_dealloc(struct ib_device *ib_dev)
+ }
+
+ /* initialize rxe device parameters */
+-static void rxe_init_device_param(struct rxe_dev *rxe)
++static void rxe_init_device_param(struct rxe_dev *rxe, struct net_device *ndev)
+ {
+- struct net_device *ndev;
+-
+ rxe->max_inline_data = RXE_MAX_INLINE_DATA;
+
+ rxe->attr.vendor_id = RXE_VENDOR_ID;
+@@ -74,15 +72,9 @@ static void rxe_init_device_param(struct rxe_dev *rxe)
+ rxe->attr.max_pkeys = RXE_MAX_PKEYS;
+ rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY;
+
+- ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
+- if (!ndev)
+- return;
+-
+ addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid,
+ ndev->dev_addr);
+
+- dev_put(ndev);
+-
+ rxe->max_ucontext = RXE_MAX_UCONTEXT;
+ }
+
+@@ -115,18 +107,13 @@ static void rxe_init_port_param(struct rxe_port *port)
+ /* initialize port state, note IB convention that HCA ports are always
+ * numbered from 1
+ */
+-static void rxe_init_ports(struct rxe_dev *rxe)
++static void rxe_init_ports(struct rxe_dev *rxe, struct net_device *ndev)
+ {
+ struct rxe_port *port = &rxe->port;
+- struct net_device *ndev;
+
+ rxe_init_port_param(port);
+- ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
+- if (!ndev)
+- return;
+ addrconf_addr_eui48((unsigned char *)&port->port_guid,
+ ndev->dev_addr);
+- dev_put(ndev);
+ spin_lock_init(&port->port_lock);
+ }
+
+@@ -144,12 +131,12 @@ static void rxe_init_pools(struct rxe_dev *rxe)
+ }
+
+ /* initialize rxe device state */
+-static void rxe_init(struct rxe_dev *rxe)
++static void rxe_init(struct rxe_dev *rxe, struct net_device *ndev)
+ {
+ /* init default device parameters */
+- rxe_init_device_param(rxe);
++ rxe_init_device_param(rxe, ndev);
+
+- rxe_init_ports(rxe);
++ rxe_init_ports(rxe, ndev);
+ rxe_init_pools(rxe);
+
+ /* init pending mmap list */
+@@ -184,7 +171,7 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu)
+ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name,
+ struct net_device *ndev)
+ {
+- rxe_init(rxe);
++ rxe_init(rxe, ndev);
+ rxe_set_mtu(rxe, mtu);
+
+ return rxe_register_device(rxe, ibdev_name, ndev);
+--
+2.39.5
+
--- /dev/null
+From fa1b25e55aaf83e82bd4346c935639ce56a2eadb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 22:26:50 +0100
+Subject: Revert "gre: Fix IPv6 link-local address generation."
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit fc486c2d060f67d672ddad81724f7c8a4d329570 ]
+
+This reverts commit 183185a18ff96751db52a46ccf93fff3a1f42815.
+
+This patch broke net/forwarding/ip6gre_custom_multipath_hash.sh in some
+circumstances (https://lore.kernel.org/netdev/Z9RIyKZDNoka53EO@mini-arch/).
+Let's revert it while the problem is being investigated.
+
+Fixes: 183185a18ff9 ("gre: Fix IPv6 link-local address generation.")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Link: https://patch.msgid.link/8b1ce738eb15dd841aab9ef888640cab4f6ccfea.1742418408.git.gnault@redhat.com
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 26cdb66574757..f7c17388ff6aa 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -3237,13 +3237,16 @@ static void add_v4_addrs(struct inet6_dev *idev)
+ struct in6_addr addr;
+ struct net_device *dev;
+ struct net *net = dev_net(idev->dev);
+- int scope, plen;
++ int scope, plen, offset = 0;
+ u32 pflags = 0;
+
+ ASSERT_RTNL();
+
+ memset(&addr, 0, sizeof(struct in6_addr));
+- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
++ /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */
++ if (idev->dev->addr_len == sizeof(struct in6_addr))
++ offset = sizeof(struct in6_addr) - 4;
++ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4);
+
+ if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) {
+ scope = IPV6_ADDR_COMPATv4;
+@@ -3554,13 +3557,7 @@ static void addrconf_gre_config(struct net_device *dev)
+ return;
+ }
+
+- /* Generate the IPv6 link-local address using addrconf_addr_gen(),
+- * unless we have an IPv4 GRE device not bound to an IP address and
+- * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this
+- * case). Such devices fall back to add_v4_addrs() instead.
+- */
+- if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 &&
+- idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) {
++ if (dev->type == ARPHRD_ETHER) {
+ addrconf_addr_gen(idev, true);
+ return;
+ }
+--
+2.39.5
+
--- /dev/null
+firmware-qcom-scm-fix-error-code-in-probe.patch
+firmware-imx-scu-fix-of-node-leak-in-.probe.patch
+arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch
+arm64-dts-rockchip-remove-supports-cqe-from-rk3588-j.patch
+arm64-dts-rockchip-remove-supports-cqe-from-rk3588-t.patch
+xfrm-fix-tunnel-mode-tx-datapath-in-packet-offload-m.patch
+xfrm_output-force-software-gso-only-in-tunnel-mode.patch
+soc-imx8m-remove-global-soc_uid.patch
+soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch
+soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch
+arm-dts-bcm2711-fix-xhci-power-domain.patch
+arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch
+arm64-dts-bcm2712-pl011-uarts-are-actually-r1p5.patch
+arm64-dts-rockchip-remove-undocumented-sdmmc-propert.patch
+rdma-rxe-fix-the-failure-of-ibv_query_device-and-ibv.patch
+rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch
+rdma-mlx5-handle-errors-returned-from-mlx5r_ib_rate.patch
+arm-omap1-select-config_generic_irq_chip.patch
+arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch
+arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch
+arm-dts-bcm5301x-fix-switch-port-labels-of-asus-rt-a.patch-8866
+dma-mapping-fix-missing-clear-bdr-in-check_ram_in_ra.patch
+rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch
+rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch
+rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch
+rdma-hns-fix-invalid-sq-params-not-being-blocked.patch
+rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch
+rdma-hns-fix-missing-xa_destroy.patch
+rdma-hns-fix-wrong-value-of-max_sge_rd.patch
+bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch
+bluetooth-hci_event-fix-connection-regression-betwee.patch
+accel-qaic-fix-possible-data-corruption-in-bos-2g.patch
+arm-davinci-da850-fix-selecting-arch_davinci_da8xx.patch
+tracing-tprobe-events-fix-to-clean-up-tprobe-correct.patch
+ata-libata-core-add-ata_quirk_no_lpm_on_ati-for-cert.patch
+net-ethernet-ti-am65-cpsw-fix-napi-registration-sequ.patch
+net-ipv6-fix-tcp-gso-segmentation-with-nat.patch
+ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch
+ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch
+devlink-fix-xa_alloc_cyclic-error-handling.patch
+dpll-fix-xa_alloc_cyclic-error-handling.patch
+phy-fix-xa_alloc_cyclic-error-handling.patch
+gpu-host1x-do-not-assume-that-a-null-domain-means-no.patch
+net-atm-fix-use-after-free-in-lec_send.patch
+net-ti-icssg-prueth-add-lock-to-stats.patch
+net-lwtunnel-fix-recursion-loops.patch
+net-ipv6-ioam6-fix-lwtunnel_output-loop.patch
+libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch
+net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch
+revert-gre-fix-ipv6-link-local-address-generation.patch
--- /dev/null
+From 73c8d7073d79d3f010fd80564bebf82be2d3d535 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 20:49:17 +0200
+Subject: soc: imx8m: Remove global soc_uid
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 9c1c02fe8d7f33c18547b79c41f3fa41ef7bae8f ]
+
+The static global soc_uid is only ever used as kasprintf() parameter in
+imx8m_soc_probe(). Pass pointer to local u64 variable to .soc_revision()
+callback instead and let the .soc_revision() callback fill in the content.
+Remove the unnecessary static global variable.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 5ea8887828c06..966593320e28d 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -30,11 +30,9 @@
+
+ struct imx8_soc_data {
+ char *name;
+- int (*soc_revision)(u32 *socrev);
++ int (*soc_revision)(u32 *socrev, u64 *socuid);
+ };
+
+-static u64 soc_uid;
+-
+ #ifdef CONFIG_HAVE_ARM_SMCCC
+ static u32 imx8mq_soc_revision_from_atf(void)
+ {
+@@ -51,7 +49,7 @@ static u32 imx8mq_soc_revision_from_atf(void)
+ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; };
+ #endif
+
+-static int imx8mq_soc_revision(u32 *socrev)
++static int imx8mq_soc_revision(u32 *socrev, u64 *socuid)
+ {
+ struct device_node *np;
+ void __iomem *ocotp_base;
+@@ -89,9 +87,9 @@ static int imx8mq_soc_revision(u32 *socrev)
+ rev = REV_B1;
+ }
+
+- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH);
+- soc_uid <<= 32;
+- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH);
++ *socuid <<= 32;
++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW);
+
+ *socrev = rev;
+
+@@ -109,7 +107,7 @@ static int imx8mq_soc_revision(u32 *socrev)
+ return ret;
+ }
+
+-static int imx8mm_soc_uid(void)
++static int imx8mm_soc_uid(u64 *socuid)
+ {
+ void __iomem *ocotp_base;
+ struct device_node *np;
+@@ -136,9 +134,9 @@ static int imx8mm_soc_uid(void)
+
+ clk_prepare_enable(clk);
+
+- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset);
+- soc_uid <<= 32;
+- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset);
++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset);
++ *socuid <<= 32;
++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset);
+
+ clk_disable_unprepare(clk);
+ clk_put(clk);
+@@ -151,7 +149,7 @@ static int imx8mm_soc_uid(void)
+ return ret;
+ }
+
+-static int imx8mm_soc_revision(u32 *socrev)
++static int imx8mm_soc_revision(u32 *socrev, u64 *socuid)
+ {
+ struct device_node *np;
+ void __iomem *anatop_base;
+@@ -172,7 +170,7 @@ static int imx8mm_soc_revision(u32 *socrev)
+ iounmap(anatop_base);
+ of_node_put(np);
+
+- return imx8mm_soc_uid();
++ return imx8mm_soc_uid(socuid);
+
+ err_iomap:
+ of_node_put(np);
+@@ -215,10 +213,11 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+ static int imx8m_soc_probe(struct platform_device *pdev)
+ {
+ struct soc_device_attribute *soc_dev_attr;
+- struct soc_device *soc_dev;
++ const struct imx8_soc_data *data;
+ const struct of_device_id *id;
++ struct soc_device *soc_dev;
+ u32 soc_rev = 0;
+- const struct imx8_soc_data *data;
++ u64 soc_uid = 0;
+ int ret;
+
+ soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
+@@ -241,7 +240,7 @@ static int imx8m_soc_probe(struct platform_device *pdev)
+ if (data) {
+ soc_dev_attr->soc_id = data->name;
+ if (data->soc_revision) {
+- ret = data->soc_revision(&soc_rev);
++ ret = data->soc_revision(&soc_rev, &soc_uid);
+ if (ret)
+ goto free_soc;
+ }
+--
+2.39.5
+
--- /dev/null
+From cfcdd92dd3785ad849a1bf2209216876ae76885f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 16:47:51 +0800
+Subject: soc: imx8m: Unregister cpufreq and soc dev in cleanup path
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit cf7139aac463880cbd5c5e999c118fbe91631411 ]
+
+Unregister the cpufreq device and soc device when resource unwinding,
+otherwise there will be warning when do removing test:
+sysfs: cannot create duplicate filename '/devices/platform/imx-cpufreq-dt'
+CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.13.0-rc1-next-20241204
+Hardware name: NXP i.MX8MPlus EVK board (DT)
+
+Fixes: 9cc832d37799 ("soc: imx8m: Probe the SoC driver as platform driver")
+Cc: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 8ac7658e3d525..3ed8161d7d28b 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -192,9 +192,20 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+ devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \
+ "unknown"
+
++static void imx8m_unregister_soc(void *data)
++{
++ soc_device_unregister(data);
++}
++
++static void imx8m_unregister_cpufreq(void *data)
++{
++ platform_device_unregister(data);
++}
++
+ static int imx8m_soc_probe(struct platform_device *pdev)
+ {
+ struct soc_device_attribute *soc_dev_attr;
++ struct platform_device *cpufreq_dev;
+ const struct imx8_soc_data *data;
+ struct device *dev = &pdev->dev;
+ const struct of_device_id *id;
+@@ -239,11 +250,22 @@ static int imx8m_soc_probe(struct platform_device *pdev)
+ if (IS_ERR(soc_dev))
+ return PTR_ERR(soc_dev);
+
++ ret = devm_add_action(dev, imx8m_unregister_soc, soc_dev);
++ if (ret)
++ return ret;
++
+ pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id,
+ soc_dev_attr->revision);
+
+- if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT))
+- platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0);
++ if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) {
++ cpufreq_dev = platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0);
++ if (IS_ERR(cpufreq_dev))
++ return dev_err_probe(dev, PTR_ERR(cpufreq_dev),
++ "Failed to register imx-cpufreq-dev device\n");
++ ret = devm_add_action(dev, imx8m_unregister_cpufreq, cpufreq_dev);
++ if (ret)
++ return ret;
++ }
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From d480a4ad0172ea809e301fff86d292f1d989066d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 20:49:18 +0200
+Subject: soc: imx8m: Use devm_* to simplify probe failure handling
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 22b03a4e957e462b380a982759ccf0f6554735d3 ]
+
+Use device managed functions to simplify handling of failures during
+probe. Remove fail paths which are no longer necessary.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/soc-imx8m.c | 92 ++++++++++++-------------------------
+ 1 file changed, 29 insertions(+), 63 deletions(-)
+
+diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c
+index 966593320e28d..8ac7658e3d525 100644
+--- a/drivers/soc/imx/soc-imx8m.c
++++ b/drivers/soc/imx/soc-imx8m.c
+@@ -51,22 +51,20 @@ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; };
+
+ static int imx8mq_soc_revision(u32 *socrev, u64 *socuid)
+ {
+- struct device_node *np;
++ struct device_node *np __free(device_node) =
++ of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp");
+ void __iomem *ocotp_base;
+ u32 magic;
+ u32 rev;
+ struct clk *clk;
+ int ret;
+
+- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp");
+ if (!np)
+ return -EINVAL;
+
+ ocotp_base = of_iomap(np, 0);
+- if (!ocotp_base) {
+- ret = -EINVAL;
+- goto err_iomap;
+- }
++ if (!ocotp_base)
++ return -EINVAL;
+
+ clk = of_clk_get_by_name(np, NULL);
+ if (IS_ERR(clk)) {
+@@ -96,35 +94,30 @@ static int imx8mq_soc_revision(u32 *socrev, u64 *socuid)
+ clk_disable_unprepare(clk);
+ clk_put(clk);
+ iounmap(ocotp_base);
+- of_node_put(np);
+
+ return 0;
+
+ err_clk:
+ iounmap(ocotp_base);
+-err_iomap:
+- of_node_put(np);
+ return ret;
+ }
+
+ static int imx8mm_soc_uid(u64 *socuid)
+ {
++ struct device_node *np __free(device_node) =
++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp");
+ void __iomem *ocotp_base;
+- struct device_node *np;
+ struct clk *clk;
+ int ret = 0;
+ u32 offset = of_machine_is_compatible("fsl,imx8mp") ?
+ IMX8MP_OCOTP_UID_OFFSET : 0;
+
+- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp");
+ if (!np)
+ return -EINVAL;
+
+ ocotp_base = of_iomap(np, 0);
+- if (!ocotp_base) {
+- ret = -EINVAL;
+- goto err_iomap;
+- }
++ if (!ocotp_base)
++ return -EINVAL;
+
+ clk = of_clk_get_by_name(np, NULL);
+ if (IS_ERR(clk)) {
+@@ -143,38 +136,27 @@ static int imx8mm_soc_uid(u64 *socuid)
+
+ err_clk:
+ iounmap(ocotp_base);
+-err_iomap:
+- of_node_put(np);
+-
+ return ret;
+ }
+
+ static int imx8mm_soc_revision(u32 *socrev, u64 *socuid)
+ {
+- struct device_node *np;
++ struct device_node *np __free(device_node) =
++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop");
+ void __iomem *anatop_base;
+- int ret;
+
+- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop");
+ if (!np)
+ return -EINVAL;
+
+ anatop_base = of_iomap(np, 0);
+- if (!anatop_base) {
+- ret = -EINVAL;
+- goto err_iomap;
+- }
++ if (!anatop_base)
++ return -EINVAL;
+
+ *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM);
+
+ iounmap(anatop_base);
+- of_node_put(np);
+
+ return imx8mm_soc_uid(socuid);
+-
+-err_iomap:
+- of_node_put(np);
+- return ret;
+ }
+
+ static const struct imx8_soc_data imx8mq_soc_data = {
+@@ -205,22 +187,23 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = {
+ { }
+ };
+
+-#define imx8_revision(soc_rev) \
+- soc_rev ? \
+- kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \
++#define imx8_revision(dev, soc_rev) \
++ (soc_rev) ? \
++ devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \
+ "unknown"
+
+ static int imx8m_soc_probe(struct platform_device *pdev)
+ {
+ struct soc_device_attribute *soc_dev_attr;
+ const struct imx8_soc_data *data;
++ struct device *dev = &pdev->dev;
+ const struct of_device_id *id;
+ struct soc_device *soc_dev;
+ u32 soc_rev = 0;
+ u64 soc_uid = 0;
+ int ret;
+
+- soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL);
++ soc_dev_attr = devm_kzalloc(dev, sizeof(*soc_dev_attr), GFP_KERNEL);
+ if (!soc_dev_attr)
+ return -ENOMEM;
+
+@@ -228,13 +211,11 @@ static int imx8m_soc_probe(struct platform_device *pdev)
+
+ ret = of_property_read_string(of_root, "model", &soc_dev_attr->machine);
+ if (ret)
+- goto free_soc;
++ return ret;
+
+ id = of_match_node(imx8_soc_match, of_root);
+- if (!id) {
+- ret = -ENODEV;
+- goto free_soc;
+- }
++ if (!id)
++ return -ENODEV;
+
+ data = id->data;
+ if (data) {
+@@ -242,27 +223,21 @@ static int imx8m_soc_probe(struct platform_device *pdev)
+ if (data->soc_revision) {
+ ret = data->soc_revision(&soc_rev, &soc_uid);
+ if (ret)
+- goto free_soc;
++ return ret;
+ }
+ }
+
+- soc_dev_attr->revision = imx8_revision(soc_rev);
+- if (!soc_dev_attr->revision) {
+- ret = -ENOMEM;
+- goto free_soc;
+- }
++ soc_dev_attr->revision = imx8_revision(dev, soc_rev);
++ if (!soc_dev_attr->revision)
++ return -ENOMEM;
+
+- soc_dev_attr->serial_number = kasprintf(GFP_KERNEL, "%016llX", soc_uid);
+- if (!soc_dev_attr->serial_number) {
+- ret = -ENOMEM;
+- goto free_rev;
+- }
++ soc_dev_attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llX", soc_uid);
++ if (!soc_dev_attr->serial_number)
++ return -ENOMEM;
+
+ soc_dev = soc_device_register(soc_dev_attr);
+- if (IS_ERR(soc_dev)) {
+- ret = PTR_ERR(soc_dev);
+- goto free_serial_number;
+- }
++ if (IS_ERR(soc_dev))
++ return PTR_ERR(soc_dev);
+
+ pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id,
+ soc_dev_attr->revision);
+@@ -271,15 +246,6 @@ static int imx8m_soc_probe(struct platform_device *pdev)
+ platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0);
+
+ return 0;
+-
+-free_serial_number:
+- kfree(soc_dev_attr->serial_number);
+-free_rev:
+- if (strcmp(soc_dev_attr->revision, "unknown"))
+- kfree(soc_dev_attr->revision);
+-free_soc:
+- kfree(soc_dev_attr);
+- return ret;
+ }
+
+ static struct platform_driver imx8m_soc_driver = {
+--
+2.39.5
+
--- /dev/null
+From 0eb14445cf95f25eebc3cf73249e21f7f284f950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 15:14:09 +0900
+Subject: tracing: tprobe-events: Fix to clean up tprobe correctly when module
+ unload
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit 0a8bb688aa824863716fc570d818b8659a79309d ]
+
+When unloading module, the tprobe events are not correctly cleaned
+up. Thus it becomes `fprobe-event` and never be enabled again even
+if loading the same module again.
+
+For example;
+
+ # cd /sys/kernel/tracing
+ # modprobe trace_events_sample
+ # echo 't:my_tprobe foo_bar' >> dynamic_events
+ # cat dynamic_events
+t:tracepoints/my_tprobe foo_bar
+ # rmmod trace_events_sample
+ # cat dynamic_events
+f:tracepoints/my_tprobe foo_bar
+
+As you can see, the second time my_tprobe starts with 'f' instead
+of 't'.
+
+This unregisters the fprobe and tracepoint callback when module is
+unloaded but marks the fprobe-event is tprobe-event.
+
+Link: https://lore.kernel.org/all/174158724946.189309.15826571379395619524.stgit@mhiramat.tok.corp.google.com/
+
+Fixes: 57a7e6de9e30 ("tracing/fprobe: Support raw tracepoints on future loaded modules")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_fprobe.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/trace_fprobe.c b/kernel/trace/trace_fprobe.c
+index 99048c3303822..092c31907c71a 100644
+--- a/kernel/trace/trace_fprobe.c
++++ b/kernel/trace/trace_fprobe.c
+@@ -977,10 +977,13 @@ static int __tracepoint_probe_module_cb(struct notifier_block *self,
+ reenable_trace_fprobe(tf);
+ }
+ } else if (val == MODULE_STATE_GOING && tp_mod->mod == tf->mod) {
+- tracepoint_probe_unregister(tf->tpoint,
++ unregister_fprobe(&tf->fp);
++ if (trace_fprobe_is_tracepoint(tf)) {
++ tracepoint_probe_unregister(tf->tpoint,
+ tf->tpoint->probestub, NULL);
+- tf->tpoint = NULL;
+- tf->mod = NULL;
++ tf->tpoint = TRACEPOINT_STUB;
++ tf->mod = NULL;
++ }
+ }
+ }
+ mutex_unlock(&event_mutex);
+--
+2.39.5
+
--- /dev/null
+From 213bfc9b10e8a98a62475dcdbc65904025f69fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 12:20:37 +0200
+Subject: xfrm: fix tunnel mode TX datapath in packet offload mode
+
+From: Alexandre Cassen <acassen@corp.free.fr>
+
+[ Upstream commit 5eddd76ec2fd1988f0a3450fde9730b10dd22992 ]
+
+Packets that match the output xfrm policy are delivered to the netstack.
+In IPsec packet mode for tunnel mode, the HW is responsible for building
+the hard header and outer IP header. In such a situation, the inner
+header may refer to a network that is not directly reachable by the host,
+resulting in a failed neighbor resolution. The packet is then dropped.
+xfrm policy defines the netdevice to use for xmit so we can send packets
+directly to it.
+
+Makes direct xmit exclusive to tunnel mode, since some rules may apply
+in transport mode.
+
+Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode")
+Signed-off-by: Alexandre Cassen <acassen@corp.free.fr>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_output.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index e5722c95b8bb3..9160a5e09041d 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -610,6 +610,40 @@ int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err)
+ }
+ EXPORT_SYMBOL_GPL(xfrm_output_resume);
+
++static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
++ struct sk_buff *skb)
++{
++ struct dst_entry *dst = skb_dst(skb);
++ struct net *net = xs_net(x);
++ int err;
++
++ dst = skb_dst_pop(skb);
++ if (!dst) {
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
++ kfree_skb(skb);
++ return -EHOSTUNREACH;
++ }
++ skb_dst_set(skb, dst);
++ nf_reset_ct(skb);
++
++ err = skb_dst(skb)->ops->local_out(net, sk, skb);
++ if (unlikely(err != 1)) {
++ kfree_skb(skb);
++ return err;
++ }
++
++ /* In transport mode, network destination is
++ * directly reachable, while in tunnel mode,
++ * inner packet network may not be. In packet
++ * offload type, HW is responsible for hard
++ * header packet mangling so directly xmit skb
++ * to netdevice.
++ */
++ skb->dev = x->xso.dev;
++ __skb_push(skb, skb->dev->hard_header_len);
++ return dev_queue_xmit(skb);
++}
++
+ static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+ return xfrm_output_resume(sk, skb, 1);
+@@ -729,6 +763,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
+ return -EHOSTUNREACH;
+ }
+
++ /* Exclusive direct xmit for tunnel mode, as
++ * some filtering or matching rules may apply
++ * in transport mode.
++ */
++ if (x->props.mode == XFRM_MODE_TUNNEL)
++ return xfrm_dev_direct_output(sk, x, skb);
++
+ return xfrm_output_resume(sk, skb, 0);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 4a0b8512ef52a8c68f9c765ba0450b5ef7386f0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 12:52:48 +0200
+Subject: xfrm_output: Force software GSO only in tunnel mode
+
+From: Cosmin Ratiu <cratiu@nvidia.com>
+
+[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ]
+
+The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel
+mode. Unfortunately, it is slightly broader than necessary, as it also
+severely affects performance for Geneve + IPSec transport mode over a
+device capable of both HW GSO and IPSec crypto offload. In this case,
+xfrm_output unnecessarily triggers software GSO instead of letting the
+HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over
+a back-2-back pair of NICs with MTU 1500, the performance was observed
+to be up to 6x worse when doing software GSO compared to leaving it to
+the hardware.
+
+This commit makes xfrm_output only trigger software GSO in crypto
+offload cases for already encapsulated packets in tunnel mode, as not
+doing so would then cause the inner tunnel skb->inner_networking_header
+to be overwritten and break software GSO for that packet later if the
+device turns out to not be capable of HW GSO.
+
+Taking a closer look at the conditions for the original bug, to better
+understand the reasons for this change:
+- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and
+ inner network header.
+- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and
+ network headers.
+- later in the xmit path, xfrm_output -> xfrm_outer_mode_output ->
+ xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner
+ network header with the one set in ip_tunnel_xmit before adding the
+ second outer header.
+- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation
+ needs to happen based on dev features. In the original bug, the hw
+ couldn't segment the packets, so skb_gso_segment was invoked.
+- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment
+ tries to use the wrong inner network header, expecting the one set in
+ iptunnel_handle_offloads but getting the one set by xfrm instead.
+- a bit later, ipv6_gso_segment accesses the wrong memory based on that
+ wrong inner network header.
+
+With the new change, the original bug (or similar ones) cannot happen
+again, as xfrm will now trigger software GSO before applying a tunnel.
+This concern doesn't exist in packet offload mode, when the HW adds
+encapsulation headers. For the non-offloaded packets (crypto in SW),
+software GSO is still done unconditionally in the else branch.
+
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Yael Chemla <ychemla@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Fixes: a204aef9fd77 ("xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output")
+Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index 9160a5e09041d..a30538a980cc7 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -793,7 +793,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
+ skb->encapsulation = 1;
+
+ if (skb_is_gso(skb)) {
+- if (skb->inner_protocol)
++ if (skb->inner_protocol && x->props.mode == XFRM_MODE_TUNNEL)
+ return xfrm_output_gso(net, sk, skb);
+
+ skb_shinfo(skb)->gso_type |= SKB_GSO_ESP;
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
