From 0732ec9c406fc776323d0f3a17ada083879ec48d Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Mon, 7 Apr 2025 10:02:15 -0400
Subject: [PATCH] Fixes for 6.6

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...dle-return-an-error-if-both-p_lvl-2-.patch |  58 ++
 ...-overlarge-ofs-data-block-size-field.patch |  51 ++
 ...e-ofs-sequence-numbers-starting-at-1.patch |  68 ++
 ...akers-on-asus-expertbook-p5405csa-1..patch |  42 ++
 ...-add-mute-led-quirk-for-hp-pavilion-.patch |  78 +++
 ...-add-support-for-asus-rog-strix-g614.patch |  39 ++
 ...-add-support-for-asus-zenbook-um3406.patch |  35 +
 ...-realtek-always-honor-no_shutup_pins.patch |  55 ++
 ...-hda-realtek-fix-asus-z13-2025-audio.patch |  36 +
 ...-fix-built-in-mic-breakage-on-asus-v.patch |  38 +
 ...p-generic_ptdump-from-mpc885_ads_def.patch |  52 ++
 ...-add-null-check-in-com20020pci_probe.patch |  67 ++
 ...65-fix-some-error-handling-paths-in-.patch | 100 +++
 ...heck-the-return-value-from-spi_setup.patch |  45 ++
 ...ard-add-null-check-in-imx_card_probe.patch |  50 ++
 ...m-fix-clock-configuration-for-ti-j72.patch |  41 ++
 ...count-directly-in-bpf_send_signal_co.patch |  47 ++
 ...istics-use-atomic-access-in-hot-path.patch | 194 ++++++
 ...ct-validation-for-num_aces-field-of-.patch |  54 ++
 ...ogic-g12a-fix-mmc-a-peripheral-clock.patch |  45 ++
 ...logic-g12b-fix-cluster-a-parent-data.patch | 105 +++
 ...xbb-drop-incorrect-flag-on-32k-clock.patch |  43 ++
 ...b-drop-non-existing-32k-clock-parent.patch |  62 ++
 ...udiomix-fix-dsp-ocram_a-clock-parent.patch |  49 ++
 ...msm8953-fix-stuck-venus0_core0-clock.patch |  43 ++
 ...dm660-fix-stuck-video_subcore0-clock.patch |  42 ++
 ...328-fix-wrong-clk_ref_usb3otg-parent.patch |  39 ++
 ...-fix-ubsan-panic-in-samsung_clk_init.patch |  53 ++
 ...-always-inline-ct_-nmi-irq-_-enter-e.patch |  57 ++
 ...ix-number-of-pages-while-using-64k-p.patch |  41 ++
 ...-add-isb-before-reading-the-trcstatr.patch | 196 ++++++
 ...-fix-negative-idle_time-handling-in-.patch | 116 +++
 ...ufreq-scpi-compare-khz-instead-of-hz.patch |  52 ++
 ...on-sec2-fix-for-aead-auth-key-length.patch |  52 ++
 ...-sec2-fix-for-aead-authsize-alignmen.patch | 105 +++
 ...isilicon-sec2-fix-for-sec-spec-check.patch | 277 ++++++++
 ...nx-fix-uninitialised-hv_nxc-on-error.patch |  95 +++
 ...ma-cleanup-chan-after-dma_async_devi.patch |  52 ++
 ...avoid-npd-when-asic-does-not-support.patch | 149 ++++
 ...fix-type-mismatch-in-calculatedynami.patch |  64 ++
 ...keep-display-off-while-going-into-s4.patch | 102 +++
 ...ircular-locking-dependency-in-svm_ra.patch | 279 ++++++++
 ...5-fix-hdcp-v-match-check-is-not-perf.patch |  51 ++
 ...-ti-sn65dsi86-fix-multiple-instances.patch |  52 ++
 queue-6.6/drm-dp_mst-fix-drm-rad-print.patch  |  95 +++
 ...drm_err-dev_err-in-hpd-path-to-avoid.patch |  69 ++
 ...-fix-error-codes-in-mtk_dsi_host_tra.patch |  64 ++
 ..._hdmi-fix-typo-for-aud_sampe_size-me.patch |  66 ++
 ..._hdmi-unregister-audio-platform-devi.patch |  85 +++
 ...dpu-don-t-use-active-in-atomic_check.patch |  65 ++
 ...phy-usescase-and-mode-before-registe.patch | 102 +++
 ...existing-per-interface-slice-count-i.patch | 107 +++
 ...-after-free-and-double-free-on-init-.patch |  76 ++
 ...xlnx-zynqmp-fix-max-dma-segment-size.patch |  38 +
 ...dings-vendor-prefixes-add-gocontroll.patch |  37 +
 ...-configuration-on-mtp-and-later-plat.patch | 178 +++++
 ...-the-dimm-size-mask-for-several-socs.patch |  46 ++
 ...-the-error-path-order-of-ie31200_ini.patch |  68 ++
 ...-the-size-of-edac_mc_layer_chip_sele.patch |  48 ++
 ...i10nm-fix-some-missing-error-reports.patch | 144 ++++
 ...finite-loop-in-exfat_find_last_clust.patch |  46 ++
 ...ove-a-variable-assignment-behind-a-n.patch |  52 ++
 ...dev-sm501fb-add-some-geometry-checks.patch |  44 ++
 ...ensure-cs_dsp_load-_coeff-returns-0-.patch |  67 ++
 ...ouple-integer-overflows-on-32bit-sys.patch |  45 ++
 ...ent-integer-overflow-in-hdr_first_de.patch |  38 +
 ...fix-the-comment-above-proc_pid_wchan.patch |  41 ++
 ...x-dax-truncate-punch_hole-fault-path.patch | 146 ++++
 ...ove-i2c_hid_get_report-error-message.patch |  43 ++
 ...fluous-and-wrong-makefile-entry-for-.patch |  44 ++
 ...re-fix-out-of-bounds-access-for-nct6.patch |  40 ++
 ...master-svc-fix-missing-the-ibi-rules.patch |  40 ++
 ...ilable-slots-before-posting-receive-.patch | 133 ++++
 ...2-ensure-error-return-on-failure-to-.patch |  61 ++
 ...-fix-failure-to-release-runtime-pm-i.patch | 100 +++
 ...130-fix-comparison-of-channel-setups.patch | 109 +++
 ...24-fix-comparison-of-channel-configs.patch | 103 +++
 ...ider-link-down-nexthops-in-path-sele.patch |  64 ++
 ...-netlink-attributes-when-using-rtext.patch |  87 +++
 ...ath-selection-from-the-first-nexthop.patch | 101 +++
 ...uninit-value-bug-in-do_isofs_readdir.patch |  89 +++
 ...robes-handle-device-exclusive-entrie.patch |  99 +++
 ...lize-elf-lowest-address-to-ulong_max.patch |  71 ++
 ...-fix-multichannel-connection-failure.patch | 127 ++++
 ...d-fix-r_count-dec-increment-mismatch.patch |  51 ++
 ...equest_free-to-match-aead_request_al.patch |  38 +
 .../leds-fix-led_off-brightness-race.patch    | 108 +++
 ...ove-error-handling-in-sw842_compress.patch |  44 ++
 ...hetical-stt_section-extern-null-dere.patch |  41 ++
 ...sable-interrupts-on-rt-in-disable_ir.patch |  82 +++
 ...ight_fault-lockdep-check-of-current-.patch |  52 ++
 ...e-use-wake_q-to-wake-up-processes-ou.patch | 150 ++++
 ...lp-text-of-cmdline_extend-in-kconfig.patch |  41 ++
 ...-the-arch_kgdb_breakpoint-implementa.patch |  74 ++
 queue-6.6/mdacon-rework-dependency-list.patch |  47 ++
 ...llgro-dvt-unregister-v4l2_device-on-.patch |  38 +
 ...icon-hevc-initialize-start_bit-field.patch |  40 ++
 ...y-omap-gpmc-drop-no-compatible-check.patch |  58 ++
 ...-to-bit-to-mitigate-integer-overflow.patch |  63 ++
 ...e-cached-dst-counters-in-dst_release.patch |  61 ++
 ...x-propperly-shutdown-ppu-re-enable-t.patch | 126 ++++
 ...x-geneve_opt-length-integer-overflow.patch | 134 ++++
 ...th-make-veth_pool_store-stop-hanging.patch | 211 ++++++
 ...-make-reserved-size-independent-of-p.patch |  77 ++
 ...revent-parser-tcam-memory-corruption.patch | 659 ++++++++++++++++++
 ...o-remove-overly-strict-queue-asserti.patch |  60 ++
 ...les-don-t-unregister-hook-when-table.patch |  48 ++
 ...t_hash-gc-reaps-elements-with-connco.patch |  40 ++
 ...nnel-fix-geneve_opt-type-confusion-a.patch |  88 +++
 ...l-pointer-exception-caused-by-calips.patch |  87 +++
 ...e-nfs_client-only-after-all-the-supe.patch |  78 +++
 ...ger-uneccessary-scans-for-return-on-.patch |  79 +++
 ...ntb-intel-fix-using-link-status-db-s.patch |  37 +
 ...-fix-shift-out-of-bounds-in-switchte.patch |  45 ++
 ...up-cmbmsc-when-registering-cmb-fails.patch |  38 +
 ...stuck-reset-on-concurrent-dpc-and-hp.patch |  75 ++
 ...b-blocks-incompatible-with-pci-p2p-d.patch |  68 ++
 ...kip-nvme_write_sq_db-on-empty-rqlist.patch |  37 +
 ...cp-fix-possible-uaf-in-nvme_tcp_poll.patch |  88 +++
 ...-segfault-in-ignore_unreachable_insn.patch |  41 ++
 ...ose-disassembly-if-cross_compile-isn.patch |  46 ++
 ...b8000-prevent-divide-by-zero-in-dib8.patch |  49 ++
 ..._tree_depth-to-avoid-out-of-bounds-a.patch |  56 ++
 ...ix-mbox-intr-handler-when-num-vfs-64.patch |  39 ++
 ...ontx2-af-free-nix_af_int_vec_gen-irq.patch |  40 ++
 ...ty-increase-nr_fwnode_reference_args.patch |  52 ++
 ...k-state-exit-during-switch-upstream-.patch |  84 +++
 ...-avoid-reset-when-disabled-via-sysfs.patch |  67 ++
 ...error-path-after-a-call-to-regulator.patch |  50 ++
 ...potential-premature-regulator-disabl.patch |  47 ++
 ...internal-register-to-change-link-cap.patch |  54 ++
 ...ix-the-driver-to-send-msg-tlp-for-in.patch |  67 ++
 ...-error-handling-path-in-histb_pcie_p.patch |  71 ++
 ...-enable-hpie-when-resuming-in-poll-m.patch |  49 ++
 ...-disable-pciehp-interrupts-early-whe.patch |  60 ++
 ...-put_device-in-pci_register_host_bri.patch |  41 ++
 ...am-bridges-for-distributing-resource.patch |  96 +++
 ...ix-irq-domain-leak-in-error-path-of-.patch |  65 ++
 ...pe-fix-load-store-operation-checking.patch |  64 ++
 ...ch-fix-perf-bench-syscall-loop-count.patch | 104 +++
 ...erf_pmu_register-vs.-perf_init_event.patch | 101 +++
 ...success-path-to-evlist__create_syswi.patch |  57 ++
 ...ouble-count-common-sysfs-and-json-ev.patch |  81 +++
 ...k-if-there-is-space-to-copy-all-the-.patch |  68 ++
 ...ement-the-refcount-of-just-created-e.patch |  52 ++
 ...t-keep-a-raw_data-pointer-to-consume.patch |  86 +++
 ...p-description-of-sample.id-event-mem.patch |  38 +
 ...-allow-the-epollrdnorm-flag-for-poll.patch |  43 ++
 ...nd_stat-for-mixed-legacy-non-legacy-.patch | 107 +++
 .../perf-tools-annotate-asm_pure_loop.s.patch |  34 +
 ...f-units-fix-insufficient-array-space.patch |  46 ++
 ...x-wrong-bypass-assignment-in-intel_p.patch |  39 ++
 ...as-rza2-fix-missing-of_node_put-call.patch |  42 ++
 ...s-rzg2l-fix-missing-of_node_put-call.patch |  42 ++
 ...s-rzv2m-fix-missing-of_node_put-call.patch |  42 ++
 ...-tegra-set-sfio-mode-to-mux-register.patch |  49 ++
 ...dell-ddv-fix-temperature-calculation.patch |  50 ++
 ...el-hid-fix-volume-buttons-on-microso.patch |  47 ++
 ...ntel-vsec-add-diamond-rapids-support.patch |  58 ++
 ...check-before-setting-power.must_resu.patch |  86 +++
 ...dling-devices-with-direct_complete-s.patch |  91 +++
 ...77693-fix-wrong-conversion-of-charge.patch |  46 ++
 ...s-always-inline-rcu_irq_work_resched.patch |  43 ++
 ...expose-hw_counters-outside-of-init-n.patch | 150 ++++
 ...nt-use-after-free-in-erdma_accept_ne.patch |  36 +
 ...b-ensure-variable-err-is-initialized.patch |  38 +
 ...lculation-of-total-invalidated-pages.patch |  65 ++
 ...fix-mlx5_poll_one-cur_qp-update-flow.patch |  91 +++
 ...e-clear-table_sz-when-rproc_shutdown.patch |  86 +++
 ...q6v5_mss-handle-platforms-with-one-p.patch |  90 +++
 ...q6v5_pas-make-single-pd-handling-mor.patch |  63 ++
 ...q6v5_pas-use-resource-with-cx-pd-for.patch |  39 ++
 ...-fix-bytes_dropped-calculation-issue.patch |  41 ++
 ...ta-use-medany-for-relocatable-builds.patch |  42 ++
 ...le-the-kernel-perf-counter-during-co.patch |  42 ++
 ...b-retrieval-of-number-of-ptes-in-cas.patch | 162 +++++
 ...-parentheses-in-macro-definitions-of.patch |  63 ++
 ...st-flag-rndis-modems-as-wwan-devices.patch |  70 ++
 ...te-vfinfo-size-for-vf-guids-when-sup.patch | 163 +++++
 ...t-fix-signature-of-rust_fmt_argument.patch |  78 +++
 ...se-online-cpus-for-validating-runtim.patch |  45 ++
 ...d-smt-always-inline-sched_smt_active.patch |  45 ++
 ...fix-string-read-in-strncmp-benchmark.patch |  83 +++
 ...pf-select-numa_no_node-to-create-map.patch |  55 ++
 ...cow-fix-the-incorrect-error-handling.patch |  41 ++
 ...-tool-resolving-errors-in-install_po.patch |  66 ++
 queue-6.6/series                              | 222 ++++++
 ...le-ipv6-code-unless-ipv6-is-configur.patch | 133 ++++
 ...etns-refcount-imbalance-causing-leak.patch | 175 +++++
 ...fix-an-of-node-reference-leak-in-sou.patch |  40 ++
 ...s-fix-a-leak-in-spufs_create_context.patch |  39 ++
 ...fix-a-leak-on-spufs_new_file-failure.patch |  40 ++
 .../spufs-fix-gang-directory-lifetimes.patch  | 195 ++++++
 ...l8723bs-select-config_crypto_lib_aes.patch |  44 ++
 ...rmal-int340x-add-null-check-for-adev.patch |  50 ++
 ...nt-for-space-returned-by-tty_write_r.patch |  85 +++
 ...packet_host-in-skb_tunnel_check_pmtu.patch |  83 +++
 ...how-failed-to-get-fw-build-informati.patch |  47 ++
 .../udp-fix-memory-accounting-leak.patch      | 171 +++++
 ...issues-on-inode-number-reuse-by-host.patch | 172 +++++
 ...ove-copy_from_kernel_nofault_allowed.patch | 144 ++++
 ...-debug-message-page-size-calculation.patch |  52 ++
 ...andling-of-multiple-calls-to-vhost_s.patch | 176 +++++
 ...out-during-connect-if-the-socket-is-.patch |  62 ++
 ...h_queue-fix-pipe-accounting-mismatch.patch |  55 ++
 ...ep-power-during-suspend-if-board-req.patch | 100 +++
 ...-allocate-chained-sg-tables-for-dump.patch | 140 ++++
 ...-use-the-right-version-of-the-rate-a.patch |  56 ++
 ...ush-the-station-before-moving-it-to-.patch |  78 +++
 ...x-inaccurate-unwinding-from-exceptio.patch |  69 ++
 ...c-unwinder-for-push_regs-with-save_r.patch |  55 ++
 ...pying-dynamic-fp-state-from-init_tas.patch |  57 ++
 ...est-fpu-state-buffer-allocation-size.patch |  49 ++
 ...ix-inconsistencies-in-guest-fpu-xfea.patch |  86 +++
 ...utput-argument-to-hypercall-that-cha.patch |  53 ++
 ...top-kernel-from-probing-vtl0-low-mem.patch |  44 ++
 ...a-test-fix-length-for-cpa_array-test.patch |  40 ++
 ...m_pat-handling-when-fork-fails-in-co.patch | 297 ++++++++
 ...rm-only-allow-config_eisa-for-32-bit.patch |  43 ++
 ...ing-rip_rel_ref-invocations-during-s.patch |  52 ++
 ...licitly-if-x86_feature_sgx_lc-is-not.patch |  87 +++
 ...xc_double_fault-consistently-noretur.patch | 127 ++++
 ...ove-performance-by-aligning-writes-t.patch | 190 +++++
 223 files changed, 17364 insertions(+)
 create mode 100644 queue-6.6/acpi-processor-idle-return-an-error-if-both-p_lvl-2-.patch
 create mode 100644 queue-6.6/affs-don-t-write-overlarge-ofs-data-block-size-field.patch
 create mode 100644 queue-6.6/affs-generate-ofs-sequence-numbers-starting-at-1.patch
 create mode 100644 queue-6.6/alsa-hda-fix-speakers-on-asus-expertbook-p5405csa-1..patch
 create mode 100644 queue-6.6/alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-add-support-for-asus-rog-strix-g614.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-add-support-for-asus-zenbook-um3406.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-always-honor-no_shutup_pins.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-fix-asus-z13-2025-audio.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-fix-built-in-mic-breakage-on-asus-v.patch
 create mode 100644 queue-6.6/arch-powerpc-drop-generic_ptdump-from-mpc885_ads_def.patch
 create mode 100644 queue-6.6/arcnet-add-null-check-in-com20020pci_probe.patch
 create mode 100644 queue-6.6/asoc-codecs-rt5665-fix-some-error-handling-paths-in-.patch
 create mode 100644 queue-6.6/asoc-cs35l41-check-the-return-value-from-spi_setup.patch
 create mode 100644 queue-6.6/asoc-imx-card-add-null-check-in-imx_card_probe.patch
 create mode 100644 queue-6.6/asoc-ti-j721e-evm-fix-clock-configuration-for-ti-j72.patch
 create mode 100644 queue-6.6/bpf-use-preempt_count-directly-in-bpf_send_signal_co.patch
 create mode 100644 queue-6.6/can-statistics-use-atomic-access-in-hot-path.patch
 create mode 100644 queue-6.6/cifs-fix-incorrect-validation-for-num_aces-field-of-.patch
 create mode 100644 queue-6.6/clk-amlogic-g12a-fix-mmc-a-peripheral-clock.patch
 create mode 100644 queue-6.6/clk-amlogic-g12b-fix-cluster-a-parent-data.patch
 create mode 100644 queue-6.6/clk-amlogic-gxbb-drop-incorrect-flag-on-32k-clock.patch
 create mode 100644 queue-6.6/clk-amlogic-gxbb-drop-non-existing-32k-clock-parent.patch
 create mode 100644 queue-6.6/clk-clk-imx8mp-audiomix-fix-dsp-ocram_a-clock-parent.patch
 create mode 100644 queue-6.6/clk-qcom-gcc-msm8953-fix-stuck-venus0_core0-clock.patch
 create mode 100644 queue-6.6/clk-qcom-mmcc-sdm660-fix-stuck-video_subcore0-clock.patch
 create mode 100644 queue-6.6/clk-rockchip-rk3328-fix-wrong-clk_ref_usb3otg-parent.patch
 create mode 100644 queue-6.6/clk-samsung-fix-ubsan-panic-in-samsung_clk_init.patch
 create mode 100644 queue-6.6/context_tracking-always-inline-ct_-nmi-irq-_-enter-e.patch
 create mode 100644 queue-6.6/coresight-catu-fix-number-of-pages-while-using-64k-p.patch
 create mode 100644 queue-6.6/coresight-etm4x-add-isb-before-reading-the-trcstatr.patch
 create mode 100644 queue-6.6/cpufreq-governor-fix-negative-idle_time-handling-in-.patch
 create mode 100644 queue-6.6/cpufreq-scpi-compare-khz-instead-of-hz.patch
 create mode 100644 queue-6.6/crypto-hisilicon-sec2-fix-for-aead-auth-key-length.patch
 create mode 100644 queue-6.6/crypto-hisilicon-sec2-fix-for-aead-authsize-alignmen.patch
 create mode 100644 queue-6.6/crypto-hisilicon-sec2-fix-for-sec-spec-check.patch
 create mode 100644 queue-6.6/crypto-nx-fix-uninitialised-hv_nxc-on-error.patch
 create mode 100644 queue-6.6/dmaengine-fsl-edma-cleanup-chan-after-dma_async_devi.patch
 create mode 100644 queue-6.6/drm-amd-display-avoid-npd-when-asic-does-not-support.patch
 create mode 100644 queue-6.6/drm-amd-display-fix-type-mismatch-in-calculatedynami.patch
 create mode 100644 queue-6.6/drm-amd-keep-display-off-while-going-into-s4.patch
 create mode 100644 queue-6.6/drm-amdkfd-fix-circular-locking-dependency-in-svm_ra.patch
 create mode 100644 queue-6.6/drm-bridge-it6505-fix-hdcp-v-match-check-is-not-perf.patch
 create mode 100644 queue-6.6/drm-bridge-ti-sn65dsi86-fix-multiple-instances.patch
 create mode 100644 queue-6.6/drm-dp_mst-fix-drm-rad-print.patch
 create mode 100644 queue-6.6/drm-mediatek-dp-drm_err-dev_err-in-hpd-path-to-avoid.patch
 create mode 100644 queue-6.6/drm-mediatek-dsi-fix-error-codes-in-mtk_dsi_host_tra.patch
 create mode 100644 queue-6.6/drm-mediatek-mtk_hdmi-fix-typo-for-aud_sampe_size-me.patch
 create mode 100644 queue-6.6/drm-mediatek-mtk_hdmi-unregister-audio-platform-devi.patch
 create mode 100644 queue-6.6/drm-msm-dpu-don-t-use-active-in-atomic_check.patch
 create mode 100644 queue-6.6/drm-msm-dsi-set-phy-usescase-and-mode-before-registe.patch
 create mode 100644 queue-6.6/drm-msm-dsi-use-existing-per-interface-slice-count-i.patch
 create mode 100644 queue-6.6/drm-vkms-fix-use-after-free-and-double-free-on-init-.patch
 create mode 100644 queue-6.6/drm-xlnx-zynqmp-fix-max-dma-segment-size.patch
 create mode 100644 queue-6.6/dt-bindings-vendor-prefixes-add-gocontroll.patch
 create mode 100644 queue-6.6/e1000e-change-k1-configuration-on-mtp-and-later-plat.patch
 create mode 100644 queue-6.6/edac-ie31200-fix-the-dimm-size-mask-for-several-socs.patch
 create mode 100644 queue-6.6/edac-ie31200-fix-the-error-path-order-of-ie31200_ini.patch
 create mode 100644 queue-6.6/edac-ie31200-fix-the-size-of-edac_mc_layer_chip_sele.patch
 create mode 100644 queue-6.6/edac-skx_common-i10nm-fix-some-missing-error-reports.patch
 create mode 100644 queue-6.6/exfat-fix-the-infinite-loop-in-exfat_find_last_clust.patch
 create mode 100644 queue-6.6/fbdev-au1100fb-move-a-variable-assignment-behind-a-n.patch
 create mode 100644 queue-6.6/fbdev-sm501fb-add-some-geometry-checks.patch
 create mode 100644 queue-6.6/firmware-cs_dsp-ensure-cs_dsp_load-_coeff-returns-0-.patch
 create mode 100644 queue-6.6/fs-ntfs3-fix-a-couple-integer-overflows-on-32bit-sys.patch
 create mode 100644 queue-6.6/fs-ntfs3-prevent-integer-overflow-in-hdr_first_de.patch
 create mode 100644 queue-6.6/fs-procfs-fix-the-comment-above-proc_pid_wchan.patch
 create mode 100644 queue-6.6/fuse-fix-dax-truncate-punch_hole-fault-path.patch
 create mode 100644 queue-6.6/hid-i2c-hid-improve-i2c_hid_get_report-error-message.patch
 create mode 100644 queue-6.6/hid-remove-superfluous-and-wrong-makefile-entry-for-.patch
 create mode 100644 queue-6.6/hwmon-nct6775-core-fix-out-of-bounds-access-for-nct6.patch
 create mode 100644 queue-6.6/i3c-master-svc-fix-missing-the-ibi-rules.patch
 create mode 100644 queue-6.6/ib-mad-check-available-slots-before-posting-receive-.patch
 create mode 100644 queue-6.6/iio-accel-mma8452-ensure-error-return-on-failure-to-.patch
 create mode 100644 queue-6.6/iio-accel-msa311-fix-failure-to-release-runtime-pm-i.patch
 create mode 100644 queue-6.6/iio-adc-ad4130-fix-comparison-of-channel-setups.patch
 create mode 100644 queue-6.6/iio-adc-ad7124-fix-comparison-of-channel-configs.patch
 create mode 100644 queue-6.6/ipv6-do-not-consider-link-down-nexthops-in-path-sele.patch
 create mode 100644 queue-6.6/ipv6-fix-omitted-netlink-attributes-when-using-rtext.patch
 create mode 100644 queue-6.6/ipv6-start-path-selection-from-the-first-nexthop.patch
 create mode 100644 queue-6.6/isofs-fix-kmsan-uninit-value-bug-in-do_isofs_readdir.patch
 create mode 100644 queue-6.6/kernel-events-uprobes-handle-device-exclusive-entrie.patch
 create mode 100644 queue-6.6/kexec-initialize-elf-lowest-address-to-ulong_max.patch
 create mode 100644 queue-6.6/ksmbd-fix-multichannel-connection-failure.patch
 create mode 100644 queue-6.6/ksmbd-fix-r_count-dec-increment-mismatch.patch
 create mode 100644 queue-6.6/ksmbd-use-aead_request_free-to-match-aead_request_al.patch
 create mode 100644 queue-6.6/leds-fix-led_off-brightness-race.patch
 create mode 100644 queue-6.6/lib-842-improve-error-handling-in-sw842_compress.patch
 create mode 100644 queue-6.6/libbpf-fix-hypothetical-stt_section-extern-null-dere.patch
 create mode 100644 queue-6.6/lockdep-don-t-disable-interrupts-on-rt-in-disable_ir.patch
 create mode 100644 queue-6.6/lockdep-mm-fix-might_fault-lockdep-check-of-current-.patch
 create mode 100644 queue-6.6/locking-semaphore-use-wake_q-to-wake-up-processes-ou.patch
 create mode 100644 queue-6.6/loongarch-fix-help-text-of-cmdline_extend-in-kconfig.patch
 create mode 100644 queue-6.6/loongarch-rework-the-arch_kgdb_breakpoint-implementa.patch
 create mode 100644 queue-6.6/mdacon-rework-dependency-list.patch
 create mode 100644 queue-6.6/media-platform-allgro-dvt-unregister-v4l2_device-on-.patch
 create mode 100644 queue-6.6/media-verisilicon-hevc-initialize-start_bit-field.patch
 create mode 100644 queue-6.6/memory-omap-gpmc-drop-no-compatible-check.patch
 create mode 100644 queue-6.6/mfd-sm501-switch-to-bit-to-mitigate-integer-overflow.patch
 create mode 100644 queue-6.6/net-decrease-cached-dst-counters-in-dst_release.patch
 create mode 100644 queue-6.6/net-dsa-mv88e6xxx-propperly-shutdown-ppu-re-enable-t.patch
 create mode 100644 queue-6.6/net-fix-geneve_opt-length-integer-overflow.patch
 create mode 100644 queue-6.6/net-ibmveth-make-veth_pool_store-stop-hanging.patch
 create mode 100644 queue-6.6/net-mlx5e-shampo-make-reserved-size-independent-of-p.patch
 create mode 100644 queue-6.6/net-mvpp2-prevent-parser-tcam-memory-corruption.patch
 create mode 100644 queue-6.6/net_sched-skbprio-remove-overly-strict-queue-asserti.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-don-t-unregister-hook-when-table.patch
 create mode 100644 queue-6.6/netfilter-nft_set_hash-gc-reaps-elements-with-connco.patch
 create mode 100644 queue-6.6/netfilter-nft_tunnel-fix-geneve_opt-type-confusion-a.patch
 create mode 100644 queue-6.6/netlabel-fix-null-pointer-exception-caused-by-calips.patch
 create mode 100644 queue-6.6/nfs-shut-down-the-nfs_client-only-after-all-the-supe.patch
 create mode 100644 queue-6.6/nfsv4-don-t-trigger-uneccessary-scans-for-return-on-.patch
 create mode 100644 queue-6.6/ntb-intel-fix-using-link-status-db-s.patch
 create mode 100644 queue-6.6/ntb_hw_switchtec-fix-shift-out-of-bounds-in-switchte.patch
 create mode 100644 queue-6.6/nvme-pci-clean-up-cmbmsc-when-registering-cmb-fails.patch
 create mode 100644 queue-6.6/nvme-pci-fix-stuck-reset-on-concurrent-dpc-and-hp.patch
 create mode 100644 queue-6.6/nvme-pci-skip-cmb-blocks-incompatible-with-pci-p2p-d.patch
 create mode 100644 queue-6.6/nvme-pci-skip-nvme_write_sq_db-on-empty-rqlist.patch
 create mode 100644 queue-6.6/nvme-tcp-fix-possible-uaf-in-nvme_tcp_poll.patch
 create mode 100644 queue-6.6/objtool-fix-segfault-in-ignore_unreachable_insn.patch
 create mode 100644 queue-6.6/objtool-fix-verbose-disassembly-if-cross_compile-isn.patch
 create mode 100644 queue-6.6/objtool-media-dib8000-prevent-divide-by-zero-in-dib8.patch
 create mode 100644 queue-6.6/ocfs2-validate-l_tree_depth-to-avoid-out-of-bounds-a.patch
 create mode 100644 queue-6.6/octeontx2-af-fix-mbox-intr-handler-when-num-vfs-64.patch
 create mode 100644 queue-6.6/octeontx2-af-free-nix_af_int_vec_gen-irq.patch
 create mode 100644 queue-6.6/of-property-increase-nr_fwnode_reference_args.patch
 create mode 100644 queue-6.6/pci-aspm-fix-link-state-exit-during-switch-upstream-.patch
 create mode 100644 queue-6.6/pci-avoid-reset-when-disabled-via-sysfs.patch
 create mode 100644 queue-6.6/pci-brcmstb-fix-error-path-after-a-call-to-regulator.patch
 create mode 100644 queue-6.6/pci-brcmstb-fix-potential-premature-regulator-disabl.patch
 create mode 100644 queue-6.6/pci-brcmstb-use-internal-register-to-change-link-cap.patch
 create mode 100644 queue-6.6/pci-cadence-ep-fix-the-driver-to-send-msg-tlp-for-in.patch
 create mode 100644 queue-6.6/pci-histb-fix-an-error-handling-path-in-histb_pcie_p.patch
 create mode 100644 queue-6.6/pci-pciehp-don-t-enable-hpie-when-resuming-in-poll-m.patch
 create mode 100644 queue-6.6/pci-portdrv-only-disable-pciehp-interrupts-early-whe.patch
 create mode 100644 queue-6.6/pci-remove-stray-put_device-in-pci_register_host_bri.patch
 create mode 100644 queue-6.6/pci-use-downstream-bridges-for-distributing-resource.patch
 create mode 100644 queue-6.6/pci-xilinx-cpm-fix-irq-domain-leak-in-error-path-of-.patch
 create mode 100644 queue-6.6/perf-arm-spe-fix-load-store-operation-checking.patch
 create mode 100644 queue-6.6/perf-bench-fix-perf-bench-syscall-loop-count.patch
 create mode 100644 queue-6.6/perf-core-fix-perf_pmu_register-vs.-perf_init_event.patch
 create mode 100644 queue-6.6/perf-evlist-add-success-path-to-evlist__create_syswi.patch
 create mode 100644 queue-6.6/perf-pmu-don-t-double-count-common-sysfs-and-json-ev.patch
 create mode 100644 queue-6.6/perf-python-check-if-there-is-space-to-copy-all-the-.patch
 create mode 100644 queue-6.6/perf-python-decrement-the-refcount-of-just-created-e.patch
 create mode 100644 queue-6.6/perf-python-don-t-keep-a-raw_data-pointer-to-consume.patch
 create mode 100644 queue-6.6/perf-python-fixup-description-of-sample.id-event-mem.patch
 create mode 100644 queue-6.6/perf-ring_buffer-allow-the-epollrdnorm-flag-for-poll.patch
 create mode 100644 queue-6.6/perf-stat-fix-find_stat-for-mixed-legacy-non-legacy-.patch
 create mode 100644 queue-6.6/perf-tools-annotate-asm_pure_loop.s.patch
 create mode 100644 queue-6.6/perf-units-fix-insufficient-array-space.patch
 create mode 100644 queue-6.6/pinctrl-intel-fix-wrong-bypass-assignment-in-intel_p.patch
 create mode 100644 queue-6.6/pinctrl-renesas-rza2-fix-missing-of_node_put-call.patch
 create mode 100644 queue-6.6/pinctrl-renesas-rzg2l-fix-missing-of_node_put-call.patch
 create mode 100644 queue-6.6/pinctrl-renesas-rzv2m-fix-missing-of_node_put-call.patch
 create mode 100644 queue-6.6/pinctrl-tegra-set-sfio-mode-to-mux-register.patch
 create mode 100644 queue-6.6/platform-x86-dell-ddv-fix-temperature-calculation.patch
 create mode 100644 queue-6.6/platform-x86-intel-hid-fix-volume-buttons-on-microso.patch
 create mode 100644 queue-6.6/platform-x86-intel-vsec-add-diamond-rapids-support.patch
 create mode 100644 queue-6.6/pm-sleep-adjust-check-before-setting-power.must_resu.patch
 create mode 100644 queue-6.6/pm-sleep-fix-handling-devices-with-direct_complete-s.patch
 create mode 100644 queue-6.6/power-supply-max77693-fix-wrong-conversion-of-charge.patch
 create mode 100644 queue-6.6/rcu-tasks-always-inline-rcu_irq_work_resched.patch
 create mode 100644 queue-6.6/rdma-core-don-t-expose-hw_counters-outside-of-init-n.patch
 create mode 100644 queue-6.6/rdma-erdma-prevent-use-after-free-in-erdma_accept_ne.patch
 create mode 100644 queue-6.6/rdma-mana_ib-ensure-variable-err-is-initialized.patch
 create mode 100644 queue-6.6/rdma-mlx5-fix-calculation-of-total-invalidated-pages.patch
 create mode 100644 queue-6.6/rdma-mlx5-fix-mlx5_poll_one-cur_qp-update-flow.patch
 create mode 100644 queue-6.6/remoteproc-core-clear-table_sz-when-rproc_shutdown.patch
 create mode 100644 queue-6.6/remoteproc-qcom_q6v5_mss-handle-platforms-with-one-p.patch
 create mode 100644 queue-6.6/remoteproc-qcom_q6v5_pas-make-single-pd-handling-mor.patch
 create mode 100644 queue-6.6/remoteproc-qcom_q6v5_pas-use-resource-with-cx-pd-for.patch
 create mode 100644 queue-6.6/ring-buffer-fix-bytes_dropped-calculation-issue.patch
 create mode 100644 queue-6.6/risc-v-errata-use-medany-for-relocatable-builds.patch
 create mode 100644 queue-6.6/risc-v-kvm-disable-the-kernel-perf-counter-during-co.patch
 create mode 100644 queue-6.6/riscv-fix-hugetlb-retrieval-of-number-of-ptes-in-cas.patch
 create mode 100644 queue-6.6/riscv-ftrace-add-parentheses-in-macro-definitions-of.patch
 create mode 100644 queue-6.6/rndis_host-flag-rndis-modems-as-wwan-devices.patch
 create mode 100644 queue-6.6/rtnetlink-allocate-vfinfo-size-for-vf-guids-when-sup.patch
 create mode 100644 queue-6.6/rust-fix-signature-of-rust_fmt_argument.patch
 create mode 100644 queue-6.6/sched-deadline-use-online-cpus-for-validating-runtim.patch
 create mode 100644 queue-6.6/sched-smt-always-inline-sched_smt_active.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-string-read-in-strncmp-benchmark.patch
 create mode 100644 queue-6.6/selftests-bpf-select-numa_no_node-to-create-map.patch
 create mode 100644 queue-6.6/selftests-mm-cow-fix-the-incorrect-error-handling.patch
 create mode 100644 queue-6.6/selinux-chain-up-tool-resolving-errors-in-install_po.patch
 create mode 100644 queue-6.6/series
 create mode 100644 queue-6.6/smack-dont-compile-ipv6-code-unless-ipv6-is-configur.patch
 create mode 100644 queue-6.6/smb-client-fix-netns-refcount-imbalance-causing-leak.patch
 create mode 100644 queue-6.6/soundwire-slave-fix-an-of-node-reference-leak-in-sou.patch
 create mode 100644 queue-6.6/spufs-fix-a-leak-in-spufs_create_context.patch
 create mode 100644 queue-6.6/spufs-fix-a-leak-on-spufs_new_file-failure.patch
 create mode 100644 queue-6.6/spufs-fix-gang-directory-lifetimes.patch
 create mode 100644 queue-6.6/staging-rtl8723bs-select-config_crypto_lib_aes.patch
 create mode 100644 queue-6.6/thermal-int340x-add-null-check-for-adev.patch
 create mode 100644 queue-6.6/tty-n_tty-use-uint-for-space-returned-by-tty_write_r.patch
 create mode 100644 queue-6.6/tunnels-accept-packet_host-in-skb_tunnel_check_pmtu.patch
 create mode 100644 queue-6.6/ucsi_ccg-don-t-show-failed-to-get-fw-build-informati.patch
 create mode 100644 queue-6.6/udp-fix-memory-accounting-leak.patch
 create mode 100644 queue-6.6/um-hostfs-avoid-issues-on-inode-number-reuse-by-host.patch
 create mode 100644 queue-6.6/um-remove-copy_from_kernel_nofault_allowed.patch
 create mode 100644 queue-6.6/usb-xhci-correct-debug-message-page-size-calculation.patch
 create mode 100644 queue-6.6/vhost-scsi-fix-handling-of-multiple-calls-to-vhost_s.patch
 create mode 100644 queue-6.6/vsock-avoid-timeout-during-connect-if-the-socket-is-.patch
 create mode 100644 queue-6.6/watch_queue-fix-pipe-accounting-mismatch.patch
 create mode 100644 queue-6.6/wifi-brcmfmac-keep-power-during-suspend-if-board-req.patch
 create mode 100644 queue-6.6/wifi-iwlwifi-fw-allocate-chained-sg-tables-for-dump.patch
 create mode 100644 queue-6.6/wifi-iwlwifi-mvm-use-the-right-version-of-the-rate-a.patch
 create mode 100644 queue-6.6/wifi-mac80211-flush-the-station-before-moving-it-to-.patch
 create mode 100644 queue-6.6/x86-dumpstack-fix-inaccurate-unwinding-from-exceptio.patch
 create mode 100644 queue-6.6/x86-entry-fix-orc-unwinder-for-push_regs-with-save_r.patch
 create mode 100644 queue-6.6/x86-fpu-avoid-copying-dynamic-fp-state-from-init_tas.patch
 create mode 100644 queue-6.6/x86-fpu-fix-guest-fpu-state-buffer-allocation-size.patch
 create mode 100644 queue-6.6/x86-fpu-xstate-fix-inconsistencies-in-guest-fpu-xfea.patch
 create mode 100644 queue-6.6/x86-hyperv-fix-output-argument-to-hypercall-that-cha.patch
 create mode 100644 queue-6.6/x86-hyperv-vtl-stop-kernel-from-probing-vtl0-low-mem.patch
 create mode 100644 queue-6.6/x86-mm-pat-cpa-test-fix-length-for-cpa_array-test.patch
 create mode 100644 queue-6.6/x86-mm-pat-fix-vm_pat-handling-when-fork-fails-in-co.patch
 create mode 100644 queue-6.6/x86-platform-only-allow-config_eisa-for-32-bit.patch
 create mode 100644 queue-6.6/x86-sev-add-missing-rip_rel_ref-invocations-during-s.patch
 create mode 100644 queue-6.6/x86-sgx-warn-explicitly-if-x86_feature_sgx_lc-is-not.patch
 create mode 100644 queue-6.6/x86-traps-make-exc_double_fault-consistently-noretur.patch
 create mode 100644 queue-6.6/x86-uaccess-improve-performance-by-aligning-writes-t.patch

diff --git a/queue-6.6/acpi-processor-idle-return-an-error-if-both-p_lvl-2-.patch b/queue-6.6/acpi-processor-idle-return-an-error-if-both-p_lvl-2-.patch
new file mode 100644
index 0000000000..a29be78568
--- /dev/null
+++ b/queue-6.6/acpi-processor-idle-return-an-error-if-both-p_lvl-2-.patch
@@ -0,0 +1,58 @@
+From a8dcbcba069da5e1a376639f6f5b746320a99bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 15:30:39 +0100
+Subject: ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states
+ are invalid
+
+From: Giovanni Gherdovich <ggherdovich@suse.cz>
+
+[ Upstream commit 9e9b893404d43894d69a18dd2fc8fcf1c36abb7e ]
+
+Prior to commit 496121c02127 ("ACPI: processor: idle: Allow probing on
+platforms with one ACPI C-state"), the acpi_idle driver wouldn't load on
+systems without a valid C-State at least as deep as C2.
+
+The behavior was desirable for guests on hypervisors such as VMWare
+ESXi, which by default don't have the _CST ACPI method, and set the C2
+and C3 latencies to 101 and 1001 microseconds respectively via the FADT,
+to signify they're unsupported.
+
+Since the above change though, these virtualized deployments end up
+loading acpi_idle, and thus entering the default C1 C-State set by
+acpi_processor_get_power_info_default(); this is undesirable for a
+system that's communicating to the OS it doesn't want C-States (missing
+_CST, and invalid C2/C3 in FADT).
+
+Make acpi_processor_get_power_info_fadt() return -ENODEV in that case,
+so that acpi_processor_get_cstate_info() exits early and doesn't set
+pr->flags.power = 1.
+
+Fixes: 496121c02127 ("ACPI: processor: idle: Allow probing on platforms with one ACPI C-state")
+Signed-off-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+Reviewed-by: Zhang Rui <rui.zhang@intel.com>
+Link: https://patch.msgid.link/20250328143040.9348-1-ggherdovich@suse.cz
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 831fa4a121598..0888e4d618d53 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -268,6 +268,10 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
+ 			 ACPI_CX_DESC_LEN, "ACPI P_LVL3 IOPORT 0x%x",
+ 			 pr->power.states[ACPI_STATE_C3].address);
+ 
++	if (!pr->power.states[ACPI_STATE_C2].address &&
++	    !pr->power.states[ACPI_STATE_C3].address)
++		return -ENODEV;
++
+ 	return 0;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/affs-don-t-write-overlarge-ofs-data-block-size-field.patch b/queue-6.6/affs-don-t-write-overlarge-ofs-data-block-size-field.patch
new file mode 100644
index 0000000000..4a99dd37be
--- /dev/null
+++ b/queue-6.6/affs-don-t-write-overlarge-ofs-data-block-size-field.patch
@@ -0,0 +1,51 @@
+From 4d901b9238bf72632aede83569b91a8049ec18f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 08:14:44 +0000
+Subject: affs: don't write overlarge OFS data block size fields
+
+From: Simon Tatham <anakin@pobox.com>
+
+[ Upstream commit 011ea742a25a77bac3d995f457886a67d178c6f0 ]
+
+If a data sector on an OFS floppy contains a value > 0x1e8 (the
+largest amount of data that fits in the sector after its header), then
+an Amiga reading the file can return corrupt data, by taking the
+overlarge size at its word and reading past the end of the buffer it
+read the disk sector into!
+
+The cause: when affs_write_end_ofs() writes data to an OFS filesystem,
+the new size field for a data block was computed by adding the amount
+of data currently being written (into the block) to the existing value
+of the size field. This is correct if you're extending the file at the
+end, but if you seek backwards in the file and overwrite _existing_
+data, it can lead to the size field being larger than the maximum
+legal value.
+
+This commit changes the calculation so that it sets the size field to
+the max of its previous size and the position within the block that we
+just wrote up to.
+
+Signed-off-by: Simon Tatham <anakin@pobox.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/affs/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index 8fd1a7c5958a8..93b319917c9a9 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -726,7 +726,8 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
+ 		tmp = min(bsize - boff, to - from);
+ 		BUG_ON(boff + tmp > bsize || tmp > bsize);
+ 		memcpy(AFFS_DATA(bh) + boff, data + from, tmp);
+-		be32_add_cpu(&AFFS_DATA_HEAD(bh)->size, tmp);
++		AFFS_DATA_HEAD(bh)->size = cpu_to_be32(
++			max(boff + tmp, be32_to_cpu(AFFS_DATA_HEAD(bh)->size)));
+ 		affs_fix_checksum(sb, bh);
+ 		mark_buffer_dirty_inode(bh, inode);
+ 		written += tmp;
+-- 
+2.39.5
+
diff --git a/queue-6.6/affs-generate-ofs-sequence-numbers-starting-at-1.patch b/queue-6.6/affs-generate-ofs-sequence-numbers-starting-at-1.patch
new file mode 100644
index 0000000000..0c0c4e2447
--- /dev/null
+++ b/queue-6.6/affs-generate-ofs-sequence-numbers-starting-at-1.patch
@@ -0,0 +1,68 @@
+From 7b46aee1c475920b6fcbd3e8e9a7b6ee6cb899f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 08:14:43 +0000
+Subject: affs: generate OFS sequence numbers starting at 1
+
+From: Simon Tatham <anakin@pobox.com>
+
+[ Upstream commit e4cf8ec4de4e13f156c1d61977d282d90c221085 ]
+
+If I write a file to an OFS floppy image, and try to read it back on
+an emulated Amiga running Workbench 1.3, the Amiga reports a disk
+error trying to read the file. (That is, it's unable to read it _at
+all_, even to copy it to the NIL: device. It isn't a matter of getting
+the wrong data and being unable to parse the file format.)
+
+This is because the 'sequence number' field in the OFS data block
+header is supposed to be based at 1, but affs writes it based at 0.
+All three locations changed by this patch were setting the sequence
+number to a variable 'bidx' which was previously obtained by dividing
+a file position by bsize, so bidx will naturally use 0 for the first
+block. Therefore all three should add 1 to that value before writing
+it into the sequence number field.
+
+With this change, the Amiga successfully reads the file.
+
+For data block reference: https://wiki.osdev.org/FFS_(Amiga)
+
+Signed-off-by: Simon Tatham <anakin@pobox.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/affs/file.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/affs/file.c b/fs/affs/file.c
+index 04c018e196028..8fd1a7c5958a8 100644
+--- a/fs/affs/file.c
++++ b/fs/affs/file.c
+@@ -597,7 +597,7 @@ affs_extent_file_ofs(struct inode *inode, u32 newsize)
+ 		BUG_ON(tmp > bsize);
+ 		AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA);
+ 		AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino);
+-		AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx);
++		AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1);
+ 		AFFS_DATA_HEAD(bh)->size = cpu_to_be32(tmp);
+ 		affs_fix_checksum(sb, bh);
+ 		bh->b_state &= ~(1UL << BH_New);
+@@ -748,7 +748,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
+ 		if (buffer_new(bh)) {
+ 			AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA);
+ 			AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino);
+-			AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx);
++			AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1);
+ 			AFFS_DATA_HEAD(bh)->size = cpu_to_be32(bsize);
+ 			AFFS_DATA_HEAD(bh)->next = 0;
+ 			bh->b_state &= ~(1UL << BH_New);
+@@ -782,7 +782,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
+ 		if (buffer_new(bh)) {
+ 			AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA);
+ 			AFFS_DATA_HEAD(bh)->key = cpu_to_be32(inode->i_ino);
+-			AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx);
++			AFFS_DATA_HEAD(bh)->sequence = cpu_to_be32(bidx + 1);
+ 			AFFS_DATA_HEAD(bh)->size = cpu_to_be32(tmp);
+ 			AFFS_DATA_HEAD(bh)->next = 0;
+ 			bh->b_state &= ~(1UL << BH_New);
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-fix-speakers-on-asus-expertbook-p5405csa-1..patch b/queue-6.6/alsa-hda-fix-speakers-on-asus-expertbook-p5405csa-1..patch
new file mode 100644
index 0000000000..09ecf1daf8
--- /dev/null
+++ b/queue-6.6/alsa-hda-fix-speakers-on-asus-expertbook-p5405csa-1..patch
@@ -0,0 +1,42 @@
+From 6fa69cb5373f3e77f8a983953b8c8cc1e83c83bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 17:12:55 +0100
+Subject: ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Bárta <daniel.barta@trustlab.cz>
+
+[ Upstream commit f479ecc5ef15ed8d774968c1a8726a49420f11a0 ]
+
+After some digging around I have found that this laptop has Cirrus's smart
+aplifiers connected to SPI bus (spi1-CSC3551:00-cs35l41-hda).
+
+To get them correctly detected and working I had to modify patch_realtek.c
+with ASUS EXPERTBOOK P5405CSA 1.0 SystemID (0x1043, 0x1f63) and add
+corresponding hda_quirk (ALC245_FIXUP_CS35L41_SPI_2).
+
+Signed-off-by: Daniel Bárta <daniel.barta@trustlab.cz>
+Link: https://patch.msgid.link/20250227161256.18061-2-daniel.barta@trustlab.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7a40f66f8fd88..77fa07f0a8455 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10235,6 +10235,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
+ 	SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2),
++	SND_PCI_QUIRK(0x1043, 0x1f63, "ASUS P5405CSA", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401),
+ 	SND_PCI_QUIRK(0x1043, 0x1fb3, "ASUS ROG Flow Z13 GZ302EA", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch b/queue-6.6/alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch
new file mode 100644
index 0000000000..58e398e997
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch
@@ -0,0 +1,78 @@
+From a748d2cefa034e3ac457e2def157fd357d10c2df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Mar 2025 03:03:19 +0530
+Subject: ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
+
+From: Navon John Lukose <navonjohnlukose@gmail.com>
+
+[ Upstream commit b11a74ac4f545626d0dc95a8ca8c41df90532bf3 ]
+
+Add a fixup to enable the mute LED on HP Pavilion x360 Convertible
+14-dy1xxx with ALC295 codec. The appropriate coefficient index and bits
+were identified through a brute-force method, as detailed in
+https://bbs.archlinux.org/viewtopic.php?pid=2079504#p2079504.
+
+Signed-off-by: Navon John Lukose <navonjohnlukose@gmail.com>
+Link: https://patch.msgid.link/20250307213319.35507-1-navonjohnlukose@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index eb39e421adb9b..fbe116b165b8c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4785,6 +4785,21 @@ static void alc236_fixup_hp_coef_micmute_led(struct hda_codec *codec,
+ 	}
+ }
+ 
++static void alc295_fixup_hp_mute_led_coefbit11(struct hda_codec *codec,
++				const struct hda_fixup *fix, int action)
++{
++	struct alc_spec *spec = codec->spec;
++
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		spec->mute_led_polarity = 0;
++		spec->mute_led_coef.idx = 0xb;
++		spec->mute_led_coef.mask = 3 << 3;
++		spec->mute_led_coef.on = 1 << 3;
++		spec->mute_led_coef.off = 1 << 4;
++		snd_hda_gen_add_mute_led_cdev(codec, coef_mute_led_set);
++	}
++}
++
+ static void alc285_fixup_hp_mute_led(struct hda_codec *codec,
+ 				const struct hda_fixup *fix, int action)
+ {
+@@ -7333,6 +7348,7 @@ enum {
+ 	ALC290_FIXUP_MONO_SPEAKERS_HSJACK,
+ 	ALC290_FIXUP_SUBWOOFER,
+ 	ALC290_FIXUP_SUBWOOFER_HSJACK,
++	ALC295_FIXUP_HP_MUTE_LED_COEFBIT11,
+ 	ALC269_FIXUP_THINKPAD_ACPI,
+ 	ALC269_FIXUP_DMIC_THINKPAD_ACPI,
+ 	ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13,
+@@ -9070,6 +9086,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC283_FIXUP_INT_MIC,
+ 	},
++	[ALC295_FIXUP_HP_MUTE_LED_COEFBIT11] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc295_fixup_hp_mute_led_coefbit11,
++	},
+ 	[ALC298_FIXUP_SAMSUNG_AMP] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc298_fixup_samsung_amp,
+@@ -9978,6 +9998,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++	SND_PCI_QUIRK(0x103c, 0x85c6, "HP Pavilion x360 Convertible 14-dy1xxx", ALC295_FIXUP_HP_MUTE_LED_COEFBIT11),
+ 	SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-add-support-for-asus-rog-strix-g614.patch b/queue-6.6/alsa-hda-realtek-add-support-for-asus-rog-strix-g614.patch
new file mode 100644
index 0000000000..96f1243a64
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-add-support-for-asus-rog-strix-g614.patch
@@ -0,0 +1,39 @@
+From 1e0a4e6a6d4b85eb4afb518ad417b42e6ffbb139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 17:06:47 +0000
+Subject: ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using
+ CS35L41 HDA
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 9120b2b4ad0dad2f6bbb6bcacd0456f806fda62d ]
+
+Add support for ASUS G614PH/PM/PP and G614FH/FM/FP.
+
+Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250305170714.755794-4-sbinding@opensource.cirrus.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 77fa07f0a8455..9f6ee6489d943 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10152,7 +10152,9 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+ 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
++	SND_PCI_QUIRK(0x1043, 0x1054, "ASUS G614FH/FM/FP", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++	SND_PCI_QUIRK(0x1043, 0x1074, "ASUS G614PH/PM/PP", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+ 	SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-add-support-for-asus-zenbook-um3406.patch b/queue-6.6/alsa-hda-realtek-add-support-for-asus-zenbook-um3406.patch
new file mode 100644
index 0000000000..622f596bfa
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-add-support-for-asus-zenbook-um3406.patch
@@ -0,0 +1,35 @@
+From f61d4d1c73bde9d6a310a2d1fd73804f57218abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 17:06:51 +0000
+Subject: ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops
+ using CS35L41 HDA
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 8463d2adbe1901247937fcdfe4b525130f6db10b ]
+
+Laptop uses 2 CS35L41 Amps with HDA, using External boost with I2C
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250305170714.755794-8-sbinding@opensource.cirrus.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9f6ee6489d943..eb39e421adb9b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10160,6 +10160,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
+ 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++	SND_PCI_QUIRK(0x1043, 0x1194, "ASUS UM3406KA", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-always-honor-no_shutup_pins.patch b/queue-6.6/alsa-hda-realtek-always-honor-no_shutup_pins.patch
new file mode 100644
index 0000000000..65d0eb96b8
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-always-honor-no_shutup_pins.patch
@@ -0,0 +1,55 @@
+From 125e22bdc597d52c2d81ee13b31d2b8a339a74bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Mar 2025 15:30:19 +0100
+Subject: ALSA: hda/realtek: Always honor no_shutup_pins
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5a0c72c1da3cbc0cd4940a95d1be2830104c6edf ]
+
+The workaround for Dell machines to skip the pin-shutup for mic pins
+introduced alc_headset_mic_no_shutup() that is replaced from the
+generic snd_hda_shutup_pins() for certain codecs.  The problem is that
+the call is done unconditionally even if spec->no_shutup_pins is set.
+This seems causing problems on other platforms like Lenovo.
+
+This patch corrects the behavior and the driver honors always
+spec->no_shutup_pins flag and skips alc_headset_mic_no_shutup() if
+it's set.
+
+Fixes: dad3197da7a3 ("ALSA: hda/realtek - Fixup headphone noise via runtime suspend")
+Reported-and-tested-by: Oleg Gorobets <oleg.goro@gmail.com>
+Link: https://patch.msgid.link/20250315143020.27184-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b3cd6090f46aa..81ebf59898a10 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -584,6 +584,9 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ {
+ 	struct alc_spec *spec = codec->spec;
+ 
++	if (spec->no_shutup_pins)
++		return;
++
+ 	switch (codec->core.vendor_id) {
+ 	case 0x10ec0236:
+ 	case 0x10ec0256:
+@@ -599,8 +602,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ 		alc_headset_mic_no_shutup(codec);
+ 		break;
+ 	default:
+-		if (!spec->no_shutup_pins)
+-			snd_hda_shutup_pins(codec);
++		snd_hda_shutup_pins(codec);
+ 		break;
+ 	}
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-fix-asus-z13-2025-audio.patch b/queue-6.6/alsa-hda-realtek-fix-asus-z13-2025-audio.patch
new file mode 100644
index 0000000000..22fb5221ca
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-fix-asus-z13-2025-audio.patch
@@ -0,0 +1,36 @@
+From 1cdec9713e39a6b245bb4b183f74f758d957d7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 18:51:07 +0100
+Subject: ALSA: hda/realtek: Fix Asus Z13 2025 audio
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit 12784ca33b62fd327631749e6a0cd2a10110a56c ]
+
+Use the basic quirk for this type of amplifier. Sound works in speakers,
+headphones, and microphone. Whereas none worked before.
+
+Tested-by: Kyle Gospodnetich <me@kylegospodneti.ch>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://patch.msgid.link/20250227175107.33432-3-lkml@antheas.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 81ebf59898a10..7a40f66f8fd88 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10236,6 +10236,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401),
++	SND_PCI_QUIRK(0x1043, 0x1fb3, "ASUS ROG Flow Z13 GZ302EA", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ 	SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2),
+-- 
+2.39.5
+
diff --git a/queue-6.6/alsa-hda-realtek-fix-built-in-mic-breakage-on-asus-v.patch b/queue-6.6/alsa-hda-realtek-fix-built-in-mic-breakage-on-asus-v.patch
new file mode 100644
index 0000000000..78bc294ea2
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-fix-built-in-mic-breakage-on-asus-v.patch
@@ -0,0 +1,38 @@
+From 9073d0f3f4806378361d812462ebc3a5e4639b02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 16:22:01 +0100
+Subject: ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 84c3c08f5a6c2e2209428b76156bcaf349c3a62d ]
+
+ASUS VivoBook X515JA with PCI SSID 1043:14f2 also hits the same issue
+as other VivoBook model about the mic pin assignment, and the same
+workaround is required to apply ALC256_FIXUP_ASUS_MIC_NO_PRESENCE
+quirk.
+
+Fixes: 3b4309546b48 ("ALSA: hda: Fix headset detection failure due to unstable sort")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219902
+Link: https://patch.msgid.link/20250326152205.26733-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index fbe116b165b8c..5179061f57b57 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10202,6 +10202,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601VV/VU/VJ/VQ/VI", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G614JY/JZ/JG", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS G513PI/PU/PV", ALC287_FIXUP_CS35L41_I2C_2),
++	SND_PCI_QUIRK(0x1043, 0x14f2, "ASUS VivoBook X515JA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x1503, "ASUS G733PY/PZ/PZV/PYV", ALC287_FIXUP_CS35L41_I2C_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ 	SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2),
+-- 
+2.39.5
+
diff --git a/queue-6.6/arch-powerpc-drop-generic_ptdump-from-mpc885_ads_def.patch b/queue-6.6/arch-powerpc-drop-generic_ptdump-from-mpc885_ads_def.patch
new file mode 100644
index 0000000000..7ceeeabcfd
--- /dev/null
+++ b/queue-6.6/arch-powerpc-drop-generic_ptdump-from-mpc885_ads_def.patch
@@ -0,0 +1,52 @@
+From efed4ab477317f417cf67d7afc982e778c32acec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 17:54:01 +0530
+Subject: arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
+
+From: Anshuman Khandual <anshuman.khandual@arm.com>
+
+[ Upstream commit 2c5e6ac2db64ace51f66a9f3b3b3ab9553d748e8 ]
+
+GENERIC_PTDUMP gets selected on powerpc explicitly and hence can be
+dropped off from mpc885_ads_defconfig.  Replace with CONFIG_PTDUMP_DEBUGFS
+instead.
+
+Link: https://lkml.kernel.org/r/20250226122404.1927473-3-anshuman.khandual@arm.com
+Fixes: e084728393a5 ("powerpc/ptdump: Convert powerpc to GENERIC_PTDUMP")
+Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: Steven Price <steven.price@arm.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/configs/mpc885_ads_defconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig
+index 56b876e418e91..6b998cb572553 100644
+--- a/arch/powerpc/configs/mpc885_ads_defconfig
++++ b/arch/powerpc/configs/mpc885_ads_defconfig
+@@ -78,4 +78,4 @@ CONFIG_DEBUG_VM_PGTABLE=y
+ CONFIG_DETECT_HUNG_TASK=y
+ CONFIG_BDI_SWITCH=y
+ CONFIG_PPC_EARLY_DEBUG=y
+-CONFIG_GENERIC_PTDUMP=y
++CONFIG_PTDUMP_DEBUGFS=y
+-- 
+2.39.5
+
diff --git a/queue-6.6/arcnet-add-null-check-in-com20020pci_probe.patch b/queue-6.6/arcnet-add-null-check-in-com20020pci_probe.patch
new file mode 100644
index 0000000000..50dbde7aca
--- /dev/null
+++ b/queue-6.6/arcnet-add-null-check-in-com20020pci_probe.patch
@@ -0,0 +1,67 @@
+From 7b5bdca10cf300023fa065abdf0726ff3f6a558c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 21:50:36 +0800
+Subject: arcnet: Add NULL check in com20020pci_probe()
+
+From: Henry Martin <bsdhenrymartin@gmail.com>
+
+[ Upstream commit fda8c491db2a90ff3e6fbbae58e495b4ddddeca3 ]
+
+devm_kasprintf() returns NULL when memory allocation fails. Currently,
+com20020pci_probe() does not check for this case, which results in a
+NULL pointer dereference.
+
+Add NULL check after devm_kasprintf() to prevent this issue and ensure
+no resources are left allocated.
+
+Fixes: 6b17a597fc2f ("arcnet: restoring support for multiple Sohard Arcnet cards")
+Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
+Link: https://patch.msgid.link/20250402135036.44697-1-bsdhenrymartin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/arcnet/com20020-pci.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
+index 7b5c8bb02f119..e7db6a4e4dc9d 100644
+--- a/drivers/net/arcnet/com20020-pci.c
++++ b/drivers/net/arcnet/com20020-pci.c
+@@ -250,18 +250,33 @@ static int com20020pci_probe(struct pci_dev *pdev,
+ 			card->tx_led.default_trigger = devm_kasprintf(&pdev->dev,
+ 							GFP_KERNEL, "arc%d-%d-tx",
+ 							dev->dev_id, i);
++			if (!card->tx_led.default_trigger) {
++				ret = -ENOMEM;
++				goto err_free_arcdev;
++			}
+ 			card->tx_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+ 							"pci:green:tx:%d-%d",
+ 							dev->dev_id, i);
+-
++			if (!card->tx_led.name) {
++				ret = -ENOMEM;
++				goto err_free_arcdev;
++			}
+ 			card->tx_led.dev = &dev->dev;
+ 			card->recon_led.brightness_set = led_recon_set;
+ 			card->recon_led.default_trigger = devm_kasprintf(&pdev->dev,
+ 							GFP_KERNEL, "arc%d-%d-recon",
+ 							dev->dev_id, i);
++			if (!card->recon_led.default_trigger) {
++				ret = -ENOMEM;
++				goto err_free_arcdev;
++			}
+ 			card->recon_led.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+ 							"pci:red:recon:%d-%d",
+ 							dev->dev_id, i);
++			if (!card->recon_led.name) {
++				ret = -ENOMEM;
++				goto err_free_arcdev;
++			}
+ 			card->recon_led.dev = &dev->dev;
+ 
+ 			ret = devm_led_classdev_register(&pdev->dev, &card->tx_led);
+-- 
+2.39.5
+
diff --git a/queue-6.6/asoc-codecs-rt5665-fix-some-error-handling-paths-in-.patch b/queue-6.6/asoc-codecs-rt5665-fix-some-error-handling-paths-in-.patch
new file mode 100644
index 0000000000..530bffc539
--- /dev/null
+++ b/queue-6.6/asoc-codecs-rt5665-fix-some-error-handling-paths-in-.patch
@@ -0,0 +1,100 @@
+From e3d0412b295ae6c61982b754b61ebc9499501749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Mar 2025 08:45:49 +0100
+Subject: ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 1ebd4944266e86a7ce274f197847f5a6399651e8 ]
+
+Should an error occur after a successful regulator_bulk_enable() call,
+regulator_bulk_disable() should be called, as already done in the remove
+function.
+
+Instead of adding an error handling path in the probe, switch from
+devm_regulator_bulk_get() to devm_regulator_bulk_get_enable() and
+simplify the remove function and some other places accordingly.
+
+Finally, add a missing const when defining rt5665_supply_names to please
+checkpatch and constify a few bytes.
+
+Fixes: 33ada14a26c8 ("ASoC: add rt5665 codec driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://patch.msgid.link/e3c2aa1b2fdfa646752d94f4af968630c0d58248.1742629525.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5665.c | 24 ++++--------------------
+ 1 file changed, 4 insertions(+), 20 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
+index a39de4a7df002..532d1d6958af3 100644
+--- a/sound/soc/codecs/rt5665.c
++++ b/sound/soc/codecs/rt5665.c
+@@ -31,9 +31,7 @@
+ #include "rl6231.h"
+ #include "rt5665.h"
+ 
+-#define RT5665_NUM_SUPPLIES 3
+-
+-static const char *rt5665_supply_names[RT5665_NUM_SUPPLIES] = {
++static const char * const rt5665_supply_names[] = {
+ 	"AVDD",
+ 	"MICVDD",
+ 	"VBAT",
+@@ -46,7 +44,6 @@ struct rt5665_priv {
+ 	struct gpio_desc *gpiod_ldo1_en;
+ 	struct gpio_desc *gpiod_reset;
+ 	struct snd_soc_jack *hs_jack;
+-	struct regulator_bulk_data supplies[RT5665_NUM_SUPPLIES];
+ 	struct delayed_work jack_detect_work;
+ 	struct delayed_work calibrate_work;
+ 	struct delayed_work jd_check_work;
+@@ -4471,8 +4468,6 @@ static void rt5665_remove(struct snd_soc_component *component)
+ 	struct rt5665_priv *rt5665 = snd_soc_component_get_drvdata(component);
+ 
+ 	regmap_write(rt5665->regmap, RT5665_RESET, 0);
+-
+-	regulator_bulk_disable(ARRAY_SIZE(rt5665->supplies), rt5665->supplies);
+ }
+ 
+ #ifdef CONFIG_PM
+@@ -4758,7 +4753,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c)
+ {
+ 	struct rt5665_platform_data *pdata = dev_get_platdata(&i2c->dev);
+ 	struct rt5665_priv *rt5665;
+-	int i, ret;
++	int ret;
+ 	unsigned int val;
+ 
+ 	rt5665 = devm_kzalloc(&i2c->dev, sizeof(struct rt5665_priv),
+@@ -4774,24 +4769,13 @@ static int rt5665_i2c_probe(struct i2c_client *i2c)
+ 	else
+ 		rt5665_parse_dt(rt5665, &i2c->dev);
+ 
+-	for (i = 0; i < ARRAY_SIZE(rt5665->supplies); i++)
+-		rt5665->supplies[i].supply = rt5665_supply_names[i];
+-
+-	ret = devm_regulator_bulk_get(&i2c->dev, ARRAY_SIZE(rt5665->supplies),
+-				      rt5665->supplies);
++	ret = devm_regulator_bulk_get_enable(&i2c->dev, ARRAY_SIZE(rt5665_supply_names),
++					     rt5665_supply_names);
+ 	if (ret != 0) {
+ 		dev_err(&i2c->dev, "Failed to request supplies: %d\n", ret);
+ 		return ret;
+ 	}
+ 
+-	ret = regulator_bulk_enable(ARRAY_SIZE(rt5665->supplies),
+-				    rt5665->supplies);
+-	if (ret != 0) {
+-		dev_err(&i2c->dev, "Failed to enable supplies: %d\n", ret);
+-		return ret;
+-	}
+-
+-
+ 	rt5665->gpiod_ldo1_en = devm_gpiod_get_optional(&i2c->dev,
+ 							"realtek,ldo1-en",
+ 							GPIOD_OUT_HIGH);
+-- 
+2.39.5
+
diff --git a/queue-6.6/asoc-cs35l41-check-the-return-value-from-spi_setup.patch b/queue-6.6/asoc-cs35l41-check-the-return-value-from-spi_setup.patch
new file mode 100644
index 0000000000..148bddf6e6
--- /dev/null
+++ b/queue-6.6/asoc-cs35l41-check-the-return-value-from-spi_setup.patch
@@ -0,0 +1,45 @@
+From 14c95a76d2aade3416bb1e22226e4fa57d631d1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 16:56:37 +0500
+Subject: ASoC: cs35l41: check the return value from spi_setup()
+
+From: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru>
+
+[ Upstream commit ad5a0970f86d82e39ebd06d45a1f7aa48a1316f8 ]
+
+Currently the return value from spi_setup() is not checked for a failure.
+It is unlikely it will ever fail in this particular case but it is still
+better to add this check for the sake of completeness and correctness. This
+is cheap since it is performed once when the device is being probed.
+
+Handle spi_setup() return value.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace.
+
+Fixes: 872fc0b6bde8 ("ASoC: cs35l41: Set the max SPI speed for the whole device")
+Signed-off-by: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru>
+Link: https://patch.msgid.link/20250304115643.2748-1-v.shevtsov@mt-integration.ru
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l41-spi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs35l41-spi.c b/sound/soc/codecs/cs35l41-spi.c
+index 5c8bb24909eb4..bd73944758c6d 100644
+--- a/sound/soc/codecs/cs35l41-spi.c
++++ b/sound/soc/codecs/cs35l41-spi.c
+@@ -39,7 +39,9 @@ static int cs35l41_spi_probe(struct spi_device *spi)
+ 		return -ENOMEM;
+ 
+ 	spi->max_speed_hz = CS35L41_SPI_MAX_FREQ;
+-	spi_setup(spi);
++	ret = spi_setup(spi);
++	if (ret < 0)
++		return ret;
+ 
+ 	spi_set_drvdata(spi, cs35l41);
+ 	cs35l41->regmap = devm_regmap_init_spi(spi, regmap_config);
+-- 
+2.39.5
+
diff --git a/queue-6.6/asoc-imx-card-add-null-check-in-imx_card_probe.patch b/queue-6.6/asoc-imx-card-add-null-check-in-imx_card_probe.patch
new file mode 100644
index 0000000000..782d98195d
--- /dev/null
+++ b/queue-6.6/asoc-imx-card-add-null-check-in-imx_card_probe.patch
@@ -0,0 +1,50 @@
+From 50d1036d02efa1bf3f6477bf51436fc4ab5d217c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 22:25:10 +0800
+Subject: ASoC: imx-card: Add NULL check in imx_card_probe()
+
+From: Henry Martin <bsdhenrymartin@gmail.com>
+
+[ Upstream commit 93d34608fd162f725172e780b1c60cc93a920719 ]
+
+devm_kasprintf() returns NULL when memory allocation fails. Currently,
+imx_card_probe() does not check for this case, which results in a NULL
+pointer dereference.
+
+Add NULL check after devm_kasprintf() to prevent this issue.
+
+Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
+Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250401142510.29900-1-bsdhenrymartin@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-card.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c
+index f8144bf4c90d3..7128bcf3a743e 100644
+--- a/sound/soc/fsl/imx-card.c
++++ b/sound/soc/fsl/imx-card.c
+@@ -742,6 +742,8 @@ static int imx_card_probe(struct platform_device *pdev)
+ 				data->dapm_routes[i].sink =
+ 					devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s",
+ 						       i + 1, "Playback");
++				if (!data->dapm_routes[i].sink)
++					return -ENOMEM;
+ 				data->dapm_routes[i].source = "CPU-Playback";
+ 			}
+ 		}
+@@ -759,6 +761,8 @@ static int imx_card_probe(struct platform_device *pdev)
+ 				data->dapm_routes[i].source =
+ 					devm_kasprintf(&pdev->dev, GFP_KERNEL, "%d %s",
+ 						       i + 1, "Capture");
++				if (!data->dapm_routes[i].source)
++					return -ENOMEM;
+ 				data->dapm_routes[i].sink = "CPU-Capture";
+ 			}
+ 		}
+-- 
+2.39.5
+
diff --git a/queue-6.6/asoc-ti-j721e-evm-fix-clock-configuration-for-ti-j72.patch b/queue-6.6/asoc-ti-j721e-evm-fix-clock-configuration-for-ti-j72.patch
new file mode 100644
index 0000000000..d0ab741682
--- /dev/null
+++ b/queue-6.6/asoc-ti-j721e-evm-fix-clock-configuration-for-ti-j72.patch
@@ -0,0 +1,41 @@
+From c3884165efaa9ee04d263f1d3e71e1bea7dcd0bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 17:05:24 +0530
+Subject: ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio
+ compatible
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit 45ff65e30deb919604e68faed156ad96ce7474d9 ]
+
+For 'ti,j7200-cpb-audio' compatible, there is support for only one PLL for
+48k. For 11025, 22050, 44100 and 88200 sampling rates, due to absence of
+J721E_CLK_PARENT_44100, we get EINVAL while running any audio application.
+Add support for these rates by using the 48k parent clock and adjusting
+the clock for these rates later in j721e_configure_refclk.
+
+Fixes: 6748d0559059 ("ASoC: ti: Add custom machine driver for j721e EVM (CPB and IVI)")
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://patch.msgid.link/20250318113524.57100-1-j-choudhary@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/j721e-evm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c
+index 6a969874c9270..5e0bdbd34a837 100644
+--- a/sound/soc/ti/j721e-evm.c
++++ b/sound/soc/ti/j721e-evm.c
+@@ -182,6 +182,8 @@ static int j721e_configure_refclk(struct j721e_priv *priv,
+ 		clk_id = J721E_CLK_PARENT_48000;
+ 	else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_44100])
+ 		clk_id = J721E_CLK_PARENT_44100;
++	else if (!(rate % 11025) && priv->pll_rates[J721E_CLK_PARENT_48000])
++		clk_id = J721E_CLK_PARENT_48000;
+ 	else
+ 		return ret;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/bpf-use-preempt_count-directly-in-bpf_send_signal_co.patch b/queue-6.6/bpf-use-preempt_count-directly-in-bpf_send_signal_co.patch
new file mode 100644
index 0000000000..6acfdc57b0
--- /dev/null
+++ b/queue-6.6/bpf-use-preempt_count-directly-in-bpf_send_signal_co.patch
@@ -0,0 +1,47 @@
+From 099e654d9fac300b99bdfe3f6787e20236f73125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 12:22:59 +0800
+Subject: bpf: Use preempt_count() directly in bpf_send_signal_common()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit b4a8b5bba712a711d8ca1f7d04646db63f9c88f5 ]
+
+bpf_send_signal_common() uses preemptible() to check whether or not the
+current context is preemptible. If it is preemptible, it will use
+irq_work to send the signal asynchronously instead of trying to hold a
+spin-lock, because spin-lock is sleepable under PREEMPT_RT.
+
+However, preemptible() depends on CONFIG_PREEMPT_COUNT. When
+CONFIG_PREEMPT_COUNT is turned off (e.g., CONFIG_PREEMPT_VOLUNTARY=y),
+!preemptible() will be evaluated as 1 and bpf_send_signal_common() will
+use irq_work unconditionally.
+
+Fix it by unfolding "!preemptible()" and using "preempt_count() != 0 ||
+irqs_disabled()" instead.
+
+Fixes: 87c544108b61 ("bpf: Send signals asynchronously if !preemptible")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20250220042259.1583319-1-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 9d8f60e0cb554..545393601be8c 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -853,7 +853,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type)
+ 	if (unlikely(is_global_init(current)))
+ 		return -EPERM;
+ 
+-	if (!preemptible()) {
++	if (preempt_count() != 0 || irqs_disabled()) {
+ 		/* Do an early check on signal validity. Otherwise,
+ 		 * the error is lost in deferred irq_work.
+ 		 */
+-- 
+2.39.5
+
diff --git a/queue-6.6/can-statistics-use-atomic-access-in-hot-path.patch b/queue-6.6/can-statistics-use-atomic-access-in-hot-path.patch
new file mode 100644
index 0000000000..408a41e461
--- /dev/null
+++ b/queue-6.6/can-statistics-use-atomic-access-in-hot-path.patch
@@ -0,0 +1,194 @@
+From 73b83063c9aace448c8bb5dc186cef565653c79c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 15:33:53 +0100
+Subject: can: statistics: use atomic access in hot path
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit 80b5f90158d1364cbd80ad82852a757fc0692bf2 ]
+
+In can_send() and can_receive() CAN messages and CAN filter matches are
+counted to be visible in the CAN procfs files.
+
+KCSAN detected a data race within can_send() when two CAN frames have
+been generated by a timer event writing to the same CAN netdevice at the
+same time. Use atomic operations to access the statistics in the hot path
+to fix the KCSAN complaint.
+
+Reported-by: syzbot+78ce4489b812515d5e4d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/67cd717d.050a0220.e1a89.0006.GAE@google.com
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://patch.msgid.link/20250310143353.3242-1-socketcan@hartkopp.net
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 12 ++++++------
+ net/can/af_can.h | 12 ++++++------
+ net/can/proc.c   | 46 +++++++++++++++++++++++++++-------------------
+ 3 files changed, 39 insertions(+), 31 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index c469fc187f0c7..cdad0be43e8ff 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -287,8 +287,8 @@ int can_send(struct sk_buff *skb, int loop)
+ 		netif_rx(newskb);
+ 
+ 	/* update statistics */
+-	pkg_stats->tx_frames++;
+-	pkg_stats->tx_frames_delta++;
++	atomic_long_inc(&pkg_stats->tx_frames);
++	atomic_long_inc(&pkg_stats->tx_frames_delta);
+ 
+ 	return 0;
+ 
+@@ -647,8 +647,8 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
+ 	int matches;
+ 
+ 	/* update statistics */
+-	pkg_stats->rx_frames++;
+-	pkg_stats->rx_frames_delta++;
++	atomic_long_inc(&pkg_stats->rx_frames);
++	atomic_long_inc(&pkg_stats->rx_frames_delta);
+ 
+ 	/* create non-zero unique skb identifier together with *skb */
+ 	while (!(can_skb_prv(skb)->skbcnt))
+@@ -669,8 +669,8 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
+ 	consume_skb(skb);
+ 
+ 	if (matches > 0) {
+-		pkg_stats->matches++;
+-		pkg_stats->matches_delta++;
++		atomic_long_inc(&pkg_stats->matches);
++		atomic_long_inc(&pkg_stats->matches_delta);
+ 	}
+ }
+ 
+diff --git a/net/can/af_can.h b/net/can/af_can.h
+index 7c2d9161e2245..22f3352c77fec 100644
+--- a/net/can/af_can.h
++++ b/net/can/af_can.h
+@@ -66,9 +66,9 @@ struct receiver {
+ struct can_pkg_stats {
+ 	unsigned long jiffies_init;
+ 
+-	unsigned long rx_frames;
+-	unsigned long tx_frames;
+-	unsigned long matches;
++	atomic_long_t rx_frames;
++	atomic_long_t tx_frames;
++	atomic_long_t matches;
+ 
+ 	unsigned long total_rx_rate;
+ 	unsigned long total_tx_rate;
+@@ -82,9 +82,9 @@ struct can_pkg_stats {
+ 	unsigned long max_tx_rate;
+ 	unsigned long max_rx_match_ratio;
+ 
+-	unsigned long rx_frames_delta;
+-	unsigned long tx_frames_delta;
+-	unsigned long matches_delta;
++	atomic_long_t rx_frames_delta;
++	atomic_long_t tx_frames_delta;
++	atomic_long_t matches_delta;
+ };
+ 
+ /* persistent statistics */
+diff --git a/net/can/proc.c b/net/can/proc.c
+index bbce97825f13f..25fdf060e30d0 100644
+--- a/net/can/proc.c
++++ b/net/can/proc.c
+@@ -118,6 +118,13 @@ void can_stat_update(struct timer_list *t)
+ 	struct can_pkg_stats *pkg_stats = net->can.pkg_stats;
+ 	unsigned long j = jiffies; /* snapshot */
+ 
++	long rx_frames = atomic_long_read(&pkg_stats->rx_frames);
++	long tx_frames = atomic_long_read(&pkg_stats->tx_frames);
++	long matches = atomic_long_read(&pkg_stats->matches);
++	long rx_frames_delta = atomic_long_read(&pkg_stats->rx_frames_delta);
++	long tx_frames_delta = atomic_long_read(&pkg_stats->tx_frames_delta);
++	long matches_delta = atomic_long_read(&pkg_stats->matches_delta);
++
+ 	/* restart counting in timer context on user request */
+ 	if (user_reset)
+ 		can_init_stats(net);
+@@ -127,35 +134,33 @@ void can_stat_update(struct timer_list *t)
+ 		can_init_stats(net);
+ 
+ 	/* prevent overflow in calc_rate() */
+-	if (pkg_stats->rx_frames > (ULONG_MAX / HZ))
++	if (rx_frames > (LONG_MAX / HZ))
+ 		can_init_stats(net);
+ 
+ 	/* prevent overflow in calc_rate() */
+-	if (pkg_stats->tx_frames > (ULONG_MAX / HZ))
++	if (tx_frames > (LONG_MAX / HZ))
+ 		can_init_stats(net);
+ 
+ 	/* matches overflow - very improbable */
+-	if (pkg_stats->matches > (ULONG_MAX / 100))
++	if (matches > (LONG_MAX / 100))
+ 		can_init_stats(net);
+ 
+ 	/* calc total values */
+-	if (pkg_stats->rx_frames)
+-		pkg_stats->total_rx_match_ratio = (pkg_stats->matches * 100) /
+-			pkg_stats->rx_frames;
++	if (rx_frames)
++		pkg_stats->total_rx_match_ratio = (matches * 100) / rx_frames;
+ 
+ 	pkg_stats->total_tx_rate = calc_rate(pkg_stats->jiffies_init, j,
+-					    pkg_stats->tx_frames);
++					    tx_frames);
+ 	pkg_stats->total_rx_rate = calc_rate(pkg_stats->jiffies_init, j,
+-					    pkg_stats->rx_frames);
++					    rx_frames);
+ 
+ 	/* calc current values */
+-	if (pkg_stats->rx_frames_delta)
++	if (rx_frames_delta)
+ 		pkg_stats->current_rx_match_ratio =
+-			(pkg_stats->matches_delta * 100) /
+-			pkg_stats->rx_frames_delta;
++			(matches_delta * 100) /	rx_frames_delta;
+ 
+-	pkg_stats->current_tx_rate = calc_rate(0, HZ, pkg_stats->tx_frames_delta);
+-	pkg_stats->current_rx_rate = calc_rate(0, HZ, pkg_stats->rx_frames_delta);
++	pkg_stats->current_tx_rate = calc_rate(0, HZ, tx_frames_delta);
++	pkg_stats->current_rx_rate = calc_rate(0, HZ, rx_frames_delta);
+ 
+ 	/* check / update maximum values */
+ 	if (pkg_stats->max_tx_rate < pkg_stats->current_tx_rate)
+@@ -168,9 +173,9 @@ void can_stat_update(struct timer_list *t)
+ 		pkg_stats->max_rx_match_ratio = pkg_stats->current_rx_match_ratio;
+ 
+ 	/* clear values for 'current rate' calculation */
+-	pkg_stats->tx_frames_delta = 0;
+-	pkg_stats->rx_frames_delta = 0;
+-	pkg_stats->matches_delta   = 0;
++	atomic_long_set(&pkg_stats->tx_frames_delta, 0);
++	atomic_long_set(&pkg_stats->rx_frames_delta, 0);
++	atomic_long_set(&pkg_stats->matches_delta, 0);
+ 
+ 	/* restart timer (one second) */
+ 	mod_timer(&net->can.stattimer, round_jiffies(jiffies + HZ));
+@@ -214,9 +219,12 @@ static int can_stats_proc_show(struct seq_file *m, void *v)
+ 	struct can_rcv_lists_stats *rcv_lists_stats = net->can.rcv_lists_stats;
+ 
+ 	seq_putc(m, '\n');
+-	seq_printf(m, " %8ld transmitted frames (TXF)\n", pkg_stats->tx_frames);
+-	seq_printf(m, " %8ld received frames (RXF)\n", pkg_stats->rx_frames);
+-	seq_printf(m, " %8ld matched frames (RXMF)\n", pkg_stats->matches);
++	seq_printf(m, " %8ld transmitted frames (TXF)\n",
++		   atomic_long_read(&pkg_stats->tx_frames));
++	seq_printf(m, " %8ld received frames (RXF)\n",
++		   atomic_long_read(&pkg_stats->rx_frames));
++	seq_printf(m, " %8ld matched frames (RXMF)\n",
++		   atomic_long_read(&pkg_stats->matches));
+ 
+ 	seq_putc(m, '\n');
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/cifs-fix-incorrect-validation-for-num_aces-field-of-.patch b/queue-6.6/cifs-fix-incorrect-validation-for-num_aces-field-of-.patch
new file mode 100644
index 0000000000..c9d9dac79b
--- /dev/null
+++ b/queue-6.6/cifs-fix-incorrect-validation-for-num_aces-field-of-.patch
@@ -0,0 +1,54 @@
+From 8d6489b119f5dab2565023b6fd6ea2ed505bcd96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 09:37:57 +0900
+Subject: cifs: fix incorrect validation for num_aces field of smb_acl
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit aa2a739a75ab6f24ef72fb3fdb9192c081eacf06 ]
+
+parse_dcal() validate num_aces to allocate ace array.
+
+f (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
+
+It is an incorrect validation that we can create an array of size ULONG_MAX.
+smb_acl has ->size field to calculate actual number of aces in response buffer
+size. Use this to check invalid num_aces.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsacl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c
+index 1fc1683b15bd8..db9076da2182a 100644
+--- a/fs/smb/client/cifsacl.c
++++ b/fs/smb/client/cifsacl.c
+@@ -778,7 +778,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl,
+ 	}
+ 
+ 	/* validate that we do not go past end of acl */
+-	if (end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
++	if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) ||
++	    end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) {
+ 		cifs_dbg(VFS, "ACL too small to parse DACL\n");
+ 		return;
+ 	}
+@@ -799,8 +800,11 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl,
+ 	if (num_aces > 0) {
+ 		umode_t denied_mode = 0;
+ 
+-		if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))
++		if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) /
++				(offsetof(struct smb_ace, sid) +
++				 offsetof(struct smb_sid, sub_auth) + sizeof(__le16)))
+ 			return;
++
+ 		ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *),
+ 				      GFP_KERNEL);
+ 		if (!ppace)
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-amlogic-g12a-fix-mmc-a-peripheral-clock.patch b/queue-6.6/clk-amlogic-g12a-fix-mmc-a-peripheral-clock.patch
new file mode 100644
index 0000000000..aeb210f1f2
--- /dev/null
+++ b/queue-6.6/clk-amlogic-g12a-fix-mmc-a-peripheral-clock.patch
@@ -0,0 +1,45 @@
+From aa5dc64e5e5984e25fe727a747d1d2c2a1cc9ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 11:03:23 +0100
+Subject: clk: amlogic: g12a: fix mmc A peripheral clock
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 0079e77c08de692cb20b38e408365c830a44b1ef ]
+
+The bit index of the peripheral clock for mmc A is wrong
+This was probably not a problem for mmc A as the peripheral is likely left
+enabled by the bootloader.
+
+No issues has been reported so far but it could be a problem, most likely
+some form of conflict between the ethernet and mmc A clock, breaking
+ethernet on init.
+
+Use the value provided by the documentation for mmc A before this
+becomes an actual problem.
+
+Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241213-amlogic-clk-g12a-mmca-fix-v1-1-5af421f58b64@baylibre.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/g12a.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
+index faaf33a82721d..233ce4a4c1c2f 100644
+--- a/drivers/clk/meson/g12a.c
++++ b/drivers/clk/meson/g12a.c
+@@ -4201,7 +4201,7 @@ static MESON_GATE(g12a_spicc_1,			HHI_GCLK_MPEG0,	14);
+ static MESON_GATE(g12a_hiu_reg,			HHI_GCLK_MPEG0,	19);
+ static MESON_GATE(g12a_mipi_dsi_phy,		HHI_GCLK_MPEG0,	20);
+ static MESON_GATE(g12a_assist_misc,		HHI_GCLK_MPEG0,	23);
+-static MESON_GATE(g12a_emmc_a,			HHI_GCLK_MPEG0,	4);
++static MESON_GATE(g12a_emmc_a,			HHI_GCLK_MPEG0,	24);
+ static MESON_GATE(g12a_emmc_b,			HHI_GCLK_MPEG0,	25);
+ static MESON_GATE(g12a_emmc_c,			HHI_GCLK_MPEG0,	26);
+ static MESON_GATE(g12a_audio_codec,		HHI_GCLK_MPEG0,	28);
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-amlogic-g12b-fix-cluster-a-parent-data.patch b/queue-6.6/clk-amlogic-g12b-fix-cluster-a-parent-data.patch
new file mode 100644
index 0000000000..a705ca84f9
--- /dev/null
+++ b/queue-6.6/clk-amlogic-g12b-fix-cluster-a-parent-data.patch
@@ -0,0 +1,105 @@
+From 89a271d65f0ea70c488f63e14d855791b7c734a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 15:30:17 +0100
+Subject: clk: amlogic: g12b: fix cluster A parent data
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 8995f8f108c3ac5ad52b12a6cfbbc7b3b32e9a58 ]
+
+Several clocks used by both g12a and g12b use the g12a cpu A clock hw
+pointer as clock parent. This is incorrect on g12b since the parents of
+cluster A cpu clock are different. Also the hw clock provided as parent to
+these children is not even registered clock on g12b.
+
+Fix the problem by reverting to the global namespace and let CCF pick
+the appropriate, as it is already done for other clocks, such as
+cpu_clk_trace_div.
+
+Fixes: 25e682a02d91 ("clk: meson: g12a: migrate to the new parent description method")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241213-amlogic-clk-g12a-cpua-parent-fix-v1-1-d8c0f41865fe@baylibre.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/g12a.c | 36 ++++++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
+index f373a8d48b1d3..faaf33a82721d 100644
+--- a/drivers/clk/meson/g12a.c
++++ b/drivers/clk/meson/g12a.c
+@@ -1138,8 +1138,18 @@ static struct clk_regmap g12a_cpu_clk_div16_en = {
+ 	.hw.init = &(struct clk_init_data) {
+ 		.name = "cpu_clk_div16_en",
+ 		.ops = &clk_regmap_gate_ro_ops,
+-		.parent_hws = (const struct clk_hw *[]) {
+-			&g12a_cpu_clk.hw
++		.parent_data = &(const struct clk_parent_data) {
++			/*
++			 * Note:
++			 * G12A and G12B have different cpu clocks (with
++			 * different struct clk_hw). We fallback to the global
++			 * naming string mechanism so this clock picks
++			 * up the appropriate one. Same goes for the other
++			 * clock using cpu cluster A clock output and present
++			 * on both G12 variant.
++			 */
++			.name = "cpu_clk",
++			.index = -1,
+ 		},
+ 		.num_parents = 1,
+ 		/*
+@@ -1204,7 +1214,10 @@ static struct clk_regmap g12a_cpu_clk_apb_div = {
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "cpu_clk_apb_div",
+ 		.ops = &clk_regmap_divider_ro_ops,
+-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
++		.parent_data = &(const struct clk_parent_data) {
++			.name = "cpu_clk",
++			.index = -1,
++		},
+ 		.num_parents = 1,
+ 	},
+ };
+@@ -1238,7 +1251,10 @@ static struct clk_regmap g12a_cpu_clk_atb_div = {
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "cpu_clk_atb_div",
+ 		.ops = &clk_regmap_divider_ro_ops,
+-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
++		.parent_data = &(const struct clk_parent_data) {
++			.name = "cpu_clk",
++			.index = -1,
++		},
+ 		.num_parents = 1,
+ 	},
+ };
+@@ -1272,7 +1288,10 @@ static struct clk_regmap g12a_cpu_clk_axi_div = {
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "cpu_clk_axi_div",
+ 		.ops = &clk_regmap_divider_ro_ops,
+-		.parent_hws = (const struct clk_hw *[]) { &g12a_cpu_clk.hw },
++		.parent_data = &(const struct clk_parent_data) {
++			.name = "cpu_clk",
++			.index = -1,
++		},
+ 		.num_parents = 1,
+ 	},
+ };
+@@ -1307,13 +1326,6 @@ static struct clk_regmap g12a_cpu_clk_trace_div = {
+ 		.name = "cpu_clk_trace_div",
+ 		.ops = &clk_regmap_divider_ro_ops,
+ 		.parent_data = &(const struct clk_parent_data) {
+-			/*
+-			 * Note:
+-			 * G12A and G12B have different cpu_clks (with
+-			 * different struct clk_hw). We fallback to the global
+-			 * naming string mechanism so cpu_clk_trace_div picks
+-			 * up the appropriate one.
+-			 */
+ 			.name = "cpu_clk",
+ 			.index = -1,
+ 		},
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-amlogic-gxbb-drop-incorrect-flag-on-32k-clock.patch b/queue-6.6/clk-amlogic-gxbb-drop-incorrect-flag-on-32k-clock.patch
new file mode 100644
index 0000000000..6806aeef00
--- /dev/null
+++ b/queue-6.6/clk-amlogic-gxbb-drop-incorrect-flag-on-32k-clock.patch
@@ -0,0 +1,43 @@
+From 3adb5c46f7c532bd00ece8966dc6df9694129408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 11:25:36 +0100
+Subject: clk: amlogic: gxbb: drop incorrect flag on 32k clock
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit f38f7fe4830c5cb4eac138249225f119e7939965 ]
+
+gxbb_32k_clk_div sets CLK_DIVIDER_ROUND_CLOSEST in the init_data flag which
+is incorrect. This is field is not where the divider flags belong.
+
+Thankfully, CLK_DIVIDER_ROUND_CLOSEST maps to bit 4 which is an unused
+clock flag, so there is no unintended consequence to this error.
+
+Effectively, the clock has been used without CLK_DIVIDER_ROUND_CLOSEST
+so far, so just drop it.
+
+Fixes: 14c735c8e308 ("clk: meson-gxbb: Add EE 32K Clock for CEC")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241220-amlogic-clk-gxbb-32k-fixes-v1-1-baca56ecf2db@baylibre.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 1b1279d94781e..ef89285a86fc0 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -1312,7 +1312,7 @@ static struct clk_regmap gxbb_32k_clk_div = {
+ 			&gxbb_32k_clk_sel.hw
+ 		},
+ 		.num_parents = 1,
+-		.flags = CLK_SET_RATE_PARENT | CLK_DIVIDER_ROUND_CLOSEST,
++		.flags = CLK_SET_RATE_PARENT,
+ 	},
+ };
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-amlogic-gxbb-drop-non-existing-32k-clock-parent.patch b/queue-6.6/clk-amlogic-gxbb-drop-non-existing-32k-clock-parent.patch
new file mode 100644
index 0000000000..78e5c86e59
--- /dev/null
+++ b/queue-6.6/clk-amlogic-gxbb-drop-non-existing-32k-clock-parent.patch
@@ -0,0 +1,62 @@
+From f9931e0e130994a7339d25ab34f121e7bd116004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 11:25:37 +0100
+Subject: clk: amlogic: gxbb: drop non existing 32k clock parent
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 7915d7d5407c026fa9343befb4d3343f7a345f97 ]
+
+The 32k clock reference a parent 'cts_slow_oscin' with a fixme note saying
+that this clock should be provided by AO controller.
+
+The HW probably has this clock but it does not exist at the moment in
+any controller implementation. Furthermore, referencing clock by the global
+name should be avoided whenever possible.
+
+There is no reason to keep this hack around, at least for now.
+
+Fixes: 14c735c8e308 ("clk: meson-gxbb: Add EE 32K Clock for CEC")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241220-amlogic-clk-gxbb-32k-fixes-v1-2-baca56ecf2db@baylibre.com
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index ef89285a86fc0..a133013356b64 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -1272,14 +1272,13 @@ static struct clk_regmap gxbb_cts_i958 = {
+ 	},
+ };
+ 
++/*
++ * This table skips a clock named 'cts_slow_oscin' in the documentation
++ * This clock does not exist yet in this controller or the AO one
++ */
++static u32 gxbb_32k_clk_parents_val_table[] = { 0, 2, 3 };
+ static const struct clk_parent_data gxbb_32k_clk_parent_data[] = {
+ 	{ .fw_name = "xtal", },
+-	/*
+-	 * FIXME: This clock is provided by the ao clock controller but the
+-	 * clock is not yet part of the binding of this controller, so string
+-	 * name must be use to set this parent.
+-	 */
+-	{ .name = "cts_slow_oscin", .index = -1 },
+ 	{ .hw = &gxbb_fclk_div3.hw },
+ 	{ .hw = &gxbb_fclk_div5.hw },
+ };
+@@ -1289,6 +1288,7 @@ static struct clk_regmap gxbb_32k_clk_sel = {
+ 		.offset = HHI_32K_CLK_CNTL,
+ 		.mask = 0x3,
+ 		.shift = 16,
++		.table = gxbb_32k_clk_parents_val_table,
+ 		},
+ 	.hw.init = &(struct clk_init_data){
+ 		.name = "32k_clk_sel",
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-clk-imx8mp-audiomix-fix-dsp-ocram_a-clock-parent.patch b/queue-6.6/clk-clk-imx8mp-audiomix-fix-dsp-ocram_a-clock-parent.patch
new file mode 100644
index 0000000000..7646121a8a
--- /dev/null
+++ b/queue-6.6/clk-clk-imx8mp-audiomix-fix-dsp-ocram_a-clock-parent.patch
@@ -0,0 +1,49 @@
+From 4e903843bca27135537afc0e8707849a8e4cf10b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 11:45:11 -0500
+Subject: clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
+
+From: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com>
+
+[ Upstream commit 91be7d27099dedf813b80702e4ca117d1fb38ce6 ]
+
+The DSP and OCRAM_A modules from AUDIOMIX are clocked by
+AUDIO_AXI_CLK_ROOT, not AUDIO_AHB_CLK_ROOT. Update the clock data
+accordingly.
+
+Fixes: 6cd95f7b151c ("clk: imx: imx8mp: Add audiomix block control")
+Signed-off-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com>
+Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20250226164513.33822-3-laurentiumihalcea111@gmail.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mp-audiomix.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp-audiomix.c b/drivers/clk/imx/clk-imx8mp-audiomix.c
+index ab2a028b3027d..f802e54d7b709 100644
+--- a/drivers/clk/imx/clk-imx8mp-audiomix.c
++++ b/drivers/clk/imx/clk-imx8mp-audiomix.c
+@@ -170,14 +170,14 @@ static struct clk_imx8mp_audiomix_sel sels[] = {
+ 	CLK_GATE("asrc", ASRC_IPG),
+ 	CLK_GATE("pdm", PDM_IPG),
+ 	CLK_GATE("earc", EARC_IPG),
+-	CLK_GATE("ocrama", OCRAMA_IPG),
++	CLK_GATE_PARENT("ocrama", OCRAMA_IPG, "axi"),
+ 	CLK_GATE("aud2htx", AUD2HTX_IPG),
+ 	CLK_GATE_PARENT("earc_phy", EARC_PHY, "sai_pll_out_div2"),
+ 	CLK_GATE("sdma2", SDMA2_ROOT),
+ 	CLK_GATE("sdma3", SDMA3_ROOT),
+ 	CLK_GATE("spba2", SPBA2_ROOT),
+-	CLK_GATE("dsp", DSP_ROOT),
+-	CLK_GATE("dspdbg", DSPDBG_ROOT),
++	CLK_GATE_PARENT("dsp", DSP_ROOT, "axi"),
++	CLK_GATE_PARENT("dspdbg", DSPDBG_ROOT, "axi"),
+ 	CLK_GATE("edma", EDMA_ROOT),
+ 	CLK_GATE_PARENT("audpll", AUDPLL_ROOT, "osc_24m"),
+ 	CLK_GATE("mu2", MU2_ROOT),
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-qcom-gcc-msm8953-fix-stuck-venus0_core0-clock.patch b/queue-6.6/clk-qcom-gcc-msm8953-fix-stuck-venus0_core0-clock.patch
new file mode 100644
index 0000000000..08ec1047ae
--- /dev/null
+++ b/queue-6.6/clk-qcom-gcc-msm8953-fix-stuck-venus0_core0-clock.patch
@@ -0,0 +1,43 @@
+From 53694f6eae90bc627b97a375e3ac6a2ea65997ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Mar 2025 16:26:18 +0100
+Subject: clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Lypak <vladimir.lypak@gmail.com>
+
+[ Upstream commit cdc59600bccf2cb4c483645438a97d4ec55f326b ]
+
+This clock can't be enable with VENUS_CORE0 GDSC turned off. But that
+GDSC is under HW control so it can be turned off at any moment.
+Instead of checking the dependent clock we can just vote for it to
+enable later when GDSC gets turned on.
+
+Fixes: 9bb6cfc3c77e6 ("clk: qcom: Add Global Clock Controller driver for MSM8953")
+Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com>
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20250315-clock-fix-v1-2-2efdc4920dda@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8953.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8953.c b/drivers/clk/qcom/gcc-msm8953.c
+index 3e5a8cb14d4df..e6e2ab1380f20 100644
+--- a/drivers/clk/qcom/gcc-msm8953.c
++++ b/drivers/clk/qcom/gcc-msm8953.c
+@@ -3770,7 +3770,7 @@ static struct clk_branch gcc_venus0_axi_clk = {
+ 
+ static struct clk_branch gcc_venus0_core0_vcodec0_clk = {
+ 	.halt_reg = 0x4c02c,
+-	.halt_check = BRANCH_HALT,
++	.halt_check = BRANCH_HALT_SKIP,
+ 	.clkr = {
+ 		.enable_reg = 0x4c02c,
+ 		.enable_mask = BIT(0),
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-qcom-mmcc-sdm660-fix-stuck-video_subcore0-clock.patch b/queue-6.6/clk-qcom-mmcc-sdm660-fix-stuck-video_subcore0-clock.patch
new file mode 100644
index 0000000000..41bfb98f99
--- /dev/null
+++ b/queue-6.6/clk-qcom-mmcc-sdm660-fix-stuck-video_subcore0-clock.patch
@@ -0,0 +1,42 @@
+From d86351cfcd1d2745201a8807f8e3a517cd48c25c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Mar 2025 16:26:17 +0100
+Subject: clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 000cbe3896c56bf5c625e286ff096533a6b27657 ]
+
+This clock can't be enable with VENUS_CORE0 GDSC turned off. But that
+GDSC is under HW control so it can be turned off at any moment.
+Instead of checking the dependent clock we can just vote for it to
+enable later when GDSC gets turned on.
+
+Fixes: 5db3ae8b33de6 ("clk: qcom: Add SDM660 Multimedia Clock Controller (MMCC) driver")
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20250315-clock-fix-v1-1-2efdc4920dda@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/mmcc-sdm660.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/mmcc-sdm660.c b/drivers/clk/qcom/mmcc-sdm660.c
+index bc19a23e13f8a..4d187d6aba734 100644
+--- a/drivers/clk/qcom/mmcc-sdm660.c
++++ b/drivers/clk/qcom/mmcc-sdm660.c
+@@ -2544,7 +2544,7 @@ static struct clk_branch video_core_clk = {
+ 
+ static struct clk_branch video_subcore0_clk = {
+ 	.halt_reg = 0x1048,
+-	.halt_check = BRANCH_HALT,
++	.halt_check = BRANCH_HALT_SKIP,
+ 	.clkr = {
+ 		.enable_reg = 0x1048,
+ 		.enable_mask = BIT(0),
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-rockchip-rk3328-fix-wrong-clk_ref_usb3otg-parent.patch b/queue-6.6/clk-rockchip-rk3328-fix-wrong-clk_ref_usb3otg-parent.patch
new file mode 100644
index 0000000000..e11ee49c5c
--- /dev/null
+++ b/queue-6.6/clk-rockchip-rk3328-fix-wrong-clk_ref_usb3otg-parent.patch
@@ -0,0 +1,39 @@
+From 436ee309f0a01ea061f5d892e005dc521de06a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 01:26:22 +0000
+Subject: clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
+
+From: Peter Geis <pgwipeout@gmail.com>
+
+[ Upstream commit a9e60f1ffe1ca57d6af6a2573e2f950e76efbf5b ]
+
+Correct the clk_ref_usb3otg parent to fix clock control for the usb3
+controller on rk3328. Verified against the rk3328 trm, the rk3228h trm,
+and the rk3328 usb3 phy clock map.
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Signed-off-by: Peter Geis <pgwipeout@gmail.com>
+Reviewed-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://lore.kernel.org/r/20250115012628.1035928-2-pgwipeout@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 267ab54937d3d..a3587c500de28 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -201,7 +201,7 @@ PNAME(mux_aclk_peri_pre_p)	= { "cpll_peri",
+ 				    "gpll_peri",
+ 				    "hdmiphy_peri" };
+ PNAME(mux_ref_usb3otg_src_p)	= { "xin24m",
+-				    "clk_usb3otg_ref" };
++				    "clk_ref_usb3otg_src" };
+ PNAME(mux_xin24m_32k_p)		= { "xin24m",
+ 				    "clk_rtc32k" };
+ PNAME(mux_mac2io_src_p)		= { "clk_mac2io_src",
+-- 
+2.39.5
+
diff --git a/queue-6.6/clk-samsung-fix-ubsan-panic-in-samsung_clk_init.patch b/queue-6.6/clk-samsung-fix-ubsan-panic-in-samsung_clk_init.patch
new file mode 100644
index 0000000000..8e7a5d92ab
--- /dev/null
+++ b/queue-6.6/clk-samsung-fix-ubsan-panic-in-samsung_clk_init.patch
@@ -0,0 +1,53 @@
+From 72a2541c893cdfff79f5fc95a07545e7ee7faafe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 10:32:52 -0800
+Subject: clk: samsung: Fix UBSAN panic in samsung_clk_init()
+
+From: Will McVicker <willmcvicker@google.com>
+
+[ Upstream commit d19d7345a7bcdb083b65568a11b11adffe0687af ]
+
+With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to
+dereferencing `ctx->clk_data.hws` before setting
+`ctx->clk_data.num = nr_clks`. Move that up to fix the crash.
+
+  UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP
+  <snip>
+  Call trace:
+   samsung_clk_init+0x110/0x124 (P)
+   samsung_clk_init+0x48/0x124 (L)
+   samsung_cmu_register_one+0x3c/0xa0
+   exynos_arm64_register_cmu+0x54/0x64
+   __gs101_cmu_top_of_clk_init_declare+0x28/0x60
+   ...
+
+Fixes: e620a1e061c4 ("drivers/clk: convert VL struct to struct_size")
+Signed-off-by: Will McVicker <willmcvicker@google.com>
+Link: https://lore.kernel.org/r/20250212183253.509771-1-willmcvicker@google.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/samsung/clk.c b/drivers/clk/samsung/clk.c
+index b6701905f2546..fa5bdf6b3a929 100644
+--- a/drivers/clk/samsung/clk.c
++++ b/drivers/clk/samsung/clk.c
+@@ -74,12 +74,12 @@ struct samsung_clk_provider * __init samsung_clk_init(struct device *dev,
+ 	if (!ctx)
+ 		panic("could not allocate clock provider context.\n");
+ 
++	ctx->clk_data.num = nr_clks;
+ 	for (i = 0; i < nr_clks; ++i)
+ 		ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
+ 
+ 	ctx->dev = dev;
+ 	ctx->reg_base = base;
+-	ctx->clk_data.num = nr_clks;
+ 	spin_lock_init(&ctx->lock);
+ 
+ 	return ctx;
+-- 
+2.39.5
+
diff --git a/queue-6.6/context_tracking-always-inline-ct_-nmi-irq-_-enter-e.patch b/queue-6.6/context_tracking-always-inline-ct_-nmi-irq-_-enter-e.patch
new file mode 100644
index 0000000000..79b2895eab
--- /dev/null
+++ b/queue-6.6/context_tracking-always-inline-ct_-nmi-irq-_-enter-e.patch
@@ -0,0 +1,57 @@
+From c58533efc8edf980a661ca9e33e2f0e3aabb480f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 21:26:45 -0700
+Subject: context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 9ac50f7311dc8b39e355582f14c1e82da47a8196 ]
+
+Thanks to CONFIG_DEBUG_SECTION_MISMATCH, empty functions can be
+generated out of line.  These can be called from noinstr code, so make
+sure they're always inlined.
+
+Fixes the following warnings:
+
+  vmlinux.o: warning: objtool: irqentry_nmi_enter+0xa2: call to ct_nmi_enter() leaves .noinstr.text section
+  vmlinux.o: warning: objtool: irqentry_nmi_exit+0x16: call to ct_nmi_exit() leaves .noinstr.text section
+  vmlinux.o: warning: objtool: irqentry_exit+0x78: call to ct_irq_exit() leaves .noinstr.text section
+
+Fixes: 6f0e6c1598b1 ("context_tracking: Take IRQ eqs entrypoints over RCU")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/8509bce3f536bcd4ae7af3a2cf6930d48c5e631a.1743481539.git.jpoimboe@kernel.org
+Closes: https://lore.kernel.org/d1eca076-fdde-484a-b33e-70e0d167c36d@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/context_tracking_irq.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/context_tracking_irq.h b/include/linux/context_tracking_irq.h
+index c50b5670c4a52..197916ee91a4b 100644
+--- a/include/linux/context_tracking_irq.h
++++ b/include/linux/context_tracking_irq.h
+@@ -10,12 +10,12 @@ void ct_irq_exit_irqson(void);
+ void ct_nmi_enter(void);
+ void ct_nmi_exit(void);
+ #else
+-static inline void ct_irq_enter(void) { }
+-static inline void ct_irq_exit(void) { }
++static __always_inline void ct_irq_enter(void) { }
++static __always_inline void ct_irq_exit(void) { }
+ static inline void ct_irq_enter_irqson(void) { }
+ static inline void ct_irq_exit_irqson(void) { }
+-static inline void ct_nmi_enter(void) { }
+-static inline void ct_nmi_exit(void) { }
++static __always_inline void ct_nmi_enter(void) { }
++static __always_inline void ct_nmi_exit(void) { }
+ #endif
+ 
+ #endif
+-- 
+2.39.5
+
diff --git a/queue-6.6/coresight-catu-fix-number-of-pages-while-using-64k-p.patch b/queue-6.6/coresight-catu-fix-number-of-pages-while-using-64k-p.patch
new file mode 100644
index 0000000000..5d7be09cd8
--- /dev/null
+++ b/queue-6.6/coresight-catu-fix-number-of-pages-while-using-64k-p.patch
@@ -0,0 +1,41 @@
+From 861849576ff4e75315f09f1d514f0422b239ae1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 21:53:48 +0000
+Subject: coresight: catu: Fix number of pages while using 64k pages
+
+From: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+
+[ Upstream commit 0e14e062f5ff98aa15264dfa87c5f5e924028561 ]
+
+Trying to record a trace on kernel with 64k pages resulted in -ENOMEM.
+This happens due to a bug in calculating the number of table pages, which
+returns zero. Fix the issue by rounding up.
+
+$ perf record --kcore -e cs_etm/@tmc_etr55,cycacc,branch_broadcast/k --per-thread taskset --cpu-list 1 dd if=/dev/zero of=/dev/null
+failed to mmap with 12 (Cannot allocate memory)
+
+Fixes: 8ed536b1e283 ("coresight: catu: Add support for scatter gather tables")
+Signed-off-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250109215348.5483-1-ilkka@os.amperecomputing.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
+index 3949ded0d4fa5..c062bcc09466a 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.c
++++ b/drivers/hwtracing/coresight/coresight-catu.c
+@@ -267,7 +267,7 @@ catu_init_sg_table(struct device *catu_dev, int node,
+ 	 * Each table can address upto 1MB and we can have
+ 	 * CATU_PAGES_PER_SYSPAGE tables in a system page.
+ 	 */
+-	nr_tpages = DIV_ROUND_UP(size, SZ_1M) / CATU_PAGES_PER_SYSPAGE;
++	nr_tpages = DIV_ROUND_UP(size, CATU_PAGES_PER_SYSPAGE * SZ_1M);
+ 	catu_table = tmc_alloc_sg_table(catu_dev, node, nr_tpages,
+ 					size >> PAGE_SHIFT, pages);
+ 	if (IS_ERR(catu_table))
+-- 
+2.39.5
+
diff --git a/queue-6.6/coresight-etm4x-add-isb-before-reading-the-trcstatr.patch b/queue-6.6/coresight-etm4x-add-isb-before-reading-the-trcstatr.patch
new file mode 100644
index 0000000000..8a307b3bf1
--- /dev/null
+++ b/queue-6.6/coresight-etm4x-add-isb-before-reading-the-trcstatr.patch
@@ -0,0 +1,196 @@
+From 473a8bfcf5a4a8dacd395af00b8f0450ef5a0fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 17:04:20 +0800
+Subject: coresight-etm4x: add isb() before reading the TRCSTATR
+
+From: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+
+[ Upstream commit 4ff6039ffb79a4a8a44b63810a8a2f2b43264856 ]
+
+As recommended by section 4.3.7 ("Synchronization when using system
+instructions to progrom the trace unit") of ARM IHI 0064H.b, the
+self-hosted trace analyzer must perform a Context synchronization
+event between writing to the TRCPRGCTLR and reading the TRCSTATR.
+Additionally, add an ISB between the each read of TRCSTATR on
+coresight_timeout() when using system instructions to program the
+trace unit.
+
+Fixes: 1ab3bb9df5e3 ("coresight: etm4x: Add necessary synchronization for sysreg access")
+Signed-off-by: Yuanfang Zhang <quic_yuanfang@quicinc.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20250116-etm_sync-v4-1-39f2b05e9514@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-core.c  | 20 ++++++--
+ .../coresight/coresight-etm4x-core.c          | 48 +++++++++++++++++--
+ include/linux/coresight.h                     |  4 ++
+ 3 files changed, 62 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
+index 4b80026db1ab6..783e259c37612 100644
+--- a/drivers/hwtracing/coresight/coresight-core.c
++++ b/drivers/hwtracing/coresight/coresight-core.c
+@@ -1465,18 +1465,20 @@ static void coresight_remove_conns(struct coresight_device *csdev)
+ }
+ 
+ /**
+- * coresight_timeout - loop until a bit has changed to a specific register
+- *			state.
++ * coresight_timeout_action - loop until a bit has changed to a specific register
++ *                  state, with a callback after every trial.
+  * @csa: coresight device access for the device
+  * @offset: Offset of the register from the base of the device.
+  * @position: the position of the bit of interest.
+  * @value: the value the bit should have.
++ * @cb: Call back after each trial.
+  *
+  * Return: 0 as soon as the bit has taken the desired state or -EAGAIN if
+  * TIMEOUT_US has elapsed, which ever happens first.
+  */
+-int coresight_timeout(struct csdev_access *csa, u32 offset,
+-		      int position, int value)
++int coresight_timeout_action(struct csdev_access *csa, u32 offset,
++		      int position, int value,
++			  coresight_timeout_cb_t cb)
+ {
+ 	int i;
+ 	u32 val;
+@@ -1492,7 +1494,8 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,
+ 			if (!(val & BIT(position)))
+ 				return 0;
+ 		}
+-
++		if (cb)
++			cb(csa, offset, position, value);
+ 		/*
+ 		 * Delay is arbitrary - the specification doesn't say how long
+ 		 * we are expected to wait.  Extra check required to make sure
+@@ -1504,6 +1507,13 @@ int coresight_timeout(struct csdev_access *csa, u32 offset,
+ 
+ 	return -EAGAIN;
+ }
++EXPORT_SYMBOL_GPL(coresight_timeout_action);
++
++int coresight_timeout(struct csdev_access *csa, u32 offset,
++		      int position, int value)
++{
++	return coresight_timeout_action(csa, offset, position, value, NULL);
++}
+ EXPORT_SYMBOL_GPL(coresight_timeout);
+ 
+ u32 coresight_relaxed_read32(struct coresight_device *csdev, u32 offset)
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index 840e4cccf8c4b..05d9f87e35333 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -399,6 +399,29 @@ static void etm4_check_arch_features(struct etmv4_drvdata *drvdata,
+ }
+ #endif /* CONFIG_ETM4X_IMPDEF_FEATURE */
+ 
++static void etm4x_sys_ins_barrier(struct csdev_access *csa, u32 offset, int pos, int val)
++{
++	if (!csa->io_mem)
++		isb();
++}
++
++/*
++ * etm4x_wait_status: Poll for TRCSTATR.<pos> == <val>. While using system
++ * instruction to access the trace unit, each access must be separated by a
++ * synchronization barrier. See ARM IHI0064H.b section "4.3.7 Synchronization of
++ * register updates", for system instructions section, in "Notes":
++ *
++ *   "In particular, whenever disabling or enabling the trace unit, a poll of
++ *    TRCSTATR needs explicit synchronization between each read of TRCSTATR"
++ */
++static int etm4x_wait_status(struct csdev_access *csa, int pos, int val)
++{
++	if (!csa->io_mem)
++		return coresight_timeout_action(csa, TRCSTATR, pos, val,
++						etm4x_sys_ins_barrier);
++	return coresight_timeout(csa, TRCSTATR, pos, val);
++}
++
+ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ {
+ 	int i, rc;
+@@ -430,7 +453,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ 		isb();
+ 
+ 	/* wait for TRCSTATR.IDLE to go up */
+-	if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 1))
++	if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 1))
+ 		dev_err(etm_dev,
+ 			"timeout while waiting for Idle Trace Status\n");
+ 	if (drvdata->nr_pe)
+@@ -523,7 +546,7 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
+ 		isb();
+ 
+ 	/* wait for TRCSTATR.IDLE to go back down to '0' */
+-	if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 0))
++	if (etm4x_wait_status(csa, TRCSTATR_IDLE_BIT, 0))
+ 		dev_err(etm_dev,
+ 			"timeout while waiting for Idle Trace Status\n");
+ 
+@@ -903,10 +926,25 @@ static void etm4_disable_hw(void *info)
+ 	tsb_csync();
+ 	etm4x_relaxed_write32(csa, control, TRCPRGCTLR);
+ 
++	/*
++	 * As recommended by section 4.3.7 ("Synchronization when using system
++	 * instructions to progrom the trace unit") of ARM IHI 0064H.b, the
++	 * self-hosted trace analyzer must perform a Context synchronization
++	 * event between writing to the TRCPRGCTLR and reading the TRCSTATR.
++	 */
++	if (!csa->io_mem)
++		isb();
++
+ 	/* wait for TRCSTATR.PMSTABLE to go to '1' */
+-	if (coresight_timeout(csa, TRCSTATR, TRCSTATR_PMSTABLE_BIT, 1))
++	if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1))
+ 		dev_err(etm_dev,
+ 			"timeout while waiting for PM stable Trace Status\n");
++	/*
++	 * As recommended by section 4.3.7 (Synchronization of register updates)
++	 * of ARM IHI 0064H.b.
++	 */
++	isb();
++
+ 	/* read the status of the single shot comparators */
+ 	for (i = 0; i < drvdata->nr_ss_cmp; i++) {
+ 		config->ss_status[i] =
+@@ -1672,7 +1710,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ 	etm4_os_lock(drvdata);
+ 
+ 	/* wait for TRCSTATR.PMSTABLE to go up */
+-	if (coresight_timeout(csa, TRCSTATR, TRCSTATR_PMSTABLE_BIT, 1)) {
++	if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) {
+ 		dev_err(etm_dev,
+ 			"timeout while waiting for PM Stable Status\n");
+ 		etm4_os_unlock(drvdata);
+@@ -1763,7 +1801,7 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ 		state->trcpdcr = etm4x_read32(csa, TRCPDCR);
+ 
+ 	/* wait for TRCSTATR.IDLE to go up */
+-	if (coresight_timeout(csa, TRCSTATR, TRCSTATR_IDLE_BIT, 1)) {
++	if (etm4x_wait_status(csa, TRCSTATR_PMSTABLE_BIT, 1)) {
+ 		dev_err(etm_dev,
+ 			"timeout while waiting for Idle Trace Status\n");
+ 		etm4_os_unlock(drvdata);
+diff --git a/include/linux/coresight.h b/include/linux/coresight.h
+index a269fffaf991c..dccfadde84f41 100644
+--- a/include/linux/coresight.h
++++ b/include/linux/coresight.h
+@@ -575,6 +575,10 @@ extern int coresight_enable(struct coresight_device *csdev);
+ extern void coresight_disable(struct coresight_device *csdev);
+ extern int coresight_timeout(struct csdev_access *csa, u32 offset,
+ 			     int position, int value);
++typedef void (*coresight_timeout_cb_t) (struct csdev_access *, u32, int, int);
++extern int coresight_timeout_action(struct csdev_access *csa, u32 offset,
++					int position, int value,
++					coresight_timeout_cb_t cb);
+ 
+ extern int coresight_claim_device(struct coresight_device *csdev);
+ extern int coresight_claim_device_unlocked(struct coresight_device *csdev);
+-- 
+2.39.5
+
diff --git a/queue-6.6/cpufreq-governor-fix-negative-idle_time-handling-in-.patch b/queue-6.6/cpufreq-governor-fix-negative-idle_time-handling-in-.patch
new file mode 100644
index 0000000000..787f4126a9
--- /dev/null
+++ b/queue-6.6/cpufreq-governor-fix-negative-idle_time-handling-in-.patch
@@ -0,0 +1,116 @@
+From b8ddc768e12dca19d5838688c292804392b24b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 11:55:10 +0800
+Subject: cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
+
+From: Jie Zhan <zhanjie9@hisilicon.com>
+
+[ Upstream commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 ]
+
+We observed an issue that the CPU frequency can't raise up with a 100% CPU
+load when NOHZ is off and the 'conservative' governor is selected.
+
+'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy()
+when NOHZ is off.  This was found and explained in commit 9485e4ca0b48
+("cpufreq: governor: Fix handling of special cases in dbs_update()").
+
+However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection
+logic in load calculation") introduced a comparison between 'idle_time' and
+'samling_rate' to detect a long idle interval.  While 'idle_time' is
+converted to int before comparison, it's actually promoted to unsigned
+again when compared with an unsigned 'sampling_rate'.  Hence, this leads to
+wrong idle interval detection when it's in fact 100% busy and sets
+policy_dbs->idle_periods to a very large value.  'conservative' adjusts the
+frequency to minimum because of the large 'idle_periods', such that the
+frequency can't raise up.  'Ondemand' doesn't use policy_dbs->idle_periods
+so it fortunately avoids the issue.
+
+Correct negative 'idle_time' to 0 before any use of it in dbs_update().
+
+Fixes: 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation")
+Signed-off-by: Jie Zhan <zhanjie9@hisilicon.com>
+Reviewed-by: Chen Yu <yu.c.chen@intel.com>
+Link: https://patch.msgid.link/20250213035510.2402076-1-zhanjie9@hisilicon.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++---------------
+ 1 file changed, 23 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
+index af44ee6a64304..1a7fcaf39cc9b 100644
+--- a/drivers/cpufreq/cpufreq_governor.c
++++ b/drivers/cpufreq/cpufreq_governor.c
+@@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
+ 		time_elapsed = update_time - j_cdbs->prev_update_time;
+ 		j_cdbs->prev_update_time = update_time;
+ 
+-		idle_time = cur_idle_time - j_cdbs->prev_cpu_idle;
++		/*
++		 * cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if
++		 * it's obtained from get_cpu_idle_time_jiffy() when NOHZ is
++		 * off, where idle_time is calculated by the difference between
++		 * time elapsed in jiffies and "busy time" obtained from CPU
++		 * statistics.  If a CPU is 100% busy, the time elapsed and busy
++		 * time should grow with the same amount in two consecutive
++		 * samples, but in practice there could be a tiny difference,
++		 * making the accumulated idle time decrease sometimes.  Hence,
++		 * in this case, idle_time should be regarded as 0 in order to
++		 * make the further process correct.
++		 */
++		if (cur_idle_time > j_cdbs->prev_cpu_idle)
++			idle_time = cur_idle_time - j_cdbs->prev_cpu_idle;
++		else
++			idle_time = 0;
++
+ 		j_cdbs->prev_cpu_idle = cur_idle_time;
+ 
+ 		if (ignore_nice) {
+@@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
+ 			 * calls, so the previous load value can be used then.
+ 			 */
+ 			load = j_cdbs->prev_load;
+-		} else if (unlikely((int)idle_time > 2 * sampling_rate &&
++		} else if (unlikely(idle_time > 2 * sampling_rate &&
+ 				    j_cdbs->prev_load)) {
+ 			/*
+ 			 * If the CPU had gone completely idle and a task has
+@@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy)
+ 			load = j_cdbs->prev_load;
+ 			j_cdbs->prev_load = 0;
+ 		} else {
+-			if (time_elapsed >= idle_time) {
++			if (time_elapsed > idle_time)
+ 				load = 100 * (time_elapsed - idle_time) / time_elapsed;
+-			} else {
+-				/*
+-				 * That can happen if idle_time is returned by
+-				 * get_cpu_idle_time_jiffy().  In that case
+-				 * idle_time is roughly equal to the difference
+-				 * between time_elapsed and "busy time" obtained
+-				 * from CPU statistics.  Then, the "busy time"
+-				 * can end up being greater than time_elapsed
+-				 * (for example, if jiffies_64 and the CPU
+-				 * statistics are updated by different CPUs),
+-				 * so idle_time may in fact be negative.  That
+-				 * means, though, that the CPU was busy all
+-				 * the time (on the rough average) during the
+-				 * last sampling interval and 100 can be
+-				 * returned as the load.
+-				 */
+-				load = (int)idle_time < 0 ? 100 : 0;
+-			}
++			else
++				load = 0;
++
+ 			j_cdbs->prev_load = load;
+ 		}
+ 
+-		if (unlikely((int)idle_time > 2 * sampling_rate)) {
++		if (unlikely(idle_time > 2 * sampling_rate)) {
+ 			unsigned int periods = idle_time / sampling_rate;
+ 
+ 			if (periods < idle_periods)
+-- 
+2.39.5
+
diff --git a/queue-6.6/cpufreq-scpi-compare-khz-instead-of-hz.patch b/queue-6.6/cpufreq-scpi-compare-khz-instead-of-hz.patch
new file mode 100644
index 0000000000..006cdeb2da
--- /dev/null
+++ b/queue-6.6/cpufreq-scpi-compare-khz-instead-of-hz.patch
@@ -0,0 +1,52 @@
+From a390dc4cf773021dc27cd5561057ef4c3d7f8304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2025 08:49:49 +0000
+Subject: cpufreq: scpi: compare kHz instead of Hz
+
+From: zuoqian <zuoqian113@gmail.com>
+
+[ Upstream commit 4742da9774a416908ef8e3916164192c15c0e2d1 ]
+
+The CPU rate from clk_get_rate() may not be divisible by 1000
+(e.g., 133333333). But the rate calculated from frequency(kHz) is
+always divisible by 1000 (e.g., 133333000).
+Comparing the rate causes a warning during CPU scaling:
+"cpufreq: __target_index: Failed to change cpu frequency: -5".
+When we choose to compare kHz here, the issue does not occur.
+
+Fixes: 343a8d17fa8d ("cpufreq: scpi: remove arm_big_little dependency")
+Signed-off-by: zuoqian <zuoqian113@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scpi-cpufreq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index d33be56983ed3..bfc2e65e1e502 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -39,8 +39,9 @@ static unsigned int scpi_cpufreq_get_rate(unsigned int cpu)
+ static int
+ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
+ {
+-	u64 rate = policy->freq_table[index].frequency * 1000;
++	unsigned long freq_khz = policy->freq_table[index].frequency;
+ 	struct scpi_data *priv = policy->driver_data;
++	unsigned long rate = freq_khz * 1000;
+ 	int ret;
+ 
+ 	ret = clk_set_rate(priv->clk, rate);
+@@ -48,7 +49,7 @@ scpi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (clk_get_rate(priv->clk) != rate)
++	if (clk_get_rate(priv->clk) / 1000 != freq_khz)
+ 		return -EIO;
+ 
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-auth-key-length.patch b/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-auth-key-length.patch
new file mode 100644
index 0000000000..25817867d8
--- /dev/null
+++ b/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-auth-key-length.patch
@@ -0,0 +1,52 @@
+From 10d5f8c3b0d13dd1aa3b0a6a10a817aad6131f33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 11:56:26 +0800
+Subject: crypto: hisilicon/sec2 - fix for aead auth key length
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit 1b284ffc30b02808a0de698667cbcf5ce5f9144e ]
+
+According to the HMAC RFC, the authentication key
+can be 0 bytes, and the hardware can handle this
+scenario. Therefore, remove the incorrect validation
+for this case.
+
+Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2")
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 789e566b3bf90..d6727b8ff582b 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -1089,11 +1089,6 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx,
+ 	struct crypto_shash *hash_tfm = ctx->hash_tfm;
+ 	int blocksize, digestsize, ret;
+ 
+-	if (!keys->authkeylen) {
+-		pr_err("hisi_sec2: aead auth key error!\n");
+-		return -EINVAL;
+-	}
+-
+ 	blocksize = crypto_shash_blocksize(hash_tfm);
+ 	digestsize = crypto_shash_digestsize(hash_tfm);
+ 	if (keys->authkeylen > blocksize) {
+@@ -1105,7 +1100,8 @@ static int sec_aead_auth_set_key(struct sec_auth_ctx *ctx,
+ 		}
+ 		ctx->a_key_len = digestsize;
+ 	} else {
+-		memcpy(ctx->a_key, keys->authkey, keys->authkeylen);
++		if (keys->authkeylen)
++			memcpy(ctx->a_key, keys->authkey, keys->authkeylen);
+ 		ctx->a_key_len = keys->authkeylen;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-authsize-alignmen.patch b/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-authsize-alignmen.patch
new file mode 100644
index 0000000000..f8af037612
--- /dev/null
+++ b/queue-6.6/crypto-hisilicon-sec2-fix-for-aead-authsize-alignmen.patch
@@ -0,0 +1,105 @@
+From 5bac06049e0505bc40341399f586fee84041c16a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 11:56:27 +0800
+Subject: crypto: hisilicon/sec2 - fix for aead authsize alignment
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit a49cc71e219040d771a8c1254879984f98192811 ]
+
+The hardware only supports authentication sizes
+that are 4-byte aligned. Therefore, the driver
+switches to software computation in this case.
+
+Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2")
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 8a6dd2513370a..99f27200d23ac 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -57,7 +57,6 @@
+ #define SEC_TYPE_MASK		0x0F
+ #define SEC_DONE_MASK		0x0001
+ #define SEC_ICV_MASK		0x000E
+-#define SEC_SQE_LEN_RATE_MASK	0x3
+ 
+ #define SEC_TOTAL_IV_SZ(depth)	(SEC_IV_SIZE * (depth))
+ #define SEC_SGL_SGE_NR		128
+@@ -80,16 +79,16 @@
+ #define SEC_TOTAL_PBUF_SZ(depth)	(PAGE_SIZE * SEC_PBUF_PAGE_NUM(depth) +	\
+ 				SEC_PBUF_LEFT_SZ(depth))
+ 
+-#define SEC_SQE_LEN_RATE	4
+ #define SEC_SQE_CFLAG		2
+ #define SEC_SQE_AEAD_FLAG	3
+ #define SEC_SQE_DONE		0x1
+ #define SEC_ICV_ERR		0x2
+-#define MIN_MAC_LEN		4
+ #define MAC_LEN_MASK		0x1U
+ #define MAX_INPUT_DATA_LEN	0xFFFE00
+ #define BITS_MASK		0xFF
++#define WORD_MASK		0x3
+ #define BYTE_BITS		0x8
++#define BYTES_TO_WORDS(bcount)	((bcount) >> 2)
+ #define SEC_XTS_NAME_SZ		0x3
+ #define IV_CM_CAL_NUM		2
+ #define IV_CL_MASK		0x7
+@@ -1179,7 +1178,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ 		goto bad_key;
+ 	}
+ 
+-	if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) {
++	if (ctx->a_ctx.a_key_len & WORD_MASK) {
+ 		ret = -EINVAL;
+ 		dev_err(dev, "AUTH key length error!\n");
+ 		goto bad_key;
+@@ -1587,11 +1586,10 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir,
+ 
+ 	sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma);
+ 
+-	sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE);
++	sec_sqe->type2.mac_key_alg = cpu_to_le32(BYTES_TO_WORDS(authsize));
+ 
+ 	sec_sqe->type2.mac_key_alg |=
+-			cpu_to_le32((u32)((ctx->a_key_len) /
+-			SEC_SQE_LEN_RATE) << SEC_AKEY_OFFSET);
++			cpu_to_le32((u32)BYTES_TO_WORDS(ctx->a_key_len) << SEC_AKEY_OFFSET);
+ 
+ 	sec_sqe->type2.mac_key_alg |=
+ 			cpu_to_le32((u32)(ctx->a_alg) << SEC_AEAD_ALG_OFFSET);
+@@ -1643,12 +1641,10 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir,
+ 	sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma);
+ 
+ 	sqe3->auth_mac_key |=
+-			cpu_to_le32((u32)(authsize /
+-			SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3);
++			cpu_to_le32(BYTES_TO_WORDS(authsize) << SEC_MAC_OFFSET_V3);
+ 
+ 	sqe3->auth_mac_key |=
+-			cpu_to_le32((u32)(ctx->a_key_len /
+-			SEC_SQE_LEN_RATE) << SEC_AKEY_OFFSET_V3);
++			cpu_to_le32((u32)BYTES_TO_WORDS(ctx->a_key_len) << SEC_AKEY_OFFSET_V3);
+ 
+ 	sqe3->auth_mac_key |=
+ 			cpu_to_le32((u32)(ctx->a_alg) << SEC_AUTH_ALG_OFFSET_V3);
+@@ -2265,8 +2261,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ 	struct device *dev = ctx->dev;
+ 	int ret;
+ 
+-	/* Hardware does not handle cases where authsize is less than 4 bytes */
+-	if (unlikely(sz < MIN_MAC_LEN)) {
++	/* Hardware does not handle cases where authsize is not 4 bytes aligned */
++	if (c_mode == SEC_CMODE_CBC && (sz & WORD_MASK)) {
+ 		sreq->aead_req.fallback = true;
+ 		return -EINVAL;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/crypto-hisilicon-sec2-fix-for-sec-spec-check.patch b/queue-6.6/crypto-hisilicon-sec2-fix-for-sec-spec-check.patch
new file mode 100644
index 0000000000..c611d2c863
--- /dev/null
+++ b/queue-6.6/crypto-hisilicon-sec2-fix-for-sec-spec-check.patch
@@ -0,0 +1,277 @@
+From c979ec99e3a67849644fcad25a229ecac3d080ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 11:56:28 +0800
+Subject: crypto: hisilicon/sec2 - fix for sec spec check
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit f4f353cb7ae9bb43e34943edb693532a39118eca ]
+
+During encryption and decryption, user requests
+must be checked first, if the specifications that
+are not supported by the hardware are used, the
+software computing is used for processing.
+
+Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2")
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h        |   1 -
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 ++++++++-------------
+ 2 files changed, 39 insertions(+), 63 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index 30c2b1a64695c..2fc04e210bc4f 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -37,7 +37,6 @@ struct sec_aead_req {
+ 	u8 *a_ivin;
+ 	dma_addr_t a_ivin_dma;
+ 	struct aead_request *aead_req;
+-	bool fallback;
+ };
+ 
+ /* SEC request of Crypto */
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 99f27200d23ac..789e566b3bf90 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -689,14 +689,10 @@ static int sec_skcipher_fbtfm_init(struct crypto_skcipher *tfm)
+ 
+ 	c_ctx->fallback = false;
+ 
+-	/* Currently, only XTS mode need fallback tfm when using 192bit key */
+-	if (likely(strncmp(alg, "xts", SEC_XTS_NAME_SZ)))
+-		return 0;
+-
+ 	c_ctx->fbtfm = crypto_alloc_sync_skcipher(alg, 0,
+ 						  CRYPTO_ALG_NEED_FALLBACK);
+ 	if (IS_ERR(c_ctx->fbtfm)) {
+-		pr_err("failed to alloc xts mode fallback tfm!\n");
++		pr_err("failed to alloc fallback tfm for %s!\n", alg);
+ 		return PTR_ERR(c_ctx->fbtfm);
+ 	}
+ 
+@@ -858,7 +854,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ 	}
+ 
+ 	memcpy(c_ctx->c_key, key, keylen);
+-	if (c_ctx->fallback && c_ctx->fbtfm) {
++	if (c_ctx->fbtfm) {
+ 		ret = crypto_sync_skcipher_setkey(c_ctx->fbtfm, key, keylen);
+ 		if (ret) {
+ 			dev_err(dev, "failed to set fallback skcipher key!\n");
+@@ -1163,8 +1159,10 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ 	}
+ 
+ 	ret = crypto_authenc_extractkeys(&keys, key, keylen);
+-	if (ret)
++	if (ret) {
++		dev_err(dev, "sec extract aead keys err!\n");
+ 		goto bad_key;
++	}
+ 
+ 	ret = sec_aead_aes_set_key(c_ctx, &keys);
+ 	if (ret) {
+@@ -1178,12 +1176,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ 		goto bad_key;
+ 	}
+ 
+-	if (ctx->a_ctx.a_key_len & WORD_MASK) {
+-		ret = -EINVAL;
+-		dev_err(dev, "AUTH key length error!\n");
+-		goto bad_key;
+-	}
+-
+ 	ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen);
+ 	if (ret) {
+ 		dev_err(dev, "set sec fallback key err!\n");
+@@ -2003,8 +1995,7 @@ static int sec_aead_sha512_ctx_init(struct crypto_aead *tfm)
+ 	return sec_aead_ctx_init(tfm, "sha512");
+ }
+ 
+-static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx,
+-	struct sec_req *sreq)
++static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ {
+ 	u32 cryptlen = sreq->c_req.sk_req->cryptlen;
+ 	struct device *dev = ctx->dev;
+@@ -2028,10 +2019,6 @@ static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx,
+ 	case SEC_CMODE_CFB:
+ 	case SEC_CMODE_OFB:
+ 	case SEC_CMODE_CTR:
+-		if (unlikely(ctx->sec->qm.ver < QM_HW_V3)) {
+-			dev_err(dev, "skcipher HW version error!\n");
+-			ret = -EINVAL;
+-		}
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+@@ -2040,17 +2027,21 @@ static int sec_skcipher_cryptlen_check(struct sec_ctx *ctx,
+ 	return ret;
+ }
+ 
+-static int sec_skcipher_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
++static int sec_skcipher_param_check(struct sec_ctx *ctx,
++				    struct sec_req *sreq, bool *need_fallback)
+ {
+ 	struct skcipher_request *sk_req = sreq->c_req.sk_req;
+ 	struct device *dev = ctx->dev;
+ 	u8 c_alg = ctx->c_ctx.c_alg;
+ 
+-	if (unlikely(!sk_req->src || !sk_req->dst ||
+-		     sk_req->cryptlen > MAX_INPUT_DATA_LEN)) {
++	if (unlikely(!sk_req->src || !sk_req->dst)) {
+ 		dev_err(dev, "skcipher input param error!\n");
+ 		return -EINVAL;
+ 	}
++
++	if (sk_req->cryptlen > MAX_INPUT_DATA_LEN)
++		*need_fallback = true;
++
+ 	sreq->c_req.c_len = sk_req->cryptlen;
+ 
+ 	if (ctx->pbuf_supported && sk_req->cryptlen <= SEC_PBUF_SZ)
+@@ -2108,6 +2099,7 @@ static int sec_skcipher_crypto(struct skcipher_request *sk_req, bool encrypt)
+ 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(sk_req);
+ 	struct sec_req *req = skcipher_request_ctx(sk_req);
+ 	struct sec_ctx *ctx = crypto_skcipher_ctx(tfm);
++	bool need_fallback = false;
+ 	int ret;
+ 
+ 	if (!sk_req->cryptlen) {
+@@ -2121,11 +2113,11 @@ static int sec_skcipher_crypto(struct skcipher_request *sk_req, bool encrypt)
+ 	req->c_req.encrypt = encrypt;
+ 	req->ctx = ctx;
+ 
+-	ret = sec_skcipher_param_check(ctx, req);
++	ret = sec_skcipher_param_check(ctx, req, &need_fallback);
+ 	if (unlikely(ret))
+ 		return -EINVAL;
+ 
+-	if (unlikely(ctx->c_ctx.fallback))
++	if (unlikely(ctx->c_ctx.fallback || need_fallback))
+ 		return sec_skcipher_soft_crypto(ctx, sk_req, encrypt);
+ 
+ 	return ctx->req_op->process(ctx, req);
+@@ -2258,52 +2250,35 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ 	size_t sz = crypto_aead_authsize(tfm);
+ 	u8 c_mode = ctx->c_ctx.c_mode;
+-	struct device *dev = ctx->dev;
+ 	int ret;
+ 
+-	/* Hardware does not handle cases where authsize is not 4 bytes aligned */
+-	if (c_mode == SEC_CMODE_CBC && (sz & WORD_MASK)) {
+-		sreq->aead_req.fallback = true;
++	if (unlikely(ctx->sec->qm.ver == QM_HW_V2 && !sreq->c_req.c_len))
+ 		return -EINVAL;
+-	}
+ 
+ 	if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN ||
+-	    req->assoclen > SEC_MAX_AAD_LEN)) {
+-		dev_err(dev, "aead input spec error!\n");
++		     req->assoclen > SEC_MAX_AAD_LEN))
+ 		return -EINVAL;
+-	}
+ 
+ 	if (c_mode == SEC_CMODE_CCM) {
+-		if (unlikely(req->assoclen > SEC_MAX_CCM_AAD_LEN)) {
+-			dev_err_ratelimited(dev, "CCM input aad parameter is too long!\n");
++		if (unlikely(req->assoclen > SEC_MAX_CCM_AAD_LEN))
+ 			return -EINVAL;
+-		}
+-		ret = aead_iv_demension_check(req);
+-		if (ret) {
+-			dev_err(dev, "aead input iv param error!\n");
+-			return ret;
+-		}
+-	}
+ 
+-	if (sreq->c_req.encrypt)
+-		sreq->c_req.c_len = req->cryptlen;
+-	else
+-		sreq->c_req.c_len = req->cryptlen - sz;
+-	if (c_mode == SEC_CMODE_CBC) {
+-		if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) {
+-			dev_err(dev, "aead crypto length error!\n");
++		ret = aead_iv_demension_check(req);
++		if (unlikely(ret))
++			return -EINVAL;
++	} else if (c_mode == SEC_CMODE_CBC) {
++		if (unlikely(sz & WORD_MASK))
++			return -EINVAL;
++		if (unlikely(ctx->a_ctx.a_key_len & WORD_MASK))
+ 			return -EINVAL;
+-		}
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
++static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq, bool *need_fallback)
+ {
+ 	struct aead_request *req = sreq->aead_req.aead_req;
+-	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+-	size_t authsize = crypto_aead_authsize(tfm);
+ 	struct device *dev = ctx->dev;
+ 	u8 c_alg = ctx->c_ctx.c_alg;
+ 
+@@ -2312,12 +2287,10 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (ctx->sec->qm.ver == QM_HW_V2) {
+-		if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt &&
+-			     req->cryptlen <= authsize))) {
+-			sreq->aead_req.fallback = true;
+-			return -EINVAL;
+-		}
++	if (unlikely(ctx->c_ctx.c_mode == SEC_CMODE_CBC &&
++		     sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) {
++		dev_err(dev, "aead cbc mode input data length error!\n");
++		return -EINVAL;
+ 	}
+ 
+ 	/* Support AES or SM4 */
+@@ -2326,8 +2299,10 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (unlikely(sec_aead_spec_check(ctx, sreq)))
++	if (unlikely(sec_aead_spec_check(ctx, sreq))) {
++		*need_fallback = true;
+ 		return -EINVAL;
++	}
+ 
+ 	if (ctx->pbuf_supported && (req->cryptlen + req->assoclen) <=
+ 		SEC_PBUF_SZ)
+@@ -2371,17 +2346,19 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt)
+ 	struct crypto_aead *tfm = crypto_aead_reqtfm(a_req);
+ 	struct sec_req *req = aead_request_ctx(a_req);
+ 	struct sec_ctx *ctx = crypto_aead_ctx(tfm);
++	size_t sz = crypto_aead_authsize(tfm);
++	bool need_fallback = false;
+ 	int ret;
+ 
+ 	req->flag = a_req->base.flags;
+ 	req->aead_req.aead_req = a_req;
+ 	req->c_req.encrypt = encrypt;
+ 	req->ctx = ctx;
+-	req->aead_req.fallback = false;
++	req->c_req.c_len = a_req->cryptlen - (req->c_req.encrypt ? 0 : sz);
+ 
+-	ret = sec_aead_param_check(ctx, req);
++	ret = sec_aead_param_check(ctx, req, &need_fallback);
+ 	if (unlikely(ret)) {
+-		if (req->aead_req.fallback)
++		if (need_fallback)
+ 			return sec_aead_soft_crypto(ctx, a_req, encrypt);
+ 		return -EINVAL;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/crypto-nx-fix-uninitialised-hv_nxc-on-error.patch b/queue-6.6/crypto-nx-fix-uninitialised-hv_nxc-on-error.patch
new file mode 100644
index 0000000000..04dfd38ed5
--- /dev/null
+++ b/queue-6.6/crypto-nx-fix-uninitialised-hv_nxc-on-error.patch
@@ -0,0 +1,95 @@
+From 6422b96a500b008d26d9f901602738ac53c76ec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Mar 2025 16:50:42 +0800
+Subject: crypto: nx - Fix uninitialised hv_nxc on error
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 9b00eb923f3e60ca76cbc8b31123716f3a87ac6a ]
+
+The compiler correctly warns that hv_nxc may be used uninitialised
+as that will occur when NX-GZIP is unavailable.
+
+Fix it by rearranging the code and delay setting caps_feat until
+the final query succeeds.
+
+Fixes: b4ba22114c78 ("crypto/nx: Get NX capabilities for GZIP coprocessor type")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/nx/nx-common-pseries.c | 37 ++++++++++++---------------
+ 1 file changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/crypto/nx/nx-common-pseries.c b/drivers/crypto/nx/nx-common-pseries.c
+index 35f2d0d8507ed..7e98f174f69b9 100644
+--- a/drivers/crypto/nx/nx-common-pseries.c
++++ b/drivers/crypto/nx/nx-common-pseries.c
+@@ -1144,6 +1144,7 @@ static void __init nxcop_get_capabilities(void)
+ {
+ 	struct hv_vas_all_caps *hv_caps;
+ 	struct hv_nx_cop_caps *hv_nxc;
++	u64 feat;
+ 	int rc;
+ 
+ 	hv_caps = kmalloc(sizeof(*hv_caps), GFP_KERNEL);
+@@ -1154,27 +1155,26 @@ static void __init nxcop_get_capabilities(void)
+ 	 */
+ 	rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES, 0,
+ 					  (u64)virt_to_phys(hv_caps));
++	if (!rc)
++		feat = be64_to_cpu(hv_caps->feat_type);
++	kfree(hv_caps);
+ 	if (rc)
+-		goto out;
++		return;
++	if (!(feat & VAS_NX_GZIP_FEAT_BIT))
++		return;
+ 
+-	caps_feat = be64_to_cpu(hv_caps->feat_type);
+ 	/*
+ 	 * NX-GZIP feature available
+ 	 */
+-	if (caps_feat & VAS_NX_GZIP_FEAT_BIT) {
+-		hv_nxc = kmalloc(sizeof(*hv_nxc), GFP_KERNEL);
+-		if (!hv_nxc)
+-			goto out;
+-		/*
+-		 * Get capabilities for NX-GZIP feature
+-		 */
+-		rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES,
+-						  VAS_NX_GZIP_FEAT,
+-						  (u64)virt_to_phys(hv_nxc));
+-	} else {
+-		pr_err("NX-GZIP feature is not available\n");
+-		rc = -EINVAL;
+-	}
++	hv_nxc = kmalloc(sizeof(*hv_nxc), GFP_KERNEL);
++	if (!hv_nxc)
++		return;
++	/*
++	 * Get capabilities for NX-GZIP feature
++	 */
++	rc = h_query_vas_capabilities(H_QUERY_NX_CAPABILITIES,
++					  VAS_NX_GZIP_FEAT,
++					  (u64)virt_to_phys(hv_nxc));
+ 
+ 	if (!rc) {
+ 		nx_cop_caps.descriptor = be64_to_cpu(hv_nxc->descriptor);
+@@ -1184,13 +1184,10 @@ static void __init nxcop_get_capabilities(void)
+ 				be64_to_cpu(hv_nxc->min_compress_len);
+ 		nx_cop_caps.min_decompress_len =
+ 				be64_to_cpu(hv_nxc->min_decompress_len);
+-	} else {
+-		caps_feat = 0;
++		caps_feat = feat;
+ 	}
+ 
+ 	kfree(hv_nxc);
+-out:
+-	kfree(hv_caps);
+ }
+ 
+ static const struct vio_device_id nx842_vio_driver_ids[] = {
+-- 
+2.39.5
+
diff --git a/queue-6.6/dmaengine-fsl-edma-cleanup-chan-after-dma_async_devi.patch b/queue-6.6/dmaengine-fsl-edma-cleanup-chan-after-dma_async_devi.patch
new file mode 100644
index 0000000000..9cee3fa020
--- /dev/null
+++ b/queue-6.6/dmaengine-fsl-edma-cleanup-chan-after-dma_async_devi.patch
@@ -0,0 +1,52 @@
+From 92c78845f7933adf9a0f36e6e2de3ea81f99e473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 15:17:19 +0800
+Subject: dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit c9c59da76ce9cb3f215b66eb3708cda1134a5206 ]
+
+There is kernel dump when do module test:
+sysfs: cannot create duplicate filename
+/devices/platform/soc@0/44000000.bus/44000000.dma-controller/dma/dma0chan0
+ __dma_async_device_channel_register+0x128/0x19c
+ dma_async_device_register+0x150/0x454
+ fsl_edma_probe+0x6cc/0x8a0
+ platform_probe+0x68/0xc8
+
+fsl_edma_cleanup_vchan will unlink vchan.chan.device_node, while
+dma_async_device_unregister  needs the link to do
+__dma_async_device_channel_unregister. So need move fsl_edma_cleanup_vchan
+after dma_async_device_unregister to make sure channel could be freed.
+
+So clean up chan after dma_async_device_unregister to address this.
+
+Fixes: 6f93b93b2a1b ("dmaengine: fsl-edma: kill the tasklets upon exit")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20250228071720.3780479-1-peng.fan@oss.nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-edma-main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
+index cd394eae47d17..cc9923ab686dc 100644
+--- a/drivers/dma/fsl-edma-main.c
++++ b/drivers/dma/fsl-edma-main.c
+@@ -675,9 +675,9 @@ static int fsl_edma_remove(struct platform_device *pdev)
+ 	struct fsl_edma_engine *fsl_edma = platform_get_drvdata(pdev);
+ 
+ 	fsl_edma_irq_exit(pdev, fsl_edma);
+-	fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
+ 	of_dma_controller_free(np);
+ 	dma_async_device_unregister(&fsl_edma->dma_dev);
++	fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
+ 	fsl_disable_clocks(fsl_edma, fsl_edma->drvdata->dmamuxs);
+ 
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-amd-display-avoid-npd-when-asic-does-not-support.patch b/queue-6.6/drm-amd-display-avoid-npd-when-asic-does-not-support.patch
new file mode 100644
index 0000000000..eb06dfc0c2
--- /dev/null
+++ b/queue-6.6/drm-amd-display-avoid-npd-when-asic-does-not-support.patch
@@ -0,0 +1,149 @@
+From d7a6952ee43bd365b2c4ee4241b06f4318f91c7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 10:06:38 -0300
+Subject: drm/amd/display: avoid NPD when ASIC does not support DMUB
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 42d9d7bed270247f134190ba0cb05bbd072f58c2 ]
+
+ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is
+tested in dm_dmub_sw_init.
+
+However, it will be dereferenced in dmub_hw_lock_mgr_cmd if
+should_use_dmub_lock returns true.
+
+This has been the case since dmub support has been added for PSR1.
+
+Fix this by checking for dmub_srv in should_use_dmub_lock.
+
+[   37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058
+[   37.447808] #PF: supervisor read access in kernel mode
+[   37.452959] #PF: error_code(0x0000) - not-present page
+[   37.458112] PGD 0 P4D 0
+[   37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
+[   37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88
+[   37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023
+[   37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0
+[   37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5
+[   37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202
+[   37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358
+[   37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000
+[   37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5
+[   37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000
+[   37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000
+[   37.551725] FS:  0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000
+[   37.559814] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0
+[   37.572697] Call Trace:
+[   37.575152]  <TASK>
+[   37.577258]  ? __die_body+0x66/0xb0
+[   37.580756]  ? page_fault_oops+0x3e7/0x4a0
+[   37.584861]  ? exc_page_fault+0x3e/0xe0
+[   37.588706]  ? exc_page_fault+0x5c/0xe0
+[   37.592550]  ? asm_exc_page_fault+0x22/0x30
+[   37.596742]  ? dmub_hw_lock_mgr_cmd+0x77/0xb0
+[   37.601107]  dcn10_cursor_lock+0x1e1/0x240
+[   37.605211]  program_cursor_attributes+0x81/0x190
+[   37.609923]  commit_planes_for_stream+0x998/0x1ef0
+[   37.614722]  update_planes_and_stream_v2+0x41e/0x5c0
+[   37.619703]  dc_update_planes_and_stream+0x78/0x140
+[   37.624588]  amdgpu_dm_atomic_commit_tail+0x4362/0x49f0
+[   37.629832]  ? srso_return_thunk+0x5/0x5f
+[   37.633847]  ? mark_held_locks+0x6d/0xd0
+[   37.637774]  ? _raw_spin_unlock_irq+0x24/0x50
+[   37.642135]  ? srso_return_thunk+0x5/0x5f
+[   37.646148]  ? lockdep_hardirqs_on+0x95/0x150
+[   37.650510]  ? srso_return_thunk+0x5/0x5f
+[   37.654522]  ? _raw_spin_unlock_irq+0x2f/0x50
+[   37.658883]  ? srso_return_thunk+0x5/0x5f
+[   37.662897]  ? wait_for_common+0x186/0x1c0
+[   37.666998]  ? srso_return_thunk+0x5/0x5f
+[   37.671009]  ? drm_crtc_next_vblank_start+0xc3/0x170
+[   37.675983]  commit_tail+0xf5/0x1c0
+[   37.679478]  drm_atomic_helper_commit+0x2a2/0x2b0
+[   37.684186]  drm_atomic_commit+0xd6/0x100
+[   37.688199]  ? __cfi___drm_printfn_info+0x10/0x10
+[   37.692911]  drm_atomic_helper_update_plane+0xe5/0x130
+[   37.698054]  drm_mode_cursor_common+0x501/0x670
+[   37.702600]  ? __cfi_drm_mode_cursor_ioctl+0x10/0x10
+[   37.707572]  drm_mode_cursor_ioctl+0x48/0x70
+[   37.711851]  drm_ioctl_kernel+0xf2/0x150
+[   37.715781]  drm_ioctl+0x363/0x590
+[   37.719189]  ? __cfi_drm_mode_cursor_ioctl+0x10/0x10
+[   37.724165]  amdgpu_drm_ioctl+0x41/0x80
+[   37.728013]  __se_sys_ioctl+0x7f/0xd0
+[   37.731685]  do_syscall_64+0x87/0x100
+[   37.735355]  ? vma_end_read+0x12/0xe0
+[   37.739024]  ? srso_return_thunk+0x5/0x5f
+[   37.743041]  ? find_held_lock+0x47/0xf0
+[   37.746884]  ? vma_end_read+0x12/0xe0
+[   37.750552]  ? srso_return_thunk+0x5/0x5f
+[   37.754565]  ? lock_release+0x1c4/0x2e0
+[   37.758406]  ? vma_end_read+0x12/0xe0
+[   37.762079]  ? exc_page_fault+0x84/0xe0
+[   37.765921]  ? srso_return_thunk+0x5/0x5f
+[   37.769938]  ? lockdep_hardirqs_on+0x95/0x150
+[   37.774303]  ? srso_return_thunk+0x5/0x5f
+[   37.778317]  ? exc_page_fault+0x84/0xe0
+[   37.782163]  entry_SYSCALL_64_after_hwframe+0x55/0x5d
+[   37.787218] RIP: 0033:0x784aa5ec3059
+[   37.790803] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1d 48 8b 45 c8 64 48 2b 04 25 28 00 0
+[   37.809553] RSP: 002b:0000784a9cdf90e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[   37.817121] RAX: ffffffffffffffda RBX: 0000784a9cdf917c RCX: 0000784aa5ec3059
+[   37.824256] RDX: 0000784a9cdf917c RSI: 00000000c01c64a3 RDI: 0000000000000020
+[   37.831391] RBP: 0000784a9cdf9130 R08: 0000000000000100 R09: 0000000000ff0000
+[   37.838525] R10: 0000000000000000 R11: 0000000000000246 R12: 0000025c01606ed0
+[   37.845657] R13: 0000025c00030200 R14: 00000000c01c64a3 R15: 0000000000000020
+[   37.852799]  </TASK>
+[   37.854992] Modules linked in:
+[   37.864546] gsmi: Log Shutdown Reason 0x03
+[   37.868656] CR2: 0000000000000058
+[   37.871979] ---[ end trace 0000000000000000 ]---
+[   37.880976] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0
+[   37.885954] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5
+[   37.904703] RSP: 0018:ffff969442853300 EFLAGS: 00010202
+[   37.909933] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358
+[   37.917068] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000
+[   37.924201] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5
+[   37.931336] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000
+[   37.938469] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000
+[   37.945602] FS:  0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000
+[   37.953689] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[   37.959435] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0
+[   37.966570] Kernel panic - not syncing: Fatal exception
+[   37.971901] Kernel Offset: 0x30200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+[   37.982840] gsmi: Log Shutdown Reason 0x02
+
+Fixes: b5c764d6ed55 ("drm/amd/display: Use HW lock mgr for PSR1")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Cc: Sun peng Li <sunpeng.li@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Cc: Daniel Wheeler <daniel.wheeler@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
+index 5c7530287730e..4dc9856e87301 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
+@@ -63,6 +63,10 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct dc_dmub_srv *dmub_srv,
+ 
+ bool should_use_dmub_lock(struct dc_link *link)
+ {
++	/* ASIC doesn't support DMUB */
++	if (!link->ctx->dmub_srv)
++		return false;
++
+ 	if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
+ 		return true;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-amd-display-fix-type-mismatch-in-calculatedynami.patch b/queue-6.6/drm-amd-display-fix-type-mismatch-in-calculatedynami.patch
new file mode 100644
index 0000000000..547c39c87d
--- /dev/null
+++ b/queue-6.6/drm-amd-display-fix-type-mismatch-in-calculatedynami.patch
@@ -0,0 +1,64 @@
+From 00490634d569479ef1dd4e098e739a198affec88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 01:28:51 +0500
+Subject: drm/amd/display: fix type mismatch in
+ CalculateDynamicMetadataParameters()
+
+From: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru>
+
+[ Upstream commit c3c584c18c90a024a54716229809ba36424f9660 ]
+
+There is a type mismatch between what CalculateDynamicMetadataParameters()
+takes and what is passed to it. Currently this function accepts several
+args as signed long but it's called with unsigned integers and integer. On
+some systems where long is 32 bits and one of these unsigned int params is
+greater than INT_MAX it may cause passing input params as negative values.
+
+Fix this by changing these argument types from long to unsigned int and to
+int respectively. Also this will align the function's definition with
+similar functions in other dcn* drivers.
+
+Found by Linux Verification Center (linuxtesting.org) with Svace.
+
+Fixes: 6725a88f88a7 ("drm/amd/display: Add DCN3 DML")
+Signed-off-by: Vitaliy Shevtsov <v.shevtsov@mt-integration.ru>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dml/dcn30/display_mode_vba_30.c   | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+index ad741a723c0e8..72ffa1abebaa1 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+@@ -281,10 +281,10 @@ static void CalculateDynamicMetadataParameters(
+ 		double DISPCLK,
+ 		double DCFClkDeepSleep,
+ 		double PixelClock,
+-		long HTotal,
+-		long VBlank,
+-		long DynamicMetadataTransmittedBytes,
+-		long DynamicMetadataLinesBeforeActiveRequired,
++		unsigned int HTotal,
++		unsigned int VBlank,
++		unsigned int DynamicMetadataTransmittedBytes,
++		int DynamicMetadataLinesBeforeActiveRequired,
+ 		int InterlaceEnable,
+ 		bool ProgressiveToInterlaceUnitInOPP,
+ 		double *Tsetup,
+@@ -3277,8 +3277,8 @@ static double CalculateWriteBackDelay(
+ 
+ 
+ static void CalculateDynamicMetadataParameters(int MaxInterDCNTileRepeaters, double DPPCLK, double DISPCLK,
+-		double DCFClkDeepSleep, double PixelClock, long HTotal, long VBlank, long DynamicMetadataTransmittedBytes,
+-		long DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP,
++		double DCFClkDeepSleep, double PixelClock, unsigned int HTotal, unsigned int VBlank, unsigned int DynamicMetadataTransmittedBytes,
++		int DynamicMetadataLinesBeforeActiveRequired, int InterlaceEnable, bool ProgressiveToInterlaceUnitInOPP,
+ 		double *Tsetup, double *Tdmbf, double *Tdmec, double *Tdmsks)
+ {
+ 	double TotalRepeaterDelayTime = 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-amd-keep-display-off-while-going-into-s4.patch b/queue-6.6/drm-amd-keep-display-off-while-going-into-s4.patch
new file mode 100644
index 0000000000..a34b78ab11
--- /dev/null
+++ b/queue-6.6/drm-amd-keep-display-off-while-going-into-s4.patch
@@ -0,0 +1,102 @@
+From cde5e8b35d84b6f3c6cbd785a52825e59c9337e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 12:51:24 -0600
+Subject: drm/amd: Keep display off while going into S4
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 4afacc9948e1f8fdbca401d259ae65ad93d298c0 ]
+
+When userspace invokes S4 the flow is:
+
+1) amdgpu_pmops_prepare()
+2) amdgpu_pmops_freeze()
+3) Create hibernation image
+4) amdgpu_pmops_thaw()
+5) Write out image to disk
+6) Turn off system
+
+Then on resume amdgpu_pmops_restore() is called.
+
+This flow has a problem that because amdgpu_pmops_thaw() is called
+it will call amdgpu_device_resume() which will resume all of the GPU.
+
+This includes turning the display hardware back on and discovering
+connectors again.
+
+This is an unexpected experience for the display to turn back on.
+Adjust the flow so that during the S4 sequence display hardware is
+not turned back on.
+
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2038
+Cc: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Link: https://lore.kernel.org/r/20250306185124.44780-1-mario.limonciello@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 68bfdc8dc0a1a7fdd9ab61e69907ae71a6fd3d91)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c           | 11 +++++++++--
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |  5 +++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index f9bc38d20ce3e..a51ceebb80547 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2461,7 +2461,6 @@ static int amdgpu_pmops_freeze(struct device *dev)
+ 
+ 	adev->in_s4 = true;
+ 	r = amdgpu_device_suspend(drm_dev, true);
+-	adev->in_s4 = false;
+ 	if (r)
+ 		return r;
+ 
+@@ -2473,8 +2472,13 @@ static int amdgpu_pmops_freeze(struct device *dev)
+ static int amdgpu_pmops_thaw(struct device *dev)
+ {
+ 	struct drm_device *drm_dev = dev_get_drvdata(dev);
++	struct amdgpu_device *adev = drm_to_adev(drm_dev);
++	int r;
+ 
+-	return amdgpu_device_resume(drm_dev, true);
++	r = amdgpu_device_resume(drm_dev, true);
++	adev->in_s4 = false;
++
++	return r;
+ }
+ 
+ static int amdgpu_pmops_poweroff(struct device *dev)
+@@ -2487,6 +2491,9 @@ static int amdgpu_pmops_poweroff(struct device *dev)
+ static int amdgpu_pmops_restore(struct device *dev)
+ {
+ 	struct drm_device *drm_dev = dev_get_drvdata(dev);
++	struct amdgpu_device *adev = drm_to_adev(drm_dev);
++
++	adev->in_s4 = false;
+ 
+ 	return amdgpu_device_resume(drm_dev, true);
+ }
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 2b7f98a2e36f5..3696b9112c74e 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2890,6 +2890,11 @@ static int dm_resume(void *handle)
+ 
+ 		return 0;
+ 	}
++
++	/* leave display off for S4 sequence */
++	if (adev->in_s4)
++		return 0;
++
+ 	/* Recreate dc_state - DC invalidates it when setting power state to S3. */
+ 	dc_release_state(dm_state->context);
+ 	dm_state->context = dc_create_state(dm->dc);
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-amdkfd-fix-circular-locking-dependency-in-svm_ra.patch b/queue-6.6/drm-amdkfd-fix-circular-locking-dependency-in-svm_ra.patch
new file mode 100644
index 0000000000..981aa13f25
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-fix-circular-locking-dependency-in-svm_ra.patch
@@ -0,0 +1,279 @@
+From 0aa57031d6c0290b762d1761536eb458659a4b03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2025 13:46:32 +0530
+Subject: drm/amdkfd: Fix Circular Locking Dependency in
+ 'svm_range_cpu_invalidate_pagetables'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit fddc45026311c05a5355fd34b9dc0a1d7eaef4a2 ]
+
+This commit addresses a circular locking dependency in the
+svm_range_cpu_invalidate_pagetables function. The function previously
+held a lock while determining whether to perform an unmap or eviction
+operation, which could lead to deadlocks.
+
+Fixes the below:
+
+[  223.418794] ======================================================
+[  223.418820] WARNING: possible circular locking dependency detected
+[  223.418845] 6.12.0-amdstaging-drm-next-lol-050225 #14 Tainted: G     U     OE
+[  223.418869] ------------------------------------------------------
+[  223.418889] kfdtest/3939 is trying to acquire lock:
+[  223.418906] ffff8957552eae38 (&dqm->lock_hidden){+.+.}-{3:3}, at: evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.419302]
+               but task is already holding lock:
+[  223.419303] ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
+[  223.419447] Console: switching to colour dummy device 80x25
+[  223.419477] [IGT] amd_basic: executing
+[  223.419599]
+               which lock already depends on the new lock.
+
+[  223.419611]
+               the existing dependency chain (in reverse order) is:
+[  223.419621]
+               -> #2 (&prange->lock){+.+.}-{3:3}:
+[  223.419636]        __mutex_lock+0x85/0xe20
+[  223.419647]        mutex_lock_nested+0x1b/0x30
+[  223.419656]        svm_range_validate_and_map+0x2f1/0x15b0 [amdgpu]
+[  223.419954]        svm_range_set_attr+0xe8c/0x1710 [amdgpu]
+[  223.420236]        svm_ioctl+0x46/0x50 [amdgpu]
+[  223.420503]        kfd_ioctl_svm+0x50/0x90 [amdgpu]
+[  223.420763]        kfd_ioctl+0x409/0x6d0 [amdgpu]
+[  223.421024]        __x64_sys_ioctl+0x95/0xd0
+[  223.421036]        x64_sys_call+0x1205/0x20d0
+[  223.421047]        do_syscall_64+0x87/0x140
+[  223.421056]        entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[  223.421068]
+               -> #1 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[  223.421084]        __ww_mutex_lock.constprop.0+0xab/0x1560
+[  223.421095]        ww_mutex_lock+0x2b/0x90
+[  223.421103]        amdgpu_amdkfd_alloc_gtt_mem+0xcc/0x2b0 [amdgpu]
+[  223.421361]        add_queue_mes+0x3bc/0x440 [amdgpu]
+[  223.421623]        unhalt_cpsch+0x1ae/0x240 [amdgpu]
+[  223.421888]        kgd2kfd_start_sched+0x5e/0xd0 [amdgpu]
+[  223.422148]        amdgpu_amdkfd_start_sched+0x3d/0x50 [amdgpu]
+[  223.422414]        amdgpu_gfx_enforce_isolation_handler+0x132/0x270 [amdgpu]
+[  223.422662]        process_one_work+0x21e/0x680
+[  223.422673]        worker_thread+0x190/0x330
+[  223.422682]        kthread+0xe7/0x120
+[  223.422690]        ret_from_fork+0x3c/0x60
+[  223.422699]        ret_from_fork_asm+0x1a/0x30
+[  223.422708]
+               -> #0 (&dqm->lock_hidden){+.+.}-{3:3}:
+[  223.422723]        __lock_acquire+0x16f4/0x2810
+[  223.422734]        lock_acquire+0xd1/0x300
+[  223.422742]        __mutex_lock+0x85/0xe20
+[  223.422751]        mutex_lock_nested+0x1b/0x30
+[  223.422760]        evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.423025]        kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
+[  223.423285]        kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
+[  223.423540]        svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
+[  223.423807]        __mmu_notifier_invalidate_range_start+0x1f5/0x250
+[  223.423819]        copy_page_range+0x1e94/0x1ea0
+[  223.423829]        copy_process+0x172f/0x2ad0
+[  223.423839]        kernel_clone+0x9c/0x3f0
+[  223.423847]        __do_sys_clone+0x66/0x90
+[  223.423856]        __x64_sys_clone+0x25/0x30
+[  223.423864]        x64_sys_call+0x1d7c/0x20d0
+[  223.423872]        do_syscall_64+0x87/0x140
+[  223.423880]        entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[  223.423891]
+               other info that might help us debug this:
+
+[  223.423903] Chain exists of:
+                 &dqm->lock_hidden --> reservation_ww_class_mutex --> &prange->lock
+
+[  223.423926]  Possible unsafe locking scenario:
+
+[  223.423935]        CPU0                    CPU1
+[  223.423942]        ----                    ----
+[  223.423949]   lock(&prange->lock);
+[  223.423958]                                lock(reservation_ww_class_mutex);
+[  223.423970]                                lock(&prange->lock);
+[  223.423981]   lock(&dqm->lock_hidden);
+[  223.423990]
+                *** DEADLOCK ***
+
+[  223.423999] 5 locks held by kfdtest/3939:
+[  223.424006]  #0: ffffffffb82b4fc0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x1387/0x2ad0
+[  223.424026]  #1: ffff89575eda81b0 (&mm->mmap_lock){++++}-{3:3}, at: copy_process+0x13a8/0x2ad0
+[  223.424046]  #2: ffff89575edaf3b0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_process+0x13e4/0x2ad0
+[  223.424066]  #3: ffffffffb82e76e0 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at: copy_page_range+0x1cea/0x1ea0
+[  223.424088]  #4: ffff8957556b83b0 (&prange->lock){+.+.}-{3:3}, at: svm_range_cpu_invalidate_pagetables+0x9d/0x850 [amdgpu]
+[  223.424365]
+               stack backtrace:
+[  223.424374] CPU: 0 UID: 0 PID: 3939 Comm: kfdtest Tainted: G     U     OE      6.12.0-amdstaging-drm-next-lol-050225 #14
+[  223.424392] Tainted: [U]=USER, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
+[  223.424401] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS PRO WIFI/X570 AORUS PRO WIFI, BIOS F36a 02/16/2022
+[  223.424416] Call Trace:
+[  223.424423]  <TASK>
+[  223.424430]  dump_stack_lvl+0x9b/0xf0
+[  223.424441]  dump_stack+0x10/0x20
+[  223.424449]  print_circular_bug+0x275/0x350
+[  223.424460]  check_noncircular+0x157/0x170
+[  223.424469]  ? __bfs+0xfd/0x2c0
+[  223.424481]  __lock_acquire+0x16f4/0x2810
+[  223.424490]  ? srso_return_thunk+0x5/0x5f
+[  223.424505]  lock_acquire+0xd1/0x300
+[  223.424514]  ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.424783]  __mutex_lock+0x85/0xe20
+[  223.424792]  ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.425058]  ? srso_return_thunk+0x5/0x5f
+[  223.425067]  ? mark_held_locks+0x54/0x90
+[  223.425076]  ? evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.425339]  ? srso_return_thunk+0x5/0x5f
+[  223.425350]  mutex_lock_nested+0x1b/0x30
+[  223.425358]  ? mutex_lock_nested+0x1b/0x30
+[  223.425367]  evict_process_queues_cpsch+0x43/0x210 [amdgpu]
+[  223.425631]  kfd_process_evict_queues+0x8a/0x1d0 [amdgpu]
+[  223.425893]  kgd2kfd_quiesce_mm+0x43/0x90 [amdgpu]
+[  223.426156]  svm_range_cpu_invalidate_pagetables+0x4a7/0x850 [amdgpu]
+[  223.426423]  ? srso_return_thunk+0x5/0x5f
+[  223.426436]  __mmu_notifier_invalidate_range_start+0x1f5/0x250
+[  223.426450]  copy_page_range+0x1e94/0x1ea0
+[  223.426461]  ? srso_return_thunk+0x5/0x5f
+[  223.426474]  ? srso_return_thunk+0x5/0x5f
+[  223.426484]  ? lock_acquire+0xd1/0x300
+[  223.426494]  ? copy_process+0x1718/0x2ad0
+[  223.426502]  ? srso_return_thunk+0x5/0x5f
+[  223.426510]  ? sched_clock_noinstr+0x9/0x10
+[  223.426519]  ? local_clock_noinstr+0xe/0xc0
+[  223.426528]  ? copy_process+0x1718/0x2ad0
+[  223.426537]  ? srso_return_thunk+0x5/0x5f
+[  223.426550]  copy_process+0x172f/0x2ad0
+[  223.426569]  kernel_clone+0x9c/0x3f0
+[  223.426577]  ? __schedule+0x4c9/0x1b00
+[  223.426586]  ? srso_return_thunk+0x5/0x5f
+[  223.426594]  ? sched_clock_noinstr+0x9/0x10
+[  223.426602]  ? srso_return_thunk+0x5/0x5f
+[  223.426610]  ? local_clock_noinstr+0xe/0xc0
+[  223.426619]  ? schedule+0x107/0x1a0
+[  223.426629]  __do_sys_clone+0x66/0x90
+[  223.426643]  __x64_sys_clone+0x25/0x30
+[  223.426652]  x64_sys_call+0x1d7c/0x20d0
+[  223.426661]  do_syscall_64+0x87/0x140
+[  223.426671]  ? srso_return_thunk+0x5/0x5f
+[  223.426679]  ? common_nsleep+0x44/0x50
+[  223.426690]  ? srso_return_thunk+0x5/0x5f
+[  223.426698]  ? trace_hardirqs_off+0x52/0xd0
+[  223.426709]  ? srso_return_thunk+0x5/0x5f
+[  223.426717]  ? syscall_exit_to_user_mode+0xcc/0x200
+[  223.426727]  ? srso_return_thunk+0x5/0x5f
+[  223.426736]  ? do_syscall_64+0x93/0x140
+[  223.426748]  ? srso_return_thunk+0x5/0x5f
+[  223.426756]  ? up_write+0x1c/0x1e0
+[  223.426765]  ? srso_return_thunk+0x5/0x5f
+[  223.426775]  ? srso_return_thunk+0x5/0x5f
+[  223.426783]  ? trace_hardirqs_off+0x52/0xd0
+[  223.426792]  ? srso_return_thunk+0x5/0x5f
+[  223.426800]  ? syscall_exit_to_user_mode+0xcc/0x200
+[  223.426810]  ? srso_return_thunk+0x5/0x5f
+[  223.426818]  ? do_syscall_64+0x93/0x140
+[  223.426826]  ? syscall_exit_to_user_mode+0xcc/0x200
+[  223.426836]  ? srso_return_thunk+0x5/0x5f
+[  223.426844]  ? do_syscall_64+0x93/0x140
+[  223.426853]  ? srso_return_thunk+0x5/0x5f
+[  223.426861]  ? irqentry_exit+0x6b/0x90
+[  223.426869]  ? srso_return_thunk+0x5/0x5f
+[  223.426877]  ? exc_page_fault+0xa7/0x2c0
+[  223.426888]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[  223.426898] RIP: 0033:0x7f46758eab57
+[  223.426906] Code: ba 04 00 f3 0f 1e fa 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 41 89 c0 85 c0 75 2c 64 48 8b 04 25 10 00
+[  223.426930] RSP: 002b:00007fff5c3e5188 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
+[  223.426943] RAX: ffffffffffffffda RBX: 00007f4675f8c040 RCX: 00007f46758eab57
+[  223.426954] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
+[  223.426965] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+[  223.426975] R10: 00007f4675e81a50 R11: 0000000000000246 R12: 0000000000000001
+[  223.426986] R13: 00007fff5c3e5470 R14: 00007fff5c3e53e0 R15: 00007fff5c3e5410
+[  223.427004]  </TASK>
+
+v2: To resolve this issue, the allocation of the process context buffer
+(`proc_ctx_bo`) has been moved from the `add_queue_mes` function to the
+`pqm_create_queue` function. This change ensures that the buffer is
+allocated only when the first queue for a process is created and only if
+the Micro Engine Scheduler (MES) is enabled. (Felix)
+
+v3: Fix typo s/Memory Execution Scheduler (MES)/Micro Engine Scheduler
+in commit message. (Lijo)
+
+Fixes: 438b39ac74e2 ("drm/amdkfd: pause autosuspend when creating pdd")
+Cc: Jesse Zhang <jesse.zhang@amd.com>
+Cc: Yunxiang Li <Yunxiang.Li@amd.com>
+Cc: Philip Yang <Philip.Yang@amd.com>
+Cc: Alex Sierra <alex.sierra@amd.com>
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/amdkfd/kfd_device_queue_manager.c    | 15 ---------------
+ .../drm/amd/amdkfd/kfd_process_queue_manager.c   | 16 ++++++++++++++++
+ 2 files changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 43fa260ddbcea..4d9a406925e18 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -197,21 +197,6 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q,
+ 	if (dqm->is_hws_hang)
+ 		return -EIO;
+ 
+-	if (!pdd->proc_ctx_cpu_ptr) {
+-		r = amdgpu_amdkfd_alloc_gtt_mem(adev,
+-				AMDGPU_MES_PROC_CTX_SIZE,
+-				&pdd->proc_ctx_bo,
+-				&pdd->proc_ctx_gpu_addr,
+-				&pdd->proc_ctx_cpu_ptr,
+-				false);
+-		if (r) {
+-			dev_err(adev->dev,
+-				"failed to allocate process context bo\n");
+-			return r;
+-		}
+-		memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
+-	}
+-
+ 	memset(&queue_input, 0x0, sizeof(struct mes_add_queue_input));
+ 	queue_input.process_id = qpd->pqm->process->pasid;
+ 	queue_input.page_table_base_addr =  qpd->page_table_base;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+index a02777694d995..e057c2bc7be42 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+@@ -329,10 +329,26 @@ int pqm_create_queue(struct process_queue_manager *pqm,
+ 	if (retval != 0)
+ 		return retval;
+ 
++	/* Register process if this is the first queue */
+ 	if (list_empty(&pdd->qpd.queues_list) &&
+ 	    list_empty(&pdd->qpd.priv_queue_list))
+ 		dev->dqm->ops.register_process(dev->dqm, &pdd->qpd);
+ 
++	/* Allocate proc_ctx_bo only if MES is enabled and this is the first queue */
++	if (!pdd->proc_ctx_cpu_ptr && dev->kfd->shared_resources.enable_mes) {
++		retval = amdgpu_amdkfd_alloc_gtt_mem(dev->adev,
++						     AMDGPU_MES_PROC_CTX_SIZE,
++						     &pdd->proc_ctx_bo,
++						     &pdd->proc_ctx_gpu_addr,
++						     &pdd->proc_ctx_cpu_ptr,
++						     false);
++		if (retval) {
++			dev_err(dev->adev->dev, "failed to allocate process context bo\n");
++			return retval;
++		}
++		memset(pdd->proc_ctx_cpu_ptr, 0, AMDGPU_MES_PROC_CTX_SIZE);
++	}
++
+ 	pqn = kzalloc(sizeof(*pqn), GFP_KERNEL);
+ 	if (!pqn) {
+ 		retval = -ENOMEM;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-bridge-it6505-fix-hdcp-v-match-check-is-not-perf.patch b/queue-6.6/drm-bridge-it6505-fix-hdcp-v-match-check-is-not-perf.patch
new file mode 100644
index 0000000000..d5db1a70b1
--- /dev/null
+++ b/queue-6.6/drm-bridge-it6505-fix-hdcp-v-match-check-is-not-perf.patch
@@ -0,0 +1,51 @@
+From d09479e2b90bd84b29ab4e3661cffe2b52a46286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 15:01:51 +0800
+Subject: drm/bridge: it6505: fix HDCP V match check is not performed correctly
+
+From: Hermes Wu <Hermes.wu@ite.com.tw>
+
+[ Upstream commit a5072fc77fb9e38fa9fd883642c83c3720049159 ]
+
+Fix a typo where V compare incorrectly compares av[] with av[] itself,
+which can result in HDCP failure.
+
+The loop of V compare is expected to iterate for 5 times
+which compare V array form av[0][] to av[4][].
+It should check loop counter reach the last statement "i == 5"
+before return true
+
+Fixes: 0989c02c7a5c ("drm/bridge: it6505: fix HDCP CTS compare V matching")
+Signed-off-by: Hermes Wu <Hermes.wu@ite.com.tw>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250121-fix-hdcp-v-comp-v4-1-185f45c728dc@ite.com.tw
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index fe33b988d7523..e094165e584a5 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -2039,12 +2039,13 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)
+ 			continue;
+ 		}
+ 
+-		for (i = 0; i < 5; i++) {
++		for (i = 0; i < 5; i++)
+ 			if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] ||
+-			    av[i][1] != av[i][2] || bv[i][0] != av[i][3])
++			    bv[i][1] != av[i][2] || bv[i][0] != av[i][3])
+ 				break;
+ 
+-			DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d, %d", retry, i);
++		if (i == 5) {
++			DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d", retry);
+ 			return true;
+ 		}
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-bridge-ti-sn65dsi86-fix-multiple-instances.patch b/queue-6.6/drm-bridge-ti-sn65dsi86-fix-multiple-instances.patch
new file mode 100644
index 0000000000..198433d055
--- /dev/null
+++ b/queue-6.6/drm-bridge-ti-sn65dsi86-fix-multiple-instances.patch
@@ -0,0 +1,52 @@
+From 5951fb82a43e7149647047bd4f1602c2a51856f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 15:18:46 +0100
+Subject: drm/bridge: ti-sn65dsi86: Fix multiple instances
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 574f5ee2c85a00a579549d50e9fc9c6c072ee4c4 ]
+
+Each bridge instance creates up to four auxiliary devices with different
+names.  However, their IDs are always zero, causing duplicate filename
+errors when a system has multiple bridges:
+
+    sysfs: cannot create duplicate filename '/bus/auxiliary/devices/ti_sn65dsi86.gpio.0'
+
+Fix this by using a unique instance ID per bridge instance.  The
+instance ID is derived from the I2C adapter number and the bridge's I2C
+address, to support multiple instances on the same bus.
+
+Fixes: bf73537f411b ("drm/bridge: ti-sn65dsi86: Break GPIO and MIPI-to-eDP bridge into sub-drivers")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/7a68a0e3f927e26edca6040067fb653eb06efb79.1733840089.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 3309c01fa7153..bfbd3fee12567 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -480,6 +480,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
+ 				       const char *name)
+ {
+ 	struct device *dev = pdata->dev;
++	const struct i2c_client *client = to_i2c_client(dev);
+ 	struct auxiliary_device *aux;
+ 	int ret;
+ 
+@@ -488,6 +489,7 @@ static int ti_sn65dsi86_add_aux_device(struct ti_sn65dsi86 *pdata,
+ 		return -ENOMEM;
+ 
+ 	aux->name = name;
++	aux->id = (client->adapter->nr << 10) | client->addr;
+ 	aux->dev.parent = dev;
+ 	aux->dev.release = ti_sn65dsi86_aux_device_release;
+ 	device_set_of_node_from_dev(&aux->dev, dev);
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-dp_mst-fix-drm-rad-print.patch b/queue-6.6/drm-dp_mst-fix-drm-rad-print.patch
new file mode 100644
index 0000000000..93a05a47b2
--- /dev/null
+++ b/queue-6.6/drm-dp_mst-fix-drm-rad-print.patch
@@ -0,0 +1,95 @@
+From 807a03f7c2a02f42c3796feb2bc4ad9880526dac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 17:10:59 +0800
+Subject: drm/dp_mst: Fix drm RAD print
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit 6bbce873a9c97cb12f5455c497be279ac58e707f ]
+
+[Why]
+The RAD of sideband message printed today is incorrect.
+For RAD stored within MST branch
+- If MST branch LCT is 1, it's RAD array is untouched and remained as 0.
+- If MST branch LCT is larger than 1, use nibble to store the up facing
+  port number in cascaded sequence as illustrated below:
+
+  u8 RAD[0] = (LCT_2_UFP << 4) | LCT_3_UFP
+     RAD[1] = (LCT_4_UFP << 4) | LCT_5_UFP
+     ...
+
+In drm_dp_mst_rad_to_str(), it wrongly to use BIT_MASK(4) to fetch the port
+number of one nibble.
+
+[How]
+Adjust the code by:
+- RAD array items are valuable only for LCT >= 1.
+- Use 0xF as the mask to replace BIT_MASK(4)
+
+V2:
+- Document how RAD is constructed (Imre)
+
+V3:
+- Adjust the comment for rad[] so kdoc formats it properly (Lyude)
+
+Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests")
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Harry Wentland <hwentlan@amd.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250113091100.3314533-2-Wayne.Lin@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 8 ++++----
+ include/drm/display/drm_dp_mst_helper.h       | 7 +++++++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 71a30387ca125..21ff7ef7ce920 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -178,13 +178,13 @@ static int
+ drm_dp_mst_rad_to_str(const u8 rad[8], u8 lct, char *out, size_t len)
+ {
+ 	int i;
+-	u8 unpacked_rad[16];
++	u8 unpacked_rad[16] = {};
+ 
+-	for (i = 0; i < lct; i++) {
++	for (i = 1; i < lct; i++) {
+ 		if (i % 2)
+-			unpacked_rad[i] = rad[i / 2] >> 4;
++			unpacked_rad[i] = rad[(i - 1) / 2] >> 4;
+ 		else
+-			unpacked_rad[i] = rad[i / 2] & BIT_MASK(4);
++			unpacked_rad[i] = rad[(i - 1) / 2] & 0xF;
+ 	}
+ 
+ 	/* TODO: Eventually add something to printk so we can format the rad
+diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h
+index 46705dacdd081..7751be9452c15 100644
+--- a/include/drm/display/drm_dp_mst_helper.h
++++ b/include/drm/display/drm_dp_mst_helper.h
+@@ -215,6 +215,13 @@ struct drm_dp_mst_branch {
+ 	 */
+ 	struct list_head destroy_next;
+ 
++	/**
++	 * @rad: Relative Address of the MST branch.
++	 * For &drm_dp_mst_topology_mgr.mst_primary, it's rad[8] are all 0,
++	 * unset and unused. For MST branches connected after mst_primary,
++	 * in each element of rad[] the nibbles are ordered by the most
++	 * signifcant 4 bits first and the least significant 4 bits second.
++	 */
+ 	u8 rad[8];
+ 	u8 lct;
+ 	int num_ports;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-mediatek-dp-drm_err-dev_err-in-hpd-path-to-avoid.patch b/queue-6.6/drm-mediatek-dp-drm_err-dev_err-in-hpd-path-to-avoid.patch
new file mode 100644
index 0000000000..763ab97da0
--- /dev/null
+++ b/queue-6.6/drm-mediatek-dp-drm_err-dev_err-in-hpd-path-to-avoid.patch
@@ -0,0 +1,69 @@
+From 2baded1bbd97b1943c497dbffab1aa9cd596b223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 09:42:50 -0800
+Subject: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ]
+
+The function mtk_dp_wait_hpd_asserted() may be called before the
+`mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach().
+Specifically it can be called via this callpath:
+ - mtk_edp_wait_hpd_asserted
+ - [panel probe]
+ - dp_aux_ep_probe
+
+Using "drm" level prints anywhere in this callpath causes a NULL
+pointer dereference. Change the error message directly in
+mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the
+error messages in mtk_dp_parse_capabilities(), which is called by
+mtk_dp_wait_hpd_asserted().
+
+While touching these prints, also add the error code to them to make
+future debugging easier.
+
+Fixes: 7eacba9a083b ("drm/mediatek: dp: Add .wait_hpd_asserted() for AUX bus")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20250116094249.1.I29b0b621abb613ddc70ab4996426a3909e1aa75f@changeid/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index be4de26c77f91..199527643093a 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -1648,7 +1648,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp)
+ 
+ 	ret = drm_dp_dpcd_readb(&mtk_dp->aux, DP_MSTM_CAP, &val);
+ 	if (ret < 1) {
+-		drm_err(mtk_dp->drm_dev, "Read mstm cap failed\n");
++		dev_err(mtk_dp->dev, "Read mstm cap failed: %zd\n", ret);
+ 		return ret == 0 ? -EIO : ret;
+ 	}
+ 
+@@ -1658,7 +1658,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp)
+ 					DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0,
+ 					&val);
+ 		if (ret < 1) {
+-			drm_err(mtk_dp->drm_dev, "Read irq vector failed\n");
++			dev_err(mtk_dp->dev, "Read irq vector failed: %zd\n", ret);
+ 			return ret == 0 ? -EIO : ret;
+ 		}
+ 
+@@ -1941,7 +1941,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa
+ 
+ 	ret = mtk_dp_parse_capabilities(mtk_dp);
+ 	if (ret) {
+-		drm_err(mtk_dp->drm_dev, "Can't parse capabilities\n");
++		dev_err(mtk_dp->dev, "Can't parse capabilities: %d\n", ret);
+ 		return ret;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-mediatek-dsi-fix-error-codes-in-mtk_dsi_host_tra.patch b/queue-6.6/drm-mediatek-dsi-fix-error-codes-in-mtk_dsi_host_tra.patch
new file mode 100644
index 0000000000..79201ff98d
--- /dev/null
+++ b/queue-6.6/drm-mediatek-dsi-fix-error-codes-in-mtk_dsi_host_tra.patch
@@ -0,0 +1,64 @@
+From db3e544a38e11e0c8fa2115b94d647aaf4c98b7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 12:35:57 +0300
+Subject: drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit dcb166ee43c3d594e7b73a24f6e8cf5663eeff2c ]
+
+There is a type bug because the return statement:
+
+        return ret < 0 ? ret : recv_cnt;
+
+The issue is that ret is an int, recv_cnt is a u32 and the function
+returns ssize_t, which is a signed long.  The way that the type promotion
+works is that the negative error codes are first cast to u32 and then
+to signed long.  The error codes end up being positive instead of
+negative and the callers treat them as success.
+
+Fixes: 81cc7e51c4f1 ("drm/mediatek: Allow commands to be sent during video mode")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202412210801.iADw0oIH-lkp@intel.com/
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/b754a408-4f39-4e37-b52d-7706c132e27f@stanley.mountain/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 0d96264ec5c6d..f154b3a7c2c2d 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -1016,12 +1016,12 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
+ 				     const struct mipi_dsi_msg *msg)
+ {
+ 	struct mtk_dsi *dsi = host_to_dsi(host);
+-	u32 recv_cnt, i;
++	ssize_t recv_cnt;
+ 	u8 read_data[16];
+ 	void *src_addr;
+ 	u8 irq_flag = CMD_DONE_INT_FLAG;
+ 	u32 dsi_mode;
+-	int ret;
++	int ret, i;
+ 
+ 	dsi_mode = readl(dsi->regs + DSI_MODE_CTRL);
+ 	if (dsi_mode & MODE) {
+@@ -1070,7 +1070,7 @@ static ssize_t mtk_dsi_host_transfer(struct mipi_dsi_host *host,
+ 	if (recv_cnt)
+ 		memcpy(msg->rx_buf, src_addr, recv_cnt);
+ 
+-	DRM_INFO("dsi get %d byte data from the panel address(0x%x)\n",
++	DRM_INFO("dsi get %zd byte data from the panel address(0x%x)\n",
+ 		 recv_cnt, *((u8 *)(msg->tx_buf)));
+ 
+ restore_dsi_mode:
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-mediatek-mtk_hdmi-fix-typo-for-aud_sampe_size-me.patch b/queue-6.6/drm-mediatek-mtk_hdmi-fix-typo-for-aud_sampe_size-me.patch
new file mode 100644
index 0000000000..e6da1c09e6
--- /dev/null
+++ b/queue-6.6/drm-mediatek-mtk_hdmi-fix-typo-for-aud_sampe_size-me.patch
@@ -0,0 +1,66 @@
+From 197ee86ff100c126724e4bda1bb2d5c15afa58ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 16:48:12 +0100
+Subject: drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 72fcb88e7bbc053ed4fc74cebb0315b98a0f20c3 ]
+
+Rename member aud_sampe_size of struct hdmi_audio_param to
+aud_sample_size to fix a typo and enhance readability.
+
+This commit brings no functional changes.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250217154836.108895-20-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index cff5ed3802413..68d0b65ef783a 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -137,7 +137,7 @@ enum hdmi_aud_channel_swap_type {
+ 
+ struct hdmi_audio_param {
+ 	enum hdmi_audio_coding_type aud_codec;
+-	enum hdmi_audio_sample_size aud_sampe_size;
++	enum hdmi_audio_sample_size aud_sample_size;
+ 	enum hdmi_aud_input_type aud_input_type;
+ 	enum hdmi_aud_i2s_fmt aud_i2s_fmt;
+ 	enum hdmi_aud_mclk aud_mclk;
+@@ -1075,7 +1075,7 @@ static int mtk_hdmi_output_init(struct mtk_hdmi *hdmi)
+ 
+ 	hdmi->csp = HDMI_COLORSPACE_RGB;
+ 	aud_param->aud_codec = HDMI_AUDIO_CODING_TYPE_PCM;
+-	aud_param->aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16;
++	aud_param->aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16;
+ 	aud_param->aud_input_type = HDMI_AUD_INPUT_I2S;
+ 	aud_param->aud_i2s_fmt = HDMI_I2S_MODE_I2S_24BIT;
+ 	aud_param->aud_mclk = HDMI_AUD_MCLK_128FS;
+@@ -1576,14 +1576,14 @@ static int mtk_hdmi_audio_hw_params(struct device *dev, void *data,
+ 	switch (daifmt->fmt) {
+ 	case HDMI_I2S:
+ 		hdmi_params.aud_codec = HDMI_AUDIO_CODING_TYPE_PCM;
+-		hdmi_params.aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16;
++		hdmi_params.aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16;
+ 		hdmi_params.aud_input_type = HDMI_AUD_INPUT_I2S;
+ 		hdmi_params.aud_i2s_fmt = HDMI_I2S_MODE_I2S_24BIT;
+ 		hdmi_params.aud_mclk = HDMI_AUD_MCLK_128FS;
+ 		break;
+ 	case HDMI_SPDIF:
+ 		hdmi_params.aud_codec = HDMI_AUDIO_CODING_TYPE_PCM;
+-		hdmi_params.aud_sampe_size = HDMI_AUDIO_SAMPLE_SIZE_16;
++		hdmi_params.aud_sample_size = HDMI_AUDIO_SAMPLE_SIZE_16;
+ 		hdmi_params.aud_input_type = HDMI_AUD_INPUT_SPDIF;
+ 		break;
+ 	default:
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-mediatek-mtk_hdmi-unregister-audio-platform-devi.patch b/queue-6.6/drm-mediatek-mtk_hdmi-unregister-audio-platform-devi.patch
new file mode 100644
index 0000000000..56735a627e
--- /dev/null
+++ b/queue-6.6/drm-mediatek-mtk_hdmi-unregister-audio-platform-devi.patch
@@ -0,0 +1,85 @@
+From 500b924abe13d389638731430919a1451c248bcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 16:48:10 +0100
+Subject: drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 0be123cafc06eed0fd1227166a66e786434b0c50 ]
+
+The probe function of this driver may fail after registering the
+audio platform device: in that case, the state is not getting
+cleaned up, leaving this device registered.
+
+Adding up to the mix, should the probe function of this driver
+return a probe deferral for N times, we're registering up to N
+audio platform devices and, again, never freeing them up.
+
+To fix this, add a pointer to the audio platform device in the
+mtk_hdmi structure, and add a devm action to unregister it upon
+driver removal or probe failure.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250217154836.108895-18-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 86133bf16326b..cff5ed3802413 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -173,6 +173,7 @@ struct mtk_hdmi {
+ 	unsigned int sys_offset;
+ 	void __iomem *regs;
+ 	enum hdmi_colorspace csp;
++	struct platform_device *audio_pdev;
+ 	struct hdmi_audio_param aud_param;
+ 	bool audio_enable;
+ 	bool powered;
+@@ -1666,6 +1667,11 @@ static const struct hdmi_codec_ops mtk_hdmi_audio_codec_ops = {
+ 	.no_capture_mute = 1,
+ };
+ 
++static void mtk_hdmi_unregister_audio_driver(void *data)
++{
++	platform_device_unregister(data);
++}
++
+ static int mtk_hdmi_register_audio_driver(struct device *dev)
+ {
+ 	struct mtk_hdmi *hdmi = dev_get_drvdata(dev);
+@@ -1675,13 +1681,20 @@ static int mtk_hdmi_register_audio_driver(struct device *dev)
+ 		.i2s = 1,
+ 		.data = hdmi,
+ 	};
+-	struct platform_device *pdev;
++	int ret;
+ 
+-	pdev = platform_device_register_data(dev, HDMI_CODEC_DRV_NAME,
+-					     PLATFORM_DEVID_AUTO, &codec_data,
+-					     sizeof(codec_data));
+-	if (IS_ERR(pdev))
+-		return PTR_ERR(pdev);
++	hdmi->audio_pdev = platform_device_register_data(dev,
++							 HDMI_CODEC_DRV_NAME,
++							 PLATFORM_DEVID_AUTO,
++							 &codec_data,
++							 sizeof(codec_data));
++	if (IS_ERR(hdmi->audio_pdev))
++		return PTR_ERR(hdmi->audio_pdev);
++
++	ret = devm_add_action_or_reset(dev, mtk_hdmi_unregister_audio_driver,
++				       hdmi->audio_pdev);
++	if (ret)
++		return ret;
+ 
+ 	DRM_INFO("%s driver bound to HDMI\n", HDMI_CODEC_DRV_NAME);
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-msm-dpu-don-t-use-active-in-atomic_check.patch b/queue-6.6/drm-msm-dpu-don-t-use-active-in-atomic_check.patch
new file mode 100644
index 0000000000..51d9eff1ec
--- /dev/null
+++ b/queue-6.6/drm-msm-dpu-don-t-use-active-in-atomic_check.patch
@@ -0,0 +1,65 @@
+From e1b654f9a8b0cd763de18d2720530c71c622530d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2025 14:43:33 +0200
+Subject: drm/msm/dpu: don't use active in atomic_check()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 25b4614843bcc56ba150f7c99905125a019e656c ]
+
+The driver isn't supposed to consult crtc_state->active/active_check for
+resource allocation. Instead all resources should be allocated if
+crtc_state->enabled is set. Stop consulting active / active_changed in
+order to determine whether the hardware resources should be
+(re)allocated.
+
+Fixes: ccc862b957c6 ("drm/msm/dpu: Fix reservation failures in modeset")
+Reported-by: Simona Vetter <simona.vetter@ffwll.ch>
+Closes: https://lore.kernel.org/dri-devel/ZtW_S0j5AEr4g0QW@phenom.ffwll.local/
+Reviewed-by: Simona Vetter <simona.vetter@ffwll.ch>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/633393/
+Link: https://lore.kernel.org/r/20250123-drm-dirty-modeset-v2-1-bbfd3a6cd1a4@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c    | 4 ----
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +--
+ 2 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index ad57368dc13f0..2df1e6293062d 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1210,10 +1210,6 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc,
+ 
+ 	DRM_DEBUG_ATOMIC("%s: check\n", dpu_crtc->name);
+ 
+-	/* force a full mode set if active state changed */
+-	if (crtc_state->active_changed)
+-		crtc_state->mode_changed = true;
+-
+ 	if (cstate->num_mixers) {
+ 		rc = _dpu_crtc_check_and_setup_lm_bounds(crtc, crtc_state);
+ 		if (rc)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 35cf9080168b1..99cccde5d2216 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -669,12 +669,11 @@ static int dpu_encoder_virt_atomic_check(
+ 
+ 	/*
+ 	 * Release and Allocate resources on every modeset
+-	 * Dont allocate when active is false.
+ 	 */
+ 	if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+ 		dpu_rm_release(global_state, drm_enc);
+ 
+-		if (!crtc_state->active_changed || crtc_state->enable)
++		if (crtc_state->enable)
+ 			ret = dpu_rm_reserve(&dpu_kms->rm, global_state,
+ 					drm_enc, crtc_state, topology);
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-msm-dsi-set-phy-usescase-and-mode-before-registe.patch b/queue-6.6/drm-msm-dsi-set-phy-usescase-and-mode-before-registe.patch
new file mode 100644
index 0000000000..242e197747
--- /dev/null
+++ b/queue-6.6/drm-msm-dsi-set-phy-usescase-and-mode-before-registe.patch
@@ -0,0 +1,102 @@
+From f1f8fba309cf1c9d93b6afcf5c2756e5d9ad7029 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 12:17:42 +0100
+Subject: drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 660c396c98c061f9696bebacc178b74072e80054 ]
+
+Ordering issues here cause an uninitialized (default STANDALONE)
+usecase to be programmed (which appears to be a MUX) in some cases
+when msm_dsi_host_register() is called, leading to the slave PLL in
+bonded-DSI mode to source from a clock parent (dsi1vco) that is off.
+
+This should seemingly not be a problem as the actual dispcc clocks from
+DSI1 that are muxed in the clock tree of DSI0 are way further down, this
+bit still seems to have an effect on them somehow and causes the right
+side of the panel controlled by DSI1 to not function.
+
+In an ideal world this code is refactored to no longer have such
+error-prone calls "across subsystems", and instead model the "PLL src"
+register field as a regular mux so that changing the clock parents
+programmatically or in DTS via `assigned-clock-parents` has the
+desired effect.
+But for the avid reader, the clocks that we *are* muxing into DSI0's
+tree are way further down, so if this bit turns out to be a simple mux
+between dsiXvco and out_div, that shouldn't have any effect as this
+whole tree is off anyway.
+
+Fixes: 57bf43389337 ("drm/msm/dsi: Pass down use case to PHY")
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Patchwork: https://patchwork.freedesktop.org/patch/637650/
+Link: https://lore.kernel.org/r/20250217-drm-msm-initial-dualpipe-dsc-fixes-v3-2-913100d6103f@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_manager.c | 32 ++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+index 28b8012a21f2b..1a75f9c18c24b 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+@@ -74,17 +74,35 @@ static int dsi_mgr_setup_components(int id)
+ 	int ret;
+ 
+ 	if (!IS_BONDED_DSI()) {
++		/*
++		 * Set the usecase before calling msm_dsi_host_register(), which would
++		 * already program the PLL source mux based on a default usecase.
++		 */
++		msm_dsi_phy_set_usecase(msm_dsi->phy, MSM_DSI_PHY_STANDALONE);
++		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
++
+ 		ret = msm_dsi_host_register(msm_dsi->host);
+ 		if (ret)
+ 			return ret;
+-
+-		msm_dsi_phy_set_usecase(msm_dsi->phy, MSM_DSI_PHY_STANDALONE);
+-		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
+ 	} else if (other_dsi) {
+ 		struct msm_dsi *master_link_dsi = IS_MASTER_DSI_LINK(id) ?
+ 							msm_dsi : other_dsi;
+ 		struct msm_dsi *slave_link_dsi = IS_MASTER_DSI_LINK(id) ?
+ 							other_dsi : msm_dsi;
++
++		/*
++		 * PLL0 is to drive both DSI link clocks in bonded DSI mode.
++		 *
++		 * Set the usecase before calling msm_dsi_host_register(), which would
++		 * already program the PLL source mux based on a default usecase.
++		 */
++		msm_dsi_phy_set_usecase(clk_master_dsi->phy,
++					MSM_DSI_PHY_MASTER);
++		msm_dsi_phy_set_usecase(clk_slave_dsi->phy,
++					MSM_DSI_PHY_SLAVE);
++		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
++		msm_dsi_host_set_phy_mode(other_dsi->host, other_dsi->phy);
++
+ 		/* Register slave host first, so that slave DSI device
+ 		 * has a chance to probe, and do not block the master
+ 		 * DSI device's probe.
+@@ -98,14 +116,6 @@ static int dsi_mgr_setup_components(int id)
+ 		ret = msm_dsi_host_register(master_link_dsi->host);
+ 		if (ret)
+ 			return ret;
+-
+-		/* PLL0 is to drive both 2 DSI link clocks in bonded DSI mode. */
+-		msm_dsi_phy_set_usecase(clk_master_dsi->phy,
+-					MSM_DSI_PHY_MASTER);
+-		msm_dsi_phy_set_usecase(clk_slave_dsi->phy,
+-					MSM_DSI_PHY_SLAVE);
+-		msm_dsi_host_set_phy_mode(msm_dsi->host, msm_dsi->phy);
+-		msm_dsi_host_set_phy_mode(other_dsi->host, other_dsi->phy);
+ 	}
+ 
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-msm-dsi-use-existing-per-interface-slice-count-i.patch b/queue-6.6/drm-msm-dsi-use-existing-per-interface-slice-count-i.patch
new file mode 100644
index 0000000000..df6997923c
--- /dev/null
+++ b/queue-6.6/drm-msm-dsi-use-existing-per-interface-slice-count-i.patch
@@ -0,0 +1,107 @@
+From 1afda15d85e460e1d8c42044d04e43498d14d582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 12:17:41 +0100
+Subject: drm/msm/dsi: Use existing per-interface slice count in DSC timing
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 14ad809ceb66d0874cbe4bd5ca9edf0de8d9ad96 ]
+
+When configuring the timing of DSI hosts (interfaces) in
+dsi_timing_setup() all values written to registers are taking
+bonded-mode into account by dividing the original mode width by 2
+(half the data is sent over each of the two DSI hosts), but the full
+width instead of the interface width is passed as hdisplay parameter to
+dsi_update_dsc_timing().
+
+Currently only msm_dsc_get_slices_per_intf() is called within
+dsi_update_dsc_timing() with the `hdisplay` argument which clearly
+documents that it wants the width of a single interface (which, again,
+in bonded DSI mode is half the total width of the mode) resulting in all
+subsequent values to be completely off.
+
+However, as soon as we start to pass the halved hdisplay
+into dsi_update_dsc_timing() we might as well discard
+msm_dsc_get_slices_per_intf() since the value it calculates is already
+available in dsc->slice_count which is per-interface by the current
+design of MSM DPU/DSI implementations and their use of the DRM DSC
+helpers.
+
+Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Patchwork: https://patchwork.freedesktop.org/patch/637648/
+Link: https://lore.kernel.org/r/20250217-drm-msm-initial-dualpipe-dsc-fixes-v3-1-913100d6103f@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c   |  8 ++++----
+ drivers/gpu/drm/msm/msm_dsc_helper.h | 11 -----------
+ 2 files changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index f920329fe2e09..f90ccdfbb2fc7 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -825,7 +825,7 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host,
+ 		dsi_write(msm_host, REG_DSI_CPHY_MODE_CTRL, BIT(0));
+ }
+ 
+-static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mode, u32 hdisplay)
++static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mode)
+ {
+ 	struct drm_dsc_config *dsc = msm_host->dsc;
+ 	u32 reg, reg_ctrl, reg_ctrl2;
+@@ -837,7 +837,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod
+ 	/* first calculate dsc parameters and then program
+ 	 * compress mode registers
+ 	 */
+-	slice_per_intf = msm_dsc_get_slices_per_intf(dsc, hdisplay);
++	slice_per_intf = dsc->slice_count;
+ 
+ 	total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf;
+ 	bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */
+@@ -948,7 +948,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+ 
+ 	if (msm_host->mode_flags & MIPI_DSI_MODE_VIDEO) {
+ 		if (msm_host->dsc)
+-			dsi_update_dsc_timing(msm_host, false, mode->hdisplay);
++			dsi_update_dsc_timing(msm_host, false);
+ 
+ 		dsi_write(msm_host, REG_DSI_ACTIVE_H,
+ 			DSI_ACTIVE_H_START(ha_start) |
+@@ -969,7 +969,7 @@ static void dsi_timing_setup(struct msm_dsi_host *msm_host, bool is_bonded_dsi)
+ 			DSI_ACTIVE_VSYNC_VPOS_END(vs_end));
+ 	} else {		/* command mode */
+ 		if (msm_host->dsc)
+-			dsi_update_dsc_timing(msm_host, true, mode->hdisplay);
++			dsi_update_dsc_timing(msm_host, true);
+ 
+ 		/* image data and 1 byte write_memory_start cmd */
+ 		if (!msm_host->dsc)
+diff --git a/drivers/gpu/drm/msm/msm_dsc_helper.h b/drivers/gpu/drm/msm/msm_dsc_helper.h
+index b9049fe1e2790..63f95523b2cbb 100644
+--- a/drivers/gpu/drm/msm/msm_dsc_helper.h
++++ b/drivers/gpu/drm/msm/msm_dsc_helper.h
+@@ -12,17 +12,6 @@
+ #include <linux/math.h>
+ #include <drm/display/drm_dsc_helper.h>
+ 
+-/**
+- * msm_dsc_get_slices_per_intf() - calculate number of slices per interface
+- * @dsc: Pointer to drm dsc config struct
+- * @intf_width: interface width in pixels
+- * Returns: Integer representing the number of slices for the given interface
+- */
+-static inline u32 msm_dsc_get_slices_per_intf(const struct drm_dsc_config *dsc, u32 intf_width)
+-{
+-	return DIV_ROUND_UP(intf_width, dsc->slice_width);
+-}
+-
+ /**
+  * msm_dsc_get_bytes_per_line() - calculate bytes per line
+  * @dsc: Pointer to drm dsc config struct
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-vkms-fix-use-after-free-and-double-free-on-init-.patch b/queue-6.6/drm-vkms-fix-use-after-free-and-double-free-on-init-.patch
new file mode 100644
index 0000000000..d11be34519
--- /dev/null
+++ b/queue-6.6/drm-vkms-fix-use-after-free-and-double-free-on-init-.patch
@@ -0,0 +1,76 @@
+From 669b6c49f4eab383ca373331e0da6d34ad7ed1cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 09:49:12 +0100
+Subject: drm/vkms: Fix use after free and double free on init error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit ed15511a773df86205bda66c37193569575ae828 ]
+
+If the driver initialization fails, the vkms_exit() function might
+access an uninitialized or freed default_config pointer and it might
+double free it.
+
+Fix both possible errors by initializing default_config only when the
+driver initialization succeeded.
+
+Reported-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Closes: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
+Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Reviewed-by: Thomas Zimmermann <tzimmremann@suse.de>
+Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250212084912.3196-1-jose.exposito89@gmail.com
+Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
+index dd0af086e7fa9..25db36ec06d49 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -243,17 +243,19 @@ static int __init vkms_init(void)
+ 	if (!config)
+ 		return -ENOMEM;
+ 
+-	default_config = config;
+-
+ 	config->cursor = enable_cursor;
+ 	config->writeback = enable_writeback;
+ 	config->overlay = enable_overlay;
+ 
+ 	ret = vkms_create(config);
+-	if (ret)
++	if (ret) {
+ 		kfree(config);
++		return ret;
++	}
+ 
+-	return ret;
++	default_config = config;
++
++	return 0;
+ }
+ 
+ static void vkms_destroy(struct vkms_config *config)
+@@ -277,9 +279,10 @@ static void vkms_destroy(struct vkms_config *config)
+ 
+ static void __exit vkms_exit(void)
+ {
+-	if (default_config->dev)
+-		vkms_destroy(default_config);
++	if (!default_config)
++		return;
+ 
++	vkms_destroy(default_config);
+ 	kfree(default_config);
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/drm-xlnx-zynqmp-fix-max-dma-segment-size.patch b/queue-6.6/drm-xlnx-zynqmp-fix-max-dma-segment-size.patch
new file mode 100644
index 0000000000..e5a3a37779
--- /dev/null
+++ b/queue-6.6/drm-xlnx-zynqmp-fix-max-dma-segment-size.patch
@@ -0,0 +1,38 @@
+From 52db1999ebbb8ca81a50ebd8a0f991573298d40e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 11:03:39 +0200
+Subject: drm: xlnx: zynqmp: Fix max dma segment size
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 28b529a98525123acd37372a04d21e87ec2edcf7 ]
+
+Fix "mapping sg segment longer than device claims to support" warning by
+setting the max segment size.
+
+Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Tested-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250115-xilinx-formats-v2-10-160327ca652a@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+index f5781939de9c3..a25b22238e3d2 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+@@ -231,6 +231,8 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return ret;
+ 
++	dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
++
+ 	/* Try the reserved memory. Proceed if there's none. */
+ 	of_reserved_mem_device_init(&pdev->dev);
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/dt-bindings-vendor-prefixes-add-gocontroll.patch b/queue-6.6/dt-bindings-vendor-prefixes-add-gocontroll.patch
new file mode 100644
index 0000000000..db25cc9b5d
--- /dev/null
+++ b/queue-6.6/dt-bindings-vendor-prefixes-add-gocontroll.patch
@@ -0,0 +1,37 @@
+From dcc712a5191e04e5743bdf8314e60e4fbbc4af6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 15:19:13 +0100
+Subject: dt-bindings: vendor-prefixes: add GOcontroll
+
+From: Maud Spierings <maudspierings@gocontroll.com>
+
+[ Upstream commit 5f0d2de417166698c8eba433b696037ce04730da ]
+
+GOcontroll produces embedded linux systems and IO modules to use in
+these systems, add its prefix.
+
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
+Link: https://patch.msgid.link/20250226-initial_display-v2-2-23fafa130817@gocontroll.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+index 12a16031d7b6d..dc275ab60e534 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -524,6 +524,8 @@ patternProperties:
+     description: GlobalTop Technology, Inc.
+   "^gmt,.*":
+     description: Global Mixed-mode Technology, Inc.
++  "^gocontroll,.*":
++    description: GOcontroll Modular Embedded Electronics B.V.
+   "^goldelico,.*":
+     description: Golden Delicious Computers GmbH & Co. KG
+   "^goodix,.*":
+-- 
+2.39.5
+
diff --git a/queue-6.6/e1000e-change-k1-configuration-on-mtp-and-later-plat.patch b/queue-6.6/e1000e-change-k1-configuration-on-mtp-and-later-plat.patch
new file mode 100644
index 0000000000..11d4de5bc6
--- /dev/null
+++ b/queue-6.6/e1000e-change-k1-configuration-on-mtp-and-later-plat.patch
@@ -0,0 +1,178 @@
+From 1a65339eb433569af8e5e18690c8531d54358949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 16:05:56 +0200
+Subject: e1000e: change k1 configuration on MTP and later platforms
+
+From: Vitaly Lifshits <vitaly.lifshits@intel.com>
+
+[ Upstream commit efaaf344bc2917cbfa5997633bc18a05d3aed27f ]
+
+Starting from Meteor Lake, the Kumeran interface between the integrated
+MAC and the I219 PHY works at a different frequency. This causes sporadic
+MDI errors when accessing the PHY, and in rare circumstances could lead
+to packet corruption.
+
+To overcome this, introduce minor changes to the Kumeran idle
+state (K1) parameters during device initialization. Hardware reset
+reverts this configuration, therefore it needs to be applied in a few
+places.
+
+Fixes: cc23f4f0b6b9 ("e1000e: Add support for Meteor Lake")
+Signed-off-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/defines.h |  3 +
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 80 +++++++++++++++++++--
+ drivers/net/ethernet/intel/e1000e/ich8lan.h |  4 ++
+ 3 files changed, 82 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
+index 63c3c79380a1b..0a35d36c2c857 100644
+--- a/drivers/net/ethernet/intel/e1000e/defines.h
++++ b/drivers/net/ethernet/intel/e1000e/defines.h
+@@ -808,4 +808,7 @@
+ /* SerDes Control */
+ #define E1000_GEN_POLL_TIMEOUT          640
+ 
++#define E1000_FEXTNVM12_PHYPD_CTRL_MASK	0x00C00000
++#define E1000_FEXTNVM12_PHYPD_CTRL_P1	0x00800000
++
+ #endif /* _E1000_DEFINES_H_ */
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 2f9655cf5dd9e..364378133526a 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -285,6 +285,45 @@ static void e1000_toggle_lanphypc_pch_lpt(struct e1000_hw *hw)
+ 	}
+ }
+ 
++/**
++ * e1000_reconfigure_k1_exit_timeout - reconfigure K1 exit timeout to
++ * align to MTP and later platform requirements.
++ * @hw: pointer to the HW structure
++ *
++ * Context: PHY semaphore must be held by caller.
++ * Return: 0 on success, negative on failure
++ */
++static s32 e1000_reconfigure_k1_exit_timeout(struct e1000_hw *hw)
++{
++	u16 phy_timeout;
++	u32 fextnvm12;
++	s32 ret_val;
++
++	if (hw->mac.type < e1000_pch_mtp)
++		return 0;
++
++	/* Change Kumeran K1 power down state from P0s to P1 */
++	fextnvm12 = er32(FEXTNVM12);
++	fextnvm12 &= ~E1000_FEXTNVM12_PHYPD_CTRL_MASK;
++	fextnvm12 |= E1000_FEXTNVM12_PHYPD_CTRL_P1;
++	ew32(FEXTNVM12, fextnvm12);
++
++	/* Wait for the interface the settle */
++	usleep_range(1000, 1100);
++
++	/* Change K1 exit timeout */
++	ret_val = e1e_rphy_locked(hw, I217_PHY_TIMEOUTS_REG,
++				  &phy_timeout);
++	if (ret_val)
++		return ret_val;
++
++	phy_timeout &= ~I217_PHY_TIMEOUTS_K1_EXIT_TO_MASK;
++	phy_timeout |= 0xF00;
++
++	return e1e_wphy_locked(hw, I217_PHY_TIMEOUTS_REG,
++				  phy_timeout);
++}
++
+ /**
+  *  e1000_init_phy_workarounds_pchlan - PHY initialization workarounds
+  *  @hw: pointer to the HW structure
+@@ -327,15 +366,22 @@ static s32 e1000_init_phy_workarounds_pchlan(struct e1000_hw *hw)
+ 	 * LANPHYPC Value bit to force the interconnect to PCIe mode.
+ 	 */
+ 	switch (hw->mac.type) {
++	case e1000_pch_mtp:
++	case e1000_pch_lnp:
++	case e1000_pch_ptp:
++	case e1000_pch_nvp:
++		/* At this point the PHY might be inaccessible so don't
++		 * propagate the failure
++		 */
++		if (e1000_reconfigure_k1_exit_timeout(hw))
++			e_dbg("Failed to reconfigure K1 exit timeout\n");
++
++		fallthrough;
+ 	case e1000_pch_lpt:
+ 	case e1000_pch_spt:
+ 	case e1000_pch_cnp:
+ 	case e1000_pch_tgp:
+ 	case e1000_pch_adp:
+-	case e1000_pch_mtp:
+-	case e1000_pch_lnp:
+-	case e1000_pch_ptp:
+-	case e1000_pch_nvp:
+ 		if (e1000_phy_is_accessible_pchlan(hw))
+ 			break;
+ 
+@@ -419,8 +465,20 @@ static s32 e1000_init_phy_workarounds_pchlan(struct e1000_hw *hw)
+ 		 *  the PHY is in.
+ 		 */
+ 		ret_val = hw->phy.ops.check_reset_block(hw);
+-		if (ret_val)
++		if (ret_val) {
+ 			e_err("ME blocked access to PHY after reset\n");
++			goto out;
++		}
++
++		if (hw->mac.type >= e1000_pch_mtp) {
++			ret_val = hw->phy.ops.acquire(hw);
++			if (ret_val) {
++				e_err("Failed to reconfigure K1 exit timeout\n");
++				goto out;
++			}
++			ret_val = e1000_reconfigure_k1_exit_timeout(hw);
++			hw->phy.ops.release(hw);
++		}
+ 	}
+ 
+ out:
+@@ -4888,6 +4946,18 @@ static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
+ 	u16 i;
+ 
+ 	e1000_initialize_hw_bits_ich8lan(hw);
++	if (hw->mac.type >= e1000_pch_mtp) {
++		ret_val = hw->phy.ops.acquire(hw);
++		if (ret_val)
++			return ret_val;
++
++		ret_val = e1000_reconfigure_k1_exit_timeout(hw);
++		hw->phy.ops.release(hw);
++		if (ret_val) {
++			e_dbg("Error failed to reconfigure K1 exit timeout\n");
++			return ret_val;
++		}
++	}
+ 
+ 	/* Initialize identification LED */
+ 	ret_val = mac->ops.id_led_init(hw);
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index 2504b11c3169f..5feb589a9b5ff 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -219,6 +219,10 @@
+ #define I217_PLL_CLOCK_GATE_REG	PHY_REG(772, 28)
+ #define I217_PLL_CLOCK_GATE_MASK	0x07FF
+ 
++/* PHY Timeouts */
++#define I217_PHY_TIMEOUTS_REG                   PHY_REG(770, 21)
++#define I217_PHY_TIMEOUTS_K1_EXIT_TO_MASK       0x0FC0
++
+ #define SW_FLAG_TIMEOUT		1000	/* SW Semaphore flag timeout in ms */
+ 
+ /* Inband Control */
+-- 
+2.39.5
+
diff --git a/queue-6.6/edac-ie31200-fix-the-dimm-size-mask-for-several-socs.patch b/queue-6.6/edac-ie31200-fix-the-dimm-size-mask-for-several-socs.patch
new file mode 100644
index 0000000000..c6bd2848db
--- /dev/null
+++ b/queue-6.6/edac-ie31200-fix-the-dimm-size-mask-for-several-socs.patch
@@ -0,0 +1,46 @@
+From aa39fabc6569af251b645900a53b48c65c12b8e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 09:14:02 +0800
+Subject: EDAC/ie31200: Fix the DIMM size mask for several SoCs
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 3427befbbca6b19fe0e37f91d66ce5221de70bf1 ]
+
+The DIMM size mask for {Sky, Kaby, Coffee} Lake is not bits{7:0},
+but bits{5:0}. Fix it.
+
+Fixes: 953dee9bbd24 ("EDAC, ie31200_edac: Add Skylake support")
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Gary Wang <gary.c.wang@intel.com>
+Link: https://lore.kernel.org/r/20250310011411.31685-3-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/ie31200_edac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
+index 98d74c604d726..92714dd88b3f6 100644
+--- a/drivers/edac/ie31200_edac.c
++++ b/drivers/edac/ie31200_edac.c
+@@ -162,6 +162,7 @@
+ #define IE31200_MAD_DIMM_0_OFFSET		0x5004
+ #define IE31200_MAD_DIMM_0_OFFSET_SKL		0x500C
+ #define IE31200_MAD_DIMM_SIZE			GENMASK_ULL(7, 0)
++#define IE31200_MAD_DIMM_SIZE_SKL		GENMASK_ULL(5, 0)
+ #define IE31200_MAD_DIMM_A_RANK			BIT(17)
+ #define IE31200_MAD_DIMM_A_RANK_SHIFT		17
+ #define IE31200_MAD_DIMM_A_RANK_SKL		BIT(10)
+@@ -375,7 +376,7 @@ static void __iomem *ie31200_map_mchbar(struct pci_dev *pdev)
+ static void __skl_populate_dimm_info(struct dimm_data *dd, u32 addr_decode,
+ 				     int chan)
+ {
+-	dd->size = (addr_decode >> (chan << 4)) & IE31200_MAD_DIMM_SIZE;
++	dd->size = (addr_decode >> (chan << 4)) & IE31200_MAD_DIMM_SIZE_SKL;
+ 	dd->dual_rank = (addr_decode & (IE31200_MAD_DIMM_A_RANK_SKL << (chan << 4))) ? 1 : 0;
+ 	dd->x16_width = ((addr_decode & (IE31200_MAD_DIMM_A_WIDTH_SKL << (chan << 4))) >>
+ 				(IE31200_MAD_DIMM_A_WIDTH_SKL_SHIFT + (chan << 4)));
+-- 
+2.39.5
+
diff --git a/queue-6.6/edac-ie31200-fix-the-error-path-order-of-ie31200_ini.patch b/queue-6.6/edac-ie31200-fix-the-error-path-order-of-ie31200_ini.patch
new file mode 100644
index 0000000000..9aaf62b185
--- /dev/null
+++ b/queue-6.6/edac-ie31200-fix-the-error-path-order-of-ie31200_ini.patch
@@ -0,0 +1,68 @@
+From e6f76b9f93c7b194a43f6c2d5655a185a3772a8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 09:14:03 +0800
+Subject: EDAC/ie31200: Fix the error path order of ie31200_init()
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 231e341036d9988447e3b3345cf741a98139199e ]
+
+The error path order of ie31200_init() is incorrect, fix it.
+
+Fixes: 709ed1bcef12 ("EDAC/ie31200: Fallback if host bridge device is already initialized")
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Gary Wang <gary.c.wang@intel.com>
+Link: https://lore.kernel.org/r/20250310011411.31685-4-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/ie31200_edac.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
+index 92714dd88b3f6..56be8ef40f376 100644
+--- a/drivers/edac/ie31200_edac.c
++++ b/drivers/edac/ie31200_edac.c
+@@ -617,7 +617,7 @@ static int __init ie31200_init(void)
+ 
+ 	pci_rc = pci_register_driver(&ie31200_driver);
+ 	if (pci_rc < 0)
+-		goto fail0;
++		return pci_rc;
+ 
+ 	if (!mci_pdev) {
+ 		ie31200_registered = 0;
+@@ -628,11 +628,13 @@ static int __init ie31200_init(void)
+ 			if (mci_pdev)
+ 				break;
+ 		}
++
+ 		if (!mci_pdev) {
+ 			edac_dbg(0, "ie31200 pci_get_device fail\n");
+ 			pci_rc = -ENODEV;
+-			goto fail1;
++			goto fail0;
+ 		}
++
+ 		pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
+ 		if (pci_rc < 0) {
+ 			edac_dbg(0, "ie31200 init fail\n");
+@@ -640,12 +642,12 @@ static int __init ie31200_init(void)
+ 			goto fail1;
+ 		}
+ 	}
+-	return 0;
+ 
++	return 0;
+ fail1:
+-	pci_unregister_driver(&ie31200_driver);
+-fail0:
+ 	pci_dev_put(mci_pdev);
++fail0:
++	pci_unregister_driver(&ie31200_driver);
+ 
+ 	return pci_rc;
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/edac-ie31200-fix-the-size-of-edac_mc_layer_chip_sele.patch b/queue-6.6/edac-ie31200-fix-the-size-of-edac_mc_layer_chip_sele.patch
new file mode 100644
index 0000000000..21bb6d70c5
--- /dev/null
+++ b/queue-6.6/edac-ie31200-fix-the-size-of-edac_mc_layer_chip_sele.patch
@@ -0,0 +1,48 @@
+From 50c24dd8e4341ee02d6b6e4f6f9db33abe42a859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 09:14:01 +0800
+Subject: EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit d59d844e319d97682c8de29b88d2d60922a683b3 ]
+
+The EDAC_MC_LAYER_CHIP_SELECT layer pertains to the rank, not the DIMM.
+Fix its size to reflect the number of ranks instead of the number of DIMMs.
+Also delete the unused macros IE31200_{DIMMS,RANKS}.
+
+Fixes: 7ee40b897d18 ("ie31200_edac: Introduce the driver")
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Gary Wang <gary.c.wang@intel.com>
+Link: https://lore.kernel.org/r/20250310011411.31685-2-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/ie31200_edac.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
+index 9ef13570f2e54..98d74c604d726 100644
+--- a/drivers/edac/ie31200_edac.c
++++ b/drivers/edac/ie31200_edac.c
+@@ -91,8 +91,6 @@
+ 	 (((did) & PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK) ==                 \
+ 	  PCI_DEVICE_ID_INTEL_IE31200_HB_CFL_MASK))
+ 
+-#define IE31200_DIMMS			4
+-#define IE31200_RANKS			8
+ #define IE31200_RANKS_PER_CHANNEL	4
+ #define IE31200_DIMMS_PER_CHANNEL	2
+ #define IE31200_CHANNELS		2
+@@ -426,7 +424,7 @@ static int ie31200_probe1(struct pci_dev *pdev, int dev_idx)
+ 
+ 	nr_channels = how_many_channels(pdev);
+ 	layers[0].type = EDAC_MC_LAYER_CHIP_SELECT;
+-	layers[0].size = IE31200_DIMMS;
++	layers[0].size = IE31200_RANKS_PER_CHANNEL;
+ 	layers[0].is_virt_csrow = true;
+ 	layers[1].type = EDAC_MC_LAYER_CHANNEL;
+ 	layers[1].size = nr_channels;
+-- 
+2.39.5
+
diff --git a/queue-6.6/edac-skx_common-i10nm-fix-some-missing-error-reports.patch b/queue-6.6/edac-skx_common-i10nm-fix-some-missing-error-reports.patch
new file mode 100644
index 0000000000..d811e1529f
--- /dev/null
+++ b/queue-6.6/edac-skx_common-i10nm-fix-some-missing-error-reports.patch
@@ -0,0 +1,144 @@
+From 1496d155ab01c717aff23c21510732d2d8c6e7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 08:27:28 +0800
+Subject: EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald
+ Rapids
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit d9207cf7760f5f5599e9ff7eb0fedf56821a1d59 ]
+
+When doing error injection to some memory DIMMs on certain Intel Emerald
+Rapids servers, the i10nm_edac missed error reports for some memory DIMMs.
+
+Certain BIOS configurations may hide some memory controllers, and the
+i10nm_edac doesn't enumerate these hidden memory controllers. However, the
+ADXL decodes memory errors using memory controller physical indices even
+if there are hidden memory controllers. Therefore, the memory controller
+physical indices reported by the ADXL may mismatch the logical indices
+enumerated by the i10nm_edac, resulting in missed error reports for some
+memory DIMMs.
+
+Fix this issue by creating a mapping table from memory controller physical
+indices (used by the ADXL) to logical indices (used by the i10nm_edac) and
+using it to convert the physical indices to the logical indices during the
+error handling process.
+
+Fixes: c545f5e41225 ("EDAC/i10nm: Skip the absent memory controllers")
+Reported-by: Kevin Chang <kevin1.chang@intel.com>
+Tested-by: Kevin Chang <kevin1.chang@intel.com>
+Reported-by: Thomas Chen <Thomas.Chen@intel.com>
+Tested-by: Thomas Chen <Thomas.Chen@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20250214002728.6287-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c |  2 ++
+ drivers/edac/skx_common.c | 33 +++++++++++++++++++++++++++++++++
+ drivers/edac/skx_common.h | 11 +++++++++++
+ 3 files changed, 46 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index 535f058b48eef..67a46abe07da9 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -755,6 +755,8 @@ static int i10nm_get_ddr_munits(void)
+ 				continue;
+ 			} else {
+ 				d->imc[lmc].mdev = mdev;
++				if (res_cfg->type == SPR)
++					skx_set_mc_mapping(d, i, lmc);
+ 				lmc++;
+ 			}
+ 		}
+diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c
+index 0b8aaf5f77d9f..d47f0055217e4 100644
+--- a/drivers/edac/skx_common.c
++++ b/drivers/edac/skx_common.c
+@@ -120,6 +120,35 @@ void skx_adxl_put(void)
+ }
+ EXPORT_SYMBOL_GPL(skx_adxl_put);
+ 
++static void skx_init_mc_mapping(struct skx_dev *d)
++{
++	/*
++	 * By default, the BIOS presents all memory controllers within each
++	 * socket to the EDAC driver. The physical indices are the same as
++	 * the logical indices of the memory controllers enumerated by the
++	 * EDAC driver.
++	 */
++	for (int i = 0; i < NUM_IMC; i++)
++		d->mc_mapping[i] = i;
++}
++
++void skx_set_mc_mapping(struct skx_dev *d, u8 pmc, u8 lmc)
++{
++	edac_dbg(0, "Set the mapping of mc phy idx to logical idx: %02d -> %02d\n",
++		 pmc, lmc);
++
++	d->mc_mapping[pmc] = lmc;
++}
++EXPORT_SYMBOL_GPL(skx_set_mc_mapping);
++
++static u8 skx_get_mc_mapping(struct skx_dev *d, u8 pmc)
++{
++	edac_dbg(0, "Get the mapping of mc phy idx to logical idx: %02d -> %02d\n",
++		 pmc, d->mc_mapping[pmc]);
++
++	return d->mc_mapping[pmc];
++}
++
+ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)
+ {
+ 	struct skx_dev *d;
+@@ -187,6 +216,8 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)
+ 		return false;
+ 	}
+ 
++	res->imc = skx_get_mc_mapping(d, res->imc);
++
+ 	for (i = 0; i < adxl_component_count; i++) {
+ 		if (adxl_values[i] == ~0x0ull)
+ 			continue;
+@@ -307,6 +338,8 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list)
+ 			 d->bus[0], d->bus[1], d->bus[2], d->bus[3]);
+ 		list_add_tail(&d->list, &dev_edac_list);
+ 		prev = pdev;
++
++		skx_init_mc_mapping(d);
+ 	}
+ 
+ 	if (list)
+diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h
+index e7f18ada16681..5acfef8fd3d36 100644
+--- a/drivers/edac/skx_common.h
++++ b/drivers/edac/skx_common.h
+@@ -94,6 +94,16 @@ struct skx_dev {
+ 	struct pci_dev *uracu; /* for i10nm CPU */
+ 	struct pci_dev *pcu_cr3; /* for HBM memory detection */
+ 	u32 mcroute;
++	/*
++	 * Some server BIOS may hide certain memory controllers, and the
++	 * EDAC driver skips those hidden memory controllers. However, the
++	 * ADXL still decodes memory error address using physical memory
++	 * controller indices. The mapping table is used to convert the
++	 * physical indices (reported by ADXL) to the logical indices
++	 * (used the EDAC driver) of present memory controllers during the
++	 * error handling process.
++	 */
++	u8 mc_mapping[NUM_IMC];
+ 	struct skx_imc {
+ 		struct mem_ctl_info *mci;
+ 		struct pci_dev *mdev; /* for i10nm CPU */
+@@ -243,6 +253,7 @@ void skx_adxl_put(void);
+ void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log);
+ void skx_set_mem_cfg(bool mem_cfg_2lm);
+ void skx_set_res_cfg(struct res_config *cfg);
++void skx_set_mc_mapping(struct skx_dev *d, u8 pmc, u8 lmc);
+ 
+ int skx_get_src_id(struct skx_dev *d, int off, u8 *id);
+ int skx_get_node_id(struct skx_dev *d, u8 *id);
+-- 
+2.39.5
+
diff --git a/queue-6.6/exfat-fix-the-infinite-loop-in-exfat_find_last_clust.patch b/queue-6.6/exfat-fix-the-infinite-loop-in-exfat_find_last_clust.patch
new file mode 100644
index 0000000000..c473543388
--- /dev/null
+++ b/queue-6.6/exfat-fix-the-infinite-loop-in-exfat_find_last_clust.patch
@@ -0,0 +1,46 @@
+From ad6c2e4debc26b518b1d51f97d3d7128a689cd00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 10:53:10 +0800
+Subject: exfat: fix the infinite loop in exfat_find_last_cluster()
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit b0522303f67255926b946aa66885a0104d1b2980 ]
+
+In exfat_find_last_cluster(), the cluster chain is traversed until
+the EOF cluster. If the cluster chain includes a loop due to file
+system corruption, the EOF cluster cannot be traversed, resulting
+in an infinite loop.
+
+If the number of clusters indicated by the file size is inconsistent
+with the cluster chain length, exfat_find_last_cluster() will return
+an error, so if this inconsistency is found, the traversal can be
+aborted without traversing to the EOF cluster.
+
+Reported-by: syzbot+f7d147e6db52b1e09dba@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=f7d147e6db52b1e09dba
+Tested-by: syzbot+f7d147e6db52b1e09dba@syzkaller.appspotmail.com
+Fixes: 31023864e67a ("exfat: add fat entry operations")
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 74590041fb2c7..24e1e05f9f34a 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -265,7 +265,7 @@ int exfat_find_last_cluster(struct super_block *sb, struct exfat_chain *p_chain,
+ 		clu = next;
+ 		if (exfat_ent_get(sb, clu, &next))
+ 			return -EIO;
+-	} while (next != EXFAT_EOF_CLUSTER);
++	} while (next != EXFAT_EOF_CLUSTER && count <= p_chain->size);
+ 
+ 	if (p_chain->size != count) {
+ 		exfat_fs_error(sb,
+-- 
+2.39.5
+
diff --git a/queue-6.6/fbdev-au1100fb-move-a-variable-assignment-behind-a-n.patch b/queue-6.6/fbdev-au1100fb-move-a-variable-assignment-behind-a-n.patch
new file mode 100644
index 0000000000..2dbf074d38
--- /dev/null
+++ b/queue-6.6/fbdev-au1100fb-move-a-variable-assignment-behind-a-n.patch
@@ -0,0 +1,52 @@
+From c8eaa412a33419cbcfb4f7f0c0352f030a2a88f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 21:35:36 +0200
+Subject: fbdev: au1100fb: Move a variable assignment behind a null pointer
+ check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit 2df2c0caaecfd869b49e14f2b8df822397c5dd7f ]
+
+The address of a data structure member was determined before
+a corresponding null pointer check in the implementation of
+the function “au1100fb_setmode”.
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: 3b495f2bb749 ("Au1100 FB driver uplift for 2.6.")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/au1100fb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/au1100fb.c b/drivers/video/fbdev/au1100fb.c
+index 648d6cac86e8f..6822589680798 100644
+--- a/drivers/video/fbdev/au1100fb.c
++++ b/drivers/video/fbdev/au1100fb.c
+@@ -137,13 +137,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)
+ 	 */
+ int au1100fb_setmode(struct au1100fb_device *fbdev)
+ {
+-	struct fb_info *info = &fbdev->info;
++	struct fb_info *info;
+ 	u32 words;
+ 	int index;
+ 
+ 	if (!fbdev)
+ 		return -EINVAL;
+ 
++	info = &fbdev->info;
++
+ 	/* Update var-dependent FB info */
+ 	if (panel_is_active(fbdev->panel) || panel_is_color(fbdev->panel)) {
+ 		if (info->var.bits_per_pixel <= 8) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/fbdev-sm501fb-add-some-geometry-checks.patch b/queue-6.6/fbdev-sm501fb-add-some-geometry-checks.patch
new file mode 100644
index 0000000000..e99446143f
--- /dev/null
+++ b/queue-6.6/fbdev-sm501fb-add-some-geometry-checks.patch
@@ -0,0 +1,44 @@
+From 9cdaf7af9696dd64b5319c708b0481d45bbf64ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 01:30:11 +0000
+Subject: fbdev: sm501fb: Add some geometry checks.
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ]
+
+Added checks for xoffset, yoffset settings.
+Incorrect settings of these parameters can lead to errors
+in sm501fb_pan_ functions.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5fc404e47bdf ("[PATCH] fb: SM501 framebuffer driver")
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sm501fb.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
+index 65c799ac5604f..b9d72f368c6c6 100644
+--- a/drivers/video/fbdev/sm501fb.c
++++ b/drivers/video/fbdev/sm501fb.c
+@@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var,
+ 	if (var->xres_virtual > 4096 || var->yres_virtual > 2048)
+ 		return -EINVAL;
+ 
++	/* geometry sanity checks */
++	if (var->xres + var->xoffset > var->xres_virtual)
++		return -EINVAL;
++
++	if (var->yres + var->yoffset > var->yres_virtual)
++		return -EINVAL;
++
+ 	/* can cope with 8,16 or 32bpp */
+ 
+ 	if (var->bits_per_pixel <= 8)
+-- 
+2.39.5
+
diff --git a/queue-6.6/firmware-cs_dsp-ensure-cs_dsp_load-_coeff-returns-0-.patch b/queue-6.6/firmware-cs_dsp-ensure-cs_dsp_load-_coeff-returns-0-.patch
new file mode 100644
index 0000000000..53ddf97610
--- /dev/null
+++ b/queue-6.6/firmware-cs_dsp-ensure-cs_dsp_load-_coeff-returns-0-.patch
@@ -0,0 +1,67 @@
+From 5b43422a8e507360b0788ace6bfb042a336e4cf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 17:05:29 +0000
+Subject: firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 2593f7e0dc93a898a84220b3fb180d86f1ca8c60 ]
+
+Set ret = 0 on successful completion of the processing loop in
+cs_dsp_load() and cs_dsp_load_coeff() to ensure that the function
+returns 0 on success.
+
+All normal firmware files will have at least one data block, and
+processing this block will set ret == 0, from the result of either
+regmap_raw_write() or cs_dsp_parse_coeff().
+
+The kunit tests create a dummy firmware file that contains only the
+header, without any data blocks. This gives cs_dsp a file to "load"
+that will not cause any side-effects. As there aren't any data blocks,
+the processing loop will not set ret == 0.
+
+Originally there was a line after the processing loop:
+
+    ret = regmap_async_complete(regmap);
+
+which would set ret == 0 before the function returned.
+
+Commit fe08b7d5085a ("firmware: cs_dsp: Remove async regmap writes")
+changed the regmap write to a normal sync write, so the call to
+regmap_async_complete() wasn't necessary and was removed. It was
+overlooked that the ret here wasn't only to check the result of
+regmap_async_complete(), it also set the final return value of the
+function.
+
+Fixes: fe08b7d5085a ("firmware: cs_dsp: Remove async regmap writes")
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250323170529.197205-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/cirrus/cs_dsp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c
+index 4ce5681be18f0..c015d2b4c5cf9 100644
+--- a/drivers/firmware/cirrus/cs_dsp.c
++++ b/drivers/firmware/cirrus/cs_dsp.c
+@@ -1584,6 +1584,7 @@ static int cs_dsp_load(struct cs_dsp *dsp, const struct firmware *firmware,
+ 
+ 	cs_dsp_debugfs_save_wmfwname(dsp, file);
+ 
++	ret = 0;
+ out_fw:
+ 	cs_dsp_buf_free(&buf_list);
+ 	kfree(text);
+@@ -2299,6 +2300,7 @@ static int cs_dsp_load_coeff(struct cs_dsp *dsp, const struct firmware *firmware
+ 
+ 	cs_dsp_debugfs_save_binname(dsp, file);
+ 
++	ret = 0;
+ out_fw:
+ 	cs_dsp_buf_free(&buf_list);
+ 	kfree(text);
+-- 
+2.39.5
+
diff --git a/queue-6.6/fs-ntfs3-fix-a-couple-integer-overflows-on-32bit-sys.patch b/queue-6.6/fs-ntfs3-fix-a-couple-integer-overflows-on-32bit-sys.patch
new file mode 100644
index 0000000000..e36a1aa33d
--- /dev/null
+++ b/queue-6.6/fs-ntfs3-fix-a-couple-integer-overflows-on-32bit-sys.patch
@@ -0,0 +1,45 @@
+From 3f89acd94e7d1f54cbabcf44cf72e4aa16d52974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Feb 2025 23:52:00 +0300
+Subject: fs/ntfs3: Fix a couple integer overflows on 32bit systems
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 5ad414f4df2294b28836b5b7b69787659d6aa708 ]
+
+On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can
+have an integer wrapping issue.  Fix it by using size_add().
+
+Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/index.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 9089c58a005ce..28aae6ea1e615 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -618,7 +618,7 @@ static bool index_hdr_check(const struct INDEX_HDR *hdr, u32 bytes)
+ 	u32 off = le32_to_cpu(hdr->de_off);
+ 
+ 	if (!IS_ALIGNED(off, 8) || tot > bytes || end > tot ||
+-	    off + sizeof(struct NTFS_DE) > end) {
++	    size_add(off, sizeof(struct NTFS_DE)) > end) {
+ 		/* incorrect index buffer. */
+ 		return false;
+ 	}
+@@ -736,7 +736,7 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx,
+ 	if (end > total)
+ 		return NULL;
+ 
+-	if (off + sizeof(struct NTFS_DE) > end)
++	if (size_add(off, sizeof(struct NTFS_DE)) > end)
+ 		return NULL;
+ 
+ 	e = Add2Ptr(hdr, off);
+-- 
+2.39.5
+
diff --git a/queue-6.6/fs-ntfs3-prevent-integer-overflow-in-hdr_first_de.patch b/queue-6.6/fs-ntfs3-prevent-integer-overflow-in-hdr_first_de.patch
new file mode 100644
index 0000000000..1db568ec56
--- /dev/null
+++ b/queue-6.6/fs-ntfs3-prevent-integer-overflow-in-hdr_first_de.patch
@@ -0,0 +1,38 @@
+From d4645751cb3b0429643ca70a8d5889a4884b6504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Feb 2025 23:52:10 +0300
+Subject: fs/ntfs3: Prevent integer overflow in hdr_first_de()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 6bb81b94f7a9cba6bde9a905cef52a65317a8b04 ]
+
+The "de_off" and "used" variables come from the disk so they both need to
+check.  The problem is that on 32bit systems if they're both greater than
+UINT_MAX - 16 then the check does work as intended because of an integer
+overflow.
+
+Fixes: 60ce8dfde035 ("fs/ntfs3: Fix wrong if in hdr_first_de")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/ntfs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
+index 964e27c7b9016..c1d1c4a7cf4d6 100644
+--- a/fs/ntfs3/ntfs.h
++++ b/fs/ntfs3/ntfs.h
+@@ -717,7 +717,7 @@ static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr)
+ 	struct NTFS_DE *e;
+ 	u16 esize;
+ 
+-	if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used )
++	if (de_off >= used || size_add(de_off, sizeof(struct NTFS_DE)) > used)
+ 		return NULL;
+ 
+ 	e = Add2Ptr(hdr, de_off);
+-- 
+2.39.5
+
diff --git a/queue-6.6/fs-procfs-fix-the-comment-above-proc_pid_wchan.patch b/queue-6.6/fs-procfs-fix-the-comment-above-proc_pid_wchan.patch
new file mode 100644
index 0000000000..019e037620
--- /dev/null
+++ b/queue-6.6/fs-procfs-fix-the-comment-above-proc_pid_wchan.patch
@@ -0,0 +1,41 @@
+From 678f76801cc52c8e13fdd8ba041228d368770444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 14:02:22 -0700
+Subject: fs/procfs: fix the comment above proc_pid_wchan()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 6287fbad1cd91f0c25cdc3a580499060828a8f30 ]
+
+proc_pid_wchan() used to report kernel addresses to user space but that is
+no longer the case today.  Bring the comment above proc_pid_wchan() in
+sync with the implementation.
+
+Link: https://lkml.kernel.org/r/20250319210222.1518771-1-bvanassche@acm.org
+Fixes: b2f73922d119 ("fs/proc, core/debug: Don't expose absolute kernel addresses via wchan")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Cc: Kees Cook <kees@kernel.org>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 91fe20b7657c0..d444155581cab 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -416,7 +416,7 @@ static const struct file_operations proc_pid_cmdline_ops = {
+ #ifdef CONFIG_KALLSYMS
+ /*
+  * Provides a wchan file via kallsyms in a proper one-value-per-file format.
+- * Returns the resolved symbol.  If that fails, simply return the address.
++ * Returns the resolved symbol to user space.
+  */
+ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
+ 			  struct pid *pid, struct task_struct *task)
+-- 
+2.39.5
+
diff --git a/queue-6.6/fuse-fix-dax-truncate-punch_hole-fault-path.patch b/queue-6.6/fuse-fix-dax-truncate-punch_hole-fault-path.patch
new file mode 100644
index 0000000000..4058fad4c3
--- /dev/null
+++ b/queue-6.6/fuse-fix-dax-truncate-punch_hole-fault-path.patch
@@ -0,0 +1,146 @@
+From ef51475f583506c16d7bd71a8de07dcf8a090d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 14:30:56 +1100
+Subject: fuse: fix dax truncate/punch_hole fault path
+
+From: Alistair Popple <apopple@nvidia.com>
+
+[ Upstream commit 7851bf649d423edd7286b292739f2eefded3d35c ]
+
+Patch series "fs/dax: Fix ZONE_DEVICE page reference counts", v9.
+
+Device and FS DAX pages have always maintained their own page reference
+counts without following the normal rules for page reference counting.  In
+particular pages are considered free when the refcount hits one rather
+than zero and refcounts are not added when mapping the page.
+
+Tracking this requires special PTE bits (PTE_DEVMAP) and a secondary
+mechanism for allowing GUP to hold references on the page (see
+get_dev_pagemap).  However there doesn't seem to be any reason why FS DAX
+pages need their own reference counting scheme.
+
+By treating the refcounts on these pages the same way as normal pages we
+can remove a lot of special checks.  In particular pXd_trans_huge()
+becomes the same as pXd_leaf(), although I haven't made that change here.
+It also frees up a valuable SW define PTE bit on architectures that have
+devmap PTE bits defined.
+
+It also almost certainly allows further clean-up of the devmap managed
+functions, but I have left that as a future improvment.  It also enables
+support for compound ZONE_DEVICE pages which is one of my primary
+motivators for doing this work.
+
+This patch (of 20):
+
+FS DAX requires file systems to call into the DAX layout prior to
+unlinking inodes to ensure there is no ongoing DMA or other remote access
+to the direct mapped page.  The fuse file system implements
+fuse_dax_break_layouts() to do this which includes a comment indicating
+that passing dmap_end == 0 leads to unmapping of the whole file.
+
+However this is not true - passing dmap_end == 0 will not unmap anything
+before dmap_start, and further more dax_layout_busy_page_range() will not
+scan any of the range to see if there maybe ongoing DMA access to the
+range.  Fix this by passing -1 for dmap_end to fuse_dax_break_layouts()
+which will invalidate the entire file range to
+dax_layout_busy_page_range().
+
+Link: https://lkml.kernel.org/r/cover.8068ad144a7eea4a813670301f4d2a86a8e68ec4.1740713401.git-series.apopple@nvidia.com
+Link: https://lkml.kernel.org/r/f09a34b6c40032022e4ddee6fadb7cc676f08867.1740713401.git-series.apopple@nvidia.com
+Fixes: 6ae330cad6ef ("virtiofs: serialize truncate/punch_hole and dax fault path")
+Signed-off-by: Alistair Popple <apopple@nvidia.com>
+Co-developed-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Balbir Singh <balbirs@nvidia.com>
+Tested-by: Alison Schofield <alison.schofield@intel.com>
+Cc: Vivek Goyal <vgoyal@redhat.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Asahi Lina <lina@asahilina.net>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Chunyan Zhang <zhang.lyra@gmail.com>
+Cc: "Darrick J. Wong" <djwong@kernel.org>
+Cc: Dave Chinner <david@fromorbit.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Huacai Chen <chenhuacai@kernel.org>
+Cc: Ira Weiny <ira.weiny@intel.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jason Gunthorpe <jgg@nvidia.com>
+Cc: Jason Gunthorpe <jgg@ziepe.ca>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: linmiaohe <linmiaohe@huawei.com>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
+Cc: Michael "Camp Drill Sergeant" Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Ted Ts'o <tytso@mit.edu>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: WANG Xuerui <kernel@xen0n.name>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dax.c  | 1 -
+ fs/fuse/dir.c  | 2 +-
+ fs/fuse/file.c | 4 ++--
+ 3 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/fuse/dax.c b/fs/fuse/dax.c
+index 12ef91d170bb3..7faf1af59d5d8 100644
+--- a/fs/fuse/dax.c
++++ b/fs/fuse/dax.c
+@@ -681,7 +681,6 @@ static int __fuse_dax_break_layouts(struct inode *inode, bool *retry,
+ 			0, 0, fuse_wait_dax_page(inode));
+ }
+ 
+-/* dmap_end == 0 leads to unmapping of whole file */
+ int fuse_dax_break_layouts(struct inode *inode, u64 dmap_start,
+ 				  u64 dmap_end)
+ {
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 89bffaed421fa..e4d6cc0d2332a 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1875,7 +1875,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
+ 	if (FUSE_IS_DAX(inode) && is_truncate) {
+ 		filemap_invalidate_lock(mapping);
+ 		fault_blocked = true;
+-		err = fuse_dax_break_layouts(inode, 0, 0);
++		err = fuse_dax_break_layouts(inode, 0, -1);
+ 		if (err) {
+ 			filemap_invalidate_unlock(mapping);
+ 			return err;
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index ceb9f7d230388..3e4c3fcb588ba 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -241,7 +241,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
+ 
+ 	if (dax_truncate) {
+ 		filemap_invalidate_lock(inode->i_mapping);
+-		err = fuse_dax_break_layouts(inode, 0, 0);
++		err = fuse_dax_break_layouts(inode, 0, -1);
+ 		if (err)
+ 			goto out_inode_unlock;
+ 	}
+@@ -3023,7 +3023,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
+ 	inode_lock(inode);
+ 	if (block_faults) {
+ 		filemap_invalidate_lock(inode->i_mapping);
+-		err = fuse_dax_break_layouts(inode, 0, 0);
++		err = fuse_dax_break_layouts(inode, 0, -1);
+ 		if (err)
+ 			goto out;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/hid-i2c-hid-improve-i2c_hid_get_report-error-message.patch b/queue-6.6/hid-i2c-hid-improve-i2c_hid_get_report-error-message.patch
new file mode 100644
index 0000000000..085deaee68
--- /dev/null
+++ b/queue-6.6/hid-i2c-hid-improve-i2c_hid_get_report-error-message.patch
@@ -0,0 +1,43 @@
+From e9cc6cc5702c0dc6757c69dec23f0d47e614e2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 19:04:18 +0800
+Subject: HID: i2c-hid: improve i2c_hid_get_report error message
+
+From: Wentao Guan <guanwentao@uniontech.com>
+
+[ Upstream commit 723aa55c08c9d1e0734e39a815fd41272eac8269 ]
+
+We have two places to print "failed to set a report to ...",
+use "get a report from" instead of "set a report to", it makes
+people who knows less about the module to know where the error
+happened.
+
+Before:
+i2c_hid_acpi i2c-FTSC1000:00: failed to set a report to device: -11
+
+After:
+i2c_hid_acpi i2c-FTSC1000:00: failed to get a report from device: -11
+
+Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 045db6f0fb4c4..3dcdd3368b463 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -258,7 +258,7 @@ static int i2c_hid_get_report(struct i2c_hid *ihid,
+ 			     ihid->rawbuf, recv_len + sizeof(__le16));
+ 	if (error) {
+ 		dev_err(&ihid->client->dev,
+-			"failed to set a report to device: %d\n", error);
++			"failed to get a report from device: %d\n", error);
+ 		return error;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/hid-remove-superfluous-and-wrong-makefile-entry-for-.patch b/queue-6.6/hid-remove-superfluous-and-wrong-makefile-entry-for-.patch
new file mode 100644
index 0000000000..0561da7237
--- /dev/null
+++ b/queue-6.6/hid-remove-superfluous-and-wrong-makefile-entry-for-.patch
@@ -0,0 +1,44 @@
+From 3c42abae924184dd43d648acb3dbe8db1a709754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 09:08:22 +0100
+Subject: HID: remove superfluous (and wrong) Makefile entry for
+ CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit fe0fb58325e519008e2606a5aa2cff7ad23e212d ]
+
+The line
+
+	obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)   += intel-ish-hid/
+
+in top-level HID Makefile is both superfluous (as CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
+depends on CONFIG_INTEL_ISH_HID, which contains intel-ish-hid/ already) and wrong (as it's
+missing the CONFIG_ prefix).
+
+Just remove it.
+
+Fixes: 91b228107da3e ("HID: intel-ish-hid: ISH firmware loader client driver")
+Reported-by: Jiri Slaby <jirislaby@kernel.org>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
+index 082a728eac600..f5a06b62b385d 100644
+--- a/drivers/hid/Makefile
++++ b/drivers/hid/Makefile
+@@ -165,7 +165,6 @@ obj-$(CONFIG_USB_KBD)		+= usbhid/
+ obj-$(CONFIG_I2C_HID_CORE)	+= i2c-hid/
+ 
+ obj-$(CONFIG_INTEL_ISH_HID)	+= intel-ish-hid/
+-obj-$(INTEL_ISH_FIRMWARE_DOWNLOADER)	+= intel-ish-hid/
+ 
+ obj-$(CONFIG_AMD_SFH_HID)       += amd-sfh-hid/
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/hwmon-nct6775-core-fix-out-of-bounds-access-for-nct6.patch b/queue-6.6/hwmon-nct6775-core-fix-out-of-bounds-access-for-nct6.patch
new file mode 100644
index 0000000000..dca30f8410
--- /dev/null
+++ b/queue-6.6/hwmon-nct6775-core-fix-out-of-bounds-access-for-nct6.patch
@@ -0,0 +1,40 @@
+From 3ec572b9e0283e5944721db8747e48d1b026b0f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 05:08:32 +0200
+Subject: hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
+
+From: Tasos Sahanidis <tasos@tasossah.com>
+
+[ Upstream commit 815f80ad20b63830949a77c816e35395d5d55144 ]
+
+pwm_num is set to 7 for these chips, but NCT6776_REG_PWM_MODE and
+NCT6776_PWM_MODE_MASK only contain 6 values.
+
+Fix this by adding another 0 to the end of each array.
+
+Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
+Link: https://lore.kernel.org/r/20250312030832.106475-1-tasos@tasossah.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
+index 16f6b7ba2a5de..da4c3425d2d1d 100644
+--- a/drivers/hwmon/nct6775-core.c
++++ b/drivers/hwmon/nct6775-core.c
+@@ -273,8 +273,8 @@ static const s8 NCT6776_BEEP_BITS[NUM_BEEP_BITS] = {
+ static const u16 NCT6776_REG_TOLERANCE_H[] = {
+ 	0x10c, 0x20c, 0x30c, 0x80c, 0x90c, 0xa0c, 0xb0c };
+ 
+-static const u8 NCT6776_REG_PWM_MODE[] = { 0x04, 0, 0, 0, 0, 0 };
+-static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0 };
++static const u8 NCT6776_REG_PWM_MODE[] = { 0x04, 0, 0, 0, 0, 0, 0 };
++static const u8 NCT6776_PWM_MODE_MASK[] = { 0x01, 0, 0, 0, 0, 0, 0 };
+ 
+ static const u16 NCT6776_REG_FAN_MIN[] = {
+ 	0x63a, 0x63c, 0x63e, 0x640, 0x642, 0x64a, 0x64c };
+-- 
+2.39.5
+
diff --git a/queue-6.6/i3c-master-svc-fix-missing-the-ibi-rules.patch b/queue-6.6/i3c-master-svc-fix-missing-the-ibi-rules.patch
new file mode 100644
index 0000000000..b2affe1c0f
--- /dev/null
+++ b/queue-6.6/i3c-master-svc-fix-missing-the-ibi-rules.patch
@@ -0,0 +1,40 @@
+From 3ef38406bee5b8b64f01614d1dd85e237b04ab43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 13:36:04 +0800
+Subject: i3c: master: svc: Fix missing the IBI rules
+
+From: Stanley Chu <yschu@nuvoton.com>
+
+[ Upstream commit 9cecad134d84d14dc72a0eea7a107691c3e5a837 ]
+
+The code does not add IBI rules for devices with controller capability.
+However, the secondary controller has the controller capability and works
+at target mode when the device is probed. Therefore, add IBI rules for
+such devices.
+
+Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
+Signed-off-by: Stanley Chu <yschu@nuvoton.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20250318053606.3087121-2-yschu@nuvoton.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index c5ab39f1e755c..652a666909a55 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -951,7 +951,7 @@ static int svc_i3c_update_ibirules(struct svc_i3c_master *master)
+ 
+ 	/* Create the IBIRULES register for both cases */
+ 	i3c_bus_for_each_i3cdev(&master->base.bus, dev) {
+-		if (I3C_BCR_DEVICE_ROLE(dev->info.bcr) == I3C_BCR_I3C_MASTER)
++		if (!(dev->info.bcr & I3C_BCR_IBI_REQ_CAP))
+ 			continue;
+ 
+ 		if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/ib-mad-check-available-slots-before-posting-receive-.patch b/queue-6.6/ib-mad-check-available-slots-before-posting-receive-.patch
new file mode 100644
index 0000000000..fb1b3cc187
--- /dev/null
+++ b/queue-6.6/ib-mad-check-available-slots-before-posting-receive-.patch
@@ -0,0 +1,133 @@
+From 6cf0f106b0202c465b1e0a081a359d409470619b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 16:20:17 +0200
+Subject: IB/mad: Check available slots before posting receive WRs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit 37826f0a8c2f6b6add5179003b8597e32a445362 ]
+
+The ib_post_receive_mads() function handles posting receive work
+requests (WRs) to MAD QPs and is called in two cases:
+1) When a MAD port is opened.
+2) When a receive WQE is consumed upon receiving a new MAD.
+
+Whereas, if MADs arrive during the port open phase, a race condition
+might cause an extra WR to be posted, exceeding the QP’s capacity.
+This leads to failures such as:
+infiniband mlx5_0: ib_post_recv failed: -12
+infiniband mlx5_0: Couldn't post receive WRs
+infiniband mlx5_0: Couldn't start port
+infiniband mlx5_0: Couldn't open port 1
+
+Fix this by checking the current receive count before posting a new WR.
+If the QP’s receive queue is full, do not post additional WRs.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Link: https://patch.msgid.link/c4984ba3c3a98a5711a558bccefcad789587ecf1.1741875592.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/mad.c | 38 ++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 58befbaaf0ad5..242434c09e8d8 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -2671,11 +2671,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ 				    struct ib_mad_private *mad)
+ {
+ 	unsigned long flags;
+-	int post, ret;
+ 	struct ib_mad_private *mad_priv;
+ 	struct ib_sge sg_list;
+ 	struct ib_recv_wr recv_wr;
+ 	struct ib_mad_queue *recv_queue = &qp_info->recv_queue;
++	int ret = 0;
+ 
+ 	/* Initialize common scatter list fields */
+ 	sg_list.lkey = qp_info->port_priv->pd->local_dma_lkey;
+@@ -2685,7 +2685,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ 	recv_wr.sg_list = &sg_list;
+ 	recv_wr.num_sge = 1;
+ 
+-	do {
++	while (true) {
+ 		/* Allocate and map receive buffer */
+ 		if (mad) {
+ 			mad_priv = mad;
+@@ -2693,10 +2693,8 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ 		} else {
+ 			mad_priv = alloc_mad_private(port_mad_size(qp_info->port_priv),
+ 						     GFP_ATOMIC);
+-			if (!mad_priv) {
+-				ret = -ENOMEM;
+-				break;
+-			}
++			if (!mad_priv)
++				return -ENOMEM;
+ 		}
+ 		sg_list.length = mad_priv_dma_size(mad_priv);
+ 		sg_list.addr = ib_dma_map_single(qp_info->port_priv->device,
+@@ -2705,37 +2703,41 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
+ 						 DMA_FROM_DEVICE);
+ 		if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device,
+ 						  sg_list.addr))) {
+-			kfree(mad_priv);
+ 			ret = -ENOMEM;
+-			break;
++			goto free_mad_priv;
+ 		}
+ 		mad_priv->header.mapping = sg_list.addr;
+ 		mad_priv->header.mad_list.mad_queue = recv_queue;
+ 		mad_priv->header.mad_list.cqe.done = ib_mad_recv_done;
+ 		recv_wr.wr_cqe = &mad_priv->header.mad_list.cqe;
+-
+-		/* Post receive WR */
+ 		spin_lock_irqsave(&recv_queue->lock, flags);
+-		post = (++recv_queue->count < recv_queue->max_active);
+-		list_add_tail(&mad_priv->header.mad_list.list, &recv_queue->list);
++		if (recv_queue->count >= recv_queue->max_active) {
++			/* Fully populated the receive queue */
++			spin_unlock_irqrestore(&recv_queue->lock, flags);
++			break;
++		}
++		recv_queue->count++;
++		list_add_tail(&mad_priv->header.mad_list.list,
++			      &recv_queue->list);
+ 		spin_unlock_irqrestore(&recv_queue->lock, flags);
++
+ 		ret = ib_post_recv(qp_info->qp, &recv_wr, NULL);
+ 		if (ret) {
+ 			spin_lock_irqsave(&recv_queue->lock, flags);
+ 			list_del(&mad_priv->header.mad_list.list);
+ 			recv_queue->count--;
+ 			spin_unlock_irqrestore(&recv_queue->lock, flags);
+-			ib_dma_unmap_single(qp_info->port_priv->device,
+-					    mad_priv->header.mapping,
+-					    mad_priv_dma_size(mad_priv),
+-					    DMA_FROM_DEVICE);
+-			kfree(mad_priv);
+ 			dev_err(&qp_info->port_priv->device->dev,
+ 				"ib_post_recv failed: %d\n", ret);
+ 			break;
+ 		}
+-	} while (post);
++	}
+ 
++	ib_dma_unmap_single(qp_info->port_priv->device,
++			    mad_priv->header.mapping,
++			    mad_priv_dma_size(mad_priv), DMA_FROM_DEVICE);
++free_mad_priv:
++	kfree(mad_priv);
+ 	return ret;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/iio-accel-mma8452-ensure-error-return-on-failure-to-.patch b/queue-6.6/iio-accel-mma8452-ensure-error-return-on-failure-to-.patch
new file mode 100644
index 0000000000..1b52b97b7e
--- /dev/null
+++ b/queue-6.6/iio-accel-mma8452-ensure-error-return-on-failure-to-.patch
@@ -0,0 +1,61 @@
+From 7ec75911866a970724ec85498fae3ab936f4d5f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 14:01:28 +0000
+Subject: iio: accel: mma8452: Ensure error return on failure to matching
+ oversampling ratio
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit df330c808182a8beab5d0f84a6cbc9cff76c61fc ]
+
+If a match was not found, then the write_raw() callback would return
+the odr index, not an error. Return -EINVAL if this occurs.
+To avoid similar issues in future, introduce j, a new indexing variable
+rather than using ret for this purpose.
+
+Fixes: 79de2ee469aa ("iio: accel: mma8452: claim direct mode during write raw")
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250217140135.896574-2-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/mma8452.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
+index f42a887114865..16a0de6002be0 100644
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -711,7 +711,7 @@ static int mma8452_write_raw(struct iio_dev *indio_dev,
+ 			     int val, int val2, long mask)
+ {
+ 	struct mma8452_data *data = iio_priv(indio_dev);
+-	int i, ret;
++	int i, j, ret;
+ 
+ 	ret = iio_device_claim_direct_mode(indio_dev);
+ 	if (ret)
+@@ -771,14 +771,18 @@ static int mma8452_write_raw(struct iio_dev *indio_dev,
+ 		break;
+ 
+ 	case IIO_CHAN_INFO_OVERSAMPLING_RATIO:
+-		ret = mma8452_get_odr_index(data);
++		j = mma8452_get_odr_index(data);
+ 
+ 		for (i = 0; i < ARRAY_SIZE(mma8452_os_ratio); i++) {
+-			if (mma8452_os_ratio[i][ret] == val) {
++			if (mma8452_os_ratio[i][j] == val) {
+ 				ret = mma8452_set_power_mode(data, i);
+ 				break;
+ 			}
+ 		}
++		if (i == ARRAY_SIZE(mma8452_os_ratio)) {
++			ret = -EINVAL;
++			break;
++		}
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+-- 
+2.39.5
+
diff --git a/queue-6.6/iio-accel-msa311-fix-failure-to-release-runtime-pm-i.patch b/queue-6.6/iio-accel-msa311-fix-failure-to-release-runtime-pm-i.patch
new file mode 100644
index 0000000000..a10387eebc
--- /dev/null
+++ b/queue-6.6/iio-accel-msa311-fix-failure-to-release-runtime-pm-i.patch
@@ -0,0 +1,100 @@
+From 3b2154a34c3876c6264d099a6f5e814c7f66412f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 14:01:33 +0000
+Subject: iio: accel: msa311: Fix failure to release runtime pm if direct mode
+ claim fails.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 60a0cf2ebab92011055ab7db6553c0fc3c546938 ]
+
+Reorder the claiming of direct mode and runtime pm calls to simplify
+handling a little.  For correct error handling, after the reorder
+iio_device_release_direct_mode() must be claimed in an error occurs
+in pm_runtime_resume_and_get()
+
+Fixes: 1ca2cfbc0c33 ("iio: add MEMSensing MSA311 3-axis accelerometer driver")
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250217140135.896574-7-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/msa311.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iio/accel/msa311.c b/drivers/iio/accel/msa311.c
+index 6ddcc3c2f8409..5927df633e1f9 100644
+--- a/drivers/iio/accel/msa311.c
++++ b/drivers/iio/accel/msa311.c
+@@ -593,23 +593,25 @@ static int msa311_read_raw_data(struct iio_dev *indio_dev,
+ 	__le16 axis;
+ 	int err;
+ 
+-	err = pm_runtime_resume_and_get(dev);
++	err = iio_device_claim_direct_mode(indio_dev);
+ 	if (err)
+ 		return err;
+ 
+-	err = iio_device_claim_direct_mode(indio_dev);
+-	if (err)
++	err = pm_runtime_resume_and_get(dev);
++	if (err) {
++		iio_device_release_direct_mode(indio_dev);
+ 		return err;
++	}
+ 
+ 	mutex_lock(&msa311->lock);
+ 	err = msa311_get_axis(msa311, chan, &axis);
+ 	mutex_unlock(&msa311->lock);
+ 
+-	iio_device_release_direct_mode(indio_dev);
+-
+ 	pm_runtime_mark_last_busy(dev);
+ 	pm_runtime_put_autosuspend(dev);
+ 
++	iio_device_release_direct_mode(indio_dev);
++
+ 	if (err) {
+ 		dev_err(dev, "can't get axis %s (%pe)\n",
+ 			chan->datasheet_name, ERR_PTR(err));
+@@ -755,10 +757,6 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)
+ 	unsigned int odr;
+ 	int err;
+ 
+-	err = pm_runtime_resume_and_get(dev);
+-	if (err)
+-		return err;
+-
+ 	/*
+ 	 * Sampling frequency changing is prohibited when buffer mode is
+ 	 * enabled, because sometimes MSA311 chip returns outliers during
+@@ -768,6 +766,12 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)
+ 	if (err)
+ 		return err;
+ 
++	err = pm_runtime_resume_and_get(dev);
++	if (err) {
++		iio_device_release_direct_mode(indio_dev);
++		return err;
++	}
++
+ 	err = -EINVAL;
+ 	for (odr = 0; odr < ARRAY_SIZE(msa311_odr_table); odr++)
+ 		if (val == msa311_odr_table[odr].integral &&
+@@ -778,11 +782,11 @@ static int msa311_write_samp_freq(struct iio_dev *indio_dev, int val, int val2)
+ 			break;
+ 		}
+ 
+-	iio_device_release_direct_mode(indio_dev);
+-
+ 	pm_runtime_mark_last_busy(dev);
+ 	pm_runtime_put_autosuspend(dev);
+ 
++	iio_device_release_direct_mode(indio_dev);
++
+ 	if (err)
+ 		dev_err(dev, "can't update frequency (%pe)\n", ERR_PTR(err));
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/iio-adc-ad4130-fix-comparison-of-channel-setups.patch b/queue-6.6/iio-adc-ad4130-fix-comparison-of-channel-setups.patch
new file mode 100644
index 0000000000..afa73139a8
--- /dev/null
+++ b/queue-6.6/iio-adc-ad4130-fix-comparison-of-channel-setups.patch
@@ -0,0 +1,109 @@
+From ccc0501001b8d3827cfd1db553de9346bffc514b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 12:47:00 +0100
+Subject: iio: adc: ad4130: Fix comparison of channel setups
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 280acb19824663d55a3f4d09087c76fabe86fa3c ]
+
+Checking the binary representation of two structs (of the same type)
+for equality doesn't have the same semantic as comparing all members for
+equality. The former might find a difference where the latter doesn't in
+the presence of padding or when ambiguous types like float or bool are
+involved. (Floats typically have different representations for single
+values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has
+at least 8 bits and the raw values 1 and 2 (probably) both evaluate to
+true, but memcmp finds a difference.)
+
+When searching for a channel that already has the configuration we need,
+the comparison by member is the one that is needed.
+
+Convert the comparison accordingly to compare the members one after
+another. Also add a static_assert guard to (somewhat) ensure that when
+struct ad4130_setup_info is expanded, the comparison is adapted, too.
+
+This issue is somewhat theoretic, but using memcmp() on a struct is a
+bad pattern that is worth fixing.
+
+Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://patch.msgid.link/20250303114659.1672695-12-u.kleine-koenig@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad4130.c | 41 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 39 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c
+index e650ebd167b03..6442218628518 100644
+--- a/drivers/iio/adc/ad4130.c
++++ b/drivers/iio/adc/ad4130.c
+@@ -223,6 +223,10 @@ enum ad4130_pin_function {
+ 	AD4130_PIN_FN_VBIAS = BIT(3),
+ };
+ 
++/*
++ * If you make adaptations in this struct, you most likely also have to adapt
++ * ad4130_setup_info_eq(), too.
++ */
+ struct ad4130_setup_info {
+ 	unsigned int			iout0_val;
+ 	unsigned int			iout1_val;
+@@ -591,6 +595,40 @@ static irqreturn_t ad4130_irq_handler(int irq, void *private)
+ 	return IRQ_HANDLED;
+ }
+ 
++static bool ad4130_setup_info_eq(struct ad4130_setup_info *a,
++				 struct ad4130_setup_info *b)
++{
++	/*
++	 * This is just to make sure that the comparison is adapted after
++	 * struct ad4130_setup_info was changed.
++	 */
++	static_assert(sizeof(*a) ==
++		      sizeof(struct {
++				     unsigned int iout0_val;
++				     unsigned int iout1_val;
++				     unsigned int burnout;
++				     unsigned int pga;
++				     unsigned int fs;
++				     u32 ref_sel;
++				     enum ad4130_filter_mode filter_mode;
++				     bool ref_bufp;
++				     bool ref_bufm;
++			     }));
++
++	if (a->iout0_val != b->iout0_val ||
++	    a->iout1_val != b->iout1_val ||
++	    a->burnout != b->burnout ||
++	    a->pga != b->pga ||
++	    a->fs != b->fs ||
++	    a->ref_sel != b->ref_sel ||
++	    a->filter_mode != b->filter_mode ||
++	    a->ref_bufp != b->ref_bufp ||
++	    a->ref_bufm != b->ref_bufm)
++		return false;
++
++	return true;
++}
++
+ static int ad4130_find_slot(struct ad4130_state *st,
+ 			    struct ad4130_setup_info *target_setup_info,
+ 			    unsigned int *slot, bool *overwrite)
+@@ -604,8 +642,7 @@ static int ad4130_find_slot(struct ad4130_state *st,
+ 		struct ad4130_slot_info *slot_info = &st->slots_info[i];
+ 
+ 		/* Immediately accept a matching setup info. */
+-		if (!memcmp(target_setup_info, &slot_info->setup,
+-			    sizeof(*target_setup_info))) {
++		if (ad4130_setup_info_eq(target_setup_info, &slot_info->setup)) {
+ 			*slot = i;
+ 			return 0;
+ 		}
+-- 
+2.39.5
+
diff --git a/queue-6.6/iio-adc-ad7124-fix-comparison-of-channel-configs.patch b/queue-6.6/iio-adc-ad7124-fix-comparison-of-channel-configs.patch
new file mode 100644
index 0000000000..fb57efbc08
--- /dev/null
+++ b/queue-6.6/iio-adc-ad7124-fix-comparison-of-channel-configs.patch
@@ -0,0 +1,103 @@
+From 5a7a32258f94bd55e581d2b1c0ffb73dcce99301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 12:47:01 +0100
+Subject: iio: adc: ad7124: Fix comparison of channel configs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+
+[ Upstream commit 05a5d874f7327b75e9bc4359618017e047cc129c ]
+
+Checking the binary representation of two structs (of the same type)
+for equality doesn't have the same semantic as comparing all members for
+equality. The former might find a difference where the latter doesn't in
+the presence of padding or when ambiguous types like float or bool are
+involved. (Floats typically have different representations for single
+values, like -0.0 vs +0.0, or 0.5 * 2² vs 0.25 * 2³. The type bool has
+at least 8 bits and the raw values 1 and 2 (probably) both evaluate to
+true, but memcmp finds a difference.)
+
+When searching for a channel that already has the configuration we need,
+the comparison by member is the one that is needed.
+
+Convert the comparison accordingly to compare the members one after
+another. Also add a static_assert guard to (somewhat) ensure that when
+struct ad7124_channel_config::config_props is expanded, the comparison
+is adapted, too.
+
+This issue is somewhat theoretic, but using memcmp() on a struct is a
+bad pattern that is worth fixing.
+
+Fixes: 7b8d045e497a ("iio: adc: ad7124: allow more than 8 channels")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://patch.msgid.link/20250303114659.1672695-13-u.kleine-koenig@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7124.c | 35 +++++++++++++++++++++++++++++++----
+ 1 file changed, 31 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c
+index d2060d394c8d2..0e6baf017bfd1 100644
+--- a/drivers/iio/adc/ad7124.c
++++ b/drivers/iio/adc/ad7124.c
+@@ -147,7 +147,11 @@ struct ad7124_chip_info {
+ struct ad7124_channel_config {
+ 	bool live;
+ 	unsigned int cfg_slot;
+-	/* Following fields are used to compare equality. */
++	/*
++	 * Following fields are used to compare for equality. If you
++	 * make adaptations in it, you most likely also have to adapt
++	 * ad7124_find_similar_live_cfg(), too.
++	 */
+ 	struct_group(config_props,
+ 		enum ad7124_ref_sel refsel;
+ 		bool bipolar;
+@@ -334,15 +338,38 @@ static struct ad7124_channel_config *ad7124_find_similar_live_cfg(struct ad7124_
+ 								  struct ad7124_channel_config *cfg)
+ {
+ 	struct ad7124_channel_config *cfg_aux;
+-	ptrdiff_t cmp_size;
+ 	int i;
+ 
+-	cmp_size = sizeof_field(struct ad7124_channel_config, config_props);
++	/*
++	 * This is just to make sure that the comparison is adapted after
++	 * struct ad7124_channel_config was changed.
++	 */
++	static_assert(sizeof_field(struct ad7124_channel_config, config_props) ==
++		      sizeof(struct {
++				     enum ad7124_ref_sel refsel;
++				     bool bipolar;
++				     bool buf_positive;
++				     bool buf_negative;
++				     unsigned int vref_mv;
++				     unsigned int pga_bits;
++				     unsigned int odr;
++				     unsigned int odr_sel_bits;
++				     unsigned int filter_type;
++			     }));
++
+ 	for (i = 0; i < st->num_channels; i++) {
+ 		cfg_aux = &st->channels[i].cfg;
+ 
+ 		if (cfg_aux->live &&
+-		    !memcmp(&cfg->config_props, &cfg_aux->config_props, cmp_size))
++		    cfg->refsel == cfg_aux->refsel &&
++		    cfg->bipolar == cfg_aux->bipolar &&
++		    cfg->buf_positive == cfg_aux->buf_positive &&
++		    cfg->buf_negative == cfg_aux->buf_negative &&
++		    cfg->vref_mv == cfg_aux->vref_mv &&
++		    cfg->pga_bits == cfg_aux->pga_bits &&
++		    cfg->odr == cfg_aux->odr &&
++		    cfg->odr_sel_bits == cfg_aux->odr_sel_bits &&
++		    cfg->filter_type == cfg_aux->filter_type)
+ 			return cfg_aux;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/ipv6-do-not-consider-link-down-nexthops-in-path-sele.patch b/queue-6.6/ipv6-do-not-consider-link-down-nexthops-in-path-sele.patch
new file mode 100644
index 0000000000..56369cb920
--- /dev/null
+++ b/queue-6.6/ipv6-do-not-consider-link-down-nexthops-in-path-sele.patch
@@ -0,0 +1,64 @@
+From a3baa267f089be375e32ec415d610ba3affdfaf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 14:42:24 +0300
+Subject: ipv6: Do not consider link down nexthops in path selection
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 8b8e0dd357165e0258d9f9cdab5366720ed2f619 ]
+
+Nexthops whose link is down are not supposed to be considered during
+path selection when the "ignore_routes_with_linkdown" sysctl is set.
+This is done by assigning them a negative region boundary.
+
+However, when comparing the computed hash (unsigned) with the region
+boundary (signed), the negative region boundary is treated as unsigned,
+resulting in incorrect nexthop selection.
+
+Fix by treating the computed hash as signed. Note that the computed hash
+is always in range of [0, 2^31 - 1].
+
+Fixes: 3d709f69a3e7 ("ipv6: Use hash-threshold instead of modulo-N")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20250402114224.293392-3-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 8f8a6970b9b7a..2e98531fa51a3 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -444,6 +444,7 @@ void fib6_select_path(const struct net *net, struct fib6_result *res,
+ {
+ 	struct fib6_info *first, *match = res->f6i;
+ 	struct fib6_info *sibling;
++	int hash;
+ 
+ 	if (!match->nh && (!match->fib6_nsiblings || have_oif_match))
+ 		goto out;
+@@ -470,7 +471,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res,
+ 	if (!first)
+ 		goto out;
+ 
+-	if (fl6->mp_hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) &&
++	hash = fl6->mp_hash;
++	if (hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) &&
+ 	    rt6_score_route(first->fib6_nh, first->fib6_flags, oif,
+ 			    strict) >= 0) {
+ 		match = first;
+@@ -483,7 +485,7 @@ void fib6_select_path(const struct net *net, struct fib6_result *res,
+ 		int nh_upper_bound;
+ 
+ 		nh_upper_bound = atomic_read(&nh->fib_nh_upper_bound);
+-		if (fl6->mp_hash > nh_upper_bound)
++		if (hash > nh_upper_bound)
+ 			continue;
+ 		if (rt6_score_route(nh, sibling->fib6_flags, oif, strict) < 0)
+ 			break;
+-- 
+2.39.5
+
diff --git a/queue-6.6/ipv6-fix-omitted-netlink-attributes-when-using-rtext.patch b/queue-6.6/ipv6-fix-omitted-netlink-attributes-when-using-rtext.patch
new file mode 100644
index 0000000000..4ed32a3ba6
--- /dev/null
+++ b/queue-6.6/ipv6-fix-omitted-netlink-attributes-when-using-rtext.patch
@@ -0,0 +1,87 @@
+From 76bf136c7139497b842e7047cd08f2c4e260dd30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 14:17:51 +0200
+Subject: ipv6: fix omitted netlink attributes when using
+ RTEXT_FILTER_SKIP_STATS
+
+From: Fernando Fernandez Mancera <ffmancera@riseup.net>
+
+[ Upstream commit 7ac6ea4a3e0898db76aecccd68fb2c403eb7d24e ]
+
+Using RTEXT_FILTER_SKIP_STATS is incorrectly skipping non-stats IPv6
+netlink attributes on link dump. This causes issues on userspace tools,
+e.g iproute2 is not rendering address generation mode as it should due
+to missing netlink attribute.
+
+Move the filling of IFLA_INET6_STATS and IFLA_INET6_ICMP6STATS to a
+helper function guarded by a flag check to avoid hitting the same
+situation in the future.
+
+Fixes: d5566fd72ec1 ("rtnetlink: RTEXT_FILTER_SKIP_STATS support to avoid dumping inet/inet6 stats")
+Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250402121751.3108-1-ffmancera@riseup.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 37 +++++++++++++++++++++++++------------
+ 1 file changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 8360939acf85a..bb9add46e382a 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -5750,6 +5750,27 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
+ 	}
+ }
+ 
++static int inet6_fill_ifla6_stats_attrs(struct sk_buff *skb,
++					struct inet6_dev *idev)
++{
++	struct nlattr *nla;
++
++	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
++	if (!nla)
++		goto nla_put_failure;
++	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
++
++	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
++	if (!nla)
++		goto nla_put_failure;
++	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
++
++	return 0;
++
++nla_put_failure:
++	return -EMSGSIZE;
++}
++
+ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev,
+ 				  u32 ext_filter_mask)
+ {
+@@ -5771,18 +5792,10 @@ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev,
+ 
+ 	/* XXX - MC not implemented */
+ 
+-	if (ext_filter_mask & RTEXT_FILTER_SKIP_STATS)
+-		return 0;
+-
+-	nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
+-	if (!nla)
+-		goto nla_put_failure;
+-	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
+-
+-	nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
+-	if (!nla)
+-		goto nla_put_failure;
+-	snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
++	if (!(ext_filter_mask & RTEXT_FILTER_SKIP_STATS)) {
++		if (inet6_fill_ifla6_stats_attrs(skb, idev) < 0)
++			goto nla_put_failure;
++	}
+ 
+ 	nla = nla_reserve(skb, IFLA_INET6_TOKEN, sizeof(struct in6_addr));
+ 	if (!nla)
+-- 
+2.39.5
+
diff --git a/queue-6.6/ipv6-start-path-selection-from-the-first-nexthop.patch b/queue-6.6/ipv6-start-path-selection-from-the-first-nexthop.patch
new file mode 100644
index 0000000000..0550d5da4d
--- /dev/null
+++ b/queue-6.6/ipv6-start-path-selection-from-the-first-nexthop.patch
@@ -0,0 +1,101 @@
+From 8b4893578ab9130bfa5ef79bcb4277bdbd6286e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 14:42:23 +0300
+Subject: ipv6: Start path selection from the first nexthop
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 4d0ab3a6885e3e9040310a8d8f54503366083626 ]
+
+Cited commit transitioned IPv6 path selection to use hash-threshold
+instead of modulo-N. With hash-threshold, each nexthop is assigned a
+region boundary in the multipath hash function's output space and a
+nexthop is chosen if the calculated hash is smaller than the nexthop's
+region boundary.
+
+Hash-threshold does not work correctly if path selection does not start
+with the first nexthop. For example, if fib6_select_path() is always
+passed the last nexthop in the group, then it will always be chosen
+because its region boundary covers the entire hash function's output
+space.
+
+Fix this by starting the selection process from the first nexthop and do
+not consider nexthops for which rt6_score_route() provided a negative
+score.
+
+Fixes: 3d709f69a3e7 ("ipv6: Use hash-threshold instead of modulo-N")
+Reported-by: Stanislav Fomichev <stfomichev@gmail.com>
+Closes: https://lore.kernel.org/netdev/Z9RIyKZDNoka53EO@mini-arch/
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250402114224.293392-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 38 +++++++++++++++++++++++++++++++++++---
+ 1 file changed, 35 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 3ab5ea55ff8c3..8f8a6970b9b7a 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -414,11 +414,35 @@ static bool rt6_check_expired(const struct rt6_info *rt)
+ 	return false;
+ }
+ 
++static struct fib6_info *
++rt6_multipath_first_sibling_rcu(const struct fib6_info *rt)
++{
++	struct fib6_info *iter;
++	struct fib6_node *fn;
++
++	fn = rcu_dereference(rt->fib6_node);
++	if (!fn)
++		goto out;
++	iter = rcu_dereference(fn->leaf);
++	if (!iter)
++		goto out;
++
++	while (iter) {
++		if (iter->fib6_metric == rt->fib6_metric &&
++		    rt6_qualify_for_ecmp(iter))
++			return iter;
++		iter = rcu_dereference(iter->fib6_next);
++	}
++
++out:
++	return NULL;
++}
++
+ void fib6_select_path(const struct net *net, struct fib6_result *res,
+ 		      struct flowi6 *fl6, int oif, bool have_oif_match,
+ 		      const struct sk_buff *skb, int strict)
+ {
+-	struct fib6_info *match = res->f6i;
++	struct fib6_info *first, *match = res->f6i;
+ 	struct fib6_info *sibling;
+ 
+ 	if (!match->nh && (!match->fib6_nsiblings || have_oif_match))
+@@ -442,10 +466,18 @@ void fib6_select_path(const struct net *net, struct fib6_result *res,
+ 		return;
+ 	}
+ 
+-	if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound))
++	first = rt6_multipath_first_sibling_rcu(match);
++	if (!first)
+ 		goto out;
+ 
+-	list_for_each_entry_rcu(sibling, &match->fib6_siblings,
++	if (fl6->mp_hash <= atomic_read(&first->fib6_nh->fib_nh_upper_bound) &&
++	    rt6_score_route(first->fib6_nh, first->fib6_flags, oif,
++			    strict) >= 0) {
++		match = first;
++		goto out;
++	}
++
++	list_for_each_entry_rcu(sibling, &first->fib6_siblings,
+ 				fib6_siblings) {
+ 		const struct fib6_nh *nh = sibling->fib6_nh;
+ 		int nh_upper_bound;
+-- 
+2.39.5
+
diff --git a/queue-6.6/isofs-fix-kmsan-uninit-value-bug-in-do_isofs_readdir.patch b/queue-6.6/isofs-fix-kmsan-uninit-value-bug-in-do_isofs_readdir.patch
new file mode 100644
index 0000000000..ea7531547e
--- /dev/null
+++ b/queue-6.6/isofs-fix-kmsan-uninit-value-bug-in-do_isofs_readdir.patch
@@ -0,0 +1,89 @@
+From eff5f2bbd84ce6c8f01f6c1f4cc7c24ae787c621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Feb 2025 19:59:00 +0000
+Subject: isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+[ Upstream commit 81a82e8f33880793029cd6f8a766fb13b737e6a7 ]
+
+In do_isofs_readdir() when assigning the variable
+"struct iso_directory_record *de" the b_data field of the buffer_head
+is accessed and an offset is added to it, the size of b_data is 2048
+and the offset size is 2047, meaning
+"de = (struct iso_directory_record *) (bh->b_data + offset);"
+yields the final byte of the 2048 sized b_data block.
+
+The first byte of the directory record (de_len) is then read and
+found to be 31, meaning the directory record size is 31 bytes long.
+The directory record is defined by the structure:
+
+	struct iso_directory_record {
+		__u8 length;                     // 1 byte
+		__u8 ext_attr_length;            // 1 byte
+		__u8 extent[8];                  // 8 bytes
+		__u8 size[8];                    // 8 bytes
+		__u8 date[7];                    // 7 bytes
+		__u8 flags;                      // 1 byte
+		__u8 file_unit_size;             // 1 byte
+		__u8 interleave;                 // 1 byte
+		__u8 volume_sequence_number[4];  // 4 bytes
+		__u8 name_len;                   // 1 byte
+		char name[];                     // variable size
+	} __attribute__((packed));
+
+The fixed portion of this structure occupies 33 bytes. Therefore, a
+valid directory record must be at least 33 bytes long
+(even without considering the variable-length name field).
+Since de_len is only 31, it is insufficient to contain
+the complete fixed header.
+
+The code later hits the following sanity check that
+compares de_len against the sum of de->name_len and
+sizeof(struct iso_directory_record):
+
+	if (de_len < de->name_len[0] + sizeof(struct iso_directory_record)) {
+		...
+	}
+
+Since the fixed portion of the structure is
+33 bytes (up to and including name_len member),
+a valid record should have de_len of at least 33 bytes;
+here, however, de_len is too short, and the field de->name_len
+(located at offset 32) is accessed even though it lies beyond
+the available 31 bytes.
+
+This access on the corrupted isofs data triggers a KASAN uninitialized
+memory warning. The fix would be to first verify that de_len is at least
+sizeof(struct iso_directory_record) before accessing any
+fields like de->name_len.
+
+Reported-by: syzbot <syzbot+812641c6c3d7586a1613@syzkaller.appspotmail.com>
+Tested-by: syzbot <syzbot+812641c6c3d7586a1613@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=812641c6c3d7586a1613
+Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem")
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20250211195900.42406-1-qasdev00@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/isofs/dir.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
+index eb2f8273e6f15..09df40b612fbf 100644
+--- a/fs/isofs/dir.c
++++ b/fs/isofs/dir.c
+@@ -147,7 +147,8 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
+ 			de = tmpde;
+ 		}
+ 		/* Basic sanity check, whether name doesn't exceed dir entry */
+-		if (de_len < de->name_len[0] +
++		if (de_len < sizeof(struct iso_directory_record) ||
++		    de_len < de->name_len[0] +
+ 					sizeof(struct iso_directory_record)) {
+ 			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ 			       " in block %lu of inode %lu\n", block,
+-- 
+2.39.5
+
diff --git a/queue-6.6/kernel-events-uprobes-handle-device-exclusive-entrie.patch b/queue-6.6/kernel-events-uprobes-handle-device-exclusive-entrie.patch
new file mode 100644
index 0000000000..576f3bfab5
--- /dev/null
+++ b/queue-6.6/kernel-events-uprobes-handle-device-exclusive-entrie.patch
@@ -0,0 +1,99 @@
+From 90a5fc02a6437ffa4febadb988cec546f0f14a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 20:37:50 +0100
+Subject: kernel/events/uprobes: handle device-exclusive entries correctly in
+ __replace_page()
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit 096cbb80ab3fd85a9035ec17a1312c2a7db8bc8c ]
+
+Ever since commit b756a3b5e7ea ("mm: device exclusive memory access") we
+can return with a device-exclusive entry from page_vma_mapped_walk().
+
+__replace_page() is not prepared for that, so teach it about these PFN
+swap PTEs.  Note that device-private entries are so far not applicable on
+that path, because GUP would never have returned such folios (conversion
+to device-private happens by page migration, not in-place conversion of
+the PTE).
+
+There is a race between GUP and us locking the folio to look it up using
+page_vma_mapped_walk(), so this is likely a fix (unless something else
+could prevent that race, but it doesn't look like).  pte_pfn() on
+something that is not a present pte could give use garbage, and we'd
+wrongly mess up the mapcount because it was already adjusted by calling
+folio_remove_rmap_pte() when making the entry device-exclusive.
+
+Link: https://lkml.kernel.org/r/20250210193801.781278-9-david@redhat.com
+Fixes: b756a3b5e7ea ("mm: device exclusive memory access")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Tested-by: Alistair Popple <apopple@nvidia.com>
+Cc: Alex Shi <alexs@kernel.org>
+Cc: Danilo Krummrich <dakr@kernel.org>
+Cc: Dave Airlie <airlied@gmail.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Jason Gunthorpe <jgg@nvidia.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Karol Herbst <kherbst@redhat.com>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Cc: Lyude <lyude@redhat.com>
+Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: SeongJae Park <sj@kernel.org>
+Cc: Simona Vetter <simona.vetter@ffwll.ch>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Yanteng Si <si.yanteng@linux.dev>
+Cc: Barry Song <v-songbaohua@oppo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index f5dfc2f22d798..a554f43d3ceb9 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -159,6 +159,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
+ 	DEFINE_FOLIO_VMA_WALK(pvmw, old_folio, vma, addr, 0);
+ 	int err;
+ 	struct mmu_notifier_range range;
++	pte_t pte;
+ 
+ 	mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm, addr,
+ 				addr + PAGE_SIZE);
+@@ -178,6 +179,16 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
+ 	if (!page_vma_mapped_walk(&pvmw))
+ 		goto unlock;
+ 	VM_BUG_ON_PAGE(addr != pvmw.address, old_page);
++	pte = ptep_get(pvmw.pte);
++
++	/*
++	 * Handle PFN swap PTES, such as device-exclusive ones, that actually
++	 * map pages: simply trigger GUP again to fix it up.
++	 */
++	if (unlikely(!pte_present(pte))) {
++		page_vma_mapped_walk_done(&pvmw);
++		goto unlock;
++	}
+ 
+ 	if (new_page) {
+ 		folio_get(new_folio);
+@@ -192,7 +203,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
+ 		inc_mm_counter(mm, MM_ANONPAGES);
+ 	}
+ 
+-	flush_cache_page(vma, addr, pte_pfn(ptep_get(pvmw.pte)));
++	flush_cache_page(vma, addr, pte_pfn(pte));
+ 	ptep_clear_flush(vma, addr, pvmw.pte);
+ 	if (new_page)
+ 		set_pte_at_notify(mm, addr, pvmw.pte,
+-- 
+2.39.5
+
diff --git a/queue-6.6/kexec-initialize-elf-lowest-address-to-ulong_max.patch b/queue-6.6/kexec-initialize-elf-lowest-address-to-ulong_max.patch
new file mode 100644
index 0000000000..cee5aed047
--- /dev/null
+++ b/queue-6.6/kexec-initialize-elf-lowest-address-to-ulong_max.patch
@@ -0,0 +1,71 @@
+From cf186f1eaa4588d3d5e78768351cd34ebd799a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2025 17:08:24 +0530
+Subject: kexec: initialize ELF lowest address to ULONG_MAX
+
+From: Sourabh Jain <sourabhjain@linux.ibm.com>
+
+[ Upstream commit 9986fb5164c8b21f6439cfd45ba36d8cc80c9710 ]
+
+Patch series "powerpc/crash: use generic crashkernel reservation", v3.
+
+Commit 0ab97169aa05 ("crash_core: add generic function to do reservation")
+added a generic function to reserve crashkernel memory.  So let's use the
+same function on powerpc and remove the architecture-specific code that
+essentially does the same thing.
+
+The generic crashkernel reservation also provides a way to split the
+crashkernel reservation into high and low memory reservations, which can
+be enabled for powerpc in the future.
+
+Additionally move powerpc to use generic APIs to locate memory hole for
+kexec segments while loading kdump kernel.
+
+This patch (of 7):
+
+kexec_elf_load() loads an ELF executable and sets the address of the
+lowest PT_LOAD section to the address held by the lowest_load_addr
+function argument.
+
+To determine the lowest PT_LOAD address, a local variable lowest_addr
+(type unsigned long) is initialized to UINT_MAX.  After loading each
+PT_LOAD, its address is compared to lowest_addr.  If a loaded PT_LOAD
+address is lower, lowest_addr is updated.  However, setting lowest_addr to
+UINT_MAX won't work when the kernel image is loaded above 4G, as the
+returned lowest PT_LOAD address would be invalid.  This is resolved by
+initializing lowest_addr to ULONG_MAX instead.
+
+This issue was discovered while implementing crashkernel high/low
+reservation on the PowerPC architecture.
+
+Link: https://lkml.kernel.org/r/20250131113830.925179-1-sourabhjain@linux.ibm.com
+Link: https://lkml.kernel.org/r/20250131113830.925179-2-sourabhjain@linux.ibm.com
+Fixes: a0458284f062 ("powerpc: Add support code for kexec_file_load()")
+Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
+Acked-by: Hari Bathini <hbathini@linux.ibm.com>
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kexec_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/kexec_elf.c b/kernel/kexec_elf.c
+index d3689632e8b90..3a5c25b2adc94 100644
+--- a/kernel/kexec_elf.c
++++ b/kernel/kexec_elf.c
+@@ -390,7 +390,7 @@ int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,
+ 			 struct kexec_buf *kbuf,
+ 			 unsigned long *lowest_load_addr)
+ {
+-	unsigned long lowest_addr = UINT_MAX;
++	unsigned long lowest_addr = ULONG_MAX;
+ 	int ret;
+ 	size_t i;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/ksmbd-fix-multichannel-connection-failure.patch b/queue-6.6/ksmbd-fix-multichannel-connection-failure.patch
new file mode 100644
index 0000000000..07b6d77ed9
--- /dev/null
+++ b/queue-6.6/ksmbd-fix-multichannel-connection-failure.patch
@@ -0,0 +1,127 @@
+From 14b7d39f55e745dfe60f0f3ae46dbd3b6a211241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 20:19:20 +0900
+Subject: ksmbd: fix multichannel connection failure
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit c1883049aa9b2b7dffd3a68c5fc67fa92c174bd9 ]
+
+ksmbd check that the session of second channel is in the session list of
+first connection. If it is in session list, multichannel connection
+should not be allowed.
+
+Fixes: b95629435b84 ("ksmbd: fix racy issue from session lookup and expire")
+Reported-by: Sean Heelan <seanheelan@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/mgmt/user_session.c | 16 ++++++++++++++++
+ fs/smb/server/mgmt/user_session.h |  2 ++
+ fs/smb/server/smb2pdu.c           | 12 ++++--------
+ 3 files changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
+index 9a134181df61f..1ea219cbb4a18 100644
+--- a/fs/smb/server/mgmt/user_session.c
++++ b/fs/smb/server/mgmt/user_session.c
+@@ -255,6 +255,22 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
+ 	up_write(&sessions_table_lock);
+ }
+ 
++bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
++				   unsigned long long id)
++{
++	struct ksmbd_session *sess;
++
++	down_read(&conn->session_lock);
++	sess = xa_load(&conn->sessions, id);
++	if (sess) {
++		up_read(&conn->session_lock);
++		return true;
++	}
++	up_read(&conn->session_lock);
++
++	return false;
++}
++
+ struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
+ 					   unsigned long long id)
+ {
+diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h
+index c1c4b20bd5c6c..f21348381d598 100644
+--- a/fs/smb/server/mgmt/user_session.h
++++ b/fs/smb/server/mgmt/user_session.h
+@@ -87,6 +87,8 @@ void ksmbd_session_destroy(struct ksmbd_session *sess);
+ struct ksmbd_session *ksmbd_session_lookup_slowpath(unsigned long long id);
+ struct ksmbd_session *ksmbd_session_lookup(struct ksmbd_conn *conn,
+ 					   unsigned long long id);
++bool is_ksmbd_session_in_connection(struct ksmbd_conn *conn,
++				     unsigned long long id);
+ int ksmbd_session_register(struct ksmbd_conn *conn,
+ 			   struct ksmbd_session *sess);
+ void ksmbd_sessions_deregister(struct ksmbd_conn *conn);
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 58e5cc2b1f3e1..2030052421881 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1707,44 +1707,38 @@ int smb2_sess_setup(struct ksmbd_work *work)
+ 
+ 		if (conn->dialect != sess->dialect) {
+ 			rc = -EINVAL;
+-			ksmbd_user_session_put(sess);
+ 			goto out_err;
+ 		}
+ 
+ 		if (!(req->hdr.Flags & SMB2_FLAGS_SIGNED)) {
+ 			rc = -EINVAL;
+-			ksmbd_user_session_put(sess);
+ 			goto out_err;
+ 		}
+ 
+ 		if (strncmp(conn->ClientGUID, sess->ClientGUID,
+ 			    SMB2_CLIENT_GUID_SIZE)) {
+ 			rc = -ENOENT;
+-			ksmbd_user_session_put(sess);
+ 			goto out_err;
+ 		}
+ 
+ 		if (sess->state == SMB2_SESSION_IN_PROGRESS) {
+ 			rc = -EACCES;
+-			ksmbd_user_session_put(sess);
+ 			goto out_err;
+ 		}
+ 
+ 		if (sess->state == SMB2_SESSION_EXPIRED) {
+ 			rc = -EFAULT;
+-			ksmbd_user_session_put(sess);
+ 			goto out_err;
+ 		}
+-		ksmbd_user_session_put(sess);
+ 
+ 		if (ksmbd_conn_need_reconnect(conn)) {
+ 			rc = -EFAULT;
++			ksmbd_user_session_put(sess);
+ 			sess = NULL;
+ 			goto out_err;
+ 		}
+ 
+-		sess = ksmbd_session_lookup(conn, sess_id);
+-		if (!sess) {
++		if (is_ksmbd_session_in_connection(conn, sess_id)) {
+ 			rc = -EACCES;
+ 			goto out_err;
+ 		}
+@@ -1910,6 +1904,8 @@ int smb2_sess_setup(struct ksmbd_work *work)
+ 
+ 			sess->last_active = jiffies;
+ 			sess->state = SMB2_SESSION_EXPIRED;
++			ksmbd_user_session_put(sess);
++			work->sess = NULL;
+ 			if (try_delay) {
+ 				ksmbd_conn_set_need_reconnect(conn);
+ 				ssleep(5);
+-- 
+2.39.5
+
diff --git a/queue-6.6/ksmbd-fix-r_count-dec-increment-mismatch.patch b/queue-6.6/ksmbd-fix-r_count-dec-increment-mismatch.patch
new file mode 100644
index 0000000000..a10c7be637
--- /dev/null
+++ b/queue-6.6/ksmbd-fix-r_count-dec-increment-mismatch.patch
@@ -0,0 +1,51 @@
+From dc2a961ed77d2e4513981078f3d10d0140658a1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 00:00:24 +0900
+Subject: ksmbd: fix r_count dec/increment mismatch
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit ddb7ea36ba7129c2ed107e2186591128618864e1 ]
+
+r_count is only increased when there is an oplock break wait,
+so r_count inc/decrement are not paired. This can cause r_count
+to become negative, which can lead to a problem where the ksmbd
+thread does not terminate.
+
+Fixes: 3aa660c05924 ("ksmbd: prevent connection release during oplock break notification")
+Reported-by: Norbert Szetei <norbert@doyensec.com>
+Tested-by: Norbert Szetei <norbert@doyensec.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/oplock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
+index 11e82a14a40ad..d91493e3d7559 100644
+--- a/fs/smb/server/oplock.c
++++ b/fs/smb/server/oplock.c
+@@ -724,8 +724,8 @@ static int smb2_oplock_break_noti(struct oplock_info *opinfo)
+ 	work->conn = conn;
+ 	work->sess = opinfo->sess;
+ 
++	ksmbd_conn_r_count_inc(conn);
+ 	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+-		ksmbd_conn_r_count_inc(conn);
+ 		INIT_WORK(&work->work, __smb2_oplock_break_noti);
+ 		ksmbd_queue_work(work);
+ 
+@@ -833,8 +833,8 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo)
+ 	work->conn = conn;
+ 	work->sess = opinfo->sess;
+ 
++	ksmbd_conn_r_count_inc(conn);
+ 	if (opinfo->op_state == OPLOCK_ACK_WAIT) {
+-		ksmbd_conn_r_count_inc(conn);
+ 		INIT_WORK(&work->work, __smb2_lease_break_noti);
+ 		ksmbd_queue_work(work);
+ 		wait_for_break_ack(opinfo);
+-- 
+2.39.5
+
diff --git a/queue-6.6/ksmbd-use-aead_request_free-to-match-aead_request_al.patch b/queue-6.6/ksmbd-use-aead_request_free-to-match-aead_request_al.patch
new file mode 100644
index 0000000000..7fc8107806
--- /dev/null
+++ b/queue-6.6/ksmbd-use-aead_request_free-to-match-aead_request_al.patch
@@ -0,0 +1,38 @@
+From e027d1e36033c37f345df53594f28b808ac917f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Mar 2025 20:12:34 +0800
+Subject: ksmbd: use aead_request_free to match aead_request_alloc
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 6171063e9d046ffa46f51579b2ca4a43caef581a ]
+
+Use aead_request_free() instead of kfree() to properly free memory
+allocated by aead_request_alloc(). This ensures sensitive crypto data
+is zeroed before being freed.
+
+Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/auth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
+index 58380a986af55..c3baf6537fadb 100644
+--- a/fs/smb/server/auth.c
++++ b/fs/smb/server/auth.c
+@@ -1213,7 +1213,7 @@ int ksmbd_crypt_message(struct ksmbd_work *work, struct kvec *iov,
+ free_sg:
+ 	kfree(sg);
+ free_req:
+-	kfree(req);
++	aead_request_free(req);
+ free_ctx:
+ 	ksmbd_release_crypto_ctx(ctx);
+ 	return rc;
+-- 
+2.39.5
+
diff --git a/queue-6.6/leds-fix-led_off-brightness-race.patch b/queue-6.6/leds-fix-led_off-brightness-race.patch
new file mode 100644
index 0000000000..159dcc65e8
--- /dev/null
+++ b/queue-6.6/leds-fix-led_off-brightness-race.patch
@@ -0,0 +1,108 @@
+From fbe57872db5588cc07e65f4484865764620ec24a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 12:23:17 +0100
+Subject: leds: Fix LED_OFF brightness race
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit 2c70953b6f535f7698ccbf22c1f5ba26cb6c2816 ]
+
+While commit fa15d8c69238 ("leds: Fix set_brightness_delayed() race")
+successfully forces led_set_brightness() to be called with LED_OFF at
+least once when switching from blinking to LED on state so that
+hw-blinking can be disabled, another race remains. Indeed in
+led_set_brightness(LED_OFF) followed by led_set_brightness(any)
+scenario the following CPU scheduling can happen:
+
+    CPU0                                     CPU1
+    ----                                     ----
+ set_brightness_delayed() {
+   test_and_clear_bit(BRIGHTNESS_OFF)
+                                         led_set_brightness(LED_OFF) {
+                                           set_bit(BRIGHTNESS_OFF)
+					   queue_work()
+                                         }
+                                         led_set_brightness(any) {
+                                           set_bit(BRIGHTNESS)
+					   queue_work() //already queued
+                                         }
+   test_and_clear_bit(BRIGHTNESS)
+     /* LED set with brightness any */
+ }
+
+ /* From previous CPU1 queue_work() */
+ set_brightness_delayed() {
+   test_and_clear_bit(BRIGHTNESS_OFF)
+     /* LED turned off */
+   test_and_clear_bit(BRIGHTNESS)
+     /* Clear from previous run, LED remains off */
+
+In that case the led_set_brightness(LED_OFF)/led_set_brightness(any)
+sequence will be effectively executed in reverse order and LED will
+remain off.
+
+With the introduction of commit 32360bf6a5d4 ("leds: Introduce ordered
+workqueue for LEDs events instead of system_wq") the race is easier to
+trigger as sysfs brightness configuration does not wait for
+set_brightness_delayed() work to finish (flush_work() removal).
+
+Use delayed_set_value to optionnally re-configure brightness after a
+LED_OFF. That way a LED state could be configured more that once but
+final state will always be as expected. Ensure that delayed_set_value
+modification is seen before set_bit() using smp_mb__before_atomic().
+
+Fixes: fa15d8c69238 ("leds: Fix set_brightness_delayed() race")
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/19c81177059dab7b656c42063958011a8e4d1a66.1740050412.git.repk@triplefau.lt
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-core.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
+index 214ed81eb0e92..136cb7f7469b6 100644
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -147,8 +147,19 @@ static void set_brightness_delayed(struct work_struct *ws)
+ 	 * before this work item runs once. To make sure this works properly
+ 	 * handle LED_SET_BRIGHTNESS_OFF first.
+ 	 */
+-	if (test_and_clear_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags))
++	if (test_and_clear_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags)) {
+ 		set_brightness_delayed_set_brightness(led_cdev, LED_OFF);
++		/*
++		 * The consecutives led_set_brightness(LED_OFF),
++		 * led_set_brightness(LED_FULL) could have been executed out of
++		 * order (LED_FULL first), if the work_flags has been set
++		 * between LED_SET_BRIGHTNESS_OFF and LED_SET_BRIGHTNESS of this
++		 * work. To avoid ending with the LED turned off, turn the LED
++		 * on again.
++		 */
++		if (led_cdev->delayed_set_value != LED_OFF)
++			set_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags);
++	}
+ 
+ 	if (test_and_clear_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags))
+ 		set_brightness_delayed_set_brightness(led_cdev, led_cdev->delayed_set_value);
+@@ -319,10 +330,13 @@ void led_set_brightness_nopm(struct led_classdev *led_cdev, unsigned int value)
+ 	 * change is done immediately afterwards (before the work runs),
+ 	 * it uses a separate work_flag.
+ 	 */
+-	if (value) {
+-		led_cdev->delayed_set_value = value;
++	led_cdev->delayed_set_value = value;
++	/* Ensure delayed_set_value is seen before work_flags modification */
++	smp_mb__before_atomic();
++
++	if (value)
+ 		set_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags);
+-	} else {
++	else {
+ 		clear_bit(LED_SET_BRIGHTNESS, &led_cdev->work_flags);
+ 		clear_bit(LED_SET_BLINK, &led_cdev->work_flags);
+ 		set_bit(LED_SET_BRIGHTNESS_OFF, &led_cdev->work_flags);
+-- 
+2.39.5
+
diff --git a/queue-6.6/lib-842-improve-error-handling-in-sw842_compress.patch b/queue-6.6/lib-842-improve-error-handling-in-sw842_compress.patch
new file mode 100644
index 0000000000..5d3f00080c
--- /dev/null
+++ b/queue-6.6/lib-842-improve-error-handling-in-sw842_compress.patch
@@ -0,0 +1,44 @@
+From 628a39d0993cd3009f50df2404b1014afbd80b06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 19:42:04 +0530
+Subject: lib: 842: Improve error handling in sw842_compress()
+
+From: Tanya Agarwal <tanyaagarwal25699@gmail.com>
+
+[ Upstream commit af324dc0e2b558678aec42260cce38be16cc77ca ]
+
+The static code analysis tool "Coverity Scan" pointed the following
+implementation details out for further development considerations:
+CID 1309755: Unused value
+In sw842_compress: A value assigned to a variable is never used. (CWE-563)
+returned_value: Assigning value from add_repeat_template(p, repeat_count)
+to ret here, but that stored value is overwritten before it can be used.
+
+Conclusion:
+Add error handling for the return value from an add_repeat_template()
+call.
+
+Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
+Signed-off-by: Tanya Agarwal <tanyaagarwal25699@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/842/842_compress.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c
+index c02baa4168e16..055356508d97c 100644
+--- a/lib/842/842_compress.c
++++ b/lib/842/842_compress.c
+@@ -532,6 +532,8 @@ int sw842_compress(const u8 *in, unsigned int ilen,
+ 		}
+ 		if (repeat_count) {
+ 			ret = add_repeat_template(p, repeat_count);
++			if (ret)
++				return ret;
+ 			repeat_count = 0;
+ 			if (next == last) /* reached max repeat bits */
+ 				goto repeat;
+-- 
+2.39.5
+
diff --git a/queue-6.6/libbpf-fix-hypothetical-stt_section-extern-null-dere.patch b/queue-6.6/libbpf-fix-hypothetical-stt_section-extern-null-dere.patch
new file mode 100644
index 0000000000..54a609512f
--- /dev/null
+++ b/queue-6.6/libbpf-fix-hypothetical-stt_section-extern-null-dere.patch
@@ -0,0 +1,41 @@
+From 2d7052ce71ed5f62f1309e2a2c2eb83d4ee2a02f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 16:28:21 -0800
+Subject: libbpf: Fix hypothetical STT_SECTION extern NULL deref case
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit e0525cd72b5979d8089fe524a071ea93fd011dc9 ]
+
+Fix theoretical NULL dereference in linker when resolving *extern*
+STT_SECTION symbol against not-yet-existing ELF section. Not sure if
+it's possible in practice for valid ELF object files (this would require
+embedded assembly manipulations, at which point BTF will be missing),
+but fix the s/dst_sym/dst_sec/ typo guarding this condition anyways.
+
+Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs")
+Fixes: a46349227cd8 ("libbpf: Add linker extern resolution support for functions and global variables")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20250220002821.834400-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/linker.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
+index 736ebceea233f..a3a190d13db8a 100644
+--- a/tools/lib/bpf/linker.c
++++ b/tools/lib/bpf/linker.c
+@@ -1974,7 +1974,7 @@ static int linker_append_elf_sym(struct bpf_linker *linker, struct src_obj *obj,
+ 
+ 	obj->sym_map[src_sym_idx] = dst_sym_idx;
+ 
+-	if (sym_type == STT_SECTION && dst_sym) {
++	if (sym_type == STT_SECTION && dst_sec) {
+ 		dst_sec->sec_sym_idx = dst_sym_idx;
+ 		dst_sym->st_value = 0;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/lockdep-don-t-disable-interrupts-on-rt-in-disable_ir.patch b/queue-6.6/lockdep-don-t-disable-interrupts-on-rt-in-disable_ir.patch
new file mode 100644
index 0000000000..723919ff24
--- /dev/null
+++ b/queue-6.6/lockdep-don-t-disable-interrupts-on-rt-in-disable_ir.patch
@@ -0,0 +1,82 @@
+From f10a44ff6e61e9d487308a1d20fe4867eae8adf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 11:36:18 +0100
+Subject: lockdep: Don't disable interrupts on RT in
+ disable_irq_nosync_lockdep.*()
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 87886b32d669abc11c7be95ef44099215e4f5788 ]
+
+disable_irq_nosync_lockdep() disables interrupts with lockdep enabled to
+avoid false positive reports by lockdep that a certain lock has not been
+acquired with disabled interrupts. The user of this macros expects that
+a lock can be acquried without disabling interrupts because the IRQ line
+triggering the interrupt is disabled.
+
+This triggers a warning on PREEMPT_RT because after
+disable_irq_nosync_lockdep.*() the following spinlock_t now is acquired
+with disabled interrupts.
+
+On PREEMPT_RT there is no difference between spin_lock() and
+spin_lock_irq() so avoiding disabling interrupts in this case works for
+the two remaining callers as of today.
+
+Don't disable interrupts on PREEMPT_RT in disable_irq_nosync_lockdep.*().
+
+Closes: https://lore.kernel.org/760e34f9-6034-40e0-82a5-ee9becd24438@roeck-us.net
+Fixes: e8106b941ceab ("[PATCH] lockdep: core, add enable/disable_irq_irqsave/irqrestore() APIs")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Suggested-by: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20250212103619.2560503-2-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/interrupt.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index 4a1dc88ddbff9..2610a7d156da8 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -441,7 +441,7 @@ irq_calc_affinity_vectors(unsigned int minvec, unsigned int maxvec,
+ static inline void disable_irq_nosync_lockdep(unsigned int irq)
+ {
+ 	disable_irq_nosync(irq);
+-#ifdef CONFIG_LOCKDEP
++#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT)
+ 	local_irq_disable();
+ #endif
+ }
+@@ -449,7 +449,7 @@ static inline void disable_irq_nosync_lockdep(unsigned int irq)
+ static inline void disable_irq_nosync_lockdep_irqsave(unsigned int irq, unsigned long *flags)
+ {
+ 	disable_irq_nosync(irq);
+-#ifdef CONFIG_LOCKDEP
++#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT)
+ 	local_irq_save(*flags);
+ #endif
+ }
+@@ -464,7 +464,7 @@ static inline void disable_irq_lockdep(unsigned int irq)
+ 
+ static inline void enable_irq_lockdep(unsigned int irq)
+ {
+-#ifdef CONFIG_LOCKDEP
++#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT)
+ 	local_irq_enable();
+ #endif
+ 	enable_irq(irq);
+@@ -472,7 +472,7 @@ static inline void enable_irq_lockdep(unsigned int irq)
+ 
+ static inline void enable_irq_lockdep_irqrestore(unsigned int irq, unsigned long *flags)
+ {
+-#ifdef CONFIG_LOCKDEP
++#if defined(CONFIG_LOCKDEP) && !defined(CONFIG_PREEMPT_RT)
+ 	local_irq_restore(*flags);
+ #endif
+ 	enable_irq(irq);
+-- 
+2.39.5
+
diff --git a/queue-6.6/lockdep-mm-fix-might_fault-lockdep-check-of-current-.patch b/queue-6.6/lockdep-mm-fix-might_fault-lockdep-check-of-current-.patch
new file mode 100644
index 0000000000..33a78ea3e4
--- /dev/null
+++ b/queue-6.6/lockdep-mm-fix-might_fault-lockdep-check-of-current-.patch
@@ -0,0 +1,52 @@
+From 5c7e9bcf0106da510039bf745c29d08f6e6ec63a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 14:39:10 +0100
+Subject: lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit a1b65f3f7c6f7f0a08a7dba8be458c6415236487 ]
+
+Turns out that this commit, about 10 years ago:
+
+  9ec23531fd48 ("sched/preempt, mm/fault: Trigger might_sleep() in might_fault() with disabled pagefaults")
+
+... accidentally (and unnessecarily) put the lockdep part of
+__might_fault() under CONFIG_DEBUG_ATOMIC_SLEEP=y.
+
+This is potentially notable because large distributions such as
+Ubuntu are running with !CONFIG_DEBUG_ATOMIC_SLEEP.
+
+Restore the debug check.
+
+[ mingo: Update changelog. ]
+
+Fixes: 9ec23531fd48 ("sched/preempt, mm/fault: Trigger might_sleep() in might_fault() with disabled pagefaults")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Link: https://lore.kernel.org/r/20241104135517.536628371@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 65f1865cb461e..c39a45481c443 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -5945,10 +5945,8 @@ void __might_fault(const char *file, int line)
+ 	if (pagefault_disabled())
+ 		return;
+ 	__might_sleep(file, line);
+-#if defined(CONFIG_DEBUG_ATOMIC_SLEEP)
+ 	if (current->mm)
+ 		might_lock_read(&current->mm->mmap_lock);
+-#endif
+ }
+ EXPORT_SYMBOL(__might_fault);
+ #endif
+-- 
+2.39.5
+
diff --git a/queue-6.6/locking-semaphore-use-wake_q-to-wake-up-processes-ou.patch b/queue-6.6/locking-semaphore-use-wake_q-to-wake-up-processes-ou.patch
new file mode 100644
index 0000000000..6be6ca02f4
--- /dev/null
+++ b/queue-6.6/locking-semaphore-use-wake_q-to-wake-up-processes-ou.patch
@@ -0,0 +1,150 @@
+From de40888cb7c5db40ebd6d3b3e62f7bab31d437d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 15:26:52 -0800
+Subject: locking/semaphore: Use wake_q to wake up processes outside lock
+ critical section
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 85b2b9c16d053364e2004883140538e73b333cdb ]
+
+A circular lock dependency splat has been seen involving down_trylock():
+
+  ======================================================
+  WARNING: possible circular locking dependency detected
+  6.12.0-41.el10.s390x+debug
+  ------------------------------------------------------
+  dd/32479 is trying to acquire lock:
+  0015a20accd0d4f8 ((console_sem).lock){-.-.}-{2:2}, at: down_trylock+0x26/0x90
+
+  but task is already holding lock:
+  000000017e461698 (&zone->lock){-.-.}-{2:2}, at: rmqueue_bulk+0xac/0x8f0
+
+  the existing dependency chain (in reverse order) is:
+  -> #4 (&zone->lock){-.-.}-{2:2}:
+  -> #3 (hrtimer_bases.lock){-.-.}-{2:2}:
+  -> #2 (&rq->__lock){-.-.}-{2:2}:
+  -> #1 (&p->pi_lock){-.-.}-{2:2}:
+  -> #0 ((console_sem).lock){-.-.}-{2:2}:
+
+The console_sem -> pi_lock dependency is due to calling try_to_wake_up()
+while holding the console_sem raw_spinlock. This dependency can be broken
+by using wake_q to do the wakeup instead of calling try_to_wake_up()
+under the console_sem lock. This will also make the semaphore's
+raw_spinlock become a terminal lock without taking any further locks
+underneath it.
+
+The hrtimer_bases.lock is a raw_spinlock while zone->lock is a
+spinlock. The hrtimer_bases.lock -> zone->lock dependency happens via
+the debug_objects_fill_pool() helper function in the debugobjects code.
+
+  -> #4 (&zone->lock){-.-.}-{2:2}:
+         __lock_acquire+0xe86/0x1cc0
+         lock_acquire.part.0+0x258/0x630
+         lock_acquire+0xb8/0xe0
+         _raw_spin_lock_irqsave+0xb4/0x120
+         rmqueue_bulk+0xac/0x8f0
+         __rmqueue_pcplist+0x580/0x830
+         rmqueue_pcplist+0xfc/0x470
+         rmqueue.isra.0+0xdec/0x11b0
+         get_page_from_freelist+0x2ee/0xeb0
+         __alloc_pages_noprof+0x2c2/0x520
+         alloc_pages_mpol_noprof+0x1fc/0x4d0
+         alloc_pages_noprof+0x8c/0xe0
+         allocate_slab+0x320/0x460
+         ___slab_alloc+0xa58/0x12b0
+         __slab_alloc.isra.0+0x42/0x60
+         kmem_cache_alloc_noprof+0x304/0x350
+         fill_pool+0xf6/0x450
+         debug_object_activate+0xfe/0x360
+         enqueue_hrtimer+0x34/0x190
+         __run_hrtimer+0x3c8/0x4c0
+         __hrtimer_run_queues+0x1b2/0x260
+         hrtimer_interrupt+0x316/0x760
+         do_IRQ+0x9a/0xe0
+         do_irq_async+0xf6/0x160
+
+Normally a raw_spinlock to spinlock dependency is not legitimate
+and will be warned if CONFIG_PROVE_RAW_LOCK_NESTING is enabled,
+but debug_objects_fill_pool() is an exception as it explicitly
+allows this dependency for non-PREEMPT_RT kernel without causing
+PROVE_RAW_LOCK_NESTING lockdep splat. As a result, this dependency is
+legitimate and not a bug.
+
+Anyway, semaphore is the only locking primitive left that is still
+using try_to_wake_up() to do wakeup inside critical section, all the
+other locking primitives had been migrated to use wake_q to do wakeup
+outside of the critical section. It is also possible that there are
+other circular locking dependencies involving printk/console_sem or
+other existing/new semaphores lurking somewhere which may show up in
+the future. Let just do the migration now to wake_q to avoid headache
+like this.
+
+Reported-by: yzbot+ed801a886dfdbfe7136d@syzkaller.appspotmail.com
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250307232717.1759087-3-boqun.feng@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/semaphore.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/locking/semaphore.c b/kernel/locking/semaphore.c
+index 34bfae72f2952..de9117c0e671e 100644
+--- a/kernel/locking/semaphore.c
++++ b/kernel/locking/semaphore.c
+@@ -29,6 +29,7 @@
+ #include <linux/export.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
++#include <linux/sched/wake_q.h>
+ #include <linux/semaphore.h>
+ #include <linux/spinlock.h>
+ #include <linux/ftrace.h>
+@@ -38,7 +39,7 @@ static noinline void __down(struct semaphore *sem);
+ static noinline int __down_interruptible(struct semaphore *sem);
+ static noinline int __down_killable(struct semaphore *sem);
+ static noinline int __down_timeout(struct semaphore *sem, long timeout);
+-static noinline void __up(struct semaphore *sem);
++static noinline void __up(struct semaphore *sem, struct wake_q_head *wake_q);
+ 
+ /**
+  * down - acquire the semaphore
+@@ -183,13 +184,16 @@ EXPORT_SYMBOL(down_timeout);
+ void __sched up(struct semaphore *sem)
+ {
+ 	unsigned long flags;
++	DEFINE_WAKE_Q(wake_q);
+ 
+ 	raw_spin_lock_irqsave(&sem->lock, flags);
+ 	if (likely(list_empty(&sem->wait_list)))
+ 		sem->count++;
+ 	else
+-		__up(sem);
++		__up(sem, &wake_q);
+ 	raw_spin_unlock_irqrestore(&sem->lock, flags);
++	if (!wake_q_empty(&wake_q))
++		wake_up_q(&wake_q);
+ }
+ EXPORT_SYMBOL(up);
+ 
+@@ -269,11 +273,12 @@ static noinline int __sched __down_timeout(struct semaphore *sem, long timeout)
+ 	return __down_common(sem, TASK_UNINTERRUPTIBLE, timeout);
+ }
+ 
+-static noinline void __sched __up(struct semaphore *sem)
++static noinline void __sched __up(struct semaphore *sem,
++				  struct wake_q_head *wake_q)
+ {
+ 	struct semaphore_waiter *waiter = list_first_entry(&sem->wait_list,
+ 						struct semaphore_waiter, list);
+ 	list_del(&waiter->list);
+ 	waiter->up = true;
+-	wake_up_process(waiter->task);
++	wake_q_add(wake_q, waiter->task);
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/loongarch-fix-help-text-of-cmdline_extend-in-kconfig.patch b/queue-6.6/loongarch-fix-help-text-of-cmdline_extend-in-kconfig.patch
new file mode 100644
index 0000000000..bd74eed3a7
--- /dev/null
+++ b/queue-6.6/loongarch-fix-help-text-of-cmdline_extend-in-kconfig.patch
@@ -0,0 +1,41 @@
+From 096de79ca012769098a76f076fbaad629a5a5d8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Mar 2025 16:31:09 +0800
+Subject: LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
+
+[ Upstream commit be216cbc1ddf99a51915414ce147311c0dfd50a2 ]
+
+It is the built-in command line appended to the bootloader command line,
+not the bootloader command line appended to the built-in command line.
+
+Fixes: fa96b57c1490 ("LoongArch: Add build infrastructure")
+Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
+index 9fd8644a9a4c6..623cf80639dec 100644
+--- a/arch/loongarch/Kconfig
++++ b/arch/loongarch/Kconfig
+@@ -356,8 +356,8 @@ config CMDLINE_BOOTLOADER
+ config CMDLINE_EXTEND
+ 	bool "Use built-in to extend bootloader kernel arguments"
+ 	help
+-	  The command-line arguments provided during boot will be
+-	  appended to the built-in command line. This is useful in
++	  The built-in command line will be appended to the command-
++	  line arguments provided during boot. This is useful in
+ 	  cases where the provided arguments are insufficient and
+ 	  you don't want to or cannot modify them.
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/loongarch-rework-the-arch_kgdb_breakpoint-implementa.patch b/queue-6.6/loongarch-rework-the-arch_kgdb_breakpoint-implementa.patch
new file mode 100644
index 0000000000..e32409066c
--- /dev/null
+++ b/queue-6.6/loongarch-rework-the-arch_kgdb_breakpoint-implementa.patch
@@ -0,0 +1,74 @@
+From 724d0403f5ed747369e8669221fb4879c10bc805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Mar 2025 16:31:09 +0800
+Subject: LoongArch: Rework the arch_kgdb_breakpoint() implementation
+
+From: Yuli Wang <wangyuli@uniontech.com>
+
+[ Upstream commit 29c92a41c6d2879c1f62220fe4758dce191bb38f ]
+
+The arch_kgdb_breakpoint() function defines the kgdb_breakinst symbol
+using inline assembly.
+
+1. There's a potential issue where the compiler might inline
+arch_kgdb_breakpoint(), which would then define the kgdb_breakinst
+symbol multiple times, leading to a linker error.
+
+To prevent this, declare arch_kgdb_breakpoint() as noinline.
+
+Fix follow error with LLVM-19 *only* when LTO_CLANG_FULL:
+    LD      vmlinux.o
+  ld.lld-19: error: ld-temp.o <inline asm>:3:1: symbol 'kgdb_breakinst' is already defined
+  kgdb_breakinst: break 2
+  ^
+
+2. Remove "nop" in the inline assembly because it's meaningless for
+LoongArch here.
+
+3. Add "STACK_FRAME_NON_STANDARD" for arch_kgdb_breakpoint() to avoid
+the objtool warning.
+
+Fixes: e14dd076964e ("LoongArch: Add basic KGDB & KDB support")
+Tested-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Co-developed-by: Winston Wen <wentao@uniontech.com>
+Signed-off-by: Winston Wen <wentao@uniontech.com>
+Co-developed-by: Wentao Guan <guanwentao@uniontech.com>
+Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
+Signed-off-by: Yuli Wang <wangyuli@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/kgdb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/loongarch/kernel/kgdb.c b/arch/loongarch/kernel/kgdb.c
+index 445c452d72a79..7be5b4c0c9002 100644
+--- a/arch/loongarch/kernel/kgdb.c
++++ b/arch/loongarch/kernel/kgdb.c
+@@ -8,6 +8,7 @@
+ #include <linux/hw_breakpoint.h>
+ #include <linux/kdebug.h>
+ #include <linux/kgdb.h>
++#include <linux/objtool.h>
+ #include <linux/processor.h>
+ #include <linux/ptrace.h>
+ #include <linux/sched.h>
+@@ -224,13 +225,13 @@ void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
+ 	regs->csr_era = pc;
+ }
+ 
+-void arch_kgdb_breakpoint(void)
++noinline void arch_kgdb_breakpoint(void)
+ {
+ 	__asm__ __volatile__ (			\
+ 		".globl kgdb_breakinst\n\t"	\
+-		"nop\n"				\
+ 		"kgdb_breakinst:\tbreak 2\n\t"); /* BRK_KDB = 2 */
+ }
++STACK_FRAME_NON_STANDARD(arch_kgdb_breakpoint);
+ 
+ /*
+  * Calls linux_debug_hook before the kernel dies. If KGDB is enabled,
+-- 
+2.39.5
+
diff --git a/queue-6.6/mdacon-rework-dependency-list.patch b/queue-6.6/mdacon-rework-dependency-list.patch
new file mode 100644
index 0000000000..ea95044ded
--- /dev/null
+++ b/queue-6.6/mdacon-rework-dependency-list.patch
@@ -0,0 +1,47 @@
+From 8e9f2d217e2e1bb5139f549377a2b32d12f5f5bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2025 17:44:23 +0100
+Subject: mdacon: rework dependency list
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5bbcc7645f4b244ffb5ac6563fbe9d3d42194447 ]
+
+mdacon has roughly the same dependencies as vgacon but expresses them
+as a negative list instead of a positive list, with the only practical
+difference being PowerPC/CHRP, which uses vga16fb instead of vgacon.
+
+The CONFIG_MDA_CONSOLE description advises to only turn it on when vgacon
+is also used because MDA/Hercules-only systems should be using vgacon
+instead, so just change the list to enforce that directly for simplicity.
+
+The probing was broken from 2002 to 2008, this improves on the fix
+that was added then: If vgacon is a loadable module, then mdacon
+cannot be built-in now, and the list of systems that support vgacon
+is carried over.
+
+Fixes: 0b9cf3aa6b1e ("mdacon messing up default vc's - set default to vc13-16 again")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/console/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
+index 30577b1d3de59..cdbcb86ff3944 100644
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -24,7 +24,7 @@ config VGA_CONSOLE
+ 	  Say Y.
+ 
+ config MDA_CONSOLE
+-	depends on !M68K && !PARISC && ISA
++	depends on VGA_CONSOLE && ISA
+ 	tristate "MDA text console (dual-headed)"
+ 	help
+ 	  Say Y here if you have an old MDA or monochrome Hercules graphics
+-- 
+2.39.5
+
diff --git a/queue-6.6/media-platform-allgro-dvt-unregister-v4l2_device-on-.patch b/queue-6.6/media-platform-allgro-dvt-unregister-v4l2_device-on-.patch
new file mode 100644
index 0000000000..297bf89504
--- /dev/null
+++ b/queue-6.6/media-platform-allgro-dvt-unregister-v4l2_device-on-.patch
@@ -0,0 +1,38 @@
+From 7cda5bc4497998993549e3a673e730306cb6111a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 11:06:21 +0900
+Subject: media: platform: allgro-dvt: unregister v4l2_device on the error path
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit c2b96a6818159fba8a3bcc38262da9e77f9b3ec7 ]
+
+In allegro_probe(), the v4l2 device is not unregistered in the error
+path, which results in a memory leak. Fix it by calling
+v4l2_device_unregister() before returning error.
+
+Fixes: d74d4e2359ec ("media: allegro: move driver out of staging")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/allegro-dvt/allegro-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/allegro-dvt/allegro-core.c b/drivers/media/platform/allegro-dvt/allegro-core.c
+index 7dffea2ad88a1..4994a2e65fedc 100644
+--- a/drivers/media/platform/allegro-dvt/allegro-core.c
++++ b/drivers/media/platform/allegro-dvt/allegro-core.c
+@@ -3914,6 +3914,7 @@ static int allegro_probe(struct platform_device *pdev)
+ 	if (ret < 0) {
+ 		v4l2_err(&dev->v4l2_dev,
+ 			 "failed to request firmware: %d\n", ret);
++		v4l2_device_unregister(&dev->v4l2_dev);
+ 		return ret;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/media-verisilicon-hevc-initialize-start_bit-field.patch b/queue-6.6/media-verisilicon-hevc-initialize-start_bit-field.patch
new file mode 100644
index 0000000000..2f4d338c1f
--- /dev/null
+++ b/queue-6.6/media-verisilicon-hevc-initialize-start_bit-field.patch
@@ -0,0 +1,40 @@
+From fa5356e26aad17aa1eb1e0a0f5242676f8036bb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 09:10:52 +0100
+Subject: media: verisilicon: HEVC: Initialize start_bit field
+
+From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+
+[ Upstream commit 7fcb42b3835e90ef18d68555934cf72adaf58402 ]
+
+The HEVC driver needs to set the start_bit field explicitly to avoid
+causing corrupted frames when the VP9 decoder is used in parallel. The
+reason for this problem is that the VP9 and the HEVC decoder share this
+register.
+
+Fixes: cb5dd5a0fa51 ("media: hantro: Introduce G2/HEVC decoder")
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Tested-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
+index a9d4ac84a8d8d..d1971af5f7fa6 100644
+--- a/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
++++ b/drivers/media/platform/verisilicon/hantro_g2_hevc_dec.c
+@@ -517,6 +517,7 @@ static void set_buffers(struct hantro_ctx *ctx)
+ 	hantro_reg_write(vpu, &g2_stream_len, src_len);
+ 	hantro_reg_write(vpu, &g2_strm_buffer_len, src_buf_len);
+ 	hantro_reg_write(vpu, &g2_strm_start_offset, 0);
++	hantro_reg_write(vpu, &g2_start_bit, 0);
+ 	hantro_reg_write(vpu, &g2_write_mvs_e, 1);
+ 
+ 	hantro_write_addr(vpu, G2_TILE_SIZES_ADDR, ctx->hevc_dec.tile_sizes.dma);
+-- 
+2.39.5
+
diff --git a/queue-6.6/memory-omap-gpmc-drop-no-compatible-check.patch b/queue-6.6/memory-omap-gpmc-drop-no-compatible-check.patch
new file mode 100644
index 0000000000..f01ebb6cfd
--- /dev/null
+++ b/queue-6.6/memory-omap-gpmc-drop-no-compatible-check.patch
@@ -0,0 +1,58 @@
+From 4e6ca6342500b57787a7afe266aa3299cbd80201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 15:15:14 +0100
+Subject: memory: omap-gpmc: drop no compatible check
+
+From: Roger Quadros <rogerq@kernel.org>
+
+[ Upstream commit edcccc6892f65eff5fd3027a13976131dc7fd733 ]
+
+We are no longer depending on legacy device trees so
+drop the no compatible check for NAND and OneNAND
+nodes.
+
+Suggested-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
+Link: https://lore.kernel.org/r/20250114-omap-gpmc-drop-no-compatible-check-v1-1-262c8d549732@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/omap-gpmc.c | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index d78f73db37c88..ab0985bb5789a 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -2247,26 +2247,6 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
+ 		goto err;
+ 	}
+ 
+-	if (of_node_name_eq(child, "nand")) {
+-		/* Warn about older DT blobs with no compatible property */
+-		if (!of_property_read_bool(child, "compatible")) {
+-			dev_warn(&pdev->dev,
+-				 "Incompatible NAND node: missing compatible");
+-			ret = -EINVAL;
+-			goto err;
+-		}
+-	}
+-
+-	if (of_node_name_eq(child, "onenand")) {
+-		/* Warn about older DT blobs with no compatible property */
+-		if (!of_property_read_bool(child, "compatible")) {
+-			dev_warn(&pdev->dev,
+-				 "Incompatible OneNAND node: missing compatible");
+-			ret = -EINVAL;
+-			goto err;
+-		}
+-	}
+-
+ 	if (of_match_node(omap_nand_ids, child)) {
+ 		/* NAND specific setup */
+ 		val = 8;
+-- 
+2.39.5
+
diff --git a/queue-6.6/mfd-sm501-switch-to-bit-to-mitigate-integer-overflow.patch b/queue-6.6/mfd-sm501-switch-to-bit-to-mitigate-integer-overflow.patch
new file mode 100644
index 0000000000..30bed1b5f0
--- /dev/null
+++ b/queue-6.6/mfd-sm501-switch-to-bit-to-mitigate-integer-overflow.patch
@@ -0,0 +1,63 @@
+From dd354a95f4041f2d2873bcccdf11ef6c1b82003a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 09:12:06 -0800
+Subject: mfd: sm501: Switch to BIT() to mitigate integer overflows
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 2d8cb9ffe18c2f1e5bd07a19cbce85b26c1d0cf0 ]
+
+If offset end up being high enough, right hand expression in functions
+like sm501_gpio_set() shifted left for that number of bits, may
+not fit in int type.
+
+Just in case, fix that by using BIT() both as an option safe from
+overflow issues and to make this step look similar to other gpio
+drivers.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: f61be273d369 ("sm501: add gpiolib support")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20250115171206.20308-1-n.zhandarovich@fintech.ru
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/sm501.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index 28027982cf693..509dcb226cbfb 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -920,7 +920,7 @@ static void sm501_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+ {
+ 	struct sm501_gpio_chip *smchip = gpiochip_get_data(chip);
+ 	struct sm501_gpio *smgpio = smchip->ourgpio;
+-	unsigned long bit = 1 << offset;
++	unsigned long bit = BIT(offset);
+ 	void __iomem *regs = smchip->regbase;
+ 	unsigned long save;
+ 	unsigned long val;
+@@ -946,7 +946,7 @@ static int sm501_gpio_input(struct gpio_chip *chip, unsigned offset)
+ 	struct sm501_gpio_chip *smchip = gpiochip_get_data(chip);
+ 	struct sm501_gpio *smgpio = smchip->ourgpio;
+ 	void __iomem *regs = smchip->regbase;
+-	unsigned long bit = 1 << offset;
++	unsigned long bit = BIT(offset);
+ 	unsigned long save;
+ 	unsigned long ddr;
+ 
+@@ -971,7 +971,7 @@ static int sm501_gpio_output(struct gpio_chip *chip,
+ {
+ 	struct sm501_gpio_chip *smchip = gpiochip_get_data(chip);
+ 	struct sm501_gpio *smgpio = smchip->ourgpio;
+-	unsigned long bit = 1 << offset;
++	unsigned long bit = BIT(offset);
+ 	void __iomem *regs = smchip->regbase;
+ 	unsigned long save;
+ 	unsigned long val;
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-decrease-cached-dst-counters-in-dst_release.patch b/queue-6.6/net-decrease-cached-dst-counters-in-dst_release.patch
new file mode 100644
index 0000000000..6582620b01
--- /dev/null
+++ b/queue-6.6/net-decrease-cached-dst-counters-in-dst_release.patch
@@ -0,0 +1,61 @@
+From ec2fd51161ae592dc7f8dbb4c252e5517e27c498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 18:36:32 +0100
+Subject: net: decrease cached dst counters in dst_release
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 3a0a3ff6593d670af2451ec363ccb7b18aec0c0a ]
+
+Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in
+dst_release()") moved decrementing the dst count from dst_destroy to
+dst_release to avoid accessing already freed data in case of netns
+dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels
+are used, this fix is incomplete as the same issue will be seen for
+cached dsts:
+
+  Unable to handle kernel paging request at virtual address ffff5aabf6b5c000
+  Call trace:
+   percpu_counter_add_batch+0x3c/0x160 (P)
+   dst_release+0xec/0x108
+   dst_cache_destroy+0x68/0xd8
+   dst_destroy+0x13c/0x168
+   dst_destroy_rcu+0x1c/0xb0
+   rcu_do_batch+0x18c/0x7d0
+   rcu_core+0x174/0x378
+   rcu_core_si+0x18/0x30
+
+Fix this by invalidating the cache, and thus decrementing cached dst
+counters, in dst_release too.
+
+Fixes: d71785ffc7e7 ("net: add dst_cache to ovs vxlan lwtunnel")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Link: https://patch.msgid.link/20250326173634.31096-1-atenart@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dst.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/net/core/dst.c b/net/core/dst.c
+index 137b8d1c72203..aad197e761cb4 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -167,6 +167,14 @@ static void dst_count_dec(struct dst_entry *dst)
+ void dst_release(struct dst_entry *dst)
+ {
+ 	if (dst && rcuref_put(&dst->__rcuref)) {
++#ifdef CONFIG_DST_CACHE
++		if (dst->flags & DST_METADATA) {
++			struct metadata_dst *md_dst = (struct metadata_dst *)dst;
++
++			if (md_dst->type == METADATA_IP_TUNNEL)
++				dst_cache_reset_now(&md_dst->u.tun_info.dst_cache);
++		}
++#endif
+ 		dst_count_dec(dst);
+ 		call_rcu_hurry(&dst->rcu_head, dst_destroy_rcu);
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-dsa-mv88e6xxx-propperly-shutdown-ppu-re-enable-t.patch b/queue-6.6/net-dsa-mv88e6xxx-propperly-shutdown-ppu-re-enable-t.patch
new file mode 100644
index 0000000000..99b835d429
--- /dev/null
+++ b/queue-6.6/net-dsa-mv88e6xxx-propperly-shutdown-ppu-re-enable-t.patch
@@ -0,0 +1,126 @@
+From 4940dfb2ba86824aaff11d01a0e7556f97ce72d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 15:56:37 +0200
+Subject: net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on
+ destroy
+
+From: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
+
+[ Upstream commit a58d882841a0750da3c482cd3d82432b1c7edb77 ]
+
+The mv88e6xxx has an internal PPU that polls PHY state. If we want to
+access the internal PHYs, we need to disable the PPU first. Because
+that is a slow operation, a 10ms timer is used to re-enable it,
+canceled with every access, so bulk operations effectively only
+disable it once and re-enable it some 10ms after the last access.
+
+If a PHY is accessed and then the mv88e6xxx module is removed before
+the 10ms are up, the PPU re-enable ends up accessing a dangling pointer.
+
+This especially affects probing during bootup. The MDIO bus and PHY
+registration may succeed, but registration with the DSA framework
+may fail later on (e.g. because the CPU port depends on another,
+very slow device that isn't done probing yet, returning -EPROBE_DEFER).
+In this case, probe() fails, but the MDIO subsystem may already have
+accessed the MIDO bus or PHYs, arming the timer.
+
+This is fixed as follows:
+ - If probe fails after mv88e6xxx_phy_init(), make sure we also call
+   mv88e6xxx_phy_destroy() before returning
+ - In mv88e6xxx_remove(), make sure we do the teardown in the correct
+   order, calling mv88e6xxx_phy_destroy() after unregistering the
+   switch device.
+ - In mv88e6xxx_phy_destroy(), destroy both the timer and the work item
+   that the timer might schedule, synchronously waiting in case one of
+   the callbacks already fired and destroying the timer first, before
+   waiting for the work item.
+ - Access to the PPU is guarded by a mutex, the worker acquires it
+   with a mutex_trylock(), not proceeding with the expensive shutdown
+   if that fails. We grab the mutex in mv88e6xxx_phy_destroy() to make
+   sure the slow PPU shutdown is already done or won't even enter, when
+   we wait for the work item.
+
+Fixes: 2e5f032095ff ("dsa: add support for the Marvell 88E6131 switch chip")
+Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250401135705.92760-1-david.oberhollenzer@sigma-star.at
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 11 +++++++----
+ drivers/net/dsa/mv88e6xxx/phy.c  |  3 +++
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index a39b33353ca6c..8b01ee3e684a3 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -7156,13 +7156,13 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ 	err = mv88e6xxx_switch_reset(chip);
+ 	mv88e6xxx_reg_unlock(chip);
+ 	if (err)
+-		goto out;
++		goto out_phy;
+ 
+ 	if (np) {
+ 		chip->irq = of_irq_get(np, 0);
+ 		if (chip->irq == -EPROBE_DEFER) {
+ 			err = chip->irq;
+-			goto out;
++			goto out_phy;
+ 		}
+ 	}
+ 
+@@ -7181,7 +7181,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ 	mv88e6xxx_reg_unlock(chip);
+ 
+ 	if (err)
+-		goto out;
++		goto out_phy;
+ 
+ 	if (chip->info->g2_irqs > 0) {
+ 		err = mv88e6xxx_g2_irq_setup(chip);
+@@ -7215,6 +7215,8 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
+ 		mv88e6xxx_g1_irq_free(chip);
+ 	else
+ 		mv88e6xxx_irq_poll_free(chip);
++out_phy:
++	mv88e6xxx_phy_destroy(chip);
+ out:
+ 	if (pdata)
+ 		dev_put(pdata->netdev);
+@@ -7237,7 +7239,6 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
+ 		mv88e6xxx_ptp_free(chip);
+ 	}
+ 
+-	mv88e6xxx_phy_destroy(chip);
+ 	mv88e6xxx_unregister_switch(chip);
+ 
+ 	mv88e6xxx_g1_vtu_prob_irq_free(chip);
+@@ -7250,6 +7251,8 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
+ 		mv88e6xxx_g1_irq_free(chip);
+ 	else
+ 		mv88e6xxx_irq_poll_free(chip);
++
++	mv88e6xxx_phy_destroy(chip);
+ }
+ 
+ static void mv88e6xxx_shutdown(struct mdio_device *mdiodev)
+diff --git a/drivers/net/dsa/mv88e6xxx/phy.c b/drivers/net/dsa/mv88e6xxx/phy.c
+index 8bb88b3d900db..ee9e5d7e52770 100644
+--- a/drivers/net/dsa/mv88e6xxx/phy.c
++++ b/drivers/net/dsa/mv88e6xxx/phy.c
+@@ -229,7 +229,10 @@ static void mv88e6xxx_phy_ppu_state_init(struct mv88e6xxx_chip *chip)
+ 
+ static void mv88e6xxx_phy_ppu_state_destroy(struct mv88e6xxx_chip *chip)
+ {
++	mutex_lock(&chip->ppu_mutex);
+ 	del_timer_sync(&chip->ppu_timer);
++	cancel_work_sync(&chip->ppu_work);
++	mutex_unlock(&chip->ppu_mutex);
+ }
+ 
+ int mv88e6185_phy_ppu_read(struct mv88e6xxx_chip *chip, struct mii_bus *bus,
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-fix-geneve_opt-length-integer-overflow.patch b/queue-6.6/net-fix-geneve_opt-length-integer-overflow.patch
new file mode 100644
index 0000000000..c6176ca4f2
--- /dev/null
+++ b/queue-6.6/net-fix-geneve_opt-length-integer-overflow.patch
@@ -0,0 +1,134 @@
+From 28e5724f2eb5ab3fd795d1fba6e33462262a4b49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 00:56:32 +0800
+Subject: net: fix geneve_opt length integer overflow
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit b27055a08ad4b415dcf15b63034f9cb236f7fb40 ]
+
+struct geneve_opt uses 5 bit length for each single option, which
+means every vary size option should be smaller than 128 bytes.
+
+However, all current related Netlink policies cannot promise this
+length condition and the attacker can exploit a exact 128-byte size
+option to *fake* a zero length option and confuse the parsing logic,
+further achieve heap out-of-bounds read.
+
+One example crash log is like below:
+
+[    3.905425] ==================================================================
+[    3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0
+[    3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177
+[    3.906646]
+[    3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1
+[    3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+[    3.907784] Call Trace:
+[    3.907925]  <TASK>
+[    3.908048]  dump_stack_lvl+0x44/0x5c
+[    3.908258]  print_report+0x184/0x4be
+[    3.909151]  kasan_report+0xc5/0x100
+[    3.909539]  kasan_check_range+0xf3/0x1a0
+[    3.909794]  memcpy+0x1f/0x60
+[    3.909968]  nla_put+0xa9/0xe0
+[    3.910147]  tunnel_key_dump+0x945/0xba0
+[    3.911536]  tcf_action_dump_1+0x1c1/0x340
+[    3.912436]  tcf_action_dump+0x101/0x180
+[    3.912689]  tcf_exts_dump+0x164/0x1e0
+[    3.912905]  fw_dump+0x18b/0x2d0
+[    3.913483]  tcf_fill_node+0x2ee/0x460
+[    3.914778]  tfilter_notify+0xf4/0x180
+[    3.915208]  tc_new_tfilter+0xd51/0x10d0
+[    3.918615]  rtnetlink_rcv_msg+0x4a2/0x560
+[    3.919118]  netlink_rcv_skb+0xcd/0x200
+[    3.919787]  netlink_unicast+0x395/0x530
+[    3.921032]  netlink_sendmsg+0x3d0/0x6d0
+[    3.921987]  __sock_sendmsg+0x99/0xa0
+[    3.922220]  __sys_sendto+0x1b7/0x240
+[    3.922682]  __x64_sys_sendto+0x72/0x90
+[    3.922906]  do_syscall_64+0x5e/0x90
+[    3.923814]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+[    3.924122] RIP: 0033:0x7e83eab84407
+[    3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf
+[    3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
+[    3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407
+[    3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003
+[    3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c
+[    3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0
+[    3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8
+
+Fix these issues by enforing correct length condition in related
+policies.
+
+Fixes: 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts")
+Fixes: 4ece47787077 ("lwtunnel: add options setting and dumping for geneve")
+Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key")
+Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
+Link: https://patch.msgid.link/20250402165632.6958-1-linma@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel_core.c  | 2 +-
+ net/netfilter/nft_tunnel.c | 2 +-
+ net/sched/act_tunnel_key.c | 2 +-
+ net/sched/cls_flower.c     | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
+index fda08e2c72899..deb08cab44640 100644
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -450,7 +450,7 @@ static const struct nla_policy
+ geneve_opt_policy[LWTUNNEL_IP_OPT_GENEVE_MAX + 1] = {
+ 	[LWTUNNEL_IP_OPT_GENEVE_CLASS]	= { .type = NLA_U16 },
+ 	[LWTUNNEL_IP_OPT_GENEVE_TYPE]	= { .type = NLA_U8 },
+-	[LWTUNNEL_IP_OPT_GENEVE_DATA]	= { .type = NLA_BINARY, .len = 128 },
++	[LWTUNNEL_IP_OPT_GENEVE_DATA]	= { .type = NLA_BINARY, .len = 127 },
+ };
+ 
+ static const struct nla_policy
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index e3f5731ebaacf..d499eb3f4f297 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -333,7 +333,7 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr,
+ static const struct nla_policy nft_tunnel_opts_geneve_policy[NFTA_TUNNEL_KEY_GENEVE_MAX + 1] = {
+ 	[NFTA_TUNNEL_KEY_GENEVE_CLASS]	= { .type = NLA_U16 },
+ 	[NFTA_TUNNEL_KEY_GENEVE_TYPE]	= { .type = NLA_U8 },
+-	[NFTA_TUNNEL_KEY_GENEVE_DATA]	= { .type = NLA_BINARY, .len = 128 },
++	[NFTA_TUNNEL_KEY_GENEVE_DATA]	= { .type = NLA_BINARY, .len = 127 },
+ };
+ 
+ static int nft_tunnel_obj_geneve_init(const struct nlattr *attr,
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index 0c8aa7e686eab..99fb869aee91b 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -68,7 +68,7 @@ geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = {
+ 	[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS]	   = { .type = NLA_U16 },
+ 	[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE]	   = { .type = NLA_U8 },
+ 	[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA]	   = { .type = NLA_BINARY,
+-						       .len = 128 },
++						       .len = 127 },
+ };
+ 
+ static const struct nla_policy
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index bcf1b8012b2c3..b00e491e8130d 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -748,7 +748,7 @@ geneve_opt_policy[TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX + 1] = {
+ 	[TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS]      = { .type = NLA_U16 },
+ 	[TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE]       = { .type = NLA_U8 },
+ 	[TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA]       = { .type = NLA_BINARY,
+-						       .len = 128 },
++						       .len = 127 },
+ };
+ 
+ static const struct nla_policy
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-ibmveth-make-veth_pool_store-stop-hanging.patch b/queue-6.6/net-ibmveth-make-veth_pool_store-stop-hanging.patch
new file mode 100644
index 0000000000..1445b12b46
--- /dev/null
+++ b/queue-6.6/net-ibmveth-make-veth_pool_store-stop-hanging.patch
@@ -0,0 +1,211 @@
+From 2bc542af49fdfc6101fd98503480572529001653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Apr 2025 10:44:03 -0500
+Subject: net: ibmveth: make veth_pool_store stop hanging
+
+From: Dave Marquardt <davemarq@linux.ibm.com>
+
+[ Upstream commit 053f3ff67d7feefc75797863f3d84b47ad47086f ]
+
+v2:
+- Created a single error handling unlock and exit in veth_pool_store
+- Greatly expanded commit message with previous explanatory-only text
+
+Summary: Use rtnl_mutex to synchronize veth_pool_store with itself,
+ibmveth_close and ibmveth_open, preventing multiple calls in a row to
+napi_disable.
+
+Background: Two (or more) threads could call veth_pool_store through
+writing to /sys/devices/vio/30000002/pool*/*. You can do this easily
+with a little shell script. This causes a hang.
+
+I configured LOCKDEP, compiled ibmveth.c with DEBUG, and built a new
+kernel. I ran this test again and saw:
+
+    Setting pool0/active to 0
+    Setting pool1/active to 1
+    [   73.911067][ T4365] ibmveth 30000002 eth0: close starting
+    Setting pool1/active to 1
+    Setting pool1/active to 0
+    [   73.911367][ T4366] ibmveth 30000002 eth0: close starting
+    [   73.916056][ T4365] ibmveth 30000002 eth0: close complete
+    [   73.916064][ T4365] ibmveth 30000002 eth0: open starting
+    [  110.808564][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.
+    [  230.808495][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.
+    [  243.683786][  T123] INFO: task stress.sh:4365 blocked for more than 122 seconds.
+    [  243.683827][  T123]       Not tainted 6.14.0-01103-g2df0c02dab82-dirty #8
+    [  243.683833][  T123] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+    [  243.683838][  T123] task:stress.sh       state:D stack:28096 pid:4365  tgid:4365  ppid:4364   task_flags:0x400040 flags:0x00042000
+    [  243.683852][  T123] Call Trace:
+    [  243.683857][  T123] [c00000000c38f690] [0000000000000001] 0x1 (unreliable)
+    [  243.683868][  T123] [c00000000c38f840] [c00000000001f908] __switch_to+0x318/0x4e0
+    [  243.683878][  T123] [c00000000c38f8a0] [c000000001549a70] __schedule+0x500/0x12a0
+    [  243.683888][  T123] [c00000000c38f9a0] [c00000000154a878] schedule+0x68/0x210
+    [  243.683896][  T123] [c00000000c38f9d0] [c00000000154ac80] schedule_preempt_disabled+0x30/0x50
+    [  243.683904][  T123] [c00000000c38fa00] [c00000000154dbb0] __mutex_lock+0x730/0x10f0
+    [  243.683913][  T123] [c00000000c38fb10] [c000000001154d40] napi_enable+0x30/0x60
+    [  243.683921][  T123] [c00000000c38fb40] [c000000000f4ae94] ibmveth_open+0x68/0x5dc
+    [  243.683928][  T123] [c00000000c38fbe0] [c000000000f4aa20] veth_pool_store+0x220/0x270
+    [  243.683936][  T123] [c00000000c38fc70] [c000000000826278] sysfs_kf_write+0x68/0xb0
+    [  243.683944][  T123] [c00000000c38fcb0] [c0000000008240b8] kernfs_fop_write_iter+0x198/0x2d0
+    [  243.683951][  T123] [c00000000c38fd00] [c00000000071b9ac] vfs_write+0x34c/0x650
+    [  243.683958][  T123] [c00000000c38fdc0] [c00000000071bea8] ksys_write+0x88/0x150
+    [  243.683966][  T123] [c00000000c38fe10] [c0000000000317f4] system_call_exception+0x124/0x340
+    [  243.683973][  T123] [c00000000c38fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
+    ...
+    [  243.684087][  T123] Showing all locks held in the system:
+    [  243.684095][  T123] 1 lock held by khungtaskd/123:
+    [  243.684099][  T123]  #0: c00000000278e370 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x50/0x248
+    [  243.684114][  T123] 4 locks held by stress.sh/4365:
+    [  243.684119][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150
+    [  243.684132][  T123]  #1: c000000041aea888 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0
+    [  243.684143][  T123]  #2: c0000000366fb9a8 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0
+    [  243.684155][  T123]  #3: c000000035ff4cb8 (&dev->lock){+.+.}-{3:3}, at: napi_enable+0x30/0x60
+    [  243.684166][  T123] 5 locks held by stress.sh/4366:
+    [  243.684170][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150
+    [  243.684183][  T123]  #1: c00000000aee2288 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0
+    [  243.684194][  T123]  #2: c0000000366f4ba8 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0
+    [  243.684205][  T123]  #3: c000000035ff4cb8 (&dev->lock){+.+.}-{3:3}, at: napi_disable+0x30/0x60
+    [  243.684216][  T123]  #4: c0000003ff9bbf18 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x138/0x12a0
+
+From the ibmveth debug, two threads are calling veth_pool_store, which
+calls ibmveth_close and ibmveth_open. Here's the sequence:
+
+  T4365             T4366
+  ----------------- ----------------- ---------
+  veth_pool_store   veth_pool_store
+                    ibmveth_close
+  ibmveth_close
+  napi_disable
+                    napi_disable
+  ibmveth_open
+  napi_enable                         <- HANG
+
+ibmveth_close calls napi_disable at the top and ibmveth_open calls
+napi_enable at the top.
+
+https://docs.kernel.org/networking/napi.html]] says
+
+  The control APIs are not idempotent. Control API calls are safe
+  against concurrent use of datapath APIs but an incorrect sequence of
+  control API calls may result in crashes, deadlocks, or race
+  conditions. For example, calling napi_disable() multiple times in a
+  row will deadlock.
+
+In the normal open and close paths, rtnl_mutex is acquired to prevent
+other callers. This is missing from veth_pool_store. Use rtnl_mutex in
+veth_pool_store fixes these hangs.
+
+Signed-off-by: Dave Marquardt <davemarq@linux.ibm.com>
+Fixes: 860f242eb534 ("[PATCH] ibmveth change buffer pools dynamically")
+Reviewed-by: Nick Child <nnac123@linux.ibm.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250402154403.386744-1-davemarq@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmveth.c | 39 +++++++++++++++++++++---------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index a8d79ee350f8d..a332a0e3154a2 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1824,18 +1824,22 @@ static ssize_t veth_pool_store(struct kobject *kobj, struct attribute *attr,
+ 	long value = simple_strtol(buf, NULL, 10);
+ 	long rc;
+ 
++	rtnl_lock();
++
+ 	if (attr == &veth_active_attr) {
+ 		if (value && !pool->active) {
+ 			if (netif_running(netdev)) {
+ 				if (ibmveth_alloc_buffer_pool(pool)) {
+ 					netdev_err(netdev,
+ 						   "unable to alloc pool\n");
+-					return -ENOMEM;
++					rc = -ENOMEM;
++					goto unlock_err;
+ 				}
+ 				pool->active = 1;
+ 				ibmveth_close(netdev);
+-				if ((rc = ibmveth_open(netdev)))
+-					return rc;
++				rc = ibmveth_open(netdev);
++				if (rc)
++					goto unlock_err;
+ 			} else {
+ 				pool->active = 1;
+ 			}
+@@ -1855,48 +1859,59 @@ static ssize_t veth_pool_store(struct kobject *kobj, struct attribute *attr,
+ 
+ 			if (i == IBMVETH_NUM_BUFF_POOLS) {
+ 				netdev_err(netdev, "no active pool >= MTU\n");
+-				return -EPERM;
++				rc = -EPERM;
++				goto unlock_err;
+ 			}
+ 
+ 			if (netif_running(netdev)) {
+ 				ibmveth_close(netdev);
+ 				pool->active = 0;
+-				if ((rc = ibmveth_open(netdev)))
+-					return rc;
++				rc = ibmveth_open(netdev);
++				if (rc)
++					goto unlock_err;
+ 			}
+ 			pool->active = 0;
+ 		}
+ 	} else if (attr == &veth_num_attr) {
+ 		if (value <= 0 || value > IBMVETH_MAX_POOL_COUNT) {
+-			return -EINVAL;
++			rc = -EINVAL;
++			goto unlock_err;
+ 		} else {
+ 			if (netif_running(netdev)) {
+ 				ibmveth_close(netdev);
+ 				pool->size = value;
+-				if ((rc = ibmveth_open(netdev)))
+-					return rc;
++				rc = ibmveth_open(netdev);
++				if (rc)
++					goto unlock_err;
+ 			} else {
+ 				pool->size = value;
+ 			}
+ 		}
+ 	} else if (attr == &veth_size_attr) {
+ 		if (value <= IBMVETH_BUFF_OH || value > IBMVETH_MAX_BUF_SIZE) {
+-			return -EINVAL;
++			rc = -EINVAL;
++			goto unlock_err;
+ 		} else {
+ 			if (netif_running(netdev)) {
+ 				ibmveth_close(netdev);
+ 				pool->buff_size = value;
+-				if ((rc = ibmveth_open(netdev)))
+-					return rc;
++				rc = ibmveth_open(netdev);
++				if (rc)
++					goto unlock_err;
+ 			} else {
+ 				pool->buff_size = value;
+ 			}
+ 		}
+ 	}
++	rtnl_unlock();
+ 
+ 	/* kick the interrupt handler to allocate/deallocate pools */
+ 	ibmveth_interrupt(netdev->irq, netdev);
+ 	return count;
++
++unlock_err:
++	rtnl_unlock();
++	return rc;
+ }
+ 
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-mlx5e-shampo-make-reserved-size-independent-of-p.patch b/queue-6.6/net-mlx5e-shampo-make-reserved-size-independent-of-p.patch
new file mode 100644
index 0000000000..ac936dee19
--- /dev/null
+++ b/queue-6.6/net-mlx5e-shampo-make-reserved-size-independent-of-p.patch
@@ -0,0 +1,77 @@
+From aa3a6fed31f22a706f069d38ab0b511bc0b64e5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 14:28:26 +0200
+Subject: net/mlx5e: SHAMPO, Make reserved size independent of page size
+
+From: Lama Kayal <lkayal@nvidia.com>
+
+[ Upstream commit fab05835688526f9de123d1e98e4d1f838da4e22 ]
+
+When hw-gro is enabled, the maximum number of header entries that are
+needed per wqe (hd_per_wqe) is calculated based on the size of the
+reservations among other parameters.
+
+Miscalculation of the size of reservations leads to incorrect
+calculation of hd_per_wqe as 0, particularly in the case of large page
+size like in aarch64, this prevents the SHAMPO header from being
+correctly initialized in the device, ultimately causing the following
+cqe err that indicates a violation of PD.
+
+ mlx5_core 0000:00:08.0 eth2: ERR CQE on RQ: 0x1180
+ mlx5_core 0000:00:08.0 eth2: Error cqe on cqn 0x510, ci 0x0, qn 0x1180, opcode 0xe, syndrome  0x4, vendor syndrome 0x32
+ 00000000: 00 00 00 00 04 4a 00 00 00 00 00 00 20 00 93 32
+ 00000010: 55 00 00 00 fb cc 00 00 00 00 00 00 07 18 00 00
+ 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a
+ 00000030: 00 00 00 9a 93 00 32 04 00 00 00 00 00 00 da e1
+
+Use the correct formula for calculating the size of reservations,
+precisely it shouldn't be dependent on page size, instead use the
+correct multiply of MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE.
+
+Fixes: e5ca8fb08ab2 ("net/mlx5e: Add control path for SHAMPO feature")
+Signed-off-by: Lama Kayal <lkayal@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/1742732906-166564-1-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+index 30507b7c2fb17..775010e94cb7c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+@@ -408,7 +408,7 @@ u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5_core_dev *mdev,
+ 				     struct mlx5e_params *params)
+ {
+ 	u32 resrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) *
+-			 PAGE_SIZE;
++			 MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE;
+ 
+ 	return order_base_2(DIV_ROUND_UP(resrv_size, params->sw_mtu));
+ }
+@@ -881,7 +881,8 @@ static u32 mlx5e_shampo_get_log_cq_size(struct mlx5_core_dev *mdev,
+ 					struct mlx5e_params *params,
+ 					struct mlx5e_xsk_param *xsk)
+ {
+-	int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE;
++	int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) *
++		MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE;
+ 	u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, xsk));
+ 	int pkt_per_rsrv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params));
+ 	u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, xsk);
+@@ -1094,7 +1095,8 @@ u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev,
+ 			    struct mlx5e_params *params,
+ 			    struct mlx5e_rq_param *rq_param)
+ {
+-	int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * PAGE_SIZE;
++	int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) *
++		MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE;
+ 	u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, NULL));
+ 	int pkt_per_resv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params));
+ 	u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, NULL);
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-mvpp2-prevent-parser-tcam-memory-corruption.patch b/queue-6.6/net-mvpp2-prevent-parser-tcam-memory-corruption.patch
new file mode 100644
index 0000000000..d947a25fbc
--- /dev/null
+++ b/queue-6.6/net-mvpp2-prevent-parser-tcam-memory-corruption.patch
@@ -0,0 +1,659 @@
+From e391a7848790ede951031be3094d318bb0c61201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 08:58:04 +0200
+Subject: net: mvpp2: Prevent parser TCAM memory corruption
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 96844075226b49af25a69a1d084b648ec2d9b08d ]
+
+Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM
+information, from concurrent modifications.
+
+Both the TCAM and SRAM tables are indirectly accessed by configuring
+an index register that selects the row to read or write to. This means
+that operations must be atomic in order to, e.g., avoid spreading
+writes across multiple rows. Since the shadow SRAM array is used to
+find free rows in the hardware table, it must also be protected in
+order to avoid TOCTOU errors where multiple cores allocate the same
+row.
+
+This issue was detected in a situation where `mvpp2_set_rx_mode()` ran
+concurrently on two CPUs. In this particular case the
+MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the
+classifier unit to drop all incoming unicast - indicated by the
+`rx_classifier_drops` counter.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://patch.msgid.link/20250401065855.3113635-1-tobias@waldekranz.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2.h    |   3 +
+ .../net/ethernet/marvell/mvpp2/mvpp2_main.c   |   3 +-
+ .../net/ethernet/marvell/mvpp2/mvpp2_prs.c    | 201 ++++++++++++------
+ 3 files changed, 140 insertions(+), 67 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index 9e02e4367bec8..9bd3d76b5fe2a 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -1108,6 +1108,9 @@ struct mvpp2 {
+ 
+ 	/* Spinlocks for CM3 shared memory configuration */
+ 	spinlock_t mss_spinlock;
++
++	/* Spinlock for shared PRS parser memory and shadow table */
++	spinlock_t prs_spinlock;
+ };
+ 
+ struct mvpp2_pcpu_stats {
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 34051c9abd97d..fce57faf345ce 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -7615,8 +7615,9 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	if (mvpp2_read(priv, MVPP2_VER_ID_REG) == MVPP2_VER_PP23)
+ 		priv->hw_version = MVPP23;
+ 
+-	/* Init mss lock */
++	/* Init locks for shared packet processor resources */
+ 	spin_lock_init(&priv->mss_spinlock);
++	spin_lock_init(&priv->prs_spinlock);
+ 
+ 	/* Initialize network controller */
+ 	err = mvpp2_init(pdev, priv);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 9af22f497a40f..93e978bdf303c 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -23,6 +23,8 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ {
+ 	int i;
+ 
++	lockdep_assert_held(&priv->prs_spinlock);
++
+ 	if (pe->index > MVPP2_PRS_TCAM_SRAM_SIZE - 1)
+ 		return -EINVAL;
+ 
+@@ -43,11 +45,13 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ }
+ 
+ /* Initialize tcam entry from hw */
+-int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+-			   int tid)
++static int __mvpp2_prs_init_from_hw(struct mvpp2 *priv,
++				    struct mvpp2_prs_entry *pe, int tid)
+ {
+ 	int i;
+ 
++	lockdep_assert_held(&priv->prs_spinlock);
++
+ 	if (tid > MVPP2_PRS_TCAM_SRAM_SIZE - 1)
+ 		return -EINVAL;
+ 
+@@ -73,6 +77,18 @@ int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+ 	return 0;
+ }
+ 
++int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
++			   int tid)
++{
++	int err;
++
++	spin_lock_bh(&priv->prs_spinlock);
++	err = __mvpp2_prs_init_from_hw(priv, pe, tid);
++	spin_unlock_bh(&priv->prs_spinlock);
++
++	return err;
++}
++
+ /* Invalidate tcam hw entry */
+ static void mvpp2_prs_hw_inv(struct mvpp2 *priv, int index)
+ {
+@@ -374,7 +390,7 @@ static int mvpp2_prs_flow_find(struct mvpp2 *priv, int flow)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_FLOWS)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 		bits = mvpp2_prs_sram_ai_get(&pe);
+ 
+ 		/* Sram store classification lookup ID in AI bits [5:0] */
+@@ -441,7 +457,7 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ 
+ 	if (priv->prs_shadow[MVPP2_PE_DROP_ALL].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL);
++		__mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -469,14 +485,17 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ }
+ 
+ /* Set port to unicast or multicast promiscuous mode */
+-void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+-			       enum mvpp2_prs_l2_cast l2_cast, bool add)
++static void __mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
++					enum mvpp2_prs_l2_cast l2_cast,
++					bool add)
+ {
+ 	struct mvpp2_prs_entry pe;
+ 	unsigned char cast_match;
+ 	unsigned int ri;
+ 	int tid;
+ 
++	lockdep_assert_held(&priv->prs_spinlock);
++
+ 	if (l2_cast == MVPP2_PRS_L2_UNI_CAST) {
+ 		cast_match = MVPP2_PRS_UCAST_VAL;
+ 		tid = MVPP2_PE_MAC_UC_PROMISCUOUS;
+@@ -489,7 +508,7 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 
+ 	/* promiscuous mode - Accept unknown unicast or multicast packets */
+ 	if (priv->prs_shadow[tid].valid) {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	} else {
+ 		memset(&pe, 0, sizeof(pe));
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -522,6 +541,14 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 	mvpp2_prs_hw_write(priv, &pe);
+ }
+ 
++void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
++			       enum mvpp2_prs_l2_cast l2_cast, bool add)
++{
++	spin_lock_bh(&priv->prs_spinlock);
++	__mvpp2_prs_mac_promisc_set(priv, port, l2_cast, add);
++	spin_unlock_bh(&priv->prs_spinlock);
++}
++
+ /* Set entry for dsa packets */
+ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add,
+ 				  bool tagged, bool extend)
+@@ -539,7 +566,7 @@ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -610,7 +637,7 @@ static void mvpp2_prs_dsa_tag_ethertype_set(struct mvpp2 *priv, int port,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -673,7 +700,7 @@ static int mvpp2_prs_vlan_find(struct mvpp2 *priv, unsigned short tpid, int ai)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid);
+ 		if (!match)
+ 			continue;
+@@ -726,7 +753,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
++			__mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			if ((ri_bits & MVPP2_PRS_RI_VLAN_MASK) ==
+ 			    MVPP2_PRS_RI_VLAN_DOUBLE)
+@@ -760,7 +787,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	}
+ 	/* Update ports' mask */
+ 	mvpp2_prs_tcam_port_map_set(&pe, port_map);
+@@ -800,7 +827,7 @@ static int mvpp2_prs_double_vlan_find(struct mvpp2 *priv, unsigned short tpid1,
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid1) &&
+ 			mvpp2_prs_tcam_data_cmp(&pe, 4, tpid2);
+@@ -849,7 +876,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
++			__mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			ri_bits &= MVPP2_PRS_RI_VLAN_MASK;
+ 			if (ri_bits == MVPP2_PRS_RI_VLAN_SINGLE ||
+@@ -880,7 +907,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	}
+ 
+ 	/* Update ports' mask */
+@@ -1213,8 +1240,8 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv)
+ 	/* Create dummy entries for drop all and promiscuous modes */
+ 	mvpp2_prs_drop_fc(priv);
+ 	mvpp2_prs_mac_drop_all_set(priv, 0, false);
+-	mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+-	mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
++	__mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
++	__mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+ }
+ 
+ /* Set default entries for various types of dsa packets */
+@@ -1533,12 +1560,6 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	struct mvpp2_prs_entry pe;
+ 	int err;
+ 
+-	priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool),
+-					      MVPP2_PRS_DBL_VLANS_MAX,
+-					      GFP_KERNEL);
+-	if (!priv->prs_double_vlans)
+-		return -ENOMEM;
+-
+ 	/* Double VLAN: 0x88A8, 0x8100 */
+ 	err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q,
+ 					MVPP2_PRS_PORT_MASK);
+@@ -1941,7 +1962,7 @@ static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask)
+ 		    port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+ 
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]);
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]);
+@@ -1970,6 +1991,8 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	/* Scan TCAM and see if entry with this <vid,port> already exist */
+ 	tid = mvpp2_prs_vid_range_find(port, vid, mask);
+ 
+@@ -1988,8 +2011,10 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 						MVPP2_PRS_VLAN_FILT_MAX_ENTRY);
+ 
+ 		/* There isn't room for a new VID filter */
+-		if (tid < 0)
++		if (tid < 0) {
++			spin_unlock_bh(&priv->prs_spinlock);
+ 			return tid;
++		}
+ 
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_VID);
+ 		pe.index = tid;
+@@ -1997,7 +2022,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	}
+ 
+ 	/* Enable the current port */
+@@ -2019,6 +2044,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
++	spin_unlock_bh(&priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2028,15 +2054,16 @@ void mvpp2_prs_vid_entry_remove(struct mvpp2_port *port, u16 vid)
+ 	struct mvpp2 *priv = port->priv;
+ 	int tid;
+ 
+-	/* Scan TCAM and see if entry with this <vid,port> already exist */
+-	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
++	spin_lock_bh(&priv->prs_spinlock);
+ 
+-	/* No such entry */
+-	if (tid < 0)
+-		return;
++	/* Invalidate TCAM entry with this <vid,port>, if it exists */
++	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
++	if (tid >= 0) {
++		mvpp2_prs_hw_inv(priv, tid);
++		priv->prs_shadow[tid].valid = false;
++	}
+ 
+-	mvpp2_prs_hw_inv(priv, tid);
+-	priv->prs_shadow[tid].valid = false;
++	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Remove all existing VID filters on this port */
+@@ -2045,6 +2072,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ 	struct mvpp2 *priv = port->priv;
+ 	int tid;
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
+ 	     tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
+ 		if (priv->prs_shadow[tid].valid) {
+@@ -2052,6 +2081,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ 			priv->prs_shadow[tid].valid = false;
+ 		}
+ 	}
++
++	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Remove VID filering entry for this port */
+@@ -2060,10 +2091,14 @@ void mvpp2_prs_vid_disable_filtering(struct mvpp2_port *port)
+ 	unsigned int tid = MVPP2_PRS_VID_PORT_DFLT(port->id);
+ 	struct mvpp2 *priv = port->priv;
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	/* Invalidate the guard entry */
+ 	mvpp2_prs_hw_inv(priv, tid);
+ 
+ 	priv->prs_shadow[tid].valid = false;
++
++	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Add guard entry that drops packets when no VID is matched on this port */
+@@ -2079,6 +2114,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	pe.index = tid;
+ 
+ 	reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id));
+@@ -2111,6 +2148,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 	/* Update shadow table */
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
++
++	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Parser default initialization */
+@@ -2118,6 +2157,20 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ {
+ 	int err, index, i;
+ 
++	priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE,
++					sizeof(*priv->prs_shadow),
++					GFP_KERNEL);
++	if (!priv->prs_shadow)
++		return -ENOMEM;
++
++	priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool),
++					      MVPP2_PRS_DBL_VLANS_MAX,
++					      GFP_KERNEL);
++	if (!priv->prs_double_vlans)
++		return -ENOMEM;
++
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	/* Enable tcam table */
+ 	mvpp2_write(priv, MVPP2_PRS_TCAM_CTRL_REG, MVPP2_PRS_TCAM_EN_MASK);
+ 
+@@ -2136,12 +2189,6 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	for (index = 0; index < MVPP2_PRS_TCAM_SRAM_SIZE; index++)
+ 		mvpp2_prs_hw_inv(priv, index);
+ 
+-	priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE,
+-					sizeof(*priv->prs_shadow),
+-					GFP_KERNEL);
+-	if (!priv->prs_shadow)
+-		return -ENOMEM;
+-
+ 	/* Always start from lookup = 0 */
+ 	for (index = 0; index < MVPP2_MAX_PORTS; index++)
+ 		mvpp2_prs_hw_port_init(priv, index, MVPP2_PRS_LU_MH,
+@@ -2158,26 +2205,13 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	mvpp2_prs_vid_init(priv);
+ 
+ 	err = mvpp2_prs_etype_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_vlan_init(pdev, priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_pppoe_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_ip6_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_ip4_init(priv);
+-	if (err)
+-		return err;
++	err = err ? : mvpp2_prs_vlan_init(pdev, priv);
++	err = err ? : mvpp2_prs_pppoe_init(priv);
++	err = err ? : mvpp2_prs_ip6_init(priv);
++	err = err ? : mvpp2_prs_ip4_init(priv);
+ 
+-	return 0;
++	spin_unlock_bh(&priv->prs_spinlock);
++	return err;
+ }
+ 
+ /* Compare MAC DA with tcam entry data */
+@@ -2217,7 +2251,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ 		    (priv->prs_shadow[tid].udf != udf_type))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 		entry_pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+ 		if (mvpp2_prs_mac_range_equals(&pe, da, mask) &&
+@@ -2229,7 +2263,8 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ }
+ 
+ /* Update parser's mac da entry */
+-int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
++static int __mvpp2_prs_mac_da_accept(struct mvpp2_port *port,
++				     const u8 *da, bool add)
+ {
+ 	unsigned char mask[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ 	struct mvpp2 *priv = port->priv;
+@@ -2261,7 +2296,7 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -2317,6 +2352,17 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 	return 0;
+ }
+ 
++int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
++{
++	int err;
++
++	spin_lock_bh(&port->priv->prs_spinlock);
++	err = __mvpp2_prs_mac_da_accept(port, da, add);
++	spin_unlock_bh(&port->priv->prs_spinlock);
++
++	return err;
++}
++
+ int mvpp2_prs_update_mac_da(struct net_device *dev, const u8 *da)
+ {
+ 	struct mvpp2_port *port = netdev_priv(dev);
+@@ -2345,6 +2391,8 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 	unsigned long pmap;
+ 	int index, tid;
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	for (tid = MVPP2_PE_MAC_RANGE_START;
+ 	     tid <= MVPP2_PE_MAC_RANGE_END; tid++) {
+ 		unsigned char da[ETH_ALEN], da_mask[ETH_ALEN];
+@@ -2354,7 +2402,7 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 		    (priv->prs_shadow[tid].udf != MVPP2_PRS_UDF_MAC_DEF))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(priv, &pe, tid);
+ 
+ 		pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+@@ -2375,14 +2423,17 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 			continue;
+ 
+ 		/* Remove entry from TCAM */
+-		mvpp2_prs_mac_da_accept(port, da, false);
++		__mvpp2_prs_mac_da_accept(port, da, false);
+ 	}
++
++	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ {
+ 	switch (type) {
+ 	case MVPP2_TAG_TYPE_EDSA:
++		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Add port to EDSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+@@ -2393,9 +2444,11 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_DSA);
++		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_DSA:
++		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Add port to DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2406,10 +2459,12 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
++		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_MH:
+ 	case MVPP2_TAG_TYPE_NONE:
++		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Remove port form EDSA and DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2419,6 +2474,7 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
++		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	default:
+@@ -2437,11 +2493,15 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	tid = mvpp2_prs_tcam_first_free(priv,
+ 					MVPP2_PE_LAST_FREE_TID,
+ 					MVPP2_PE_FIRST_FREE_TID);
+-	if (tid < 0)
++	if (tid < 0) {
++		spin_unlock_bh(&priv->prs_spinlock);
+ 		return tid;
++	}
+ 
+ 	pe.index = tid;
+ 
+@@ -2461,6 +2521,7 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ 	mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
++	spin_unlock_bh(&priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2472,6 +2533,8 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
++	spin_lock_bh(&port->priv->prs_spinlock);
++
+ 	tid = mvpp2_prs_flow_find(port->priv, port->id);
+ 
+ 	/* Such entry not exist */
+@@ -2480,8 +2543,10 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		tid = mvpp2_prs_tcam_first_free(port->priv,
+ 						MVPP2_PE_LAST_FREE_TID,
+ 					       MVPP2_PE_FIRST_FREE_TID);
+-		if (tid < 0)
++		if (tid < 0) {
++			spin_unlock_bh(&port->priv->prs_spinlock);
+ 			return tid;
++		}
+ 
+ 		pe.index = tid;
+ 
+@@ -2492,13 +2557,14 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		/* Update shadow table */
+ 		mvpp2_prs_shadow_set(port->priv, pe.index, MVPP2_PRS_LU_FLOWS);
+ 	} else {
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
++		__mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
+ 	mvpp2_prs_tcam_port_map_set(&pe, (1 << port->id));
+ 	mvpp2_prs_hw_write(port->priv, &pe);
+ 
++	spin_unlock_bh(&port->priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2509,11 +2575,14 @@ int mvpp2_prs_hits(struct mvpp2 *priv, int index)
+ 	if (index > MVPP2_PRS_TCAM_SRAM_SIZE)
+ 		return -EINVAL;
+ 
++	spin_lock_bh(&priv->prs_spinlock);
++
+ 	mvpp2_write(priv, MVPP2_PRS_TCAM_HIT_IDX_REG, index);
+ 
+ 	val = mvpp2_read(priv, MVPP2_PRS_TCAM_HIT_CNT_REG);
+ 
+ 	val &= MVPP2_PRS_TCAM_HIT_CNT_MASK;
+ 
++	spin_unlock_bh(&priv->prs_spinlock);
+ 	return val;
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/net_sched-skbprio-remove-overly-strict-queue-asserti.patch b/queue-6.6/net_sched-skbprio-remove-overly-strict-queue-asserti.patch
new file mode 100644
index 0000000000..eb65e20b82
--- /dev/null
+++ b/queue-6.6/net_sched-skbprio-remove-overly-strict-queue-asserti.patch
@@ -0,0 +1,60 @@
+From d30fdcfa8e0eee57d4d4b6d6f53522012cddc4ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Mar 2025 15:25:35 -0700
+Subject: net_sched: skbprio: Remove overly strict queue assertions
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit ce8fe975fd99b49c29c42e50f2441ba53112b2e8 ]
+
+In the current implementation, skbprio enqueue/dequeue contains an assertion
+that fails under certain conditions when SKBPRIO is used as a child qdisc under
+TBF with specific parameters. The failure occurs because TBF sometimes peeks at
+packets in the child qdisc without actually dequeuing them when tokens are
+unavailable.
+
+This peek operation creates a discrepancy between the parent and child qdisc
+queue length counters. When TBF later receives a high-priority packet,
+SKBPRIO's queue length may show a different value than what's reflected in its
+internal priority queue tracking, triggering the assertion.
+
+The fix removes this overly strict assertions in SKBPRIO, they are not
+necessary at all.
+
+Reported-by: syzbot+a3422a19b05ea96bee18@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a3422a19b05ea96bee18
+Fixes: aea5f654e6b7 ("net/sched: add skbprio scheduler")
+Cc: Nishanth Devarajan <ndev2021@gmail.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Link: https://patch.msgid.link/20250329222536.696204-2-xiyou.wangcong@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_skbprio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c
+index 5df2dacb7b1ab..05aa363a7fee9 100644
+--- a/net/sched/sch_skbprio.c
++++ b/net/sched/sch_skbprio.c
+@@ -121,8 +121,6 @@ static int skbprio_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 	/* Check to update highest and lowest priorities. */
+ 	if (skb_queue_empty(lp_qdisc)) {
+ 		if (q->lowest_prio == q->highest_prio) {
+-			/* The incoming packet is the only packet in queue. */
+-			BUG_ON(sch->q.qlen != 1);
+ 			q->lowest_prio = prio;
+ 			q->highest_prio = prio;
+ 		} else {
+@@ -154,7 +152,6 @@ static struct sk_buff *skbprio_dequeue(struct Qdisc *sch)
+ 	/* Update highest priority field. */
+ 	if (skb_queue_empty(hpq)) {
+ 		if (q->lowest_prio == q->highest_prio) {
+-			BUG_ON(sch->q.qlen);
+ 			q->highest_prio = 0;
+ 			q->lowest_prio = SKBPRIO_MAX_PRIORITY - 1;
+ 		} else {
+-- 
+2.39.5
+
diff --git a/queue-6.6/netfilter-nf_tables-don-t-unregister-hook-when-table.patch b/queue-6.6/netfilter-nf_tables-don-t-unregister-hook-when-table.patch
new file mode 100644
index 0000000000..aaa86c3316
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-don-t-unregister-hook-when-table.patch
@@ -0,0 +1,48 @@
+From 788ba720490a8a1fb5f664c90a2decc380e01bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 14:36:47 +0200
+Subject: netfilter: nf_tables: don't unregister hook when table is dormant
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 688c15017d5cd5aac882400782e7213d40dc3556 ]
+
+When nf_tables_updchain encounters an error, hook registration needs to
+be rolled back.
+
+This should only be done if the hook has been registered, which won't
+happen when the table is flagged as dormant (inactive).
+
+Just move the assignment into the registration block.
+
+Reported-by: syzbot+53ed3a6440173ddbf499@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=53ed3a6440173ddbf499
+Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 9e9544f819421..18ae39cf41887 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2669,11 +2669,11 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
+ 			err = nft_netdev_register_hooks(ctx->net, &hook.list);
+ 			if (err < 0)
+ 				goto err_hooks;
++
++			unregister = true;
+ 		}
+ 	}
+ 
+-	unregister = true;
+-
+ 	if (nla[NFTA_CHAIN_COUNTERS]) {
+ 		if (!nft_is_base_chain(chain)) {
+ 			err = -EOPNOTSUPP;
+-- 
+2.39.5
+
diff --git a/queue-6.6/netfilter-nft_set_hash-gc-reaps-elements-with-connco.patch b/queue-6.6/netfilter-nft_set_hash-gc-reaps-elements-with-connco.patch
new file mode 100644
index 0000000000..18ae03ce32
--- /dev/null
+++ b/queue-6.6/netfilter-nft_set_hash-gc-reaps-elements-with-connco.patch
@@ -0,0 +1,40 @@
+From d314aa9ad1b66e7ef9db103d5ecf1d0d92c7e999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 23:24:20 +0100
+Subject: netfilter: nft_set_hash: GC reaps elements with conncount for dynamic
+ sets only
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 9d74da1177c800eb3d51c13f9821b7b0683845a5 ]
+
+conncount has its own GC handler which determines when to reap stale
+elements, this is convenient for dynamic sets. However, this also reaps
+non-dynamic sets with static configurations coming from control plane.
+Always run connlimit gc handler but honor feedback to reap element if
+this set is dynamic.
+
+Fixes: 290180e2448c ("netfilter: nf_tables: add connlimit support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_hash.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 0370f69dce86d..2f1012bde1f34 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -308,7 +308,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set,
+ 
+ 	nft_setelem_expr_foreach(expr, elem_expr, size) {
+ 		if (expr->ops->gc &&
+-		    expr->ops->gc(read_pnet(&set->net), expr))
++		    expr->ops->gc(read_pnet(&set->net), expr) &&
++		    set->flags & NFT_SET_EVAL)
+ 			return true;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/netfilter-nft_tunnel-fix-geneve_opt-type-confusion-a.patch b/queue-6.6/netfilter-nft_tunnel-fix-geneve_opt-type-confusion-a.patch
new file mode 100644
index 0000000000..4beffba16f
--- /dev/null
+++ b/queue-6.6/netfilter-nft_tunnel-fix-geneve_opt-type-confusion-a.patch
@@ -0,0 +1,88 @@
+From 4b55766620d23c57d9e53e69e09efd7777551761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 01:00:26 +0800
+Subject: netfilter: nft_tunnel: fix geneve_opt type confusion addition
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit 1b755d8eb1ace3870789d48fbd94f386ad6e30be ]
+
+When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the
+parsing logic should place every geneve_opt structure one by one
+compactly. Hence, when deciding the next geneve_opt position, the
+pointer addition should be in units of char *.
+
+However, the current implementation erroneously does type conversion
+before the addition, which will lead to heap out-of-bounds write.
+
+[    6.989857] ==================================================================
+[    6.990293] BUG: KASAN: slab-out-of-bounds in nft_tunnel_obj_init+0x977/0xa70
+[    6.990725] Write of size 124 at addr ffff888005f18974 by task poc/178
+[    6.991162]
+[    6.991259] CPU: 0 PID: 178 Comm: poc-oob-write Not tainted 6.1.132 #1
+[    6.991655] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+[    6.992281] Call Trace:
+[    6.992423]  <TASK>
+[    6.992586]  dump_stack_lvl+0x44/0x5c
+[    6.992801]  print_report+0x184/0x4be
+[    6.993790]  kasan_report+0xc5/0x100
+[    6.994252]  kasan_check_range+0xf3/0x1a0
+[    6.994486]  memcpy+0x38/0x60
+[    6.994692]  nft_tunnel_obj_init+0x977/0xa70
+[    6.995677]  nft_obj_init+0x10c/0x1b0
+[    6.995891]  nf_tables_newobj+0x585/0x950
+[    6.996922]  nfnetlink_rcv_batch+0xdf9/0x1020
+[    6.998997]  nfnetlink_rcv+0x1df/0x220
+[    6.999537]  netlink_unicast+0x395/0x530
+[    7.000771]  netlink_sendmsg+0x3d0/0x6d0
+[    7.001462]  __sock_sendmsg+0x99/0xa0
+[    7.001707]  ____sys_sendmsg+0x409/0x450
+[    7.002391]  ___sys_sendmsg+0xfd/0x170
+[    7.003145]  __sys_sendmsg+0xea/0x170
+[    7.004359]  do_syscall_64+0x5e/0x90
+[    7.005817]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+[    7.006127] RIP: 0033:0x7ec756d4e407
+[    7.006339] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf
+[    7.007364] RSP: 002b:00007ffed5d46760 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
+[    7.007827] RAX: ffffffffffffffda RBX: 00007ec756cc4740 RCX: 00007ec756d4e407
+[    7.008223] RDX: 0000000000000000 RSI: 00007ffed5d467f0 RDI: 0000000000000003
+[    7.008620] RBP: 00007ffed5d468a0 R08: 0000000000000000 R09: 0000000000000000
+[    7.009039] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
+[    7.009429] R13: 00007ffed5d478b0 R14: 00007ec756ee5000 R15: 00005cbd4e655cb8
+
+Fix this bug with correct pointer addition and conversion in parse
+and dump code.
+
+Fixes: 925d844696d9 ("netfilter: nft_tunnel: add support for geneve opts")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_tunnel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index f735d79d8be57..e3f5731ebaacf 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -339,7 +339,7 @@ static const struct nla_policy nft_tunnel_opts_geneve_policy[NFTA_TUNNEL_KEY_GEN
+ static int nft_tunnel_obj_geneve_init(const struct nlattr *attr,
+ 				      struct nft_tunnel_opts *opts)
+ {
+-	struct geneve_opt *opt = (struct geneve_opt *)opts->u.data + opts->len;
++	struct geneve_opt *opt = (struct geneve_opt *)(opts->u.data + opts->len);
+ 	struct nlattr *tb[NFTA_TUNNEL_KEY_GENEVE_MAX + 1];
+ 	int err, data_len;
+ 
+@@ -621,7 +621,7 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb,
+ 		if (!inner)
+ 			goto failure;
+ 		while (opts->len > offset) {
+-			opt = (struct geneve_opt *)opts->u.data + offset;
++			opt = (struct geneve_opt *)(opts->u.data + offset);
+ 			if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS,
+ 					 opt->opt_class) ||
+ 			    nla_put_u8(skb, NFTA_TUNNEL_KEY_GENEVE_TYPE,
+-- 
+2.39.5
+
diff --git a/queue-6.6/netlabel-fix-null-pointer-exception-caused-by-calips.patch b/queue-6.6/netlabel-fix-null-pointer-exception-caused-by-calips.patch
new file mode 100644
index 0000000000..873be65bc5
--- /dev/null
+++ b/queue-6.6/netlabel-fix-null-pointer-exception-caused-by-calips.patch
@@ -0,0 +1,87 @@
+From 540e8a7c1f8fbe212c794adb5e184e511d2fb101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 20:40:18 +0800
+Subject: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4
+ sockets
+
+From: Debin Zhu <mowenroot@163.com>
+
+[ Upstream commit 078aabd567de3d63d37d7673f714e309d369e6e2 ]
+
+When calling netlbl_conn_setattr(), addr->sa_family is used
+to determine the function behavior. If sk is an IPv4 socket,
+but the connect function is called with an IPv6 address,
+the function calipso_sock_setattr() is triggered.
+Inside this function, the following code is executed:
+
+sk_fullsock(__sk) ? inet_sk(__sk)->pinet6 : NULL;
+
+Since sk is an IPv4 socket, pinet6 is NULL, leading to a
+null pointer dereference.
+
+This patch fixes the issue by checking if inet6_sk(sk)
+returns a NULL pointer before accessing pinet6.
+
+Signed-off-by: Debin Zhu <mowenroot@163.com>
+Signed-off-by: Bitao Ouyang <1985755126@qq.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Fixes: ceba1832b1b2 ("calipso: Set the calipso socket label to match the secattr.")
+Link: https://patch.msgid.link/20250401124018.4763-1-mowenroot@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/calipso.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
+index 1578ed9e97d89..c07e3da08d2a8 100644
+--- a/net/ipv6/calipso.c
++++ b/net/ipv6/calipso.c
+@@ -1075,8 +1075,13 @@ static int calipso_sock_getattr(struct sock *sk,
+ 	struct ipv6_opt_hdr *hop;
+ 	int opt_len, len, ret_val = -ENOMSG, offset;
+ 	unsigned char *opt;
+-	struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
++	struct ipv6_pinfo *pinfo = inet6_sk(sk);
++	struct ipv6_txoptions *txopts;
++
++	if (!pinfo)
++		return -EAFNOSUPPORT;
+ 
++	txopts = txopt_get(pinfo);
+ 	if (!txopts || !txopts->hopopt)
+ 		goto done;
+ 
+@@ -1128,8 +1133,13 @@ static int calipso_sock_setattr(struct sock *sk,
+ {
+ 	int ret_val;
+ 	struct ipv6_opt_hdr *old, *new;
+-	struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
++	struct ipv6_pinfo *pinfo = inet6_sk(sk);
++	struct ipv6_txoptions *txopts;
++
++	if (!pinfo)
++		return -EAFNOSUPPORT;
+ 
++	txopts = txopt_get(pinfo);
+ 	old = NULL;
+ 	if (txopts)
+ 		old = txopts->hopopt;
+@@ -1156,8 +1166,13 @@ static int calipso_sock_setattr(struct sock *sk,
+ static void calipso_sock_delattr(struct sock *sk)
+ {
+ 	struct ipv6_opt_hdr *new_hop;
+-	struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
++	struct ipv6_pinfo *pinfo = inet6_sk(sk);
++	struct ipv6_txoptions *txopts;
++
++	if (!pinfo)
++		return;
+ 
++	txopts = txopt_get(pinfo);
+ 	if (!txopts || !txopts->hopopt)
+ 		goto done;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/nfs-shut-down-the-nfs_client-only-after-all-the-supe.patch b/queue-6.6/nfs-shut-down-the-nfs_client-only-after-all-the-supe.patch
new file mode 100644
index 0000000000..6c5728c95f
--- /dev/null
+++ b/queue-6.6/nfs-shut-down-the-nfs_client-only-after-all-the-supe.patch
@@ -0,0 +1,78 @@
+From 10db362a5c42608107ae9321bcf69b7bd66971bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 17:58:50 -0400
+Subject: NFS: Shut down the nfs_client only after all the superblocks
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 2d3e998a0bc7fe26a724f87a8ce217848040520e ]
+
+The nfs_client manages state for all the superblocks in the
+"cl_superblocks" list, so it must not be shut down until all of them are
+gone.
+
+Fixes: 7d3e26a054c8 ("NFS: Cancel all existing RPC tasks when shutdown")
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/sysfs.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c
+index 7b59a40d40c06..784f7c1d003bf 100644
+--- a/fs/nfs/sysfs.c
++++ b/fs/nfs/sysfs.c
+@@ -14,6 +14,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/lockd/lockd.h>
+ 
++#include "internal.h"
+ #include "nfs4_fs.h"
+ #include "netns.h"
+ #include "sysfs.h"
+@@ -228,6 +229,25 @@ static void shutdown_client(struct rpc_clnt *clnt)
+ 	rpc_cancel_tasks(clnt, -EIO, shutdown_match_client, NULL);
+ }
+ 
++/*
++ * Shut down the nfs_client only once all the superblocks
++ * have been shut down.
++ */
++static void shutdown_nfs_client(struct nfs_client *clp)
++{
++	struct nfs_server *server;
++	rcu_read_lock();
++	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
++		if (!(server->flags & NFS_MOUNT_SHUTDOWN)) {
++			rcu_read_unlock();
++			return;
++		}
++	}
++	rcu_read_unlock();
++	nfs_mark_client_ready(clp, -EIO);
++	shutdown_client(clp->cl_rpcclient);
++}
++
+ static ssize_t
+ shutdown_show(struct kobject *kobj, struct kobj_attribute *attr,
+ 				char *buf)
+@@ -259,7 +279,6 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr,
+ 
+ 	server->flags |= NFS_MOUNT_SHUTDOWN;
+ 	shutdown_client(server->client);
+-	shutdown_client(server->nfs_client->cl_rpcclient);
+ 
+ 	if (!IS_ERR(server->client_acl))
+ 		shutdown_client(server->client_acl);
+@@ -267,6 +286,7 @@ shutdown_store(struct kobject *kobj, struct kobj_attribute *attr,
+ 	if (server->nlm_host)
+ 		shutdown_client(server->nlm_host->h_rpcclnt);
+ out:
++	shutdown_nfs_client(server->nfs_client);
+ 	return count;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/nfsv4-don-t-trigger-uneccessary-scans-for-return-on-.patch b/queue-6.6/nfsv4-don-t-trigger-uneccessary-scans-for-return-on-.patch
new file mode 100644
index 0000000000..cb1de995c8
--- /dev/null
+++ b/queue-6.6/nfsv4-don-t-trigger-uneccessary-scans-for-return-on-.patch
@@ -0,0 +1,79 @@
+From 1b5047fe3c3269782700664ca51efc52bcb1ce84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 16:50:30 -0500
+Subject: NFSv4: Don't trigger uneccessary scans for return-on-close
+ delegations
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 47acca884f714f41d95dc654f802845544554784 ]
+
+The amount of looping through the list of delegations is occasionally
+leading to soft lockups. Avoid at least some loops by not requiring the
+NFSv4 state manager to scan for delegations that are marked for
+return-on-close. Instead, either mark them for immediate return (if
+possible) or else leave it up to nfs4_inode_return_delegation_on_close()
+to return them once the file is closed by the application.
+
+Fixes: b757144fd77c ("NFSv4: Be less aggressive about returning delegations for open files")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 4bf2526a3a189..55cfa1c4e0a65 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -570,17 +570,6 @@ static bool nfs_delegation_need_return(struct nfs_delegation *delegation)
+ 
+ 	if (test_and_clear_bit(NFS_DELEGATION_RETURN, &delegation->flags))
+ 		ret = true;
+-	else if (test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags)) {
+-		struct inode *inode;
+-
+-		spin_lock(&delegation->lock);
+-		inode = delegation->inode;
+-		if (inode && list_empty(&NFS_I(inode)->open_files))
+-			ret = true;
+-		spin_unlock(&delegation->lock);
+-	}
+-	if (ret)
+-		clear_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags);
+ 	if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags) ||
+ 	    test_bit(NFS_DELEGATION_RETURN_DELAYED, &delegation->flags) ||
+ 	    test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
+@@ -821,11 +810,25 @@ int nfs4_inode_make_writeable(struct inode *inode)
+ 	return nfs4_inode_return_delegation(inode);
+ }
+ 
+-static void nfs_mark_return_if_closed_delegation(struct nfs_server *server,
+-		struct nfs_delegation *delegation)
++static void
++nfs_mark_return_if_closed_delegation(struct nfs_server *server,
++				     struct nfs_delegation *delegation)
+ {
+-	set_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags);
+-	set_bit(NFS4CLNT_DELEGRETURN, &server->nfs_client->cl_state);
++	struct inode *inode;
++
++	if (test_bit(NFS_DELEGATION_RETURN, &delegation->flags) ||
++	    test_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags))
++		return;
++	spin_lock(&delegation->lock);
++	inode = delegation->inode;
++	if (!inode)
++		goto out;
++	if (list_empty(&NFS_I(inode)->open_files))
++		nfs_mark_return_delegation(server, delegation);
++	else
++		set_bit(NFS_DELEGATION_RETURN_IF_CLOSED, &delegation->flags);
++out:
++	spin_unlock(&delegation->lock);
+ }
+ 
+ static bool nfs_server_mark_return_all_delegations(struct nfs_server *server)
+-- 
+2.39.5
+
diff --git a/queue-6.6/ntb-intel-fix-using-link-status-db-s.patch b/queue-6.6/ntb-intel-fix-using-link-status-db-s.patch
new file mode 100644
index 0000000000..d502c376d0
--- /dev/null
+++ b/queue-6.6/ntb-intel-fix-using-link-status-db-s.patch
@@ -0,0 +1,37 @@
+From a4319af0f9744ba5304797e3c9e85c9018f7a3d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jun 2024 11:15:19 +0300
+Subject: ntb: intel: Fix using link status DB's
+
+From: Nikita Shubin <n.shubin@yadro.com>
+
+[ Upstream commit 8144e9c8f30fb23bb736a5d24d5c9d46965563c4 ]
+
+Make sure we are not using DB's which were remapped for link status.
+
+Fixes: f6e51c354b60 ("ntb: intel: split out the gen3 code")
+Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/intel/ntb_hw_gen3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ntb/hw/intel/ntb_hw_gen3.c b/drivers/ntb/hw/intel/ntb_hw_gen3.c
+index ffcfc3e02c353..a5aa96a31f4a6 100644
+--- a/drivers/ntb/hw/intel/ntb_hw_gen3.c
++++ b/drivers/ntb/hw/intel/ntb_hw_gen3.c
+@@ -215,6 +215,9 @@ static int gen3_init_ntb(struct intel_ntb_dev *ndev)
+ 	}
+ 
+ 	ndev->db_valid_mask = BIT_ULL(ndev->db_count) - 1;
++	/* Make sure we are not using DB's used for link status */
++	if (ndev->hwerr_flags & NTB_HWERR_MSIX_VECTOR32_BAD)
++		ndev->db_valid_mask &= ~ndev->db_link_mask;
+ 
+ 	ndev->reg->db_iowrite(ndev->db_valid_mask,
+ 			      ndev->self_mmio +
+-- 
+2.39.5
+
diff --git a/queue-6.6/ntb_hw_switchtec-fix-shift-out-of-bounds-in-switchte.patch b/queue-6.6/ntb_hw_switchtec-fix-shift-out-of-bounds-in-switchte.patch
new file mode 100644
index 0000000000..9f8f956d1a
--- /dev/null
+++ b/queue-6.6/ntb_hw_switchtec-fix-shift-out-of-bounds-in-switchte.patch
@@ -0,0 +1,45 @@
+From 66dee5bc3ac06949305def0f9d0d2b5cf165889d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 16:33:05 +0800
+Subject: ntb_hw_switchtec: Fix shift-out-of-bounds in
+ switchtec_ntb_mw_set_trans
+
+From: Yajun Deng <yajun.deng@linux.dev>
+
+[ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ]
+
+There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and
+size. This would make xlate_pos negative.
+
+[   23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000
+[   23.734158] ================================================================================
+[   23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7
+[   23.734418] shift exponent -1 is negative
+
+Ensuring xlate_pos is a positive or zero before BIT.
+
+Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()")
+Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 0a94c634ddc27..b5f93f07e22a4 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx,
+ 	if (size != 0 && xlate_pos < 12)
+ 		return -EINVAL;
+ 
+-	if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) {
++	if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) {
+ 		/*
+ 		 * In certain circumstances we can get a buffer that is
+ 		 * not aligned to its size. (Most of the time
+-- 
+2.39.5
+
diff --git a/queue-6.6/nvme-pci-clean-up-cmbmsc-when-registering-cmb-fails.patch b/queue-6.6/nvme-pci-clean-up-cmbmsc-when-registering-cmb-fails.patch
new file mode 100644
index 0000000000..c4bcdb380b
--- /dev/null
+++ b/queue-6.6/nvme-pci-clean-up-cmbmsc-when-registering-cmb-fails.patch
@@ -0,0 +1,38 @@
+From 4abc550538aec9c94cd3c8a0c692ccd51c48c345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 01:04:43 +0800
+Subject: nvme-pci: clean up CMBMSC when registering CMB fails
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 6a3572e10f740acd48e2713ef37e92186a3ce5e8 ]
+
+CMB decoding should get disabled when the CMB block isn't successfully
+registered to P2P DMA subsystem.
+
+Clean up the CMBMSC register in this error handling codepath to disable
+CMB decoding (and CMBLOC/CMBSZ registers).
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index a36ec6df6624b..3cc00d5a10065 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1871,6 +1871,7 @@ static void nvme_map_cmb(struct nvme_dev *dev)
+ 	if (pci_p2pdma_add_resource(pdev, bar, size, offset)) {
+ 		dev_warn(dev->ctrl.device,
+ 			 "failed to register the CMB\n");
++		hi_lo_writeq(0, dev->bar + NVME_REG_CMBMSC);
+ 		return;
+ 	}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/nvme-pci-fix-stuck-reset-on-concurrent-dpc-and-hp.patch b/queue-6.6/nvme-pci-fix-stuck-reset-on-concurrent-dpc-and-hp.patch
new file mode 100644
index 0000000000..6dca5fcda8
--- /dev/null
+++ b/queue-6.6/nvme-pci-fix-stuck-reset-on-concurrent-dpc-and-hp.patch
@@ -0,0 +1,75 @@
+From 99abd8de56c3afbb394a9732b9c25fae5b54666e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 14:25:57 -0800
+Subject: nvme-pci: fix stuck reset on concurrent DPC and HP
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 3f674e7b670b7b7d9261935820e4eba3c059f835 ]
+
+The PCIe error handling has the nvme driver quiesce the device, attempt
+to restart it, then wait for that restart to complete.
+
+A PCIe DPC event also toggles the PCIe link. If the slot doesn't have
+out-of-band presence detection, this will trigger a pciehp
+re-enumeration.
+
+The error handling that calls nvme_error_resume is holding the device
+lock while this happens. This lock blocks pciehp's request to disconnect
+the driver from proceeding.
+
+Meanwhile the nvme's reset can't make forward progress because its
+device isn't there anymore with outstanding IO, and the timeout handler
+won't do anything to fix it because the device is undergoing error
+handling.
+
+End result: deadlocked.
+
+Fix this by having the timeout handler short cut the disabling for a
+disconnected PCIe device. The downside is that we're relying on an IO
+timeout to clean up this mess, which could be a minute by default.
+
+Tested-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 5265be835a4ce..a763df0200ab4 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1282,8 +1282,19 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req)
+ 	struct nvme_dev *dev = nvmeq->dev;
+ 	struct request *abort_req;
+ 	struct nvme_command cmd = { };
++	struct pci_dev *pdev = to_pci_dev(dev->dev);
+ 	u32 csts = readl(dev->bar + NVME_REG_CSTS);
+ 
++	/*
++	 * Shutdown the device immediately if we see it is disconnected. This
++	 * unblocks PCIe error handling if the nvme driver is waiting in
++	 * error_resume for a device that has been removed. We can't unbind the
++	 * driver while the driver's error callback is waiting to complete, so
++	 * we're relying on a timeout to break that deadlock if a removal
++	 * occurs while reset work is running.
++	 */
++	if (pci_dev_is_disconnected(pdev))
++		nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
+ 	if (nvme_state_terminal(&dev->ctrl))
+ 		goto disable;
+ 
+@@ -1291,7 +1302,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req)
+ 	 * the recovery mechanism will surely fail.
+ 	 */
+ 	mb();
+-	if (pci_channel_offline(to_pci_dev(dev->dev)))
++	if (pci_channel_offline(pdev))
+ 		return BLK_EH_RESET_TIMER;
+ 
+ 	/*
+-- 
+2.39.5
+
diff --git a/queue-6.6/nvme-pci-skip-cmb-blocks-incompatible-with-pci-p2p-d.patch b/queue-6.6/nvme-pci-skip-cmb-blocks-incompatible-with-pci-p2p-d.patch
new file mode 100644
index 0000000000..56e3e258ca
--- /dev/null
+++ b/queue-6.6/nvme-pci-skip-cmb-blocks-incompatible-with-pci-p2p-d.patch
@@ -0,0 +1,68 @@
+From 97334d97576d483dd5c44c6140478eb43ee1803e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2025 01:04:44 +0800
+Subject: nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 56cf7ef0d490b28fad8f8629fc135c5ab7c9f54e ]
+
+The PCI P2PDMA code will register the CMB block to the memory
+hot-plugging subsystem, which have an alignment requirement. Memory
+blocks that do not satisfy this alignment requirement (usually 2MB) will
+lead to a WARNING from memory hotplugging.
+
+Verify the CMB block's address and size against the alignment and only
+try to send CMB blocks compatible with it to prevent this warning.
+
+Tested on Intel DC D4502 SSD, which has a 512K CMB block that is too
+small for memory hotplugging (thus PCI P2PDMA).
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3cc00d5a10065..5265be835a4ce 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1850,6 +1850,18 @@ static void nvme_map_cmb(struct nvme_dev *dev)
+ 	if (offset > bar_size)
+ 		return;
+ 
++	/*
++	 * Controllers may support a CMB size larger than their BAR, for
++	 * example, due to being behind a bridge. Reduce the CMB to the
++	 * reported size of the BAR
++	 */
++	size = min(size, bar_size - offset);
++
++	if (!IS_ALIGNED(size, memremap_compat_align()) ||
++	    !IS_ALIGNED(pci_resource_start(pdev, bar),
++			memremap_compat_align()))
++		return;
++
+ 	/*
+ 	 * Tell the controller about the host side address mapping the CMB,
+ 	 * and enable CMB decoding for the NVMe 1.4+ scheme:
+@@ -1860,14 +1872,6 @@ static void nvme_map_cmb(struct nvme_dev *dev)
+ 			     dev->bar + NVME_REG_CMBMSC);
+ 	}
+ 
+-	/*
+-	 * Controllers may support a CMB size larger than their BAR,
+-	 * for example, due to being behind a bridge. Reduce the CMB to
+-	 * the reported size of the BAR
+-	 */
+-	if (size > bar_size - offset)
+-		size = bar_size - offset;
+-
+ 	if (pci_p2pdma_add_resource(pdev, bar, size, offset)) {
+ 		dev_warn(dev->ctrl.device,
+ 			 "failed to register the CMB\n");
+-- 
+2.39.5
+
diff --git a/queue-6.6/nvme-pci-skip-nvme_write_sq_db-on-empty-rqlist.patch b/queue-6.6/nvme-pci-skip-nvme_write_sq_db-on-empty-rqlist.patch
new file mode 100644
index 0000000000..940469a0f7
--- /dev/null
+++ b/queue-6.6/nvme-pci-skip-nvme_write_sq_db-on-empty-rqlist.patch
@@ -0,0 +1,37 @@
+From 71596fc7761351e1485a701d907fb61bd1f2b31a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 18:28:59 +0200
+Subject: nvme-pci: skip nvme_write_sq_db on empty rqlist
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 288ff0d10beb069355036355d5f7612579dc869c ]
+
+nvme_submit_cmds() should check the rqlist before calling
+nvme_write_sq_db(); if the list is empty, it must return immediately.
+
+Fixes: beadf0088501 ("nvme-pci: reverse request order in nvme_queue_rqs")
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index a763df0200ab4..ede3be06143fb 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -907,6 +907,9 @@ static void nvme_submit_cmds(struct nvme_queue *nvmeq, struct request **rqlist)
+ {
+ 	struct request *req;
+ 
++	if (rq_list_empty(rqlist))
++		return;
++
+ 	spin_lock(&nvmeq->sq_lock);
+ 	while ((req = rq_list_pop(rqlist))) {
+ 		struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+-- 
+2.39.5
+
diff --git a/queue-6.6/nvme-tcp-fix-possible-uaf-in-nvme_tcp_poll.patch b/queue-6.6/nvme-tcp-fix-possible-uaf-in-nvme_tcp_poll.patch
new file mode 100644
index 0000000000..9dde4c536a
--- /dev/null
+++ b/queue-6.6/nvme-tcp-fix-possible-uaf-in-nvme_tcp_poll.patch
@@ -0,0 +1,88 @@
+From 6a28661e9b250a1d664c8c2c36603d1e10095eba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 13:18:30 +0200
+Subject: nvme-tcp: fix possible UAF in nvme_tcp_poll
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 8c1624b63a7d24142a2bbc3a5ee7e95f004ea36e ]
+
+nvme_tcp_poll() may race with the send path error handler because
+it may complete the request while it is actively being polled for
+completion, resulting in a UAF panic [1]:
+
+We should make sure to stop polling when we see an error when
+trying to read from the socket. Hence make sure to propagate the
+error so that the block layer breaks the polling cycle.
+
+[1]:
+--
+[35665.692310] nvme nvme2: failed to send request -13
+[35665.702265] nvme nvme2: unsupported pdu type (3)
+[35665.702272] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[35665.702542] nvme nvme2: queue 1 receive failed:  -22
+[35665.703209] #PF: supervisor write access in kernel mode
+[35665.703213] #PF: error_code(0x0002) - not-present page
+[35665.703214] PGD 8000003801cce067 P4D 8000003801cce067 PUD 37e6f79067 PMD 0
+[35665.703220] Oops: 0002 [#1] SMP PTI
+[35665.703658] nvme nvme2: starting error recovery
+[35665.705809] Hardware name: Inspur aaabbb/YZMB-00882-104, BIOS 4.1.26 09/22/2022
+[35665.705812] Workqueue: kblockd blk_mq_requeue_work
+[35665.709172] RIP: 0010:_raw_spin_lock+0xc/0x30
+[35665.715788] Call Trace:
+[35665.716201]  <TASK>
+[35665.716613]  ? show_trace_log_lvl+0x1c1/0x2d9
+[35665.717049]  ? show_trace_log_lvl+0x1c1/0x2d9
+[35665.717457]  ? blk_mq_request_bypass_insert+0x2c/0xb0
+[35665.717950]  ? __die_body.cold+0x8/0xd
+[35665.718361]  ? page_fault_oops+0xac/0x140
+[35665.718749]  ? blk_mq_start_request+0x30/0xf0
+[35665.719144]  ? nvme_tcp_queue_rq+0xc7/0x170 [nvme_tcp]
+[35665.719547]  ? exc_page_fault+0x62/0x130
+[35665.719938]  ? asm_exc_page_fault+0x22/0x30
+[35665.720333]  ? _raw_spin_lock+0xc/0x30
+[35665.720723]  blk_mq_request_bypass_insert+0x2c/0xb0
+[35665.721101]  blk_mq_requeue_work+0xa5/0x180
+[35665.721451]  process_one_work+0x1e8/0x390
+[35665.721809]  worker_thread+0x53/0x3d0
+[35665.722159]  ? process_one_work+0x390/0x390
+[35665.722501]  kthread+0x124/0x150
+[35665.722849]  ? set_kthread_struct+0x50/0x50
+[35665.723182]  ret_from_fork+0x1f/0x30
+
+Reported-by: Zhang Guanghui <zhang.guanghui@cestc.cn>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 2a8bd812b1a6f..84db7f4f861cb 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -2467,6 +2467,7 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
+ {
+ 	struct nvme_tcp_queue *queue = hctx->driver_data;
+ 	struct sock *sk = queue->sock->sk;
++	int ret;
+ 
+ 	if (!test_bit(NVME_TCP_Q_LIVE, &queue->flags))
+ 		return 0;
+@@ -2474,9 +2475,9 @@ static int nvme_tcp_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
+ 	set_bit(NVME_TCP_Q_POLLING, &queue->flags);
+ 	if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue))
+ 		sk_busy_loop(sk, true);
+-	nvme_tcp_try_recv(queue);
++	ret = nvme_tcp_try_recv(queue);
+ 	clear_bit(NVME_TCP_Q_POLLING, &queue->flags);
+-	return queue->nr_cqe;
++	return ret < 0 ? ret : queue->nr_cqe;
+ }
+ 
+ static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size)
+-- 
+2.39.5
+
diff --git a/queue-6.6/objtool-fix-segfault-in-ignore_unreachable_insn.patch b/queue-6.6/objtool-fix-segfault-in-ignore_unreachable_insn.patch
new file mode 100644
index 0000000000..4e04a54886
--- /dev/null
+++ b/queue-6.6/objtool-fix-segfault-in-ignore_unreachable_insn.patch
@@ -0,0 +1,41 @@
+From 3c683fc9955c3cda81c6d11fb214898b4908a1bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 22:04:21 -0700
+Subject: objtool: Fix segfault in ignore_unreachable_insn()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 69d41d6dafff0967565b971d950bd10443e4076c ]
+
+Check 'prev_insn' before dereferencing it.
+
+Fixes: bd841d6154f5 ("objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/5df4ff89c9e4b9e788b77b0531234ffa7ba03e9e.1743136205.git.jpoimboe@kernel.org
+
+Closes: https://lore.kernel.org/d86b4cc6-0b97-4095-8793-a7384410b8ab@app.fastmail.com
+Closes: https://lore.kernel.org/Z-V_rruKY0-36pqA@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 5824aa68ff961..36412f1881e61 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4089,7 +4089,7 @@ static bool ignore_unreachable_insn(struct objtool_file *file, struct instructio
+ 	 * It may also insert a UD2 after calling a __noreturn function.
+ 	 */
+ 	prev_insn = prev_insn_same_sec(file, insn);
+-	if (prev_insn->dead_end &&
++	if (prev_insn && prev_insn->dead_end &&
+ 	    (insn->type == INSN_BUG ||
+ 	     (insn->type == INSN_JUMP_UNCONDITIONAL &&
+ 	      insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
+-- 
+2.39.5
+
diff --git a/queue-6.6/objtool-fix-verbose-disassembly-if-cross_compile-isn.patch b/queue-6.6/objtool-fix-verbose-disassembly-if-cross_compile-isn.patch
new file mode 100644
index 0000000000..5ab9ea0435
--- /dev/null
+++ b/queue-6.6/objtool-fix-verbose-disassembly-if-cross_compile-isn.patch
@@ -0,0 +1,46 @@
+From ff767260d21f52acce114b13457ac4ea85aeb480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 21:26:42 -0700
+Subject: objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
+
+From: David Laight <david.laight.linux@gmail.com>
+
+[ Upstream commit e77956e4e5c11218e60a1fe8cdbccd02476f2e56 ]
+
+In verbose mode, when printing the disassembly of affected functions, if
+CROSS_COMPILE isn't set, the objdump command string gets prefixed with
+"(null)".
+
+Somehow this worked before.  Maybe some versions of glibc return an
+empty string instead of NULL.  Fix it regardless.
+
+[ jpoimboe: Rewrite commit log. ]
+
+Fixes: ca653464dd097 ("objtool: Add verbose option for disassembling affected functions")
+Signed-off-by: David Laight <david.laight.linux@gmail.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250215142321.14081-1-david.laight.linux@gmail.com
+Link: https://lore.kernel.org/r/b931a4786bc0127aa4c94e8b35ed617dcbd3d3da.1743481539.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 36412f1881e61..9102ad5985cc0 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4550,6 +4550,8 @@ static int disas_funcs(const char *funcs)
+ 	char *cmd;
+ 
+ 	cross_compile = getenv("CROSS_COMPILE");
++	if (!cross_compile)
++		cross_compile = "";
+ 
+ 	objdump_str = "%sobjdump -wdr %s | gawk -M -v _funcs='%s' '"
+ 			"BEGIN { split(_funcs, funcs); }"
+-- 
+2.39.5
+
diff --git a/queue-6.6/objtool-media-dib8000-prevent-divide-by-zero-in-dib8.patch b/queue-6.6/objtool-media-dib8000-prevent-divide-by-zero-in-dib8.patch
new file mode 100644
index 0000000000..ff0fd513b2
--- /dev/null
+++ b/queue-6.6/objtool-media-dib8000-prevent-divide-by-zero-in-dib8.patch
@@ -0,0 +1,49 @@
+From f0ac5d0a2e2f8356b28554d078d6165f347219c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Mar 2025 14:56:06 -0700
+Subject: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit e63d465f59011dede0a0f1d21718b59a64c3ff5c ]
+
+If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result
+is a divide-by-zero.  Prevent that from happening.
+
+Fixes the following warning with an UBSAN kernel:
+
+  drivers/media/dvb-frontends/dib8000.o: warning: objtool: dib8000_tune() falls through to next function dib8096p_cfg_DibRx()
+
+Fixes: 173a64cb3fcf ("[media] dib8000: enhancement")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/bd1d504d930ae3f073b1e071bcf62cae7708773c.1742852847.git.jpoimboe@kernel.org
+Closes: https://lore.kernel.org/r/202503210602.fvH5DO1i-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib8000.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
+index 2f5165918163d..cfe59c3255f70 100644
+--- a/drivers/media/dvb-frontends/dib8000.c
++++ b/drivers/media/dvb-frontends/dib8000.c
+@@ -2701,8 +2701,11 @@ static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz)
+ 	u8 ratio;
+ 
+ 	if (state->revision == 0x8090) {
++		u32 internal = dib8000_read32(state, 23) / 1000;
++
+ 		ratio = 4;
+-		unit_khz_dds_val = (1<<26) / (dib8000_read32(state, 23) / 1000);
++
++		unit_khz_dds_val = (1<<26) / (internal ?: 1);
+ 		if (offset_khz < 0)
+ 			dds = (1 << 26) - (abs_offset_khz * unit_khz_dds_val);
+ 		else
+-- 
+2.39.5
+
diff --git a/queue-6.6/ocfs2-validate-l_tree_depth-to-avoid-out-of-bounds-a.patch b/queue-6.6/ocfs2-validate-l_tree_depth-to-avoid-out-of-bounds-a.patch
new file mode 100644
index 0000000000..49f4aba8d1
--- /dev/null
+++ b/queue-6.6/ocfs2-validate-l_tree_depth-to-avoid-out-of-bounds-a.patch
@@ -0,0 +1,56 @@
+From e74371c8dffd957f6cbfea50b6ab2e56c931a062 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 11:49:08 +0300
+Subject: ocfs2: validate l_tree_depth to avoid out-of-bounds access
+
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+
+[ Upstream commit a406aff8c05115119127c962cbbbbd202e1973ef ]
+
+The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is
+limited to OCFS2_MAX_PATH_DEPTH.
+
+Add a check to prevent out-of-bounds access if l_tree_depth has an invalid
+value, which may occur when reading from a corrupted mounted disk [1].
+
+Link: https://lkml.kernel.org/r/20250214084908.736528-1-kovalev@altlinux.org
+Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
+Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
+Reported-by: syzbot+66c146268dc88f4341fd@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=66c146268dc88f4341fd [1]
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Kurt Hackel <kurt.hackel@oracle.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Vasiliy Kovalev <kovalev@altlinux.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/alloc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index f0937902f7b46..e6191249169e6 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -1796,6 +1796,14 @@ static int __ocfs2_find_path(struct ocfs2_caching_info *ci,
+ 
+ 	el = root_el;
+ 	while (el->l_tree_depth) {
++		if (unlikely(le16_to_cpu(el->l_tree_depth) >= OCFS2_MAX_PATH_DEPTH)) {
++			ocfs2_error(ocfs2_metadata_cache_get_super(ci),
++				    "Owner %llu has invalid tree depth %u in extent list\n",
++				    (unsigned long long)ocfs2_metadata_cache_owner(ci),
++				    le16_to_cpu(el->l_tree_depth));
++			ret = -EROFS;
++			goto out;
++		}
+ 		if (le16_to_cpu(el->l_next_free_rec) == 0) {
+ 			ocfs2_error(ocfs2_metadata_cache_get_super(ci),
+ 				    "Owner %llu has empty extent list at depth %u\n",
+-- 
+2.39.5
+
diff --git a/queue-6.6/octeontx2-af-fix-mbox-intr-handler-when-num-vfs-64.patch b/queue-6.6/octeontx2-af-fix-mbox-intr-handler-when-num-vfs-64.patch
new file mode 100644
index 0000000000..72fc6881fb
--- /dev/null
+++ b/queue-6.6/octeontx2-af-fix-mbox-intr-handler-when-num-vfs-64.patch
@@ -0,0 +1,39 @@
+From 8b856b5e6526393bdfb6e8923c3eedf934dc8eaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 14:44:41 +0530
+Subject: octeontx2-af: Fix mbox INTR handler when num VFs > 64
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 0fdba88a211508984eb5df62008c29688692b134 ]
+
+When number of RVU VFs > 64, the vfs value passed to "rvu_queue_work"
+function is incorrect. Due to which mbox workqueue entries for
+VFs 0 to 63 never gets added to workqueue.
+
+Fixes: 9bdc47a6e328 ("octeontx2-af: Mbox communication support btw AF and it's VFs")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250327091441.1284-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index 5241737222236..67e6d755b30ec 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -2563,7 +2563,7 @@ static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
+ 		rvupf_write64(rvu, RVU_PF_VFPF_MBOX_INTX(1), intr);
+ 
+ 		rvu_queue_work(&rvu->afvf_wq_info, 64, vfs, intr);
+-		vfs -= 64;
++		vfs = 64;
+ 	}
+ 
+ 	intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(0));
+-- 
+2.39.5
+
diff --git a/queue-6.6/octeontx2-af-free-nix_af_int_vec_gen-irq.patch b/queue-6.6/octeontx2-af-free-nix_af_int_vec_gen-irq.patch
new file mode 100644
index 0000000000..bb63432c68
--- /dev/null
+++ b/queue-6.6/octeontx2-af-free-nix_af_int_vec_gen-irq.patch
@@ -0,0 +1,40 @@
+From 45ca684bfc9b3405c47a59d22ffff568bfe3e2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Mar 2025 15:10:54 +0530
+Subject: octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
+
+From: Geetha sowjanya <gakula@marvell.com>
+
+[ Upstream commit 323d6db6dc7decb06f2545efb9496259ddacd4f4 ]
+
+Due to the incorrect initial vector number in
+rvu_nix_unregister_interrupts(), NIX_AF_INT_VEC_GEN is not
+geeting free. Fix the vector number to include NIX_AF_INT_VEC_GEN
+irq.
+
+Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX")
+Signed-off-by: Geetha sowjanya <gakula@marvell.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250327094054.2312-1-gakula@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+index bffe04e6d0254..774d8b034725d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+@@ -217,7 +217,7 @@ static void rvu_nix_unregister_interrupts(struct rvu *rvu)
+ 		rvu->irq_allocated[offs + NIX_AF_INT_VEC_RVU] = false;
+ 	}
+ 
+-	for (i = NIX_AF_INT_VEC_AF_ERR; i < NIX_AF_INT_VEC_CNT; i++)
++	for (i = NIX_AF_INT_VEC_GEN; i < NIX_AF_INT_VEC_CNT; i++)
+ 		if (rvu->irq_allocated[offs + i]) {
+ 			free_irq(pci_irq_vector(rvu->pdev, offs + i), rvu_dl);
+ 			rvu->irq_allocated[offs + i] = false;
+-- 
+2.39.5
+
diff --git a/queue-6.6/of-property-increase-nr_fwnode_reference_args.patch b/queue-6.6/of-property-increase-nr_fwnode_reference_args.patch
new file mode 100644
index 0000000000..f55fddf90d
--- /dev/null
+++ b/queue-6.6/of-property-increase-nr_fwnode_reference_args.patch
@@ -0,0 +1,52 @@
+From 52abdc80cd991abcceae444dbd22735e21161291 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2025 21:58:06 +0800
+Subject: of: property: Increase NR_FWNODE_REFERENCE_ARGS
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit eb50844d728f11e87491f7c7af15a4a737f1159d ]
+
+Currently, the following two macros have different values:
+
+// The maximal argument count for firmware node reference
+ #define NR_FWNODE_REFERENCE_ARGS	8
+// The maximal argument count for DT node reference
+ #define MAX_PHANDLE_ARGS 16
+
+It may cause firmware node reference's argument count out of range if
+directly assign DT node reference's argument count to firmware's.
+
+drivers/of/property.c:of_fwnode_get_reference_args() is doing the direct
+assignment, so may cause firmware's argument count @args->nargs got out
+of range, namely, in [9, 16].
+
+Fix by increasing NR_FWNODE_REFERENCE_ARGS to 16 to meet DT requirement.
+Will align both macros later to avoid such inconsistency.
+
+Fixes: 3e3119d3088f ("device property: Introduce fwnode_property_get_reference_args")
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250225-fix_arg_count-v4-1-13cdc519eb31@quicinc.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/fwnode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
+index 525cc031596b6..7efb4493e51c0 100644
+--- a/include/linux/fwnode.h
++++ b/include/linux/fwnode.h
+@@ -83,7 +83,7 @@ struct fwnode_endpoint {
+ #define SWNODE_GRAPH_PORT_NAME_FMT		"port@%u"
+ #define SWNODE_GRAPH_ENDPOINT_NAME_FMT		"endpoint@%u"
+ 
+-#define NR_FWNODE_REFERENCE_ARGS	8
++#define NR_FWNODE_REFERENCE_ARGS	16
+ 
+ /**
+  * struct fwnode_reference_args - Fwnode reference with additional arguments
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-aspm-fix-link-state-exit-during-switch-upstream-.patch b/queue-6.6/pci-aspm-fix-link-state-exit-during-switch-upstream-.patch
new file mode 100644
index 0000000000..2b1ef012a9
--- /dev/null
+++ b/queue-6.6/pci-aspm-fix-link-state-exit-during-switch-upstream-.patch
@@ -0,0 +1,84 @@
+From 77259828f76e12bc8a6df8f99d647e0bfb06e4e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Dec 2024 19:39:08 -0800
+Subject: PCI/ASPM: Fix link state exit during switch upstream function removal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Stodden <daniel.stodden@gmail.com>
+
+[ Upstream commit cbf937dcadfd571a434f8074d057b32cd14fbea5 ]
+
+Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to
+avoid use-after-free"), we would free the ASPM link only after the last
+function on the bus pertaining to the given link was removed.
+
+That was too late. If function 0 is removed before sibling function,
+link->downstream would point to free'd memory after.
+
+After above change, we freed the ASPM parent link state upon any function
+removal on the bus pertaining to a given link.
+
+That is too early. If the link is to a PCIe switch with MFD on the upstream
+port, then removing functions other than 0 first would free a link which
+still remains parent_link to the remaining downstream ports.
+
+The resulting GPFs are especially frequent during hot-unplug, because
+pciehp removes devices on the link bus in reverse order.
+
+On that switch, function 0 is the virtual P2P bridge to the internal bus.
+Free exactly when function 0 is removed -- before the parent link is
+obsolete, but after all subordinate links are gone.
+
+Link: https://lore.kernel.org/r/e12898835f25234561c9d7de4435590d957b85d9.1734924854.git.dns@arista.com
+Fixes: 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free")
+Signed-off-by: Daniel Stodden <dns@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aspm.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 0aef6dc055b92..4e995ca4de01b 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -977,16 +977,16 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ 	parent_link = link->parent;
+ 
+ 	/*
+-	 * link->downstream is a pointer to the pci_dev of function 0.  If
+-	 * we remove that function, the pci_dev is about to be deallocated,
+-	 * so we can't use link->downstream again.  Free the link state to
+-	 * avoid this.
++	 * Free the parent link state, no later than function 0 (i.e.
++	 * link->downstream) being removed.
+ 	 *
+-	 * If we're removing a non-0 function, it's possible we could
+-	 * retain the link state, but PCIe r6.0, sec 7.5.3.7, recommends
+-	 * programming the same ASPM Control value for all functions of
+-	 * multi-function devices, so disable ASPM for all of them.
++	 * Do not free the link state any earlier. If function 0 is a
++	 * switch upstream port, this link state is parent_link to all
++	 * subordinate ones.
+ 	 */
++	if (pdev != link->downstream)
++		goto out;
++
+ 	pcie_config_aspm_link(link, 0);
+ 	list_del(&link->sibling);
+ 	free_link_state(link);
+@@ -997,6 +997,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ 		pcie_config_aspm_path(parent_link);
+ 	}
+ 
++ out:
+ 	mutex_unlock(&aspm_lock);
+ 	up_read(&pci_bus_sem);
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-avoid-reset-when-disabled-via-sysfs.patch b/queue-6.6/pci-avoid-reset-when-disabled-via-sysfs.patch
new file mode 100644
index 0000000000..e25612f5e3
--- /dev/null
+++ b/queue-6.6/pci-avoid-reset-when-disabled-via-sysfs.patch
@@ -0,0 +1,67 @@
+From bd16e87e5b5e1e4d5d8bb809c7831c58db6d092d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2025 14:56:00 -0600
+Subject: PCI: Avoid reset when disabled via sysfs
+
+From: Nishanth Aravamudan <naravamudan@nvidia.com>
+
+[ Upstream commit 479380efe1625e251008d24b2810283db60d6fcd ]
+
+After d88f521da3ef ("PCI: Allow userspace to query and set device reset
+mechanism"), userspace can disable reset of specific PCI devices by writing
+an empty string to the sysfs reset_method file.
+
+However, pci_slot_resettable() does not check pci_reset_supported(), which
+means that pci_reset_function() will still reset the device even if
+userspace has disabled all the reset methods.
+
+I was able to reproduce this issue with a vfio device passed to a qemu
+guest, where I had disabled PCI reset via sysfs.
+
+Add an explicit check of pci_reset_supported() in both
+pci_slot_resettable() and pci_bus_resettable() to ensure both the reset
+status and reset execution are bypassed if an administrator disables it for
+a device.
+
+Link: https://lore.kernel.org/r/20250207205600.1846178-1-naravamudan@nvidia.com
+Fixes: d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism")
+Signed-off-by: Nishanth Aravamudan <naravamudan@nvidia.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Alex Williamson <alex.williamson@redhat.com>
+Cc: Raphael Norwitz <raphael.norwitz@nutanix.com>
+Cc: Amey Narkhede <ameynarkhede03@gmail.com>
+Cc: Jason Gunthorpe <jgg@nvidia.com>
+Cc: Yishai Hadas <yishaih@nvidia.com>
+Cc: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 095fa1910d36d..bcce569a83395 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5714,6 +5714,8 @@ static bool pci_bus_resettable(struct pci_bus *bus)
+ 		return false;
+ 
+ 	list_for_each_entry(dev, &bus->devices, bus_list) {
++		if (!pci_reset_supported(dev))
++			return false;
+ 		if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+ 		    (dev->subordinate && !pci_bus_resettable(dev->subordinate)))
+ 			return false;
+@@ -5790,6 +5792,8 @@ static bool pci_slot_resettable(struct pci_slot *slot)
+ 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ 		if (!dev->slot || dev->slot != slot)
+ 			continue;
++		if (!pci_reset_supported(dev))
++			return false;
+ 		if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
+ 		    (dev->subordinate && !pci_bus_resettable(dev->subordinate)))
+ 			return false;
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-brcmstb-fix-error-path-after-a-call-to-regulator.patch b/queue-6.6/pci-brcmstb-fix-error-path-after-a-call-to-regulator.patch
new file mode 100644
index 0000000000..84b3566cb2
--- /dev/null
+++ b/queue-6.6/pci-brcmstb-fix-error-path-after-a-call-to-regulator.patch
@@ -0,0 +1,50 @@
+From f65d1b20b74e4a3bfd7b2b31004d4894bd19b6ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 12:39:32 -0500
+Subject: PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jim Quinlan <james.quinlan@broadcom.com>
+
+[ Upstream commit 3651ad5249c51cf7eee078e12612557040a6bdb4 ]
+
+If the regulator_bulk_get() returns an error and no regulators
+are created, we need to set their number to zero.
+
+If we don't do this and the PCIe link up fails, a call to the
+regulator_bulk_free() will result in a kernel panic.
+
+While at it, print the error value, as we cannot return an error
+upwards as the kernel will WARN() on an error from add_bus().
+
+Fixes: 9e6be018b263 ("PCI: brcmstb: Enable child bus device regulators from DT")
+Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20250214173944.47506-5-james.quinlan@broadcom.com
+[kwilczynski: commit log, use comma in the message to match style with
+other similar messages]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
+index 54c440f09a7ab..e39c61e17d86c 100644
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -1132,7 +1132,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus)
+ 
+ 		ret = regulator_bulk_get(dev, sr->num_supplies, sr->supplies);
+ 		if (ret) {
+-			dev_info(dev, "No regulators for downstream device\n");
++			dev_info(dev, "Did not get regulators, err=%d\n", ret);
++			pcie->sr = NULL;
+ 			goto no_regulators;
+ 		}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-brcmstb-fix-potential-premature-regulator-disabl.patch b/queue-6.6/pci-brcmstb-fix-potential-premature-regulator-disabl.patch
new file mode 100644
index 0000000000..66ef5d46ce
--- /dev/null
+++ b/queue-6.6/pci-brcmstb-fix-potential-premature-regulator-disabl.patch
@@ -0,0 +1,47 @@
+From efba8aacdb43193625daad093e429291091b69d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 12:39:33 -0500
+Subject: PCI: brcmstb: Fix potential premature regulator disabling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jim Quinlan <james.quinlan@broadcom.com>
+
+[ Upstream commit b7de1b60ecab2f7b6f05d8116e93228a0bbb8563 ]
+
+The platform supports enabling and disabling regulators only on
+ports below the Root Complex.
+
+Thus, we need to verify this both when adding and removing the bus,
+otherwise regulators may be disabled prematurely when a bus further
+down the topology is removed.
+
+Fixes: 9e6be018b263 ("PCI: brcmstb: Enable child bus device regulators from DT")
+Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20250214173944.47506-6-james.quinlan@broadcom.com
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
+index e39c61e17d86c..44d385f5c27cd 100644
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -1156,7 +1156,7 @@ static void brcm_pcie_remove_bus(struct pci_bus *bus)
+ 	struct subdev_regulators *sr = pcie->sr;
+ 	struct device *dev = &bus->dev;
+ 
+-	if (!sr)
++	if (!sr || !bus->parent || !pci_is_root_bus(bus->parent))
+ 		return;
+ 
+ 	if (regulator_bulk_disable(sr->num_supplies, sr->supplies))
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-brcmstb-use-internal-register-to-change-link-cap.patch b/queue-6.6/pci-brcmstb-use-internal-register-to-change-link-cap.patch
new file mode 100644
index 0000000000..428f284f7b
--- /dev/null
+++ b/queue-6.6/pci-brcmstb-use-internal-register-to-change-link-cap.patch
@@ -0,0 +1,54 @@
+From 13ecb3f0a7c1fcabed7068716831cc4f67e5c362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 12:39:30 -0500
+Subject: PCI: brcmstb: Use internal register to change link capability
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jim Quinlan <james.quinlan@broadcom.com>
+
+[ Upstream commit 0c97321e11e0e9e18546f828492758f6aaecec59 ]
+
+The driver has been mistakenly writing to a read-only (RO)
+configuration space register (PCI_EXP_LNKCAP) to change the
+PCIe link capability.
+
+Although harmless in this case, the proper write destination
+is an internal register that is reflected by PCI_EXP_LNKCAP.
+
+Thus, fix the brcm_pcie_set_gen() function to correctly update
+the link capability.
+
+Fixes: c0452137034b ("PCI: brcmstb: Add Broadcom STB PCIe host controller driver")
+Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20250214173944.47506-3-james.quinlan@broadcom.com
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
+index e47a77f943b1e..54c440f09a7ab 100644
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -378,10 +378,10 @@ static int brcm_pcie_set_ssc(struct brcm_pcie *pcie)
+ static void brcm_pcie_set_gen(struct brcm_pcie *pcie, int gen)
+ {
+ 	u16 lnkctl2 = readw(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2);
+-	u32 lnkcap = readl(pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
++	u32 lnkcap = readl(pcie->base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
+ 
+ 	lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS) | gen;
+-	writel(lnkcap, pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCAP);
++	writel(lnkcap, pcie->base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY);
+ 
+ 	lnkctl2 = (lnkctl2 & ~0xf) | gen;
+ 	writew(lnkctl2, pcie->base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKCTL2);
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-cadence-ep-fix-the-driver-to-send-msg-tlp-for-in.patch b/queue-6.6/pci-cadence-ep-fix-the-driver-to-send-msg-tlp-for-in.patch
new file mode 100644
index 0000000000..59fb11017d
--- /dev/null
+++ b/queue-6.6/pci-cadence-ep-fix-the-driver-to-send-msg-tlp-for-in.patch
@@ -0,0 +1,67 @@
+From e26c491018e3578057d9195fd8d8e606276a7cd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Feb 2025 00:57:24 +0800
+Subject: PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data
+ payload
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans Zhang <18255117159@163.com>
+
+[ Upstream commit 3ac47fbf4f6e8c3a7c3855fac68cc3246f90f850 ]
+
+Per the Cadence's "PCIe Controller IP for AX14" user guide, Version
+1.04, Section 9.1.7.1, "AXI Subordinate to PCIe Address Translation
+Registers", Table 9.4, the bit 16 of the AXI Subordinate Address
+(axi_s_awaddr) when set corresponds to MSG with data, and when not set,
+to MSG without data.
+
+However, the driver is currently doing the opposite and due to this,
+the INTx is never received on the host.
+
+So, fix the driver to reflect the documentation and also make INTx work.
+
+Fixes: 37dddf14f1ae ("PCI: cadence: Add EndPoint Controller driver for Cadence PCIe controller")
+Signed-off-by: Hans Zhang <18255117159@163.com>
+Signed-off-by: Hans Zhang <hans.zhang@cixtech.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20250214165724.184599-1-18255117159@163.com
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-ep.c | 3 +--
+ drivers/pci/controller/cadence/pcie-cadence.h    | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+index b8b655d4047ec..a87dab9abba26 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-ep.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+@@ -354,8 +354,7 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn, u8 intx,
+ 	spin_unlock_irqrestore(&ep->lock, flags);
+ 
+ 	offset = CDNS_PCIE_NORMAL_MSG_ROUTING(MSG_ROUTING_LOCAL) |
+-		 CDNS_PCIE_NORMAL_MSG_CODE(msg_code) |
+-		 CDNS_PCIE_MSG_NO_DATA;
++		 CDNS_PCIE_NORMAL_MSG_CODE(msg_code);
+ 	writel(0, ep->irq_cpu_addr + offset);
+ }
+ 
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index d55dfd173f228..9efb71cbe6996 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -240,7 +240,7 @@ struct cdns_pcie_rp_ib_bar {
+ #define CDNS_PCIE_NORMAL_MSG_CODE_MASK		GENMASK(15, 8)
+ #define CDNS_PCIE_NORMAL_MSG_CODE(code) \
+ 	(((code) << 8) & CDNS_PCIE_NORMAL_MSG_CODE_MASK)
+-#define CDNS_PCIE_MSG_NO_DATA			BIT(16)
++#define CDNS_PCIE_MSG_DATA			BIT(16)
+ 
+ struct cdns_pcie;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-histb-fix-an-error-handling-path-in-histb_pcie_p.patch b/queue-6.6/pci-histb-fix-an-error-handling-path-in-histb_pcie_p.patch
new file mode 100644
index 0000000000..d92cd15c21
--- /dev/null
+++ b/queue-6.6/pci-histb-fix-an-error-handling-path-in-histb_pcie_p.patch
@@ -0,0 +1,71 @@
+From 7341c4370e5497097d81587cc4d021c91c26dbb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Mar 2025 19:42:54 +0100
+Subject: PCI: histb: Fix an error handling path in histb_pcie_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b36fb50701619efca5f5450b355d42575cf532ed ]
+
+If an error occurs after a successful phy_init() call, then phy_exit()
+should be called.
+
+Add the missing call, as already done in the remove function.
+
+Fixes: bbd11bddb398 ("PCI: hisi: Add HiSilicon STB SoC PCIe controller driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[kwilczynski: remove unnecessary hipcie->phy NULL check from
+histb_pcie_probe() and squash a patch that removes similar NULL
+check for hipcie-phy from histb_pcie_remove() from
+https://lore.kernel.org/linux-pci/c369b5d25e17a44984ae5a889ccc28a59a0737f7.1742058005.git.christophe.jaillet@wanadoo.fr]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Link: https://lore.kernel.org/r/8301fc15cdea5d2dac21f57613e8e6922fb1ad95.1740854531.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-histb.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-histb.c b/drivers/pci/controller/dwc/pcie-histb.c
+index fd484cc7c481d..335b26635ee99 100644
+--- a/drivers/pci/controller/dwc/pcie-histb.c
++++ b/drivers/pci/controller/dwc/pcie-histb.c
+@@ -409,16 +409,21 @@ static int histb_pcie_probe(struct platform_device *pdev)
+ 	ret = histb_pcie_host_enable(pp);
+ 	if (ret) {
+ 		dev_err(dev, "failed to enable host\n");
+-		return ret;
++		goto err_exit_phy;
+ 	}
+ 
+ 	ret = dw_pcie_host_init(pp);
+ 	if (ret) {
+ 		dev_err(dev, "failed to initialize host\n");
+-		return ret;
++		goto err_exit_phy;
+ 	}
+ 
+ 	return 0;
++
++err_exit_phy:
++	phy_exit(hipcie->phy);
++
++	return ret;
+ }
+ 
+ static void histb_pcie_remove(struct platform_device *pdev)
+@@ -427,8 +432,7 @@ static void histb_pcie_remove(struct platform_device *pdev)
+ 
+ 	histb_pcie_host_disable(hipcie);
+ 
+-	if (hipcie->phy)
+-		phy_exit(hipcie->phy);
++	phy_exit(hipcie->phy);
+ }
+ 
+ static const struct of_device_id histb_pcie_of_match[] = {
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-pciehp-don-t-enable-hpie-when-resuming-in-poll-m.patch b/queue-6.6/pci-pciehp-don-t-enable-hpie-when-resuming-in-poll-m.patch
new file mode 100644
index 0000000000..19667bd311
--- /dev/null
+++ b/queue-6.6/pci-pciehp-don-t-enable-hpie-when-resuming-in-poll-m.patch
@@ -0,0 +1,49 @@
+From 52267d696ac1f07a2521c5cff6ad25c17ef2841f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 18:21:14 +0200
+Subject: PCI: pciehp: Don't enable HPIE when resuming in poll mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 527664f738afb6f2c58022cd35e63801e5dc7aec ]
+
+PCIe hotplug can operate in poll mode without interrupt handlers using a
+polling kthread only.  eb34da60edee ("PCI: pciehp: Disable hotplug
+interrupt during suspend") failed to consider that and enables HPIE
+(Hot-Plug Interrupt Enable) unconditionally when resuming the Port.
+
+Only set HPIE if non-poll mode is in use. This makes
+pcie_enable_interrupt() match how pcie_enable_notification() already
+handles HPIE.
+
+Link: https://lore.kernel.org/r/20250321162114.3939-1-ilpo.jarvinen@linux.intel.com
+Fixes: eb34da60edee ("PCI: pciehp: Disable hotplug interrupt during suspend")
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/pciehp_hpc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
+index fd713abdfb9f9..b0bccc4d0da28 100644
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -839,7 +839,9 @@ void pcie_enable_interrupt(struct controller *ctrl)
+ {
+ 	u16 mask;
+ 
+-	mask = PCI_EXP_SLTCTL_HPIE | PCI_EXP_SLTCTL_DLLSCE;
++	mask = PCI_EXP_SLTCTL_DLLSCE;
++	if (!pciehp_poll_mode)
++		mask |= PCI_EXP_SLTCTL_HPIE;
+ 	pcie_write_cmd(ctrl, mask, mask);
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-portdrv-only-disable-pciehp-interrupts-early-whe.patch b/queue-6.6/pci-portdrv-only-disable-pciehp-interrupts-early-whe.patch
new file mode 100644
index 0000000000..fea55c3a5c
--- /dev/null
+++ b/queue-6.6/pci-portdrv-only-disable-pciehp-interrupts-early-whe.patch
@@ -0,0 +1,60 @@
+From 76ea70f9df5e63bb913925c426c79d68a7419601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 10:36:30 +0800
+Subject: PCI/portdrv: Only disable pciehp interrupts early when needed
+
+From: Feng Tang <feng.tang@linux.alibaba.com>
+
+[ Upstream commit 9d7db4db19827380e225914618c0c1bf435ed2f5 ]
+
+Firmware developers reported that Linux issues two PCIe hotplug commands in
+very short intervals on an ARM server, which doesn't comply with the PCIe
+spec.  According to PCIe r6.1, sec 6.7.3.2, if the Command Completed event
+is supported, software must wait for a command to complete or wait at
+least 1 second before sending a new command.
+
+In the failure case, the first PCIe hotplug command is from
+get_port_device_capability(), which sends a command to disable PCIe hotplug
+interrupts without waiting for its completion, and the second command comes
+from pcie_enable_notification() of pciehp driver, which enables hotplug
+interrupts again.
+
+Fix this by only disabling the hotplug interrupts when the pciehp driver is
+not enabled.
+
+Link: https://lore.kernel.org/r/20250303023630.78397-1-feng.tang@linux.alibaba.com
+Fixes: 2bd50dd800b5 ("PCI: PCIe: Disable PCIe port services during port initialization")
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Feng Tang <feng.tang@linux.alibaba.com>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/portdrv.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pcie/portdrv.c b/drivers/pci/pcie/portdrv.c
+index 46fad0d813b2b..d6e5fef54c3b8 100644
+--- a/drivers/pci/pcie/portdrv.c
++++ b/drivers/pci/pcie/portdrv.c
+@@ -227,10 +227,12 @@ static int get_port_device_capability(struct pci_dev *dev)
+ 
+ 		/*
+ 		 * Disable hot-plug interrupts in case they have been enabled
+-		 * by the BIOS and the hot-plug service driver is not loaded.
++		 * by the BIOS and the hot-plug service driver won't be loaded
++		 * to handle them.
+ 		 */
+-		pcie_capability_clear_word(dev, PCI_EXP_SLTCTL,
+-			  PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE);
++		if (!IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE))
++			pcie_capability_clear_word(dev, PCI_EXP_SLTCTL,
++				PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE);
+ 	}
+ 
+ #ifdef CONFIG_PCIEAER
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-remove-stray-put_device-in-pci_register_host_bri.patch b/queue-6.6/pci-remove-stray-put_device-in-pci_register_host_bri.patch
new file mode 100644
index 0000000000..510f5b3d2c
--- /dev/null
+++ b/queue-6.6/pci-remove-stray-put_device-in-pci_register_host_bri.patch
@@ -0,0 +1,41 @@
+From 768feff3ec1aa49ea557e742a6373b52dc7d6d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 11:46:34 +0300
+Subject: PCI: Remove stray put_device() in pci_register_host_bridge()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 6e8d06e5096c80cbf41313b4a204f43071ca42be ]
+
+This put_device() was accidentally left over from when we changed the code
+from using device_register() to calling device_add().  Delete it.
+
+Link: https://lore.kernel.org/r/55b24870-89fb-4c91-b85d-744e35db53c2@stanley.mountain
+Fixes: 9885440b16b8 ("PCI: Fix pci_host_bridge struct device release/free handling")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/probe.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 03b519a228403..bcd1ba829e1fc 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -927,10 +927,9 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ 	/* Temporarily move resources off the list */
+ 	list_splice_init(&bridge->windows, &resources);
+ 	err = device_add(&bridge->dev);
+-	if (err) {
+-		put_device(&bridge->dev);
++	if (err)
+ 		goto free;
+-	}
++
+ 	bus->bridge = get_device(&bridge->dev);
+ 	device_enable_async_suspend(bus->bridge);
+ 	pci_set_bus_of_node(bus);
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-use-downstream-bridges-for-distributing-resource.patch b/queue-6.6/pci-use-downstream-bridges-for-distributing-resource.patch
new file mode 100644
index 0000000000..995780c323
--- /dev/null
+++ b/queue-6.6/pci-use-downstream-bridges-for-distributing-resource.patch
@@ -0,0 +1,96 @@
+From d01b1650f690a643c5de2c198da06c70d9e8fc5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 10:24:57 +0800
+Subject: PCI: Use downstream bridges for distributing resources
+
+From: Kai-Heng Feng <kaihengf@nvidia.com>
+
+[ Upstream commit 1a596ad00ffe9b37fc60a93cbdd4daead3bf95f3 ]
+
+7180c1d08639 ("PCI: Distribute available resources for root buses, too")
+breaks BAR assignment on some devices:
+
+  pci 0006:03:00.0: BAR 0 [mem 0x6300c0000000-0x6300c1ffffff 64bit pref]: assigned
+  pci 0006:03:00.1: BAR 0 [mem 0x6300c2000000-0x6300c3ffffff 64bit pref]: assigned
+  pci 0006:03:00.2: BAR 0 [mem size 0x00800000 64bit pref]: can't assign; no space
+  pci 0006:03:00.0: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space
+  pci 0006:03:00.1: VF BAR 0 [mem size 0x02000000 64bit pref]: can't assign; no space
+
+The apertures of domain 0006 before 7180c1d08639:
+
+  6300c0000000-63ffffffffff : PCI Bus 0006:00
+    6300c0000000-6300c9ffffff : PCI Bus 0006:01
+      6300c0000000-6300c9ffffff : PCI Bus 0006:02        # 160MB
+        6300c0000000-6300c8ffffff : PCI Bus 0006:03      #   144MB
+          6300c0000000-6300c1ffffff : 0006:03:00.0       #     32MB
+          6300c2000000-6300c3ffffff : 0006:03:00.1       #     32MB
+          6300c4000000-6300c47fffff : 0006:03:00.2       #      8MB
+          6300c4800000-6300c67fffff : 0006:03:00.0       #     32MB
+          6300c6800000-6300c87fffff : 0006:03:00.1       #     32MB
+        6300c9000000-6300c9bfffff : PCI Bus 0006:04      #    12MB
+          6300c9000000-6300c9bfffff : PCI Bus 0006:05    #    12MB
+            6300c9000000-6300c91fffff : PCI Bus 0006:06  #      2MB
+            6300c9200000-6300c93fffff : PCI Bus 0006:07  #      2MB
+            6300c9400000-6300c95fffff : PCI Bus 0006:08  #      2MB
+            6300c9600000-6300c97fffff : PCI Bus 0006:09  #      2MB
+
+After 7180c1d08639:
+
+  6300c0000000-63ffffffffff : PCI Bus 0006:00
+    6300c0000000-6300c9ffffff : PCI Bus 0006:01
+      6300c0000000-6300c9ffffff : PCI Bus 0006:02        # 160MB
+        6300c0000000-6300c43fffff : PCI Bus 0006:03      #    68MB
+          6300c0000000-6300c1ffffff : 0006:03:00.0       #      32MB
+          6300c2000000-6300c3ffffff : 0006:03:00.1       #      32MB
+              --- no space ---      : 0006:03:00.2       #       8MB
+              --- no space ---      : 0006:03:00.0       #      32MB
+              --- no space ---      : 0006:03:00.1       #      32MB
+        6300c4400000-6300c4dfffff : PCI Bus 0006:04      #    10MB
+          6300c4400000-6300c4dfffff : PCI Bus 0006:05    #      10MB
+            6300c4400000-6300c45fffff : PCI Bus 0006:06  #        2MB
+            6300c4600000-6300c47fffff : PCI Bus 0006:07  #        2MB
+            6300c4800000-6300c49fffff : PCI Bus 0006:08  #        2MB
+            6300c4a00000-6300c4bfffff : PCI Bus 0006:09  #        2MB
+
+We can see that the window to 0006:03 gets shrunken too much and 0006:04
+eats away the window for 0006:03:00.2.
+
+The offending commit distributes the upstream bridge's resources multiple
+times to every downstream bridge, hence makes the aperture smaller than
+desired because calculation of io_per_b, mmio_per_b and mmio_pref_per_b
+becomes incorrect.
+
+Instead, distribute downstream bridges' own resources to resolve the issue.
+
+Link: https://lore.kernel.org/r/20241204022457.51322-1-kaihengf@nvidia.com
+Fixes: 7180c1d08639 ("PCI: Distribute available resources for root buses, too")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219540
+Signed-off-by: Kai-Heng Feng <kaihengf@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Carol Soto <csoto@nvidia.com>
+Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: Chris Chiu <chris.chiu@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/setup-bus.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 5a143ad5fca24..fba402f4f6330 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -2018,8 +2018,7 @@ pci_root_bus_distribute_available_resources(struct pci_bus *bus,
+ 		 * in case of root bus.
+ 		 */
+ 		if (bridge && pci_bridge_resources_not_assigned(dev))
+-			pci_bridge_distribute_available_resources(bridge,
+-								  add_list);
++			pci_bridge_distribute_available_resources(dev, add_list);
+ 		else
+ 			pci_root_bus_distribute_available_resources(b, add_list);
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/pci-xilinx-cpm-fix-irq-domain-leak-in-error-path-of-.patch b/queue-6.6/pci-xilinx-cpm-fix-irq-domain-leak-in-error-path-of-.patch
new file mode 100644
index 0000000000..895da83505
--- /dev/null
+++ b/queue-6.6/pci-xilinx-cpm-fix-irq-domain-leak-in-error-path-of-.patch
@@ -0,0 +1,65 @@
+From c34b4cc0f58cbd6ab918e4d8a76fbfdbaf0179b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2025 21:20:22 +0530
+Subject: PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thippeswamy Havalige <thippeswamy.havalige@amd.com>
+
+[ Upstream commit 57b0302240741e73fe51f88404b3866e0d2933ad ]
+
+The IRQ domain allocated for the PCIe controller is not freed if
+resource_list_first_type() returns NULL, leading to a resource leak.
+
+This fix ensures properly cleaning up the allocated IRQ domain in
+the error path.
+
+Fixes: 49e427e6bdd1 ("Merge branch 'pci/host-probe-refactor'")
+Signed-off-by: Thippeswamy Havalige <thippeswamy.havalige@amd.com>
+[kwilczynski: added missing Fixes: tag, refactored to use one of the goto labels]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Link: https://lore.kernel.org/r/20250224155025.782179-2-thippeswamy.havalige@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-xilinx-cpm.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-xilinx-cpm.c b/drivers/pci/controller/pcie-xilinx-cpm.c
+index 4a787a941674b..51379d791005b 100644
+--- a/drivers/pci/controller/pcie-xilinx-cpm.c
++++ b/drivers/pci/controller/pcie-xilinx-cpm.c
+@@ -594,15 +594,17 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)
+ 		return err;
+ 
+ 	bus = resource_list_first_type(&bridge->windows, IORESOURCE_BUS);
+-	if (!bus)
+-		return -ENODEV;
++	if (!bus) {
++		err = -ENODEV;
++		goto err_free_irq_domains;
++	}
+ 
+ 	port->variant = of_device_get_match_data(dev);
+ 
+ 	err = xilinx_cpm_pcie_parse_dt(port, bus->res);
+ 	if (err) {
+ 		dev_err(dev, "Parsing DT failed\n");
+-		goto err_parse_dt;
++		goto err_free_irq_domains;
+ 	}
+ 
+ 	xilinx_cpm_pcie_init_port(port);
+@@ -626,7 +628,7 @@ static int xilinx_cpm_pcie_probe(struct platform_device *pdev)
+ 	xilinx_cpm_free_interrupts(port);
+ err_setup_irq:
+ 	pci_ecam_free(port->cfg);
+-err_parse_dt:
++err_free_irq_domains:
+ 	xilinx_cpm_free_irq_domains(port);
+ 	return err;
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-arm-spe-fix-load-store-operation-checking.patch b/queue-6.6/perf-arm-spe-fix-load-store-operation-checking.patch
new file mode 100644
index 0000000000..d200574058
--- /dev/null
+++ b/queue-6.6/perf-arm-spe-fix-load-store-operation-checking.patch
@@ -0,0 +1,64 @@
+From d121b799fcacd7461923fe6bf1d1bfa7874db2e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 11:12:34 +0000
+Subject: perf arm-spe: Fix load-store operation checking
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit e1d47850bbf79a541c9b3bacdd562f5e0112274d ]
+
+The ARM_SPE_OP_LD and ARM_SPE_OP_ST operations are secondary operation
+type, they are overlapping with other second level's operation types
+belonging to SVE and branch operations.  As a result, a non load-store
+operation can be parsed for data source and memory sample.
+
+To fix the issue, this commit introduces a is_ldst_op() macro for
+checking LDST operation, and apply the checking when synthesize data
+source and memory samples.
+
+Fixes: a89dbc9b988f ("perf arm-spe: Set sample's data source field")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20250304111240.3378214-7-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/arm-spe.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c
+index afbd5869f6bff..9848310cee5f3 100644
+--- a/tools/perf/util/arm-spe.c
++++ b/tools/perf/util/arm-spe.c
+@@ -37,6 +37,8 @@
+ #include "../../arch/arm64/include/asm/cputype.h"
+ #define MAX_TIMESTAMP (~0ULL)
+ 
++#define is_ldst_op(op)		(!!((op) & ARM_SPE_OP_LDST))
++
+ struct arm_spe {
+ 	struct auxtrace			auxtrace;
+ 	struct auxtrace_queues		queues;
+@@ -520,6 +522,10 @@ static u64 arm_spe__synth_data_source(const struct arm_spe_record *record, u64 m
+ 	union perf_mem_data_src	data_src = { .mem_op = PERF_MEM_OP_NA };
+ 	bool is_neoverse = is_midr_in_range_list(midr, neoverse_spe);
+ 
++	/* Only synthesize data source for LDST operations */
++	if (!is_ldst_op(record->op))
++		return 0;
++
+ 	if (record->op & ARM_SPE_OP_LD)
+ 		data_src.mem_op = PERF_MEM_OP_LOAD;
+ 	else if (record->op & ARM_SPE_OP_ST)
+@@ -619,7 +625,7 @@ static int arm_spe_sample(struct arm_spe_queue *speq)
+ 	 * When data_src is zero it means the record is not a memory operation,
+ 	 * skip to synthesize memory sample for this case.
+ 	 */
+-	if (spe->sample_memory && data_src) {
++	if (spe->sample_memory && is_ldst_op(record->op)) {
+ 		err = arm_spe__synth_mem_sample(speq, spe->memory_id, data_src);
+ 		if (err)
+ 			return err;
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-bench-fix-perf-bench-syscall-loop-count.patch b/queue-6.6/perf-bench-fix-perf-bench-syscall-loop-count.patch
new file mode 100644
index 0000000000..9d07bf5ee3
--- /dev/null
+++ b/queue-6.6/perf-bench-fix-perf-bench-syscall-loop-count.patch
@@ -0,0 +1,104 @@
+From 591bf96e34a04abf53159d6352ebda5c3a5d362d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Mar 2025 10:23:49 +0100
+Subject: perf bench: Fix perf bench syscall loop count
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 957d194163bf983da98bf7ec7e4f86caff8cd0eb ]
+
+Command 'perf bench syscall fork -l 100000' offers option -l to run for
+a specified number of iterations. However this option is not always
+observed. The number is silently limited to 10000 iterations as can be
+seen:
+
+Output before:
+ # perf bench syscall fork -l 100000
+ # Running 'syscall/fork' benchmark:
+ # Executed 10,000 fork() calls
+     Total time: 23.388 [sec]
+
+    2338.809800 usecs/op
+            427 ops/sec
+ #
+
+When explicitly specified with option -l or --loops, also observe
+higher number of iterations:
+
+Output after:
+ # perf bench syscall fork -l 100000
+ # Running 'syscall/fork' benchmark:
+ # Executed 100,000 fork() calls
+     Total time: 716.982 [sec]
+
+    7169.829510 usecs/op
+            139 ops/sec
+ #
+
+This patch fixes the issue for basic execve fork and getpgid.
+
+Fixes: ece7f7c0507c ("perf bench syscall: Add fork syscall benchmark")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Tested-by: Athira Rajeev <atrajeev@linux.ibm.com>
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
+Link: https://lore.kernel.org/r/20250304092349.2618082-1-tmricht@linux.ibm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/syscall.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/tools/perf/bench/syscall.c b/tools/perf/bench/syscall.c
+index ea4dfc07cbd6b..e7dc216f717f5 100644
+--- a/tools/perf/bench/syscall.c
++++ b/tools/perf/bench/syscall.c
+@@ -22,8 +22,7 @@
+ #define __NR_fork -1
+ #endif
+ 
+-#define LOOPS_DEFAULT 10000000
+-static	int loops = LOOPS_DEFAULT;
++static	int loops;
+ 
+ static const struct option options[] = {
+ 	OPT_INTEGER('l', "loop",	&loops,		"Specify number of loops"),
+@@ -80,6 +79,18 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)
+ 	const char *name = NULL;
+ 	int i;
+ 
++	switch (syscall) {
++	case __NR_fork:
++	case __NR_execve:
++		/* Limit default loop to 10000 times to save time */
++		loops = 10000;
++		break;
++	default:
++		loops = 10000000;
++		break;
++	}
++
++	/* Options -l and --loops override default above */
+ 	argc = parse_options(argc, argv, options, bench_syscall_usage, 0);
+ 
+ 	gettimeofday(&start, NULL);
+@@ -94,16 +105,9 @@ static int bench_syscall_common(int argc, const char **argv, int syscall)
+ 			break;
+ 		case __NR_fork:
+ 			test_fork();
+-			/* Only loop 10000 times to save time */
+-			if (i == 10000)
+-				loops = 10000;
+ 			break;
+ 		case __NR_execve:
+ 			test_execve();
+-			/* Only loop 10000 times to save time */
+-			if (i == 10000)
+-				loops = 10000;
+-			break;
+ 		default:
+ 			break;
+ 		}
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-core-fix-perf_pmu_register-vs.-perf_init_event.patch b/queue-6.6/perf-core-fix-perf_pmu_register-vs.-perf_init_event.patch
new file mode 100644
index 0000000000..c2133554d7
--- /dev/null
+++ b/queue-6.6/perf-core-fix-perf_pmu_register-vs.-perf_init_event.patch
@@ -0,0 +1,101 @@
+From d811b8a18e0b7e57dc5f6e05e0a208d6e725d749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 14:39:12 +0100
+Subject: perf/core: Fix perf_pmu_register() vs. perf_init_event()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 003659fec9f6d8c04738cb74b5384398ae8a7e88 ]
+
+There is a fairly obvious race between perf_init_event() doing
+idr_find() and perf_pmu_register() doing idr_alloc() with an
+incompletely initialized PMU pointer.
+
+Avoid by doing idr_alloc() on a NULL pointer to register the id, and
+swizzling the real struct pmu pointer at the end using idr_replace().
+
+Also making sure to not set struct pmu members after publishing
+the struct pmu, duh.
+
+[ introduce idr_cmpxchg() in order to better handle the idr_replace()
+  error case -- if it were to return an unexpected pointer, it will
+  already have replaced the value and there is no going back. ]
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20241104135517.858805880@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 28 ++++++++++++++++++++++++++--
+ 1 file changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 4dd8936b5aa09..a524329149a71 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11556,6 +11556,21 @@ static int pmu_dev_alloc(struct pmu *pmu)
+ static struct lock_class_key cpuctx_mutex;
+ static struct lock_class_key cpuctx_lock;
+ 
++static bool idr_cmpxchg(struct idr *idr, unsigned long id, void *old, void *new)
++{
++	void *tmp, *val = idr_find(idr, id);
++
++	if (val != old)
++		return false;
++
++	tmp = idr_replace(idr, new, id);
++	if (IS_ERR(tmp))
++		return false;
++
++	WARN_ON_ONCE(tmp != val);
++	return true;
++}
++
+ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
+ {
+ 	int cpu, ret, max = PERF_TYPE_MAX;
+@@ -11577,7 +11592,7 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
+ 	if (type >= 0)
+ 		max = type;
+ 
+-	ret = idr_alloc(&pmu_idr, pmu, max, 0, GFP_KERNEL);
++	ret = idr_alloc(&pmu_idr, NULL, max, 0, GFP_KERNEL);
+ 	if (ret < 0)
+ 		goto free_pdc;
+ 
+@@ -11585,6 +11600,7 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
+ 
+ 	type = ret;
+ 	pmu->type = type;
++	atomic_set(&pmu->exclusive_cnt, 0);
+ 
+ 	if (pmu_bus_running && !pmu->dev) {
+ 		ret = pmu_dev_alloc(pmu);
+@@ -11633,14 +11649,22 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
+ 	if (!pmu->event_idx)
+ 		pmu->event_idx = perf_event_idx_default;
+ 
++	/*
++	 * Now that the PMU is complete, make it visible to perf_try_init_event().
++	 */
++	if (!idr_cmpxchg(&pmu_idr, pmu->type, NULL, pmu))
++		goto free_context;
+ 	list_add_rcu(&pmu->entry, &pmus);
+-	atomic_set(&pmu->exclusive_cnt, 0);
++
+ 	ret = 0;
+ unlock:
+ 	mutex_unlock(&pmus_lock);
+ 
+ 	return ret;
+ 
++free_context:
++	free_percpu(pmu->cpu_pmu_context);
++
+ free_dev:
+ 	if (pmu->dev && pmu->dev != PMU_NULL_DEV) {
+ 		device_del(pmu->dev);
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-evlist-add-success-path-to-evlist__create_syswi.patch b/queue-6.6/perf-evlist-add-success-path-to-evlist__create_syswi.patch
new file mode 100644
index 0000000000..2208594d41
--- /dev/null
+++ b/queue-6.6/perf-evlist-add-success-path-to-evlist__create_syswi.patch
@@ -0,0 +1,57 @@
+From d4a284d386fd64252e0a29d5e0d7c025d1cbb426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 14:22:59 -0800
+Subject: perf evlist: Add success path to evlist__create_syswide_maps
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit fe0ce8a9d85a48642880c9b78944cb0d23e779c5 ]
+
+Over various refactorings evlist__create_syswide_maps has been made to
+only ever return with -ENOMEM. Fix this so that when
+perf_evlist__set_maps is successfully called, 0 is returned.
+
+Reviewed-by: Howard Chu <howardchu95@gmail.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: https://lore.kernel.org/r/20250228222308.626803-3-irogers@google.com
+Fixes: 8c0498b6891d7ca5 ("perf evlist: Fix create_syswide_maps() not propagating maps")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evlist.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index 1eadb4f7c1b9d..f86a1eb4ea36a 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -1362,19 +1362,18 @@ static int evlist__create_syswide_maps(struct evlist *evlist)
+ 	 */
+ 	cpus = perf_cpu_map__new(NULL);
+ 	if (!cpus)
+-		goto out;
++		return -ENOMEM;
+ 
+ 	threads = perf_thread_map__new_dummy();
+-	if (!threads)
+-		goto out_put;
++	if (!threads) {
++		perf_cpu_map__put(cpus);
++		return -ENOMEM;
++	}
+ 
+ 	perf_evlist__set_maps(&evlist->core, cpus, threads);
+-
+ 	perf_thread_map__put(threads);
+-out_put:
+ 	perf_cpu_map__put(cpus);
+-out:
+-	return -ENOMEM;
++	return 0;
+ }
+ 
+ int evlist__open(struct evlist *evlist)
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-pmu-don-t-double-count-common-sysfs-and-json-ev.patch b/queue-6.6/perf-pmu-don-t-double-count-common-sysfs-and-json-ev.patch
new file mode 100644
index 0000000000..64502c2aa4
--- /dev/null
+++ b/queue-6.6/perf-pmu-don-t-double-count-common-sysfs-and-json-ev.patch
@@ -0,0 +1,81 @@
+From c8371915c0efbd9483761aa04a7cfbbf1ce143c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 10:41:01 +0000
+Subject: perf pmu: Don't double count common sysfs and json events
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit c9d699e10fa6c0cdabcddcf991e7ff42af6b2503 ]
+
+After pmu_add_cpu_aliases() is called, perf_pmu__num_events() returns an
+incorrect value that double counts common events and doesn't match the
+actual count of events in the alias list. This is because after
+'cpu_aliases_added == true', the number of events returned is
+'sysfs_aliases + cpu_json_aliases'. But when adding 'case
+EVENT_SRC_SYSFS' events, 'sysfs_aliases' and 'cpu_json_aliases' are both
+incremented together, failing to account that these ones overlap and
+only add a single item to the list. Fix it by adding another counter for
+overlapping events which doesn't influence 'cpu_json_aliases'.
+
+There doesn't seem to be a current issue because it's used in perf list
+before pmu_add_cpu_aliases() so the correct value is returned. Other
+uses in tests may also miss it for other reasons like only looking at
+uncore events. However it's marked as a fixes commit in case any new fix
+with new uses of perf_pmu__num_events() is backported.
+
+Fixes: d9c5f5f94c2d ("perf pmu: Count sys and cpuid JSON events separately")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://lore.kernel.org/r/20250226104111.564443-3-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/pmu.c | 7 ++++---
+ tools/perf/util/pmu.h | 5 +++++
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 27393e4327922..2587c4b463fa8 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -597,7 +597,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
+ 			};
+ 			if (pmu_events_table__find_event(pmu->events_table, pmu, name,
+ 							 update_alias, &data) == 0)
+-				pmu->cpu_json_aliases++;
++				pmu->cpu_common_json_aliases++;
+ 		}
+ 		pmu->sysfs_aliases++;
+ 		break;
+@@ -1680,9 +1680,10 @@ size_t perf_pmu__num_events(struct perf_pmu *pmu)
+ 	if (pmu->cpu_aliases_added)
+ 		 nr += pmu->cpu_json_aliases;
+ 	else if (pmu->events_table)
+-		nr += pmu_events_table__num_events(pmu->events_table, pmu) - pmu->cpu_json_aliases;
++		nr += pmu_events_table__num_events(pmu->events_table, pmu) -
++			pmu->cpu_common_json_aliases;
+ 	else
+-		assert(pmu->cpu_json_aliases == 0);
++		assert(pmu->cpu_json_aliases == 0 && pmu->cpu_common_json_aliases == 0);
+ 
+ 	return pmu->selectable ? nr + 1 : nr;
+ }
+diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
+index aca4238f06a65..5a03c361cb04c 100644
+--- a/tools/perf/util/pmu.h
++++ b/tools/perf/util/pmu.h
+@@ -124,6 +124,11 @@ struct perf_pmu {
+ 	uint32_t cpu_json_aliases;
+ 	/** @sys_json_aliases: Number of json event aliases loaded matching the PMU's identifier. */
+ 	uint32_t sys_json_aliases;
++	/**
++	 * @cpu_common_json_aliases: Number of json events that overlapped with sysfs when
++	 * loading all sysfs events.
++	 */
++	uint32_t cpu_common_json_aliases;
+ 	/** @sysfs_aliases_loaded: Are sysfs aliases loaded from disk? */
+ 	bool sysfs_aliases_loaded;
+ 	/**
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-python-check-if-there-is-space-to-copy-all-the-.patch b/queue-6.6/perf-python-check-if-there-is-space-to-copy-all-the-.patch
new file mode 100644
index 0000000000..7e20cd5ac4
--- /dev/null
+++ b/queue-6.6/perf-python-check-if-there-is-space-to-copy-all-the-.patch
@@ -0,0 +1,68 @@
+From 25a995f7adf0c1718c5a7ada013ff8c8f4c970a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 17:31:41 -0300
+Subject: perf python: Check if there is space to copy all the event
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 89aaeaf84231157288035b366cb6300c1c6cac64 ]
+
+The pyrf_event__new() method copies the event obtained from the perf
+ring buffer to a structure that will then be turned into a python object
+for further consumption, so it copies perf_event.header.size bytes to
+its 'event' member:
+
+  $ pahole -C pyrf_event /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so
+  struct pyrf_event {
+  	PyObject                   ob_base;              /*     0    16 */
+  	struct evsel *             evsel;                /*    16     8 */
+  	struct perf_sample         sample;               /*    24   312 */
+
+  	/* XXX last struct has 7 bytes of padding, 2 holes */
+
+  	/* --- cacheline 5 boundary (320 bytes) was 16 bytes ago --- */
+  	union perf_event           event;                /*   336  4168 */
+
+  	/* size: 4504, cachelines: 71, members: 4 */
+  	/* member types with holes: 1, total: 2 */
+  	/* paddings: 1, sum paddings: 7 */
+  	/* last cacheline: 24 bytes */
+  };
+
+  $
+
+It was doing so without checking if the event just obtained has more
+than that space, fix it.
+
+This isn't a proper, final solution, as we need to support larger
+events, but for the time being we at least bounds check and document it.
+
+Fixes: 877108e42b1b9ba6 ("perf tools: Initial python binding")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250312203141.285263-7-acme@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/python.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
+index 4697bbb17c39a..06a1e09d7349c 100644
+--- a/tools/perf/util/python.c
++++ b/tools/perf/util/python.c
+@@ -671,6 +671,11 @@ static PyObject *pyrf_event__new(union perf_event *event)
+ 	      event->header.type == PERF_RECORD_SWITCH_CPU_WIDE))
+ 		return NULL;
+ 
++	// FIXME this better be dynamic or we need to parse everything
++	// before calling perf_mmap__consume(), including tracepoint fields.
++	if (sizeof(pevent->event) < event->header.size)
++		return NULL;
++
+ 	ptype = pyrf_event__type[event->header.type];
+ 	pevent = PyObject_New(struct pyrf_event, ptype);
+ 	if (pevent != NULL)
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-python-decrement-the-refcount-of-just-created-e.patch b/queue-6.6/perf-python-decrement-the-refcount-of-just-created-e.patch
new file mode 100644
index 0000000000..b7dbfadaee
--- /dev/null
+++ b/queue-6.6/perf-python-decrement-the-refcount-of-just-created-e.patch
@@ -0,0 +1,52 @@
+From d53f15abd91cd50640bc9bde424642387155114a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 17:31:39 -0300
+Subject: perf python: Decrement the refcount of just created event on failure
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 3de5a2bf5b4847f7a59a184568f969f8fe05d57f ]
+
+To avoid a leak if we have the python object but then something happens
+and we need to return the operation, decrement the offset of the newly
+created object.
+
+Fixes: 377f698db12150a1 ("perf python: Add struct evsel into struct pyrf_event")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250312203141.285263-5-acme@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/python.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
+index 8753c9d3670ac..47c43b9c72fe7 100644
+--- a/tools/perf/util/python.c
++++ b/tools/perf/util/python.c
+@@ -1170,6 +1170,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
+ 
+ 		evsel = evlist__event2evsel(evlist, event);
+ 		if (!evsel) {
++			Py_DECREF(pyevent);
+ 			Py_INCREF(Py_None);
+ 			return Py_None;
+ 		}
+@@ -1181,9 +1182,12 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
+ 		/* Consume the even only after we parsed it out. */
+ 		perf_mmap__consume(&md->core);
+ 
+-		if (err)
++		if (err) {
++			Py_DECREF(pyevent);
+ 			return PyErr_Format(PyExc_OSError,
+ 					    "perf: can't parse sample, err=%d", err);
++		}
++
+ 		return pyevent;
+ 	}
+ end:
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-python-don-t-keep-a-raw_data-pointer-to-consume.patch b/queue-6.6/perf-python-don-t-keep-a-raw_data-pointer-to-consume.patch
new file mode 100644
index 0000000000..9d86fb3ece
--- /dev/null
+++ b/queue-6.6/perf-python-don-t-keep-a-raw_data-pointer-to-consume.patch
@@ -0,0 +1,86 @@
+From 56222e6f5beeb2054148e88a453a73a2d4e15942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 17:31:40 -0300
+Subject: perf python: Don't keep a raw_data pointer to consumed ring buffer
+ space
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit f3fed3ae34d606819d87a63d970cc3092a5be7ab ]
+
+When processing tracepoints the perf python binding was parsing the
+event before calling perf_mmap__consume(&md->core) in
+pyrf_evlist__read_on_cpu().
+
+But part of this event parsing was to set the perf_sample->raw_data
+pointer to the payload of the event, which then could be overwritten by
+other event before tracepoint fields were asked for via event.prev_comm
+in a python program, for instance.
+
+This also happened with other fields, but strings were were problems
+were surfacing, as there is UTF-8 validation for the potentially garbled
+data.
+
+This ended up showing up as (with some added debugging messages):
+
+  ( field 'prev_comm' ret=0x7f7c31f65110, raw_size=68 )  ( field 'prev_pid' ret=0x7f7c23b1bed0, raw_size=68 )  ( field 'prev_prio' ret=0x7f7c239c0030, raw_size=68 )  ( field 'prev_state' ret=0x7f7c239c0250, raw_size=68 ) time 14771421785867 prev_comm= prev_pid=1919907691 prev_prio=796026219 prev_state=0x303a32313175 ==>
+  ( XXX '��' len=16, raw_size=68)  ( field 'next_comm' ret=(nil), raw_size=68 ) Traceback (most recent call last):
+   File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 51, in <module>
+     main()
+   File "/home/acme/git/perf-tools-next/tools/perf/python/tracepoint.py", line 46, in main
+     event.next_comm,
+     ^^^^^^^^^^^^^^^
+  AttributeError: 'perf.sample_event' object has no attribute 'next_comm'
+
+When event.next_comm was asked for, the PyUnicode_FromString() python
+API would fail and that tracepoint field wouldn't be available, stopping
+the tools/perf/python/tracepoint.py test tool.
+
+But, since we already do a copy of the whole event in pyrf_event__new,
+just use it and while at it remove what was done in in e8968e654191390a
+("perf python: Fix pyrf_evlist__read_on_cpu event consuming") because we
+don't really need to wait for parsing the sample before declaring the
+event as consumed.
+
+This copy is questionable as is now, as it limits the maximum event +
+sample_type and tracepoint payload to sizeof(union perf_event), this all
+has been "working" because 'struct perf_event_mmap2', the largest entry
+in 'union perf_event' is:
+
+  $ pahole -C perf_event ~/bin/perf | grep mmap2
+	struct perf_record_mmap2   mmap2;              /*     0  4168 */
+  $
+
+Fixes: bae57e3825a3dded ("perf python: Add support to resolve tracepoint fields")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250312203141.285263-6-acme@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/python.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
+index 47c43b9c72fe7..4697bbb17c39a 100644
+--- a/tools/perf/util/python.c
++++ b/tools/perf/util/python.c
+@@ -1177,11 +1177,9 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
+ 
+ 		pevent->evsel = evsel;
+ 
+-		err = evsel__parse_sample(evsel, event, &pevent->sample);
+-
+-		/* Consume the even only after we parsed it out. */
+ 		perf_mmap__consume(&md->core);
+ 
++		err = evsel__parse_sample(evsel, &pevent->event, &pevent->sample);
+ 		if (err) {
+ 			Py_DECREF(pyevent);
+ 			return PyErr_Format(PyExc_OSError,
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-python-fixup-description-of-sample.id-event-mem.patch b/queue-6.6/perf-python-fixup-description-of-sample.id-event-mem.patch
new file mode 100644
index 0000000000..69f04df56d
--- /dev/null
+++ b/queue-6.6/perf-python-fixup-description-of-sample.id-event-mem.patch
@@ -0,0 +1,38 @@
+From 0a6fa31a598c17e8127dfa7e3384fb0ec3189e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 17:31:36 -0300
+Subject: perf python: Fixup description of sample.id event member
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 1376c195e8ad327bb9f2d32e0acc5ac39e7cb30a ]
+
+Some old cut'n'paste error, its "ip", so the description should be
+"event ip", not "event type".
+
+Fixes: 877108e42b1b9ba6 ("perf tools: Initial python binding")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250312203141.285263-2-acme@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/python.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
+index b01b0e5510563..8753c9d3670ac 100644
+--- a/tools/perf/util/python.c
++++ b/tools/perf/util/python.c
+@@ -238,7 +238,7 @@ struct pyrf_event {
+ };
+ 
+ #define sample_members \
+-	sample_member_def(sample_ip, ip, T_ULONGLONG, "event type"),			 \
++	sample_member_def(sample_ip, ip, T_ULONGLONG, "event ip"),			 \
+ 	sample_member_def(sample_pid, pid, T_INT, "event pid"),			 \
+ 	sample_member_def(sample_tid, tid, T_INT, "event tid"),			 \
+ 	sample_member_def(sample_time, time, T_ULONGLONG, "event timestamp"),		 \
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-ring_buffer-allow-the-epollrdnorm-flag-for-poll.patch b/queue-6.6/perf-ring_buffer-allow-the-epollrdnorm-flag-for-poll.patch
new file mode 100644
index 0000000000..c1b985a41e
--- /dev/null
+++ b/queue-6.6/perf-ring_buffer-allow-the-epollrdnorm-flag-for-poll.patch
@@ -0,0 +1,43 @@
+From 8ef80dea41b8410bbdfae2502cb40e772a61bf33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 11:00:36 +0800
+Subject: perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
+
+From: Tao Chen <chen.dylane@linux.dev>
+
+[ Upstream commit c96fff391c095c11dc87dab35be72dee7d217cde ]
+
+The poll man page says POLLRDNORM is equivalent to POLLIN. For poll(),
+it seems that if user sets pollfd with POLLRDNORM in userspace, perf_poll
+will not return until timeout even if perf_output_wakeup called,
+whereas POLLIN returns.
+
+Fixes: 76369139ceb9 ("perf: Split up buffer handling from core code")
+Signed-off-by: Tao Chen <chen.dylane@linux.dev>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250314030036.2543180-1-chen.dylane@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/ring_buffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index b0930b4185527..52de76ef8723b 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -19,7 +19,7 @@
+ 
+ static void perf_output_wakeup(struct perf_output_handle *handle)
+ {
+-	atomic_set(&handle->rb->poll, EPOLLIN);
++	atomic_set(&handle->rb->poll, EPOLLIN | EPOLLRDNORM);
+ 
+ 	handle->event->pending_wakeup = 1;
+ 	irq_work_queue(&handle->event->pending_irq);
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-stat-fix-find_stat-for-mixed-legacy-non-legacy-.patch b/queue-6.6/perf-stat-fix-find_stat-for-mixed-legacy-non-legacy-.patch
new file mode 100644
index 0000000000..4ddd319791
--- /dev/null
+++ b/queue-6.6/perf-stat-fix-find_stat-for-mixed-legacy-non-legacy-.patch
@@ -0,0 +1,107 @@
+From 8fc46fb21dce449cb8cffd540eb9fdd2b5891656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 14:21:07 -0800
+Subject: perf stat: Fix find_stat for mixed legacy/non-legacy events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8ce0d2da14d3fb62844dd0e95982c194326b1a5f ]
+
+Legacy events typically don't have a PMU when added leading to
+mismatched legacy/non-legacy cases in find_stat. Use evsel__find_pmu
+to make sure the evsel PMU is looked up. Update the evsel__find_pmu
+code to look for the PMU using the extended config type or, for legacy
+hardware/hw_cache events on non-hybrid systems, just use the core PMU.
+
+Before:
+```
+$ perf stat -e cycles,cpu/instructions/ -a sleep 1
+ Performance counter stats for 'system wide':
+
+       215,309,764      cycles
+        44,326,491      cpu/instructions/
+
+       1.002555314 seconds time elapsed
+```
+After:
+```
+$ perf stat -e cycles,cpu/instructions/ -a sleep 1
+
+ Performance counter stats for 'system wide':
+
+       990,676,332      cycles
+     1,235,762,487      cpu/instructions/                #    1.25  insn per cycle
+
+       1.002667198 seconds time elapsed
+```
+
+Fixes: 3612ca8e2935 ("perf stat: Fix the hard-coded metrics calculation on the hybrid")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: James Clark <james.clark@linaro.org>
+Tested-by: Leo Yan <leo.yan@arm.com>
+Tested-by: Atish Patra <atishp@rivosinc.com>
+Link: https://lore.kernel.org/r/20250109222109.567031-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/pmus.c        | 20 +++++++++++++++++---
+ tools/perf/util/stat-shadow.c |  3 ++-
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/pmus.c b/tools/perf/util/pmus.c
+index f0577aa7eca88..dda5ba9c73fd9 100644
+--- a/tools/perf/util/pmus.c
++++ b/tools/perf/util/pmus.c
+@@ -587,11 +587,25 @@ char *perf_pmus__default_pmu_name(void)
+ struct perf_pmu *evsel__find_pmu(const struct evsel *evsel)
+ {
+ 	struct perf_pmu *pmu = evsel->pmu;
++	bool legacy_core_type;
+ 
+-	if (!pmu) {
+-		pmu = perf_pmus__find_by_type(evsel->core.attr.type);
+-		((struct evsel *)evsel)->pmu = pmu;
++	if (pmu)
++		return pmu;
++
++	pmu = perf_pmus__find_by_type(evsel->core.attr.type);
++	legacy_core_type =
++		evsel->core.attr.type == PERF_TYPE_HARDWARE ||
++		evsel->core.attr.type == PERF_TYPE_HW_CACHE;
++	if (!pmu && legacy_core_type) {
++		if (perf_pmus__supports_extended_type()) {
++			u32 type = evsel->core.attr.config >> PERF_PMU_TYPE_SHIFT;
++
++			pmu = perf_pmus__find_by_type(type);
++		} else {
++			pmu = perf_pmus__find_core_pmu();
++		}
+ 	}
++	((struct evsel *)evsel)->pmu = pmu;
+ 	return pmu;
+ }
+ 
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index 2affa4d45aa21..56b186d307453 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -154,6 +154,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type
+ {
+ 	const struct evsel *cur;
+ 	int evsel_ctx = evsel_context(evsel);
++	struct perf_pmu *evsel_pmu = evsel__find_pmu(evsel);
+ 
+ 	evlist__for_each_entry(evsel->evlist, cur) {
+ 		struct perf_stat_aggr *aggr;
+@@ -180,7 +181,7 @@ static double find_stat(const struct evsel *evsel, int aggr_idx, enum stat_type
+ 		 * Except the SW CLOCK events,
+ 		 * ignore if not the PMU we're looking for.
+ 		 */
+-		if ((type != STAT_NSECS) && (evsel->pmu != cur->pmu))
++		if ((type != STAT_NSECS) && (evsel_pmu != evsel__find_pmu(cur)))
+ 			continue;
+ 
+ 		aggr = &cur->stats->aggr[aggr_idx];
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-tools-annotate-asm_pure_loop.s.patch b/queue-6.6/perf-tools-annotate-asm_pure_loop.s.patch
new file mode 100644
index 0000000000..410527f033
--- /dev/null
+++ b/queue-6.6/perf-tools-annotate-asm_pure_loop.s.patch
@@ -0,0 +1,34 @@
+From 5fd6cd27fda218844e12d19ab4dac4b6d2a5d4b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Mar 2025 09:53:45 +0100
+Subject: perf tools: annotate asm_pure_loop.S
+
+From: Marcus Meissner <meissner@suse.de>
+
+[ Upstream commit 9a352a90e88a041f4b26d359493e12a7f5ae1a6a ]
+
+Annotate so it is built with non-executable stack.
+
+Fixes: 8b97519711c3 ("perf test: Add asm pureloop test tool")
+Signed-off-by: Marcus Meissner <meissner@suse.de>
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Link: https://lore.kernel.org/r/20250323085410.23751-1-meissner@suse.de
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S b/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S
+index 75cf084a927d3..5777600467723 100644
+--- a/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S
++++ b/tools/perf/tests/shell/coresight/asm_pure_loop/asm_pure_loop.S
+@@ -26,3 +26,5 @@ skip:
+ 	mov	x0, #0
+ 	mov	x8, #93 // __NR_exit syscall
+ 	svc	#0
++
++.section .note.GNU-stack, "", @progbits
+-- 
+2.39.5
+
diff --git a/queue-6.6/perf-units-fix-insufficient-array-space.patch b/queue-6.6/perf-units-fix-insufficient-array-space.patch
new file mode 100644
index 0000000000..27c6a8d880
--- /dev/null
+++ b/queue-6.6/perf-units-fix-insufficient-array-space.patch
@@ -0,0 +1,46 @@
+From aa71e881401e1e33a5f317a41e14b927f0344a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 16:45:32 -0300
+Subject: perf units: Fix insufficient array space
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit cf67629f7f637fb988228abdb3aae46d0c1748fe ]
+
+No need to specify the array size, let the compiler figure that out.
+
+This addresses this compiler warning that was noticed while build
+testing on fedora rawhide:
+
+  31    15.81 fedora:rawhide                : FAIL gcc version 15.0.1 20250225 (Red Hat 15.0.1-0) (GCC)
+    util/units.c: In function 'unit_number__scnprintf':
+    util/units.c:67:24: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-initialization]
+       67 |         char unit[4] = "BKMG";
+          |                        ^~~~~~
+    cc1: all warnings being treated as errors
+
+Fixes: 9808143ba2e54818 ("perf tools: Add unit_number__scnprintf function")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: https://lore.kernel.org/r/20250310194534.265487-3-acme@kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/units.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/units.c b/tools/perf/util/units.c
+index 32c39cfe209b3..4c6a86e1cb54b 100644
+--- a/tools/perf/util/units.c
++++ b/tools/perf/util/units.c
+@@ -64,7 +64,7 @@ unsigned long convert_unit(unsigned long value, char *unit)
+ 
+ int unit_number__scnprintf(char *buf, size_t size, u64 n)
+ {
+-	char unit[4] = "BKMG";
++	char unit[] = "BKMG";
+ 	int i = 0;
+ 
+ 	while (((n / 1024) > 1) && (i < 3)) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/pinctrl-intel-fix-wrong-bypass-assignment-in-intel_p.patch b/queue-6.6/pinctrl-intel-fix-wrong-bypass-assignment-in-intel_p.patch
new file mode 100644
index 0000000000..c7ee31fe79
--- /dev/null
+++ b/queue-6.6/pinctrl-intel-fix-wrong-bypass-assignment-in-intel_p.patch
@@ -0,0 +1,39 @@
+From 4c95df082bcb043f3e829d51fd6f2ac7e8d6bc14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 21:44:51 +0200
+Subject: pinctrl: intel: Fix wrong bypass assignment in
+ intel_pinctrl_probe_pwm()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 0eee258cdf172763502f142d85e967f27a573be0 ]
+
+When instantiating PWM, the bypass should be set to false. The field
+is used for the selected Intel SoCs that do not have PWM feature enabled
+in their pin control IPs.
+
+Fixes: eb78d3604d6b ("pinctrl: intel: Enumerate PWM device when community has a capability")
+Reported-by: Alexis GUILLEMET <alexis.guillemet@dunasys.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Alexis GUILLEMET <alexis.guillemet@dunasys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-intel.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 3be04ab760d3f..9775f6be1c1e6 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -1524,7 +1524,6 @@ static int intel_pinctrl_probe_pwm(struct intel_pinctrl *pctrl,
+ 		.clk_rate = 19200000,
+ 		.npwm = 1,
+ 		.base_unit_bits = 22,
+-		.bypass = true,
+ 	};
+ 	struct pwm_lpss_chip *pwm;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/pinctrl-renesas-rza2-fix-missing-of_node_put-call.patch b/queue-6.6/pinctrl-renesas-rza2-fix-missing-of_node_put-call.patch
new file mode 100644
index 0000000000..4e0e5f2c44
--- /dev/null
+++ b/queue-6.6/pinctrl-renesas-rza2-fix-missing-of_node_put-call.patch
@@ -0,0 +1,42 @@
+From f823ab15700547b30d83515f1d9ec0e6fe6239cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 16:37:53 +0000
+Subject: pinctrl: renesas: rza2: Fix missing of_node_put() call
+
+From: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+
+[ Upstream commit abcdeb4e299a11ecb5a3ea0cce00e68e8f540375 ]
+
+of_parse_phandle_with_fixed_args() requires its caller to
+call into of_node_put() on the node pointer from the output
+structure, but such a call is currently missing.
+
+Call into of_node_put() to rectify that.
+
+Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller")
+Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250305163753.34913-5-fabrizio.castro.jz@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rza2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rza2.c b/drivers/pinctrl/renesas/pinctrl-rza2.c
+index 990b96d459671..c5d733216508e 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rza2.c
++++ b/drivers/pinctrl/renesas/pinctrl-rza2.c
+@@ -253,6 +253,8 @@ static int rza2_gpio_register(struct rza2_pinctrl_priv *priv)
+ 		return ret;
+ 	}
+ 
++	of_node_put(of_args.np);
++
+ 	if ((of_args.args[0] != 0) ||
+ 	    (of_args.args[1] != 0) ||
+ 	    (of_args.args[2] != priv->npins)) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/pinctrl-renesas-rzg2l-fix-missing-of_node_put-call.patch b/queue-6.6/pinctrl-renesas-rzg2l-fix-missing-of_node_put-call.patch
new file mode 100644
index 0000000000..a51a49c96d
--- /dev/null
+++ b/queue-6.6/pinctrl-renesas-rzg2l-fix-missing-of_node_put-call.patch
@@ -0,0 +1,42 @@
+From 3ddf138ed186d2922d0e31c4753076e3e97ffaf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 16:37:51 +0000
+Subject: pinctrl: renesas: rzg2l: Fix missing of_node_put() call
+
+From: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+
+[ Upstream commit a5779e625e2b377f16a6675c432aaf299ce5028c ]
+
+of_parse_phandle_with_fixed_args() requires its caller to
+call into of_node_put() on the node pointer from the output
+structure, but such a call is currently missing.
+
+Call into of_node_put() to rectify that.
+
+Fixes: c4c4637eb57f ("pinctrl: renesas: Add RZ/G2L pin and gpio controller driver")
+Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250305163753.34913-3-fabrizio.castro.jz@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 2ea6ef99cc70b..ac629c72d5927 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -1367,6 +1367,8 @@ static int rzg2l_gpio_register(struct rzg2l_pinctrl *pctrl)
+ 		return ret;
+ 	}
+ 
++	of_node_put(of_args.np);
++
+ 	if (of_args.args[0] != 0 || of_args.args[1] != 0 ||
+ 	    of_args.args[2] != pctrl->data->n_port_pins) {
+ 		dev_err(pctrl->dev, "gpio-ranges does not match selected SOC\n");
+-- 
+2.39.5
+
diff --git a/queue-6.6/pinctrl-renesas-rzv2m-fix-missing-of_node_put-call.patch b/queue-6.6/pinctrl-renesas-rzv2m-fix-missing-of_node_put-call.patch
new file mode 100644
index 0000000000..ac672c05cb
--- /dev/null
+++ b/queue-6.6/pinctrl-renesas-rzv2m-fix-missing-of_node_put-call.patch
@@ -0,0 +1,42 @@
+From 08d9957b0a3d0f0125f6bbbdc62b8d209e278a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 16:37:52 +0000
+Subject: pinctrl: renesas: rzv2m: Fix missing of_node_put() call
+
+From: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+
+[ Upstream commit 5a550b00704d3a2cd9d766a9427b0f8166da37df ]
+
+of_parse_phandle_with_fixed_args() requires its caller to
+call into of_node_put() on the node pointer from the output
+structure, but such a call is currently missing.
+
+Call into of_node_put() to rectify that.
+
+Fixes: 92a9b8252576 ("pinctrl: renesas: Add RZ/V2M pin and gpio controller driver")
+Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20250305163753.34913-4-fabrizio.castro.jz@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzv2m.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzv2m.c b/drivers/pinctrl/renesas/pinctrl-rzv2m.c
+index 52aeafaba4b69..b89ae65e71b0e 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzv2m.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzv2m.c
+@@ -944,6 +944,8 @@ static int rzv2m_gpio_register(struct rzv2m_pinctrl *pctrl)
+ 		return ret;
+ 	}
+ 
++	of_node_put(of_args.np);
++
+ 	if (of_args.args[0] != 0 || of_args.args[1] != 0 ||
+ 	    of_args.args[2] != pctrl->data->n_port_pins) {
+ 		dev_err(pctrl->dev, "gpio-ranges does not match selected SOC\n");
+-- 
+2.39.5
+
diff --git a/queue-6.6/pinctrl-tegra-set-sfio-mode-to-mux-register.patch b/queue-6.6/pinctrl-tegra-set-sfio-mode-to-mux-register.patch
new file mode 100644
index 0000000000..f899c5999f
--- /dev/null
+++ b/queue-6.6/pinctrl-tegra-set-sfio-mode-to-mux-register.patch
@@ -0,0 +1,49 @@
+From bdb09c9000dc2f2fdf1f515cba3e570ef90a7adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 10:35:42 +0530
+Subject: pinctrl: tegra: Set SFIO mode to Mux Register
+
+From: Prathamesh Shete <pshete@nvidia.com>
+
+[ Upstream commit 17013f0acb322e5052ff9b9d0fab0ab5a4bfd828 ]
+
+Tegra devices have an 'sfsel' bit field that determines whether a pin
+operates in SFIO (Special Function I/O) or GPIO mode. Currently,
+tegra_pinctrl_gpio_disable_free() sets this bit when releasing a GPIO.
+
+However, tegra_pinctrl_set_mux() can be called independently in certain
+code paths where gpio_disable_free() is not invoked. In such cases, failing
+to set the SFIO mode could lead to incorrect pin configurations, resulting
+in functional issues for peripherals relying on SFIO.
+
+This patch ensures that whenever set_mux() is called, the SFIO mode is
+correctly set in the Mux Register if the 'sfsel' bit is present. This
+prevents situations where the pin remains in GPIO mode despite being
+configured for SFIO use.
+
+Fixes: 971dac7123c7 ("pinctrl: add a driver for NVIDIA Tegra")
+Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
+Link: https://lore.kernel.org/20250306050542.16335-1-pshete@nvidia.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/tegra/pinctrl-tegra.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c
+index 734c71ef005b8..7c12a3470642c 100644
+--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
++++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
+@@ -272,6 +272,9 @@ static int tegra_pinctrl_set_mux(struct pinctrl_dev *pctldev,
+ 	val = pmx_readl(pmx, g->mux_bank, g->mux_reg);
+ 	val &= ~(0x3 << g->mux_bit);
+ 	val |= i << g->mux_bit;
++	/* Set the SFIO/GPIO selection to SFIO when under pinmux control*/
++	if (pmx->soc->sfsel_in_mux)
++		val |= (1 << g->sfsel_bit);
+ 	pmx_writel(pmx, val, g->mux_bank, g->mux_reg);
+ 
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/platform-x86-dell-ddv-fix-temperature-calculation.patch b/queue-6.6/platform-x86-dell-ddv-fix-temperature-calculation.patch
new file mode 100644
index 0000000000..48e0585d37
--- /dev/null
+++ b/queue-6.6/platform-x86-dell-ddv-fix-temperature-calculation.patch
@@ -0,0 +1,50 @@
+From 3165f1e76b328c5d4b46e3a1d4078b8f68cd8be7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Mar 2025 06:30:07 +0100
+Subject: platform/x86: dell-ddv: Fix temperature calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 7a248294a3145bc65eb0d8980a0a8edbb1b92db4 ]
+
+On the Dell Inspiron 3505 the battery temperature is always
+0.1 degrees larger than the temperature show inside the OEM
+application.
+
+Emulate this behaviour to avoid showing strange looking values
+like 29.1 degrees.
+
+Fixes: 0331b1b0ba653 ("platform/x86: dell-ddv: Fix temperature scaling")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20250305053009.378609-2-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x86/dell/dell-wmi-ddv.c
+index db1e9240dd02c..8fb434b6ab4b9 100644
+--- a/drivers/platform/x86/dell/dell-wmi-ddv.c
++++ b/drivers/platform/x86/dell/dell-wmi-ddv.c
+@@ -665,8 +665,10 @@ static ssize_t temp_show(struct device *dev, struct device_attribute *attr, char
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	/* Use 2731 instead of 2731.5 to avoid unnecessary rounding */
+-	return sysfs_emit(buf, "%d\n", value - 2731);
++	/* Use 2732 instead of 2731.5 to avoid unnecessary rounding and to emulate
++	 * the behaviour of the OEM application which seems to round down the result.
++	 */
++	return sysfs_emit(buf, "%d\n", value - 2732);
+ }
+ 
+ static ssize_t eppid_show(struct device *dev, struct device_attribute *attr, char *buf)
+-- 
+2.39.5
+
diff --git a/queue-6.6/platform-x86-intel-hid-fix-volume-buttons-on-microso.patch b/queue-6.6/platform-x86-intel-hid-fix-volume-buttons-on-microso.patch
new file mode 100644
index 0000000000..6d07bff98f
--- /dev/null
+++ b/queue-6.6/platform-x86-intel-hid-fix-volume-buttons-on-microso.patch
@@ -0,0 +1,47 @@
+From aa9455f28707f824372f3ae6e365542b8deedc67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 17:39:31 +0200
+Subject: platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4
+ tablet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Panchenko <dmitry@d-systems.ee>
+
+[ Upstream commit 2738d06fb4f01145b24c542fb06de538ffc56430 ]
+
+Volume buttons on Microsoft Surface Go 4 tablet didn't send any events.
+Add Surface Go 4 DMI match to button_array_table to fix this.
+
+Signed-off-by: Dmitry Panchenko <dmitry@d-systems.ee>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20250220154016.3620917-1-dmitry@d-systems.ee
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 7457ca2b27a60..36209997ba988 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -128,6 +128,13 @@ static const struct dmi_system_id button_array_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"),
+ 		},
+ 	},
++	{
++		.ident = "Microsoft Surface Go 4",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 4"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/platform-x86-intel-vsec-add-diamond-rapids-support.patch b/queue-6.6/platform-x86-intel-vsec-add-diamond-rapids-support.patch
new file mode 100644
index 0000000000..b290043742
--- /dev/null
+++ b/queue-6.6/platform-x86-intel-vsec-add-diamond-rapids-support.patch
@@ -0,0 +1,58 @@
+From 3932f0cb5e07ec440eeafb28bf7479a1d3206ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 13:47:27 -0800
+Subject: platform/x86/intel/vsec: Add Diamond Rapids support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit f317f38e7fbb15a0d8329289fef8cf034938fb4f ]
+
+Add PCI ID for the Diamond Rapids Platforms
+
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20250226214728.1256747-1-david.e.box@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
+index 343ab6a82c017..666ed3698afe7 100644
+--- a/drivers/platform/x86/intel/vsec.c
++++ b/drivers/platform/x86/intel/vsec.c
+@@ -420,6 +420,11 @@ static const struct intel_vsec_platform_info oobmsm_info = {
+ 	.caps = VSEC_CAP_TELEMETRY | VSEC_CAP_SDSI | VSEC_CAP_TPMI,
+ };
+ 
++/* DMR OOBMSM info */
++static const struct intel_vsec_platform_info dmr_oobmsm_info = {
++	.caps = VSEC_CAP_TELEMETRY | VSEC_CAP_TPMI,
++};
++
+ /* TGL info */
+ static const struct intel_vsec_platform_info tgl_info = {
+ 	.caps = VSEC_CAP_TELEMETRY,
+@@ -431,6 +436,7 @@ static const struct intel_vsec_platform_info tgl_info = {
+ #define PCI_DEVICE_ID_INTEL_VSEC_MTL_M		0x7d0d
+ #define PCI_DEVICE_ID_INTEL_VSEC_MTL_S		0xad0d
+ #define PCI_DEVICE_ID_INTEL_VSEC_OOBMSM		0x09a7
++#define PCI_DEVICE_ID_INTEL_VSEC_OOBMSM_DMR	0x09a1
+ #define PCI_DEVICE_ID_INTEL_VSEC_RPL		0xa77d
+ #define PCI_DEVICE_ID_INTEL_VSEC_TGL		0x9a0d
+ static const struct pci_device_id intel_vsec_pci_ids[] = {
+@@ -439,6 +445,7 @@ static const struct pci_device_id intel_vsec_pci_ids[] = {
+ 	{ PCI_DEVICE_DATA(INTEL, VSEC_MTL_M, &mtl_info) },
+ 	{ PCI_DEVICE_DATA(INTEL, VSEC_MTL_S, &mtl_info) },
+ 	{ PCI_DEVICE_DATA(INTEL, VSEC_OOBMSM, &oobmsm_info) },
++	{ PCI_DEVICE_DATA(INTEL, VSEC_OOBMSM_DMR, &dmr_oobmsm_info) },
+ 	{ PCI_DEVICE_DATA(INTEL, VSEC_RPL, &tgl_info) },
+ 	{ PCI_DEVICE_DATA(INTEL, VSEC_TGL, &tgl_info) },
+ 	{ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/pm-sleep-adjust-check-before-setting-power.must_resu.patch b/queue-6.6/pm-sleep-adjust-check-before-setting-power.must_resu.patch
new file mode 100644
index 0000000000..e13dc3a275
--- /dev/null
+++ b/queue-6.6/pm-sleep-adjust-check-before-setting-power.must_resu.patch
@@ -0,0 +1,86 @@
+From c621ef5104db5eef287d9a3c03be9ad291771348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 11:53:50 +0100
+Subject: PM: sleep: Adjust check before setting power.must_resume
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit eeb87d17aceab7803a5a5bcb6cf2817b745157cf ]
+
+The check before setting power.must_resume in device_suspend_noirq()
+does not take power.child_count into account, but it should do that, so
+use pm_runtime_need_not_resume() in it for this purpose and adjust the
+comment next to it accordingly.
+
+Fixes: 107d47b2b95e ("PM: sleep: core: Simplify the SMART_SUSPEND flag handling")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://patch.msgid.link/3353728.44csPzL39Z@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c    | 13 ++++++-------
+ drivers/base/power/runtime.c |  2 +-
+ include/linux/pm_runtime.h   |  2 ++
+ 3 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 9c5a5f4dba5a6..49728cb628c19 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1236,14 +1236,13 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
+ 	dev->power.is_noirq_suspended = true;
+ 
+ 	/*
+-	 * Skipping the resume of devices that were in use right before the
+-	 * system suspend (as indicated by their PM-runtime usage counters)
+-	 * would be suboptimal.  Also resume them if doing that is not allowed
+-	 * to be skipped.
++	 * Devices must be resumed unless they are explicitly allowed to be left
++	 * in suspend, but even in that case skipping the resume of devices that
++	 * were in use right before the system suspend (as indicated by their
++	 * runtime PM usage counters and child counters) would be suboptimal.
+ 	 */
+-	if (atomic_read(&dev->power.usage_count) > 1 ||
+-	    !(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) &&
+-	      dev->power.may_skip_resume))
++	if (!(dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME) &&
++	      dev->power.may_skip_resume) || !pm_runtime_need_not_resume(dev))
+ 		dev->power.must_resume = true;
+ 
+ 	if (dev->power.must_resume)
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 4545669cb9735..0af26cf8c0059 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1841,7 +1841,7 @@ void pm_runtime_drop_link(struct device_link *link)
+ 	pm_request_idle(link->supplier);
+ }
+ 
+-static bool pm_runtime_need_not_resume(struct device *dev)
++bool pm_runtime_need_not_resume(struct device *dev)
+ {
+ 	return atomic_read(&dev->power.usage_count) <= 1 &&
+ 		(atomic_read(&dev->power.child_count) == 0 ||
+diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
+index 7c9b354485634..406855d73901a 100644
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -66,6 +66,7 @@ static inline bool queue_pm_work(struct work_struct *work)
+ 
+ extern int pm_generic_runtime_suspend(struct device *dev);
+ extern int pm_generic_runtime_resume(struct device *dev);
++extern bool pm_runtime_need_not_resume(struct device *dev);
+ extern int pm_runtime_force_suspend(struct device *dev);
+ extern int pm_runtime_force_resume(struct device *dev);
+ 
+@@ -252,6 +253,7 @@ static inline bool queue_pm_work(struct work_struct *work) { return false; }
+ 
+ static inline int pm_generic_runtime_suspend(struct device *dev) { return 0; }
+ static inline int pm_generic_runtime_resume(struct device *dev) { return 0; }
++static inline bool pm_runtime_need_not_resume(struct device *dev) {return true; }
+ static inline int pm_runtime_force_suspend(struct device *dev) { return 0; }
+ static inline int pm_runtime_force_resume(struct device *dev) { return 0; }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/pm-sleep-fix-handling-devices-with-direct_complete-s.patch b/queue-6.6/pm-sleep-fix-handling-devices-with-direct_complete-s.patch
new file mode 100644
index 0000000000..d97b8cb1e1
--- /dev/null
+++ b/queue-6.6/pm-sleep-fix-handling-devices-with-direct_complete-s.patch
@@ -0,0 +1,91 @@
+From 55f66bda62f1f3744228ec2633b923179703f983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 17:00:00 +0100
+Subject: PM: sleep: Fix handling devices with direct_complete set on errors
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 03f1444016b71feffa1dfb8a51f15ba592f94b13 ]
+
+When dpm_suspend() fails, some devices with power.direct_complete set
+may not have been handled by device_suspend() yet, so runtime PM has
+not been disabled for them yet even though power.direct_complete is set.
+
+Since device_resume() expects that runtime PM has been disabled for all
+devices with power.direct_complete set, it will attempt to reenable
+runtime PM for the devices that have not been processed by device_suspend()
+which does not make sense.  Had those devices had runtime PM disabled
+before device_suspend() had run, device_resume() would have inadvertently
+enable runtime PM for them, but this is not expected to happen because
+it would require ->prepare() callbacks to return positive values for
+devices with runtime PM disabled, which would be invalid.
+
+In practice, this issue is most likely benign because pm_runtime_enable()
+will not allow the "disable depth" counter to underflow, but it causes a
+warning message to be printed for each affected device.
+
+To allow device_resume() to distinguish the "direct complete" devices
+that have been processed by device_suspend() from those which have not
+been handled by it, make device_suspend() set power.is_suspended for
+"direct complete" devices.
+
+Next, move the power.is_suspended check in device_resume() before the
+power.direct_complete check in it to make it skip the "direct complete"
+devices that have not been handled by device_suspend().
+
+This change is based on a preliminary patch from Saravana Kannan.
+
+Fixes: aae4518b3124 ("PM / sleep: Mechanism to avoid resuming runtime-suspended devices unnecessarily")
+Link: https://lore.kernel.org/linux-pm/20241114220921.2529905-2-saravanak@google.com/
+Reported-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Saravana Kannan <saravanak@google.com>
+Link: https://patch.msgid.link/12627587.O9o76ZdvQC@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 49728cb628c19..343d3c966e7a7 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -894,6 +894,9 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
+ 	if (dev->power.syscore)
+ 		goto Complete;
+ 
++	if (!dev->power.is_suspended)
++		goto Complete;
++
+ 	if (dev->power.direct_complete) {
+ 		/* Match the pm_runtime_disable() in __device_suspend(). */
+ 		pm_runtime_enable(dev);
+@@ -912,9 +915,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
+ 	 */
+ 	dev->power.is_prepared = false;
+ 
+-	if (!dev->power.is_suspended)
+-		goto Unlock;
+-
+ 	if (dev->pm_domain) {
+ 		info = "power domain ";
+ 		callback = pm_op(&dev->pm_domain->ops, state);
+@@ -954,7 +954,6 @@ static void __device_resume(struct device *dev, pm_message_t state, bool async)
+ 	error = dpm_run_callback(callback, dev, state, info);
+ 	dev->power.is_suspended = false;
+ 
+- Unlock:
+ 	device_unlock(dev);
+ 	dpm_watchdog_clear(&wd);
+ 
+@@ -1638,6 +1637,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
+ 			pm_runtime_disable(dev);
+ 			if (pm_runtime_status_suspended(dev)) {
+ 				pm_dev_dbg(dev, state, "direct-complete ");
++				dev->power.is_suspended = true;
+ 				goto Complete;
+ 			}
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/power-supply-max77693-fix-wrong-conversion-of-charge.patch b/queue-6.6/power-supply-max77693-fix-wrong-conversion-of-charge.patch
new file mode 100644
index 0000000000..097064115f
--- /dev/null
+++ b/queue-6.6/power-supply-max77693-fix-wrong-conversion-of-charge.patch
@@ -0,0 +1,46 @@
+From b1ad17d998ec78a6f64b8311b814a1642eb7212c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Mar 2025 21:11:49 +0100
+Subject: power: supply: max77693: Fix wrong conversion of charge input
+ threshold value
+
+From: Artur Weber <aweber.kernel@gmail.com>
+
+[ Upstream commit 30cc7b0d0e9341d419eb7da15fb5c22406dbe499 ]
+
+The charge input threshold voltage register on the MAX77693 PMIC accepts
+four values: 0x0 for 4.3v, 0x1 for 4.7v, 0x2 for 4.8v and 0x3 for 4.9v.
+Due to an oversight, the driver calculated the values for 4.7v and above
+starting from 0x0, rather than from 0x1 ([(4700000 - 4700000) / 100000]
+gives 0).
+
+Add 1 to the calculation to ensure that 4.7v is converted to a register
+value of 0x1 and that the other two voltages are converted correctly as
+well.
+
+Fixes: 87c2d9067893 ("power: max77693: Add charger driver for Maxim 77693")
+Signed-off-by: Artur Weber <aweber.kernel@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20250316-max77693-charger-input-threshold-fix-v1-1-2b037d0ac722@gmail.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max77693_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max77693_charger.c b/drivers/power/supply/max77693_charger.c
+index 794c8c054450e..0e7b3277d481a 100644
+--- a/drivers/power/supply/max77693_charger.c
++++ b/drivers/power/supply/max77693_charger.c
+@@ -556,7 +556,7 @@ static int max77693_set_charge_input_threshold_volt(struct max77693_charger *chg
+ 	case 4700000:
+ 	case 4800000:
+ 	case 4900000:
+-		data = (uvolt - 4700000) / 100000;
++		data = ((uvolt - 4700000) / 100000) + 1;
+ 		break;
+ 	default:
+ 		dev_err(chg->dev, "Wrong value for charge input voltage regulation threshold\n");
+-- 
+2.39.5
+
diff --git a/queue-6.6/rcu-tasks-always-inline-rcu_irq_work_resched.patch b/queue-6.6/rcu-tasks-always-inline-rcu_irq_work_resched.patch
new file mode 100644
index 0000000000..c8f3cf0c2d
--- /dev/null
+++ b/queue-6.6/rcu-tasks-always-inline-rcu_irq_work_resched.patch
@@ -0,0 +1,43 @@
+From cbe17bc9e7df2b021612a521681bc438a34d5c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 21:26:46 -0700
+Subject: rcu-tasks: Always inline rcu_irq_work_resched()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 6309a5c43b0dc629851f25b2e5ef8beff61d08e5 ]
+
+Thanks to CONFIG_DEBUG_SECTION_MISMATCH, empty functions can be
+generated out of line.  rcu_irq_work_resched() can be called from
+noinstr code, so make sure it's always inlined.
+
+Fixes: 564506495ca9 ("rcu/context-tracking: Move deferred nocb resched to context tracking")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/e84f15f013c07e4c410d972e75620c53b62c1b3e.1743481539.git.jpoimboe@kernel.org
+Closes: https://lore.kernel.org/d1eca076-fdde-484a-b33e-70e0d167c36d@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 7602d1f8a9ecb..72da69cc5764f 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -142,7 +142,7 @@ static inline void rcu_sysrq_end(void) { }
+ #if defined(CONFIG_NO_HZ_FULL) && (!defined(CONFIG_GENERIC_ENTRY) || !defined(CONFIG_KVM_XFER_TO_GUEST_WORK))
+ void rcu_irq_work_resched(void);
+ #else
+-static inline void rcu_irq_work_resched(void) { }
++static __always_inline void rcu_irq_work_resched(void) { }
+ #endif
+ 
+ #ifdef CONFIG_RCU_NOCB_CPU
+-- 
+2.39.5
+
diff --git a/queue-6.6/rdma-core-don-t-expose-hw_counters-outside-of-init-n.patch b/queue-6.6/rdma-core-don-t-expose-hw_counters-outside-of-init-n.patch
new file mode 100644
index 0000000000..ac707d4697
--- /dev/null
+++ b/queue-6.6/rdma-core-don-t-expose-hw_counters-outside-of-init-n.patch
@@ -0,0 +1,150 @@
+From 40c63dd749f833249aa839cd2e9fac8890094251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 16:54:20 +0000
+Subject: RDMA/core: Don't expose hw_counters outside of init net namespace
+
+From: Roman Gushchin <roman.gushchin@linux.dev>
+
+[ Upstream commit a1ecb30f90856b0be4168ad51b8875148e285c1f ]
+
+Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs
+attributes") accidentally almost exposed hw counters to non-init net
+namespaces. It didn't expose them fully, as an attempt to read any of
+those counters leads to a crash like this one:
+
+[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028
+[42021.814463] #PF: supervisor read access in kernel mode
+[42021.819549] #PF: error_code(0x0000) - not-present page
+[42021.824636] PGD 0 P4D 0
+[42021.827145] Oops: 0000 [#1] SMP PTI
+[42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S      W I        XXX
+[42021.841697] Hardware name: XXX
+[42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core]
+[42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff <48> 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48
+[42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287
+[42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000
+[42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0
+[42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000
+[42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530
+[42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000
+[42021.914418] FS:  00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000
+[42021.922423] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0
+[42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[42021.949324] Call Trace:
+[42021.951756]  <TASK>
+[42021.953842]  [<ffffffff86c58674>] ? show_regs+0x64/0x70
+[42021.959030]  [<ffffffff86c58468>] ? __die+0x78/0xc0
+[42021.963874]  [<ffffffff86c9ef75>] ? page_fault_oops+0x2b5/0x3b0
+[42021.969749]  [<ffffffff87674b92>] ? exc_page_fault+0x1a2/0x3c0
+[42021.975549]  [<ffffffff87801326>] ? asm_exc_page_fault+0x26/0x30
+[42021.981517]  [<ffffffffc0775680>] ? __pfx_show_hw_stats+0x10/0x10 [ib_core]
+[42021.988482]  [<ffffffffc077564e>] ? hw_stat_device_show+0x1e/0x40 [ib_core]
+[42021.995438]  [<ffffffff86ac7f8e>] dev_attr_show+0x1e/0x50
+[42022.000803]  [<ffffffff86a3eeb1>] sysfs_kf_seq_show+0x81/0xe0
+[42022.006508]  [<ffffffff86a11134>] seq_read_iter+0xf4/0x410
+[42022.011954]  [<ffffffff869f4b2e>] vfs_read+0x16e/0x2f0
+[42022.017058]  [<ffffffff869f50ee>] ksys_read+0x6e/0xe0
+[42022.022073]  [<ffffffff8766f1ca>] do_syscall_64+0x6a/0xa0
+[42022.027441]  [<ffffffff8780013b>] entry_SYSCALL_64_after_hwframe+0x78/0xe2
+
+The problem can be reproduced using the following steps:
+  ip netns add foo
+  ip netns exec foo bash
+  cat /sys/class/infiniband/mlx4_0/hw_counters/*
+
+The panic occurs because of casting the device pointer into an
+ib_device pointer using container_of() in hw_stat_device_show() is
+wrong and leads to a memory corruption.
+
+However the real problem is that hw counters should never been exposed
+outside of the non-init net namespace.
+
+Fix this by saving the index of the corresponding attribute group
+(it might be 1 or 2 depending on the presence of driver-specific
+attributes) and zeroing the pointer to hw_counters group for compat
+devices during the initialization.
+
+With this fix applied hw_counters are not available in a non-init
+net namespace:
+  find /sys/class/infiniband/mlx4_0/ -name hw_counters
+    /sys/class/infiniband/mlx4_0/ports/1/hw_counters
+    /sys/class/infiniband/mlx4_0/ports/2/hw_counters
+    /sys/class/infiniband/mlx4_0/hw_counters
+
+  ip netns add foo
+  ip netns exec foo bash
+  find /sys/class/infiniband/mlx4_0/ -name hw_counters
+
+Fixes: 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes")
+Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: Jason Gunthorpe <jgg@ziepe.ca>
+Cc: Leon Romanovsky <leon@kernel.org>
+Cc: Maher Sanalla <msanalla@nvidia.com>
+Cc: linux-rdma@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Link: https://patch.msgid.link/20250227165420.3430301-1-roman.gushchin@linux.dev
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 9 +++++++++
+ drivers/infiniband/core/sysfs.c  | 1 +
+ include/rdma/ib_verbs.h          | 1 +
+ 3 files changed, 11 insertions(+)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 56dd030045a20..6769c42e46d4f 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -543,6 +543,8 @@ static struct class ib_class = {
+ static void rdma_init_coredev(struct ib_core_device *coredev,
+ 			      struct ib_device *dev, struct net *net)
+ {
++	bool is_full_dev = &dev->coredev == coredev;
++
+ 	/* This BUILD_BUG_ON is intended to catch layout change
+ 	 * of union of ib_core_device and device.
+ 	 * dev must be the first element as ib_core and providers
+@@ -554,6 +556,13 @@ static void rdma_init_coredev(struct ib_core_device *coredev,
+ 
+ 	coredev->dev.class = &ib_class;
+ 	coredev->dev.groups = dev->groups;
++
++	/*
++	 * Don't expose hw counters outside of the init namespace.
++	 */
++	if (!is_full_dev && dev->hw_stats_attr_index)
++		coredev->dev.groups[dev->hw_stats_attr_index] = NULL;
++
+ 	device_initialize(&coredev->dev);
+ 	coredev->owner = dev;
+ 	INIT_LIST_HEAD(&coredev->port_list);
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index 9f97bef021497..210092b9bf17d 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -988,6 +988,7 @@ int ib_setup_device_attrs(struct ib_device *ibdev)
+ 	for (i = 0; i != ARRAY_SIZE(ibdev->groups); i++)
+ 		if (!ibdev->groups[i]) {
+ 			ibdev->groups[i] = &data->group;
++			ibdev->hw_stats_attr_index = i;
+ 			return 0;
+ 		}
+ 	WARN(true, "struct ib_device->groups is too small");
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index bc459d0616297..c7e9ec9e9a802 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -2738,6 +2738,7 @@ struct ib_device {
+ 	 * It is a NULL terminated array.
+ 	 */
+ 	const struct attribute_group	*groups[4];
++	u8				hw_stats_attr_index;
+ 
+ 	u64			     uverbs_cmd_mask;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/rdma-erdma-prevent-use-after-free-in-erdma_accept_ne.patch b/queue-6.6/rdma-erdma-prevent-use-after-free-in-erdma_accept_ne.patch
new file mode 100644
index 0000000000..e6a8fd5787
--- /dev/null
+++ b/queue-6.6/rdma-erdma-prevent-use-after-free-in-erdma_accept_ne.patch
@@ -0,0 +1,36 @@
+From 3a911ec67b747bddde02fb111bd4ae2a5b0850b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 20:04:40 +0800
+Subject: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
+
+From: Cheng Xu <chengyou@linux.alibaba.com>
+
+[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]
+
+After the erdma_cep_put(new_cep) being called, new_cep will be freed,
+and the following dereference will cause a UAF problem. Fix this issue.
+
+Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/erdma/erdma_cm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
+index 771059a8eb7d7..e349e8d2fb50a 100644
+--- a/drivers/infiniband/hw/erdma/erdma_cm.c
++++ b/drivers/infiniband/hw/erdma/erdma_cm.c
+@@ -705,7 +705,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)
+ 		erdma_cancel_mpatimer(new_cep);
+ 
+ 		erdma_cep_put(new_cep);
+-		new_cep->sock = NULL;
+ 	}
+ 
+ 	if (new_s) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/rdma-mana_ib-ensure-variable-err-is-initialized.patch b/queue-6.6/rdma-mana_ib-ensure-variable-err-is-initialized.patch
new file mode 100644
index 0000000000..efeba612e1
--- /dev/null
+++ b/queue-6.6/rdma-mana_ib-ensure-variable-err-is-initialized.patch
@@ -0,0 +1,38 @@
+From 2c74f014cb270653b2041d646300cc9758f7635f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Feb 2025 20:39:03 +0100
+Subject: RDMA/mana_ib: Ensure variable err is initialized
+
+From: Kees Bakker <kees@ijzerbout.nl>
+
+[ Upstream commit be35a3127d60964b338da95c7bfaaf4a01b330d4 ]
+
+In the function mana_ib_gd_create_dma_region if there are no dma blocks
+to process the variable `err` remains uninitialized.
+
+Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
+Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
+Link: https://patch.msgid.link/20250221195833.7516C16290A@bout3.ijzerbout.nl
+Reviewed-by: Long Li <longli@microsoft.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index 6fa9b12532997..c4c49a3f11b0a 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -327,7 +327,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 	unsigned int tail = 0;
+ 	u64 *page_addr_list;
+ 	void *request_buf;
+-	int err;
++	int err = 0;
+ 
+ 	mdev = dev->gdma_dev;
+ 	gc = mdev->gdma_context;
+-- 
+2.39.5
+
diff --git a/queue-6.6/rdma-mlx5-fix-calculation-of-total-invalidated-pages.patch b/queue-6.6/rdma-mlx5-fix-calculation-of-total-invalidated-pages.patch
new file mode 100644
index 0000000000..cb3d0024eb
--- /dev/null
+++ b/queue-6.6/rdma-mlx5-fix-calculation-of-total-invalidated-pages.patch
@@ -0,0 +1,65 @@
+From cbaf3aa5bc8221536a91a342fc32e01054a59fd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 16:29:54 +0200
+Subject: RDMA/mlx5: Fix calculation of total invalidated pages
+
+From: Chiara Meiohas <cmeiohas@nvidia.com>
+
+[ Upstream commit 79195147644653ebffadece31a42181e4c48c07d ]
+
+When invalidating an address range in mlx5, there is an optimization to
+do UMR operations in chunks.
+Previously, the invalidation counter was incorrectly updated for the
+same indexes within a chunk. Now, the invalidation counter is updated
+only when a chunk is complete and mlx5r_umr_update_xlt() is called.
+This ensures that the counter accurately represents the number of pages
+invalidated using UMR.
+
+Fixes: a3de94e3d61e ("IB/mlx5: Introduce ODP diagnostic counters")
+Signed-off-by: Chiara Meiohas <cmeiohas@nvidia.com>
+Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
+Link: https://patch.msgid.link/560deb2433318e5947282b070c915f3c81fef77f.1741875692.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/odp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index f1a0a324223c0..7ad5db46ffce7 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -274,9 +274,6 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,
+ 				blk_start_idx = idx;
+ 				in_block = 1;
+ 			}
+-
+-			/* Count page invalidations */
+-			invalidations += idx - blk_start_idx + 1;
+ 		} else {
+ 			u64 umr_offset = idx & umr_block_mask;
+ 
+@@ -286,14 +283,19 @@ static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,
+ 						     MLX5_IB_UPD_XLT_ZAP |
+ 						     MLX5_IB_UPD_XLT_ATOMIC);
+ 				in_block = 0;
++				/* Count page invalidations */
++				invalidations += idx - blk_start_idx + 1;
+ 			}
+ 		}
+ 	}
+-	if (in_block)
++	if (in_block) {
+ 		mlx5r_umr_update_xlt(mr, blk_start_idx,
+ 				     idx - blk_start_idx + 1, 0,
+ 				     MLX5_IB_UPD_XLT_ZAP |
+ 				     MLX5_IB_UPD_XLT_ATOMIC);
++		/* Count page invalidations */
++		invalidations += idx - blk_start_idx + 1;
++	}
+ 
+ 	mlx5_update_odp_stats(mr, invalidations, invalidations);
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/rdma-mlx5-fix-mlx5_poll_one-cur_qp-update-flow.patch b/queue-6.6/rdma-mlx5-fix-mlx5_poll_one-cur_qp-update-flow.patch
new file mode 100644
index 0000000000..99e60f4d54
--- /dev/null
+++ b/queue-6.6/rdma-mlx5-fix-mlx5_poll_one-cur_qp-update-flow.patch
@@ -0,0 +1,91 @@
+From dc09616393559a71e743ef6a2159e5e014b492db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 16:29:53 +0200
+Subject: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbd ]
+
+When cur_qp isn't NULL, in order to avoid fetching the QP from
+the radix tree again we check if the next cqe QP is identical to
+the one we already have.
+
+The bug however is that we are checking if the QP is identical by
+checking the QP number inside the CQE against the QP number inside the
+mlx5_ib_qp, but that's wrong since the QP number from the CQE is from
+FW so it should be matched against mlx5_core_qp which is our FW QP
+number.
+
+Otherwise we could use the wrong QP when handling a CQE which could
+cause the kernel trace below.
+
+This issue is mainly noticeable over QPs 0 & 1, since for now they are
+the only QPs in our driver whereas the QP number inside mlx5_ib_qp
+doesn't match the QP number inside mlx5_core_qp.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000012
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: Oops: 0000 [#1] SMP
+ CPU: 0 UID: 0 PID: 7927 Comm: kworker/u62:1 Not tainted 6.14.0-rc3+ #189
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+ Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
+ RIP: 0010:mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]
+ Code: 03 00 00 8d 58 ff 21 cb 66 39 d3 74 39 48 c7 c7 3c 89 6e a0 0f b7 db e8 b7 d2 b3 e0 49 8b 86 60 03 00 00 48 c7 c7 4a 89 6e a0 <0f> b7 5c 98 02 e8 9f d2 b3 e0 41 0f b7 86 78 03 00 00 83 e8 01 21
+ RSP: 0018:ffff88810511bd60 EFLAGS: 00010046
+ RAX: 0000000000000010 RBX: 0000000000000000 RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: ffff88885fa1b3c0 RDI: ffffffffa06e894a
+ RBP: 00000000000000b0 R08: 0000000000000000 R09: ffff88810511bc10
+ R10: 0000000000000001 R11: 0000000000000001 R12: ffff88810d593000
+ R13: ffff88810e579108 R14: ffff888105146000 R15: 00000000000000b0
+ FS:  0000000000000000(0000) GS:ffff88885fa00000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000012 CR3: 00000001077e6001 CR4: 0000000000370eb0
+ Call Trace:
+  <TASK>
+  ? __die+0x20/0x60
+  ? page_fault_oops+0x150/0x3e0
+  ? exc_page_fault+0x74/0x130
+  ? asm_exc_page_fault+0x22/0x30
+  ? mlx5_ib_poll_cq+0x4c7/0xd90 [mlx5_ib]
+  __ib_process_cq+0x5a/0x150 [ib_core]
+  ib_cq_poll_work+0x31/0x90 [ib_core]
+  process_one_work+0x169/0x320
+  worker_thread+0x288/0x3a0
+  ? work_busy+0xb0/0xb0
+  kthread+0xd7/0x1f0
+  ? kthreads_online_cpu+0x130/0x130
+  ? kthreads_online_cpu+0x130/0x130
+  ret_from_fork+0x2d/0x50
+  ? kthreads_online_cpu+0x130/0x130
+  ret_from_fork_asm+0x11/0x20
+  </TASK>
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/4ada09d41f1e36db62c44a9b25c209ea5f054316.1741875692.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/cq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
+index 9773d2a3d97fb..ee9acd58c5121 100644
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -487,7 +487,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq,
+ 	}
+ 
+ 	qpn = ntohl(cqe64->sop_drop_qpn) & 0xffffff;
+-	if (!*cur_qp || (qpn != (*cur_qp)->ibqp.qp_num)) {
++	if (!*cur_qp || (qpn != (*cur_qp)->trans_qp.base.mqp.qpn)) {
+ 		/* We do not have to take the QP table lock here,
+ 		 * because CQs will be locked while QPs are removed
+ 		 * from the table.
+-- 
+2.39.5
+
diff --git a/queue-6.6/remoteproc-core-clear-table_sz-when-rproc_shutdown.patch b/queue-6.6/remoteproc-core-clear-table_sz-when-rproc_shutdown.patch
new file mode 100644
index 0000000000..9406d9bf79
--- /dev/null
+++ b/queue-6.6/remoteproc-core-clear-table_sz-when-rproc_shutdown.patch
@@ -0,0 +1,86 @@
+From 63ad9c763d2327fd3527bfe73cb533bb2d3e535f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 18:01:05 +0800
+Subject: remoteproc: core: Clear table_sz when rproc_shutdown
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit efdde3d73ab25cef4ff2d06783b0aad8b093c0e4 ]
+
+There is case as below could trigger kernel dump:
+Use U-Boot to start remote processor(rproc) with resource table
+published to a fixed address by rproc. After Kernel boots up,
+stop the rproc, load a new firmware which doesn't have resource table
+,and start rproc.
+
+When starting rproc with a firmware not have resource table,
+`memcpy(loaded_table, rproc->cached_table, rproc->table_sz)` will
+trigger dump, because rproc->cache_table is set to NULL during the last
+stop operation, but rproc->table_sz is still valid.
+
+This issue is found on i.MX8MP and i.MX9.
+
+Dump as below:
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+Mem abort info:
+  ESR = 0x0000000096000004
+  EC = 0x25: DABT (current EL), IL = 32 bits
+  SET = 0, FnV = 0
+  EA = 0, S1PTW = 0
+  FSC = 0x04: level 0 translation fault
+Data abort info:
+  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af63000
+[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 2 UID: 0 PID: 1060 Comm: sh Not tainted 6.14.0-rc7-next-20250317-dirty #38
+Hardware name: NXP i.MX8MPlus EVK board (DT)
+pstate: a0000005 (NzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : __pi_memcpy_generic+0x110/0x22c
+lr : rproc_start+0x88/0x1e0
+Call trace:
+ __pi_memcpy_generic+0x110/0x22c (P)
+ rproc_boot+0x198/0x57c
+ state_store+0x40/0x104
+ dev_attr_store+0x18/0x2c
+ sysfs_kf_write+0x7c/0x94
+ kernfs_fop_write_iter+0x120/0x1cc
+ vfs_write+0x240/0x378
+ ksys_write+0x70/0x108
+ __arm64_sys_write+0x1c/0x28
+ invoke_syscall+0x48/0x10c
+ el0_svc_common.constprop.0+0xc0/0xe0
+ do_el0_svc+0x1c/0x28
+ el0_svc+0x30/0xcc
+ el0t_64_sync_handler+0x10c/0x138
+ el0t_64_sync+0x198/0x19c
+
+Clear rproc->table_sz to address the issue.
+
+Fixes: 9dc9507f1880 ("remoteproc: Properly deal with the resource table when detaching")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20250319100106.3622619-1-peng.fan@oss.nxp.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/remoteproc_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index e230af51a99b9..0c363ca566ffd 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -2024,6 +2024,7 @@ int rproc_shutdown(struct rproc *rproc)
+ 	kfree(rproc->cached_table);
+ 	rproc->cached_table = NULL;
+ 	rproc->table_ptr = NULL;
++	rproc->table_sz = 0;
+ out:
+ 	mutex_unlock(&rproc->lock);
+ 	return ret;
+-- 
+2.39.5
+
diff --git a/queue-6.6/remoteproc-qcom_q6v5_mss-handle-platforms-with-one-p.patch b/queue-6.6/remoteproc-qcom_q6v5_mss-handle-platforms-with-one-p.patch
new file mode 100644
index 0000000000..b9855a222e
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom_q6v5_mss-handle-platforms-with-one-p.patch
@@ -0,0 +1,90 @@
+From 3b1d57401225bb6a25173cad7f8e2977b2a0eecc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 23:05:18 +0100
+Subject: remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luca Weiss <luca@lucaweiss.eu>
+
+[ Upstream commit 4641840341f37dc8231e0840ec1514b4061b4322 ]
+
+For example MSM8974 has mx voltage rail exposed as regulator and only cx
+voltage rail is exposed as power domain. This power domain (cx) is
+attached internally in power domain and cannot be attached in this driver.
+
+Fixes: 8750cf392394 ("remoteproc: qcom_q6v5_mss: Allow replacing regulators with power domains")
+Co-developed-by: Matti Lehtimäki <matti.lehtimaki@gmail.com>
+Signed-off-by: Matti Lehtimäki <matti.lehtimaki@gmail.com>
+Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Signed-off-by: Luca Weiss <luca@lucaweiss.eu>
+Link: https://lore.kernel.org/r/20250217-msm8226-modem-v5-4-2bc74b80e0ae@lucaweiss.eu
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 2d717f2ed396c..8f93489aa0d49 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -1838,6 +1838,13 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,
+ 	while (pd_names[num_pds])
+ 		num_pds++;
+ 
++	/* Handle single power domain */
++	if (num_pds == 1 && dev->pm_domain) {
++		devs[0] = dev;
++		pm_runtime_enable(dev);
++		return 1;
++	}
++
+ 	for (i = 0; i < num_pds; i++) {
+ 		devs[i] = dev_pm_domain_attach_by_name(dev, pd_names[i]);
+ 		if (IS_ERR_OR_NULL(devs[i])) {
+@@ -1858,8 +1865,15 @@ static int q6v5_pds_attach(struct device *dev, struct device **devs,
+ static void q6v5_pds_detach(struct q6v5 *qproc, struct device **pds,
+ 			    size_t pd_count)
+ {
++	struct device *dev = qproc->dev;
+ 	int i;
+ 
++	/* Handle single power domain */
++	if (pd_count == 1 && dev->pm_domain) {
++		pm_runtime_disable(dev);
++		return;
++	}
++
+ 	for (i = 0; i < pd_count; i++)
+ 		dev_pm_domain_detach(pds[i], false);
+ }
+@@ -2471,13 +2485,13 @@ static const struct rproc_hexagon_res msm8974_mss = {
+ 			.supply = "pll",
+ 			.uA = 100000,
+ 		},
+-		{}
+-	},
+-	.fallback_proxy_supply = (struct qcom_mss_reg_res[]) {
+ 		{
+ 			.supply = "mx",
+ 			.uV = 1050000,
+ 		},
++		{}
++	},
++	.fallback_proxy_supply = (struct qcom_mss_reg_res[]) {
+ 		{
+ 			.supply = "cx",
+ 			.uA = 100000,
+@@ -2503,7 +2517,6 @@ static const struct rproc_hexagon_res msm8974_mss = {
+ 		NULL
+ 	},
+ 	.proxy_pd_names = (char*[]){
+-		"mx",
+ 		"cx",
+ 		NULL
+ 	},
+-- 
+2.39.5
+
diff --git a/queue-6.6/remoteproc-qcom_q6v5_pas-make-single-pd-handling-mor.patch b/queue-6.6/remoteproc-qcom_q6v5_pas-make-single-pd-handling-mor.patch
new file mode 100644
index 0000000000..79d3881514
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom_q6v5_pas-make-single-pd-handling-mor.patch
@@ -0,0 +1,63 @@
+From 677f43073f36809b1d895e0b99e642a720ad4887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 22:54:00 +0100
+Subject: remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
+
+From: Luca Weiss <luca@lucaweiss.eu>
+
+[ Upstream commit e917b73234b02aa4966325e7380d2559bf127ba9 ]
+
+Only go into the if condition for single-PD handling when there's
+actually just one power domain specified there. Otherwise it'll be an
+issue in the dts and we should fail in the regular code path.
+
+This also mirrors the latest changes in the qcom_q6v5_mss driver.
+
+Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Fixes: 17ee2fb4e856 ("remoteproc: qcom: pas: Vote for active/proxy power domains")
+Signed-off-by: Luca Weiss <luca@lucaweiss.eu>
+Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250128-pas-singlepd-v1-2-85d9ae4b0093@lucaweiss.eu
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index fd6bf9e77afcb..181f05506864e 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -490,16 +490,16 @@ static int adsp_pds_attach(struct device *dev, struct device **devs,
+ 	if (!pd_names)
+ 		return 0;
+ 
++	while (pd_names[num_pds])
++		num_pds++;
++
+ 	/* Handle single power domain */
+-	if (dev->pm_domain) {
++	if (num_pds == 1 && dev->pm_domain) {
+ 		devs[0] = dev;
+ 		pm_runtime_enable(dev);
+ 		return 1;
+ 	}
+ 
+-	while (pd_names[num_pds])
+-		num_pds++;
+-
+ 	for (i = 0; i < num_pds; i++) {
+ 		devs[i] = dev_pm_domain_attach_by_name(dev, pd_names[i]);
+ 		if (IS_ERR_OR_NULL(devs[i])) {
+@@ -524,7 +524,7 @@ static void adsp_pds_detach(struct qcom_adsp *adsp, struct device **pds,
+ 	int i;
+ 
+ 	/* Handle single power domain */
+-	if (dev->pm_domain && pd_count) {
++	if (pd_count == 1 && dev->pm_domain) {
+ 		pm_runtime_disable(dev);
+ 		return;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/remoteproc-qcom_q6v5_pas-use-resource-with-cx-pd-for.patch b/queue-6.6/remoteproc-qcom_q6v5_pas-use-resource-with-cx-pd-for.patch
new file mode 100644
index 0000000000..2f9e75e2d5
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom_q6v5_pas-use-resource-with-cx-pd-for.patch
@@ -0,0 +1,39 @@
+From 6f9251aae2e9904e054e6df024c25054d278db1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 22:53:59 +0100
+Subject: remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
+
+From: Luca Weiss <luca@lucaweiss.eu>
+
+[ Upstream commit ba785ff4162a65f18ed501019637a998b752b5ad ]
+
+MSM8226 requires the CX power domain, so use the msm8996_adsp_resource
+which has cx under proxy_pd_names and is otherwise equivalent.
+
+Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Fixes: fb4f07cc9399 ("remoteproc: qcom: pas: Add MSM8226 ADSP support")
+Signed-off-by: Luca Weiss <luca@lucaweiss.eu>
+Reviewed-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250128-pas-singlepd-v1-1-85d9ae4b0093@lucaweiss.eu
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index 181f05506864e..f6336bf4a38b9 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -1240,7 +1240,7 @@ static const struct adsp_data sm8550_mpss_resource = {
+ };
+ 
+ static const struct of_device_id adsp_of_match[] = {
+-	{ .compatible = "qcom,msm8226-adsp-pil", .data = &adsp_resource_init},
++	{ .compatible = "qcom,msm8226-adsp-pil", .data = &msm8996_adsp_resource},
+ 	{ .compatible = "qcom,msm8953-adsp-pil", .data = &msm8996_adsp_resource},
+ 	{ .compatible = "qcom,msm8974-adsp-pil", .data = &adsp_resource_init},
+ 	{ .compatible = "qcom,msm8996-adsp-pil", .data = &msm8996_adsp_resource},
+-- 
+2.39.5
+
diff --git a/queue-6.6/ring-buffer-fix-bytes_dropped-calculation-issue.patch b/queue-6.6/ring-buffer-fix-bytes_dropped-calculation-issue.patch
new file mode 100644
index 0000000000..943402e388
--- /dev/null
+++ b/queue-6.6/ring-buffer-fix-bytes_dropped-calculation-issue.patch
@@ -0,0 +1,41 @@
+From 0d73a9905b66d05d74f5189f279ff46b25604f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Feb 2025 15:01:06 +0800
+Subject: ring-buffer: Fix bytes_dropped calculation issue
+
+From: Feng Yang <yangfeng@kylinos.cn>
+
+[ Upstream commit c73f0b69648501978e8b3e8fa7eef7f4197d0481 ]
+
+The calculation of bytes-dropped and bytes_dropped_nested is reversed.
+Although it does not affect the final calculation of total_dropped,
+it should still be modified.
+
+Link: https://lore.kernel.org/20250223070106.6781-1-yangfeng59949@163.com
+Fixes: 6c43e554a2a5 ("ring-buffer: Add ring buffer startup selftest")
+Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 61caff3d4091f..62d93db72b0a9 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -5995,9 +5995,9 @@ static __init int rb_write_something(struct rb_test_data *data, bool nested)
+ 		/* Ignore dropped events before test starts. */
+ 		if (started) {
+ 			if (nested)
+-				data->bytes_dropped += len;
+-			else
+ 				data->bytes_dropped_nested += len;
++			else
++				data->bytes_dropped += len;
+ 		}
+ 		return len;
+ 	}
+-- 
+2.39.5
+
diff --git a/queue-6.6/risc-v-errata-use-medany-for-relocatable-builds.patch b/queue-6.6/risc-v-errata-use-medany-for-relocatable-builds.patch
new file mode 100644
index 0000000000..f818adaf3e
--- /dev/null
+++ b/queue-6.6/risc-v-errata-use-medany-for-relocatable-builds.patch
@@ -0,0 +1,42 @@
+From 7f8ebc1f8fef84550da2c010ab3ca3b68a53fd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Mar 2025 15:45:07 -0700
+Subject: RISC-V: errata: Use medany for relocatable builds
+
+From: Palmer Dabbelt <palmer@rivosinc.com>
+
+[ Upstream commit bb58e1579f431d42469b6aed0f03eff383ba6db5 ]
+
+We're trying to mix non-PIC/PIE objects into the otherwise-PIE
+relocatable kernels, to avoid GOT/PLT references during early boot
+alternative resolution (which happens before the GOT/PLT are set up).
+
+riscv64-unknown-linux-gnu-ld: arch/riscv/errata/sifive/errata.o: relocation R_RISCV_HI20 against `tlb_flush_all_threshold' can not be used when making a shared object; recompile with -fPIC
+riscv64-unknown-linux-gnu-ld: arch/riscv/errata/thead/errata.o: relocation R_RISCV_HI20 against `riscv_cbom_block_size' can not be used when making a shared object; recompile with -fPIC
+
+Fixes: 8dc2a7e8027f ("riscv: Fix relocatable kernels with early alternatives using -fno-pie")
+Link: https://lore.kernel.org/r/20250326224506.27165-2-palmer@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/errata/Makefile | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/errata/Makefile b/arch/riscv/errata/Makefile
+index 8a27394851233..f96ace8ea1df1 100644
+--- a/arch/riscv/errata/Makefile
++++ b/arch/riscv/errata/Makefile
+@@ -1,5 +1,9 @@
+ ifdef CONFIG_RELOCATABLE
+-KBUILD_CFLAGS += -fno-pie
++# We can't use PIC/PIE when handling early-boot errata parsing, as the kernel
++# doesn't have a GOT setup at that point.  So instead just use medany: it's
++# usually position-independent, so it should be good enough for the errata
++# handling.
++KBUILD_CFLAGS += -fno-pie -mcmodel=medany
+ endif
+ 
+ obj-$(CONFIG_ERRATA_ANDES) += andes/
+-- 
+2.39.5
+
diff --git a/queue-6.6/risc-v-kvm-disable-the-kernel-perf-counter-during-co.patch b/queue-6.6/risc-v-kvm-disable-the-kernel-perf-counter-during-co.patch
new file mode 100644
index 0000000000..1b5b16693e
--- /dev/null
+++ b/queue-6.6/risc-v-kvm-disable-the-kernel-perf-counter-during-co.patch
@@ -0,0 +1,42 @@
+From 759495e585361684f6b070a8ea2775413ae978b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 14:53:06 -0800
+Subject: RISC-V: KVM: Disable the kernel perf counter during configure
+
+From: Atish Patra <atishp@rivosinc.com>
+
+[ Upstream commit bbb622488749478955485765ddff9d56be4a7e4b ]
+
+The perf event should be marked disabled during the creation as
+it is not ready to be scheduled until there is SBI PMU start call
+or config matching is called with auto start. Otherwise, event add/start
+gets called during perf_event_create_kernel_counter function.
+It will be enabled and scheduled to run via perf_event_enable during
+either the above mentioned scenario.
+
+Fixes: 0cb74b65d2e5 ("RISC-V: KVM: Implement perf support without sampling")
+
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Link: https://lore.kernel.org/r/20250303-kvm_pmu_improve-v2-1-41d177e45929@rivosinc.com
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/vcpu_pmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/kvm/vcpu_pmu.c b/arch/riscv/kvm/vcpu_pmu.c
+index cee1b9ca4ec48..e2e2a115afb5c 100644
+--- a/arch/riscv/kvm/vcpu_pmu.c
++++ b/arch/riscv/kvm/vcpu_pmu.c
+@@ -468,6 +468,7 @@ int kvm_riscv_vcpu_pmu_ctr_cfg_match(struct kvm_vcpu *vcpu, unsigned long ctr_ba
+ 		.type = etype,
+ 		.size = sizeof(struct perf_event_attr),
+ 		.pinned = true,
++		.disabled = true,
+ 		/*
+ 		 * It should never reach here if the platform doesn't support the sscofpmf
+ 		 * extension as mode filtering won't work without it.
+-- 
+2.39.5
+
diff --git a/queue-6.6/riscv-fix-hugetlb-retrieval-of-number-of-ptes-in-cas.patch b/queue-6.6/riscv-fix-hugetlb-retrieval-of-number-of-ptes-in-cas.patch
new file mode 100644
index 0000000000..b0d14bc298
--- /dev/null
+++ b/queue-6.6/riscv-fix-hugetlb-retrieval-of-number-of-ptes-in-cas.patch
@@ -0,0 +1,162 @@
+From 14a6053dfe73cce9fbb6a63275ae49e5f19bf41d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 08:25:51 +0100
+Subject: riscv: Fix hugetlb retrieval of number of ptes in case of !present
+ pte
+
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+
+[ Upstream commit 83d78ac677b9fdd8ea763507c6fe02d6bf415f3a ]
+
+Ryan sent a fix [1] for arm64 that applies to riscv too: in some hugetlb
+functions, we must not use the pte value to get the size of a mapping
+because the pte may not be present.
+
+So use the already present size parameter for huge_pte_clear() and the
+newly introduced size parameter for huge_ptep_get_and_clear(). And make
+sure to gather A/D bits only on present ptes.
+
+Fixes: 82a1a1f3bfb6 ("riscv: mm: support Svnapot in hugetlb page")
+Link: https://lore.kernel.org/all/20250217140419.1702389-1-ryan.roberts@arm.com/ [1]
+Link: https://lore.kernel.org/r/20250317072551.572169-1-alexghiti@rivosinc.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/hugetlbpage.c | 76 ++++++++++++++++++++++---------------
+ 1 file changed, 45 insertions(+), 31 deletions(-)
+
+diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c
+index c9d70dc310d59..57afbc3270a3c 100644
+--- a/arch/riscv/mm/hugetlbpage.c
++++ b/arch/riscv/mm/hugetlbpage.c
+@@ -148,22 +148,25 @@ unsigned long hugetlb_mask_last_page(struct hstate *h)
+ static pte_t get_clear_contig(struct mm_struct *mm,
+ 			      unsigned long addr,
+ 			      pte_t *ptep,
+-			      unsigned long pte_num)
++			      unsigned long ncontig)
+ {
+-	pte_t orig_pte = ptep_get(ptep);
+-	unsigned long i;
+-
+-	for (i = 0; i < pte_num; i++, addr += PAGE_SIZE, ptep++) {
+-		pte_t pte = ptep_get_and_clear(mm, addr, ptep);
+-
+-		if (pte_dirty(pte))
+-			orig_pte = pte_mkdirty(orig_pte);
+-
+-		if (pte_young(pte))
+-			orig_pte = pte_mkyoung(orig_pte);
++	pte_t pte, tmp_pte;
++	bool present;
++
++	pte = ptep_get_and_clear(mm, addr, ptep);
++	present = pte_present(pte);
++	while (--ncontig) {
++		ptep++;
++		addr += PAGE_SIZE;
++		tmp_pte = ptep_get_and_clear(mm, addr, ptep);
++		if (present) {
++			if (pte_dirty(tmp_pte))
++				pte = pte_mkdirty(pte);
++			if (pte_young(tmp_pte))
++				pte = pte_mkyoung(pte);
++		}
+ 	}
+-
+-	return orig_pte;
++	return pte;
+ }
+ 
+ static pte_t get_clear_contig_flush(struct mm_struct *mm,
+@@ -212,6 +215,26 @@ static void clear_flush(struct mm_struct *mm,
+ 	flush_tlb_range(&vma, saddr, addr);
+ }
+ 
++static int num_contig_ptes_from_size(unsigned long sz, size_t *pgsize)
++{
++	unsigned long hugepage_shift;
++
++	if (sz >= PGDIR_SIZE)
++		hugepage_shift = PGDIR_SHIFT;
++	else if (sz >= P4D_SIZE)
++		hugepage_shift = P4D_SHIFT;
++	else if (sz >= PUD_SIZE)
++		hugepage_shift = PUD_SHIFT;
++	else if (sz >= PMD_SIZE)
++		hugepage_shift = PMD_SHIFT;
++	else
++		hugepage_shift = PAGE_SHIFT;
++
++	*pgsize = 1 << hugepage_shift;
++
++	return sz >> hugepage_shift;
++}
++
+ /*
+  * When dealing with NAPOT mappings, the privileged specification indicates that
+  * "if an update needs to be made, the OS generally should first mark all of the
+@@ -226,22 +249,10 @@ void set_huge_pte_at(struct mm_struct *mm,
+ 		     pte_t pte,
+ 		     unsigned long sz)
+ {
+-	unsigned long hugepage_shift, pgsize;
++	size_t pgsize;
+ 	int i, pte_num;
+ 
+-	if (sz >= PGDIR_SIZE)
+-		hugepage_shift = PGDIR_SHIFT;
+-	else if (sz >= P4D_SIZE)
+-		hugepage_shift = P4D_SHIFT;
+-	else if (sz >= PUD_SIZE)
+-		hugepage_shift = PUD_SHIFT;
+-	else if (sz >= PMD_SIZE)
+-		hugepage_shift = PMD_SHIFT;
+-	else
+-		hugepage_shift = PAGE_SHIFT;
+-
+-	pte_num = sz >> hugepage_shift;
+-	pgsize = 1 << hugepage_shift;
++	pte_num = num_contig_ptes_from_size(sz, &pgsize);
+ 
+ 	if (!pte_present(pte)) {
+ 		for (i = 0; i < pte_num; i++, ptep++, addr += pgsize)
+@@ -295,13 +306,14 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ 			      unsigned long addr,
+ 			      pte_t *ptep, unsigned long sz)
+ {
++	size_t pgsize;
+ 	pte_t orig_pte = ptep_get(ptep);
+ 	int pte_num;
+ 
+ 	if (!pte_napot(orig_pte))
+ 		return ptep_get_and_clear(mm, addr, ptep);
+ 
+-	pte_num = napot_pte_num(napot_cont_order(orig_pte));
++	pte_num = num_contig_ptes_from_size(sz, &pgsize);
+ 
+ 	return get_clear_contig(mm, addr, ptep, pte_num);
+ }
+@@ -351,6 +363,7 @@ void huge_pte_clear(struct mm_struct *mm,
+ 		    pte_t *ptep,
+ 		    unsigned long sz)
+ {
++	size_t pgsize;
+ 	pte_t pte = ptep_get(ptep);
+ 	int i, pte_num;
+ 
+@@ -359,8 +372,9 @@ void huge_pte_clear(struct mm_struct *mm,
+ 		return;
+ 	}
+ 
+-	pte_num = napot_pte_num(napot_cont_order(pte));
+-	for (i = 0; i < pte_num; i++, addr += PAGE_SIZE, ptep++)
++	pte_num = num_contig_ptes_from_size(sz, &pgsize);
++
++	for (i = 0; i < pte_num; i++, addr += pgsize, ptep++)
+ 		pte_clear(mm, addr, ptep);
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/riscv-ftrace-add-parentheses-in-macro-definitions-of.patch b/queue-6.6/riscv-ftrace-add-parentheses-in-macro-definitions-of.patch
new file mode 100644
index 0000000000..98aad76531
--- /dev/null
+++ b/queue-6.6/riscv-ftrace-add-parentheses-in-macro-definitions-of.patch
@@ -0,0 +1,63 @@
+From 6cc8c1b93de447739515b38e4e1a95dbe1ee8f62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2025 13:28:36 -0600
+Subject: riscv: ftrace: Add parentheses in macro definitions of make_call_t0
+ and make_call_ra
+
+From: Juhan Jin <juhan.jin@foxmail.com>
+
+[ Upstream commit 5f1a58ed91a040d4625d854f9bb3dd4995919202 ]
+
+This patch adds parentheses to parameters caller and callee of macros
+make_call_t0 and make_call_ra. Every existing invocation of these two
+macros uses a single variable for each argument, so the absence of the
+parentheses seems okay. However, future invocations might use more
+complex expressions as arguments. For example, a future invocation might
+look like this: make_call_t0(a - b, c, call). Without parentheses in the
+macro definition, the macro invocation expands to:
+
+...
+unsigned int offset = (unsigned long) c - (unsigned long) a - b;
+...
+
+which is clearly wrong.
+
+The use of parentheses ensures arguments are correctly evaluated and
+potentially saves future users of make_call_t0 and make_call_ra debugging
+trouble.
+
+Fixes: 6724a76cff85 ("riscv: ftrace: Reduce the detour code size to half")
+Signed-off-by: Juhan Jin <juhan.jin@foxmail.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/tencent_AE90AA59903A628E87E9F80E563DA5BA5508@qq.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/ftrace.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/include/asm/ftrace.h b/arch/riscv/include/asm/ftrace.h
+index 42777f91a9c58..9004dfec8c855 100644
+--- a/arch/riscv/include/asm/ftrace.h
++++ b/arch/riscv/include/asm/ftrace.h
+@@ -103,7 +103,7 @@ struct dyn_arch_ftrace {
+ #define make_call_t0(caller, callee, call)				\
+ do {									\
+ 	unsigned int offset =						\
+-		(unsigned long) callee - (unsigned long) caller;	\
++		(unsigned long) (callee) - (unsigned long) (caller);	\
+ 	call[0] = to_auipc_t0(offset);					\
+ 	call[1] = to_jalr_t0(offset);					\
+ } while (0)
+@@ -119,7 +119,7 @@ do {									\
+ #define make_call_ra(caller, callee, call)				\
+ do {									\
+ 	unsigned int offset =						\
+-		(unsigned long) callee - (unsigned long) caller;	\
++		(unsigned long) (callee) - (unsigned long) (caller);	\
+ 	call[0] = to_auipc_ra(offset);					\
+ 	call[1] = to_jalr_ra(offset);					\
+ } while (0)
+-- 
+2.39.5
+
diff --git a/queue-6.6/rndis_host-flag-rndis-modems-as-wwan-devices.patch b/queue-6.6/rndis_host-flag-rndis-modems-as-wwan-devices.patch
new file mode 100644
index 0000000000..dd7ef0d93f
--- /dev/null
+++ b/queue-6.6/rndis_host-flag-rndis-modems-as-wwan-devices.patch
@@ -0,0 +1,70 @@
+From a9d1278c0a187d312174334bde4b7ae9c36886ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 10:58:41 +0100
+Subject: rndis_host: Flag RNDIS modems as WWAN devices
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 67d1a8956d2d62fe6b4c13ebabb57806098511d8 ]
+
+Set FLAG_WWAN instead of FLAG_ETHERNET for RNDIS interfaces on Mobile
+Broadband Modems, as opposed to regular Ethernet adapters.
+
+Otherwise NetworkManager gets confused, misjudges the device type,
+and wouldn't know it should connect a modem to get the device to work.
+What would be the result depends on ModemManager version -- older
+ModemManager would end up disconnecting a device after an unsuccessful
+probe attempt (if it connected without needing to unlock a SIM), while
+a newer one might spawn a separate PPP connection over a tty interface
+instead, resulting in a general confusion and no end of chaos.
+
+The only way to get this work reliably is to fix the device type
+and have good enough version ModemManager (or equivalent).
+
+Fixes: 63ba395cd7a5 ("rndis_host: support Novatel Verizon USB730L")
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Link: https://patch.msgid.link/20250325095842.1567999-1-lkundrak@v3.sk
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/rndis_host.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index 7b3739b29c8f7..bb0bf14158727 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -630,6 +630,16 @@ static const struct driver_info	zte_rndis_info = {
+ 	.tx_fixup =	rndis_tx_fixup,
+ };
+ 
++static const struct driver_info	wwan_rndis_info = {
++	.description =	"Mobile Broadband RNDIS device",
++	.flags =	FLAG_WWAN | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT,
++	.bind =		rndis_bind,
++	.unbind =	rndis_unbind,
++	.status =	rndis_status,
++	.rx_fixup =	rndis_rx_fixup,
++	.tx_fixup =	rndis_tx_fixup,
++};
++
+ /*-------------------------------------------------------------------------*/
+ 
+ static const struct usb_device_id	products [] = {
+@@ -666,9 +676,11 @@ static const struct usb_device_id	products [] = {
+ 	USB_INTERFACE_INFO(USB_CLASS_WIRELESS_CONTROLLER, 1, 3),
+ 	.driver_info = (unsigned long) &rndis_info,
+ }, {
+-	/* Novatel Verizon USB730L */
++	/* Mobile Broadband Modem, seen in Novatel Verizon USB730L and
++	 * Telit FN990A (RNDIS)
++	 */
+ 	USB_INTERFACE_INFO(USB_CLASS_MISC, 4, 1),
+-	.driver_info = (unsigned long) &rndis_info,
++	.driver_info = (unsigned long)&wwan_rndis_info,
+ },
+ 	{ },		// END
+ };
+-- 
+2.39.5
+
diff --git a/queue-6.6/rtnetlink-allocate-vfinfo-size-for-vf-guids-when-sup.patch b/queue-6.6/rtnetlink-allocate-vfinfo-size-for-vf-guids-when-sup.patch
new file mode 100644
index 0000000000..8b169974f1
--- /dev/null
+++ b/queue-6.6/rtnetlink-allocate-vfinfo-size-for-vf-guids-when-sup.patch
@@ -0,0 +1,163 @@
+From 1d355e16b72b1d3ce158be71e99b97c6b350ac21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 11:02:26 +0200
+Subject: rtnetlink: Allocate vfinfo size for VF GUIDs when supported
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 23f00807619d15063d676218f36c5dfeda1eb420 ]
+
+Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs")
+added support for getting VF port and node GUIDs in netlink ifinfo
+messages, but their size was not taken into consideration in the
+function that allocates the netlink message, causing the following
+warning when a netlink message is filled with many VF port and node
+GUIDs:
+ # echo 64 > /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs
+ # ip link show dev ib0
+ RTNETLINK answers: Message too long
+ Cannot send link get request: Message too long
+
+Kernel warning:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0
+ Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core
+ CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:rtnl_getlink+0x586/0x5a0
+ Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff <0f> 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00
+ RSP: 0018:ffff888113557348 EFLAGS: 00010246
+ RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000
+ RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8
+ RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000
+ R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00
+ R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff
+ FS:  00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ PKRU: 55555554
+ Call Trace:
+  <TASK>
+  ? __warn+0xa5/0x230
+  ? rtnl_getlink+0x586/0x5a0
+  ? report_bug+0x22d/0x240
+  ? handle_bug+0x53/0xa0
+  ? exc_invalid_op+0x14/0x50
+  ? asm_exc_invalid_op+0x16/0x20
+  ? skb_trim+0x6a/0x80
+  ? rtnl_getlink+0x586/0x5a0
+  ? __pfx_rtnl_getlink+0x10/0x10
+  ? rtnetlink_rcv_msg+0x1e5/0x860
+  ? __pfx___mutex_lock+0x10/0x10
+  ? rcu_is_watching+0x34/0x60
+  ? __pfx_lock_acquire+0x10/0x10
+  ? stack_trace_save+0x90/0xd0
+  ? filter_irq_stacks+0x1d/0x70
+  ? kasan_save_stack+0x30/0x40
+  ? kasan_save_stack+0x20/0x40
+  ? kasan_save_track+0x10/0x30
+  rtnetlink_rcv_msg+0x21c/0x860
+  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
+  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
+  ? arch_stack_walk+0x9e/0xf0
+  ? rcu_is_watching+0x34/0x60
+  ? lock_acquire+0xd5/0x410
+  ? rcu_is_watching+0x34/0x60
+  netlink_rcv_skb+0xe0/0x210
+  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
+  ? __pfx_netlink_rcv_skb+0x10/0x10
+  ? rcu_is_watching+0x34/0x60
+  ? __pfx___netlink_lookup+0x10/0x10
+  ? lock_release+0x62/0x200
+  ? netlink_deliver_tap+0xfd/0x290
+  ? rcu_is_watching+0x34/0x60
+  ? lock_release+0x62/0x200
+  ? netlink_deliver_tap+0x95/0x290
+  netlink_unicast+0x31f/0x480
+  ? __pfx_netlink_unicast+0x10/0x10
+  ? rcu_is_watching+0x34/0x60
+  ? lock_acquire+0xd5/0x410
+  netlink_sendmsg+0x369/0x660
+  ? lock_release+0x62/0x200
+  ? __pfx_netlink_sendmsg+0x10/0x10
+  ? import_ubuf+0xb9/0xf0
+  ? __import_iovec+0x254/0x2b0
+  ? lock_release+0x62/0x200
+  ? __pfx_netlink_sendmsg+0x10/0x10
+  ____sys_sendmsg+0x559/0x5a0
+  ? __pfx_____sys_sendmsg+0x10/0x10
+  ? __pfx_copy_msghdr_from_user+0x10/0x10
+  ? rcu_is_watching+0x34/0x60
+  ? do_read_fault+0x213/0x4a0
+  ? rcu_is_watching+0x34/0x60
+  ___sys_sendmsg+0xe4/0x150
+  ? __pfx____sys_sendmsg+0x10/0x10
+  ? do_fault+0x2cc/0x6f0
+  ? handle_pte_fault+0x2e3/0x3d0
+  ? __pfx_handle_pte_fault+0x10/0x10
+  ? preempt_count_sub+0x14/0xc0
+  ? __down_read_trylock+0x150/0x270
+  ? __handle_mm_fault+0x404/0x8e0
+  ? __pfx___handle_mm_fault+0x10/0x10
+  ? lock_release+0x62/0x200
+  ? __rcu_read_unlock+0x65/0x90
+  ? rcu_is_watching+0x34/0x60
+  __sys_sendmsg+0xd5/0x150
+  ? __pfx___sys_sendmsg+0x10/0x10
+  ? __up_read+0x192/0x480
+  ? lock_release+0x62/0x200
+  ? __rcu_read_unlock+0x65/0x90
+  ? rcu_is_watching+0x34/0x60
+  do_syscall_64+0x6d/0x140
+  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ RIP: 0033:0x7f63a5b13367
+ Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+ RSP: 002b:00007fff8c726bc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+ RAX: ffffffffffffffda RBX: 0000000067b687c2 RCX: 00007f63a5b13367
+ RDX: 0000000000000000 RSI: 00007fff8c726c30 RDI: 0000000000000004
+ RBP: 00007fff8c726cb8 R08: 0000000000000000 R09: 0000000000000034
+ R10: 00007fff8c726c7c R11: 0000000000000246 R12: 0000000000000001
+ R13: 0000000000000000 R14: 00007fff8c726cd0 R15: 00007fff8c726cd0
+  </TASK>
+ irq event stamp: 0
+ hardirqs last  enabled at (0): [<0000000000000000>] 0x0
+ hardirqs last disabled at (0): [<ffffffff813f9e58>] copy_process+0xd08/0x2830
+ softirqs last  enabled at (0): [<ffffffff813f9e58>] copy_process+0xd08/0x2830
+ softirqs last disabled at (0): [<0000000000000000>] 0x0
+ ---[ end trace 0000000000000000 ]---
+
+Thus, when calculating ifinfo message size, take VF GUIDs sizes into
+account when supported.
+
+Fixes: 30aad41721e0 ("net/core: Add support for getting VF GUIDs")
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maher Sanalla <msanalla@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20250325090226.749730-1-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 4acde7067519e..26c520d1af6e6 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1011,6 +1011,9 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ 				 /* IFLA_VF_STATS_TX_DROPPED */
+ 				 nla_total_size_64bit(sizeof(__u64)));
+ 		}
++		if (dev->netdev_ops->ndo_get_vf_guid)
++			size += num_vfs * 2 *
++				nla_total_size(sizeof(struct ifla_vf_guid));
+ 		return size;
+ 	} else
+ 		return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/rust-fix-signature-of-rust_fmt_argument.patch b/queue-6.6/rust-fix-signature-of-rust_fmt_argument.patch
new file mode 100644
index 0000000000..e5ea633eba
--- /dev/null
+++ b/queue-6.6/rust-fix-signature-of-rust_fmt_argument.patch
@@ -0,0 +1,78 @@
+From ddbfaac77fa2bebf2ac40c9c5a219fc9b2691a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Mar 2025 08:45:12 +0000
+Subject: rust: fix signature of rust_fmt_argument
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+[ Upstream commit 901b3290bd4dc35e613d13abd03c129e754dd3dd ]
+
+Without this change, the rest of this series will emit the following
+error message:
+
+error[E0308]: `if` and `else` have incompatible types
+  --> <linux>/rust/kernel/print.rs:22:22
+   |
+21 | #[export]
+   | --------- expected because of this
+22 | unsafe extern "C" fn rust_fmt_argument(
+   |                      ^^^^^^^^^^^^^^^^^ expected `u8`, found `i8`
+   |
+   = note: expected fn item `unsafe extern "C" fn(*mut u8, *mut u8, *mut c_void) -> *mut u8 {bindings::rust_fmt_argument}`
+              found fn item `unsafe extern "C" fn(*mut i8, *mut i8, *const c_void) -> *mut i8 {print::rust_fmt_argument}`
+
+The error may be different depending on the architecture.
+
+To fix this, change the void pointer argument to use a const pointer,
+and change the imports to use crate::ffi instead of core::ffi for
+integer types.
+
+Fixes: 787983da7718 ("vsprintf: add new `%pA` format specifier")
+Reviewed-by: Tamir Duberstein <tamird@gmail.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Acked-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20250303-export-macro-v3-1-41fbad85a27f@google.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/vsprintf.c       | 2 +-
+ rust/kernel/print.rs | 7 +++----
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/lib/vsprintf.c b/lib/vsprintf.c
+index 2aa408441cd3e..14b27db236cc8 100644
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -2275,7 +2275,7 @@ int __init no_hash_pointers_enable(char *str)
+ early_param("no_hash_pointers", no_hash_pointers_enable);
+ 
+ /* Used for Rust formatting ('%pA'). */
+-char *rust_fmt_argument(char *buf, char *end, void *ptr);
++char *rust_fmt_argument(char *buf, char *end, const void *ptr);
+ 
+ /*
+  * Show a '%p' thing.  A kernel extension is that the '%p' is followed
+diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs
+index f48926e3e9fe3..34788218ea5d2 100644
+--- a/rust/kernel/print.rs
++++ b/rust/kernel/print.rs
+@@ -6,12 +6,11 @@
+ //!
+ //! Reference: <https://www.kernel.org/doc/html/latest/core-api/printk-basics.html>
+ 
+-use core::{
++use crate::{
+     ffi::{c_char, c_void},
+-    fmt,
++    str::RawFormatter,
+ };
+-
+-use crate::str::RawFormatter;
++use core::fmt;
+ 
+ #[cfg(CONFIG_PRINTK)]
+ use crate::bindings;
+-- 
+2.39.5
+
diff --git a/queue-6.6/sched-deadline-use-online-cpus-for-validating-runtim.patch b/queue-6.6/sched-deadline-use-online-cpus-for-validating-runtim.patch
new file mode 100644
index 0000000000..639064f07e
--- /dev/null
+++ b/queue-6.6/sched-deadline-use-online-cpus-for-validating-runtim.patch
@@ -0,0 +1,45 @@
+From e6af43e4818a13fd7efbc2dd8829d4811c7a73bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 10:59:53 +0530
+Subject: sched/deadline: Use online cpus for validating runtime
+
+From: Shrikanth Hegde <sshegde@linux.ibm.com>
+
+[ Upstream commit 14672f059d83f591afb2ee1fff56858efe055e5a ]
+
+The ftrace selftest reported a failure because writing -1 to
+sched_rt_runtime_us returns -EBUSY. This happens when the possible
+CPUs are different from active CPUs.
+
+Active CPUs are part of one root domain, while remaining CPUs are part
+of def_root_domain. Since active cpumask is being used, this results in
+cpus=0 when a non active CPUs is used in the loop.
+
+Fix it by looping over the online CPUs instead for validating the
+bandwidth calculations.
+
+Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Juri Lelli <juri.lelli@redhat.com>
+Link: https://lore.kernel.org/r/20250306052954.452005-2-sshegde@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index b9e99bc3b1cf2..6c639e48e49a9 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2780,7 +2780,7 @@ int sched_dl_global_validate(void)
+ 	 * value smaller than the currently allocated bandwidth in
+ 	 * any of the root_domains.
+ 	 */
+-	for_each_possible_cpu(cpu) {
++	for_each_online_cpu(cpu) {
+ 		rcu_read_lock_sched();
+ 
+ 		if (dl_bw_visited(cpu, gen))
+-- 
+2.39.5
+
diff --git a/queue-6.6/sched-smt-always-inline-sched_smt_active.patch b/queue-6.6/sched-smt-always-inline-sched_smt_active.patch
new file mode 100644
index 0000000000..33133a09bb
--- /dev/null
+++ b/queue-6.6/sched-smt-always-inline-sched_smt_active.patch
@@ -0,0 +1,45 @@
+From 470f32d901949ed73745e02f6f8be378a1cc5b09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 21:26:44 -0700
+Subject: sched/smt: Always inline sched_smt_active()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 09f37f2d7b21ff35b8b533f9ab8cfad2fe8f72f6 ]
+
+sched_smt_active() can be called from noinstr code, so it should always
+be inlined.  The CONFIG_SCHED_SMT version already has __always_inline.
+Do the same for its !CONFIG_SCHED_SMT counterpart.
+
+Fixes the following warning:
+
+  vmlinux.o: error: objtool: intel_idle_ibrs+0x13: call to sched_smt_active() leaves .noinstr.text section
+
+Fixes: 321a874a7ef8 ("sched/smt: Expose sched_smt_present static key")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/1d03907b0a247cf7fb5c1d518de378864f603060.1743481539.git.jpoimboe@kernel.org
+Closes: https://lore.kernel.org/r/202503311434.lyw2Tveh-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched/smt.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/sched/smt.h b/include/linux/sched/smt.h
+index 59d3736c454cf..737b50f40137b 100644
+--- a/include/linux/sched/smt.h
++++ b/include/linux/sched/smt.h
+@@ -12,7 +12,7 @@ static __always_inline bool sched_smt_active(void)
+ 	return static_branch_likely(&sched_smt_present);
+ }
+ #else
+-static inline bool sched_smt_active(void) { return false; }
++static __always_inline bool sched_smt_active(void) { return false; }
+ #endif
+ 
+ void arch_smt_update(void);
+-- 
+2.39.5
+
diff --git a/queue-6.6/selftests-bpf-fix-string-read-in-strncmp-benchmark.patch b/queue-6.6/selftests-bpf-fix-string-read-in-strncmp-benchmark.patch
new file mode 100644
index 0000000000..9d50b8080a
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-string-read-in-strncmp-benchmark.patch
@@ -0,0 +1,83 @@
+From d8ee851b67343aa21438ba381825f0d99db4b9f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 13:28:52 +0100
+Subject: selftests/bpf: Fix string read in strncmp benchmark
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Viktor Malik <vmalik@redhat.com>
+
+[ Upstream commit de07b182899227d5fd1ca7a1a7d495ecd453d49c ]
+
+The strncmp benchmark uses the bpf_strncmp helper and a hand-written
+loop to compare two strings. The values of the strings are filled from
+userspace. One of the strings is non-const (in .bss) while the other is
+const (in .rodata) since that is the requirement of bpf_strncmp.
+
+The problem is that in the hand-written loop, Clang optimizes the reads
+from the const string to always return 0 which breaks the benchmark.
+
+Use barrier_var to prevent the optimization.
+
+The effect can be seen on the strncmp-no-helper variant.
+
+Before this change:
+
+    # ./bench strncmp-no-helper
+    Setting up benchmark 'strncmp-no-helper'...
+    Benchmark 'strncmp-no-helper' started.
+    Iter   0 (112.309us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   1 (-23.238us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   2 ( 58.994us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   3 (-30.466us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   4 ( 29.996us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   5 ( 16.949us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Iter   6 (-60.035us): hits    0.000M/s (  0.000M/prod), drops    0.000M/s, total operations    0.000M/s
+    Summary: hits    0.000 ± 0.000M/s (  0.000M/prod), drops    0.000 ± 0.000M/s, total operations    0.000 ± 0.000M/s
+
+After this change:
+
+    # ./bench strncmp-no-helper
+    Setting up benchmark 'strncmp-no-helper'...
+    Benchmark 'strncmp-no-helper' started.
+    Iter   0 ( 77.711us): hits    5.534M/s (  5.534M/prod), drops    0.000M/s, total operations    5.534M/s
+    Iter   1 ( 11.215us): hits    6.006M/s (  6.006M/prod), drops    0.000M/s, total operations    6.006M/s
+    Iter   2 (-14.253us): hits    5.931M/s (  5.931M/prod), drops    0.000M/s, total operations    5.931M/s
+    Iter   3 ( 59.087us): hits    6.005M/s (  6.005M/prod), drops    0.000M/s, total operations    6.005M/s
+    Iter   4 (-21.379us): hits    6.010M/s (  6.010M/prod), drops    0.000M/s, total operations    6.010M/s
+    Iter   5 (-20.310us): hits    5.861M/s (  5.861M/prod), drops    0.000M/s, total operations    5.861M/s
+    Iter   6 ( 53.937us): hits    6.004M/s (  6.004M/prod), drops    0.000M/s, total operations    6.004M/s
+    Summary: hits    5.969 ± 0.061M/s (  5.969M/prod), drops    0.000 ± 0.000M/s, total operations    5.969 ± 0.061M/s
+
+Fixes: 9c42652f8be3 ("selftests/bpf: Add benchmark for bpf_strncmp() helper")
+Suggested-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Viktor Malik <vmalik@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/bpf/20250313122852.1365202-1-vmalik@redhat.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/strncmp_bench.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/strncmp_bench.c b/tools/testing/selftests/bpf/progs/strncmp_bench.c
+index 18373a7df76e6..f47bf88f8d2a7 100644
+--- a/tools/testing/selftests/bpf/progs/strncmp_bench.c
++++ b/tools/testing/selftests/bpf/progs/strncmp_bench.c
+@@ -35,7 +35,10 @@ static __always_inline int local_strncmp(const char *s1, unsigned int sz,
+ SEC("tp/syscalls/sys_enter_getpgid")
+ int strncmp_no_helper(void *ctx)
+ {
+-	if (local_strncmp(str, cmp_str_len + 1, target) < 0)
++	const char *target_str = target;
++
++	barrier_var(target_str);
++	if (local_strncmp(str, cmp_str_len + 1, target_str) < 0)
+ 		__sync_add_and_fetch(&hits, 1);
+ 	return 0;
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/selftests-bpf-select-numa_no_node-to-create-map.patch b/queue-6.6/selftests-bpf-select-numa_no_node-to-create-map.patch
new file mode 100644
index 0000000000..4d29b09aaa
--- /dev/null
+++ b/queue-6.6/selftests-bpf-select-numa_no_node-to-create-map.patch
@@ -0,0 +1,55 @@
+From 01c99d6ea9840e27a49ef704de98e98cd9c7bcb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2025 12:35:22 +0530
+Subject: selftests/bpf: Select NUMA_NO_NODE to create map
+
+From: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+
+[ Upstream commit 4107a1aeb20ed4cdad6a0d49de92ea0f933c71b7 ]
+
+On powerpc, a CPU does not necessarily originate from NUMA node 0.
+This contrasts with architectures like x86, where CPU 0 is not
+hot-pluggable, making NUMA node 0 a consistently valid node.
+This discrepancy can lead to failures when creating a map on NUMA
+node 0, which is initialized by default, if no CPUs are allocated
+from NUMA node 0.
+
+This patch fixes the issue by setting NUMA_NO_NODE (-1) for map
+creation for this selftest.
+
+Fixes: 96eabe7a40aa ("bpf: Allow selecting numa node during map creation")
+Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/bpf/cf1f61468b47425ecf3728689bc9636ddd1d910e.1738302337.git.skb99@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c b/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c
+index f79815b7e951b..fff16cdc93f20 100644
+--- a/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c
++++ b/tools/testing/selftests/bpf/prog_tests/bloom_filter_map.c
+@@ -6,6 +6,10 @@
+ #include <test_progs.h>
+ #include "bloom_filter_map.skel.h"
+ 
++#ifndef NUMA_NO_NODE
++#define NUMA_NO_NODE	(-1)
++#endif
++
+ static void test_fail_cases(void)
+ {
+ 	LIBBPF_OPTS(bpf_map_create_opts, opts);
+@@ -69,6 +73,7 @@ static void test_success_cases(void)
+ 
+ 	/* Create a map */
+ 	opts.map_flags = BPF_F_ZERO_SEED | BPF_F_NUMA_NODE;
++	opts.numa_node = NUMA_NO_NODE;
+ 	fd = bpf_map_create(BPF_MAP_TYPE_BLOOM_FILTER, NULL, 0, sizeof(value), 100, &opts);
+ 	if (!ASSERT_GE(fd, 0, "bpf_map_create bloom filter success case"))
+ 		return;
+-- 
+2.39.5
+
diff --git a/queue-6.6/selftests-mm-cow-fix-the-incorrect-error-handling.patch b/queue-6.6/selftests-mm-cow-fix-the-incorrect-error-handling.patch
new file mode 100644
index 0000000000..d46b5677b2
--- /dev/null
+++ b/queue-6.6/selftests-mm-cow-fix-the-incorrect-error-handling.patch
@@ -0,0 +1,41 @@
+From 2ffec30dc3460948b287d8d3708b6b82c02ea5d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 12:38:40 +0800
+Subject: selftests/mm/cow: fix the incorrect error handling
+
+From: Cyan Yang <cyan.yang@sifive.com>
+
+[ Upstream commit f841ad9ca5007167c02de143980c9dc703f90b3d ]
+
+Error handling doesn't check the correct return value.  This patch will
+fix it.
+
+Link: https://lkml.kernel.org/r/20250312043840.71799-1-cyan.yang@sifive.com
+Fixes: f4b5fd6946e2 ("selftests/vm: anon_cow: THP tests")
+Signed-off-by: Cyan Yang <cyan.yang@sifive.com>
+Reviewed-by: Dev Jain <dev.jain@arm.com>
+Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/mm/cow.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/mm/cow.c b/tools/testing/selftests/mm/cow.c
+index 6f2f839904416..76d37904172db 100644
+--- a/tools/testing/selftests/mm/cow.c
++++ b/tools/testing/selftests/mm/cow.c
+@@ -812,7 +812,7 @@ static void do_run_with_thp(test_fn fn, enum thp_run thp_run)
+ 		mremap_size = thpsize / 2;
+ 		mremap_mem = mmap(NULL, mremap_size, PROT_NONE,
+ 				  MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+-		if (mem == MAP_FAILED) {
++		if (mremap_mem == MAP_FAILED) {
+ 			ksft_test_result_fail("mmap() failed\n");
+ 			goto munmap;
+ 		}
+-- 
+2.39.5
+
diff --git a/queue-6.6/selinux-chain-up-tool-resolving-errors-in-install_po.patch b/queue-6.6/selinux-chain-up-tool-resolving-errors-in-install_po.patch
new file mode 100644
index 0000000000..4c92b44542
--- /dev/null
+++ b/queue-6.6/selinux-chain-up-tool-resolving-errors-in-install_po.patch
@@ -0,0 +1,66 @@
+From 7f8f1f448b7c7667559a7f0d2959c01b8f418029 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 10:56:43 +0100
+Subject: selinux: Chain up tool resolving errors in install_policy.sh
+
+From: Tim Schumacher <tim.schumacher1@huawei.com>
+
+[ Upstream commit 6ae0042f4d3f331e841495eb0a3d51598e593ec2 ]
+
+Subshell evaluations are not exempt from errexit, so if a command is
+not available, `which` will fail and exit the script as a whole.
+This causes the helpful error messages to not be printed if they are
+tacked on using a `$?` comparison.
+
+Resolve the issue by using chains of logical operators, which are not
+subject to the effects of errexit.
+
+Fixes: e37c1877ba5b1 ("scripts/selinux: modernize mdp")
+Signed-off-by: Tim Schumacher <tim.schumacher1@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/selinux/install_policy.sh | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/scripts/selinux/install_policy.sh b/scripts/selinux/install_policy.sh
+index 24086793b0d8d..db40237e60ce7 100755
+--- a/scripts/selinux/install_policy.sh
++++ b/scripts/selinux/install_policy.sh
+@@ -6,27 +6,24 @@ if [ `id -u` -ne 0 ]; then
+ 	exit 1
+ fi
+ 
+-SF=`which setfiles`
+-if [ $? -eq 1 ]; then
++SF=`which setfiles` || {
+ 	echo "Could not find setfiles"
+ 	echo "Do you have policycoreutils installed?"
+ 	exit 1
+-fi
++}
+ 
+-CP=`which checkpolicy`
+-if [ $? -eq 1 ]; then
++CP=`which checkpolicy` || {
+ 	echo "Could not find checkpolicy"
+ 	echo "Do you have checkpolicy installed?"
+ 	exit 1
+-fi
++}
+ VERS=`$CP -V | awk '{print $1}'`
+ 
+-ENABLED=`which selinuxenabled`
+-if [ $? -eq 1 ]; then
++ENABLED=`which selinuxenabled` || {
+ 	echo "Could not find selinuxenabled"
+ 	echo "Do you have libselinux-utils installed?"
+ 	exit 1
+-fi
++}
+ 
+ if selinuxenabled; then
+     echo "SELinux is already enabled"
+-- 
+2.39.5
+
diff --git a/queue-6.6/series b/queue-6.6/series
new file mode 100644
index 0000000000..13b4ed7ba6
--- /dev/null
+++ b/queue-6.6/series
@@ -0,0 +1,222 @@
+watch_queue-fix-pipe-accounting-mismatch.patch
+x86-mm-pat-cpa-test-fix-length-for-cpa_array-test.patch
+cpufreq-scpi-compare-khz-instead-of-hz.patch
+smack-dont-compile-ipv6-code-unless-ipv6-is-configur.patch
+cpufreq-governor-fix-negative-idle_time-handling-in-.patch
+edac-skx_common-i10nm-fix-some-missing-error-reports.patch
+x86-fpu-fix-guest-fpu-state-buffer-allocation-size.patch
+x86-fpu-avoid-copying-dynamic-fp-state-from-init_tas.patch
+x86-platform-only-allow-config_eisa-for-32-bit.patch
+x86-sev-add-missing-rip_rel_ref-invocations-during-s.patch
+lockdep-mm-fix-might_fault-lockdep-check-of-current-.patch
+pm-sleep-adjust-check-before-setting-power.must_resu.patch
+risc-v-kvm-disable-the-kernel-perf-counter-during-co.patch
+selinux-chain-up-tool-resolving-errors-in-install_po.patch
+edac-ie31200-fix-the-size-of-edac_mc_layer_chip_sele.patch
+edac-ie31200-fix-the-dimm-size-mask-for-several-socs.patch
+edac-ie31200-fix-the-error-path-order-of-ie31200_ini.patch
+thermal-int340x-add-null-check-for-adev.patch
+pm-sleep-fix-handling-devices-with-direct_complete-s.patch
+lockdep-don-t-disable-interrupts-on-rt-in-disable_ir.patch
+perf-ring_buffer-allow-the-epollrdnorm-flag-for-poll.patch
+x86-traps-make-exc_double_fault-consistently-noretur.patch
+x86-fpu-xstate-fix-inconsistencies-in-guest-fpu-xfea.patch
+media-verisilicon-hevc-initialize-start_bit-field.patch
+media-platform-allgro-dvt-unregister-v4l2_device-on-.patch
+platform-x86-dell-ddv-fix-temperature-calculation.patch
+asoc-cs35l41-check-the-return-value-from-spi_setup.patch
+hid-remove-superfluous-and-wrong-makefile-entry-for-.patch
+dt-bindings-vendor-prefixes-add-gocontroll.patch
+alsa-hda-realtek-always-honor-no_shutup_pins.patch
+asoc-ti-j721e-evm-fix-clock-configuration-for-ti-j72.patch
+drm-bridge-ti-sn65dsi86-fix-multiple-instances.patch
+drm-dp_mst-fix-drm-rad-print.patch
+drm-bridge-it6505-fix-hdcp-v-match-check-is-not-perf.patch
+drm-xlnx-zynqmp-fix-max-dma-segment-size.patch
+drm-vkms-fix-use-after-free-and-double-free-on-init-.patch
+pci-use-downstream-bridges-for-distributing-resource.patch
+drm-mediatek-mtk_hdmi-unregister-audio-platform-devi.patch
+drm-mediatek-mtk_hdmi-fix-typo-for-aud_sampe_size-me.patch
+pci-aspm-fix-link-state-exit-during-switch-upstream-.patch
+drm-msm-dpu-don-t-use-active-in-atomic_check.patch
+drm-msm-dsi-use-existing-per-interface-slice-count-i.patch
+drm-msm-dsi-set-phy-usescase-and-mode-before-registe.patch
+drm-amdkfd-fix-circular-locking-dependency-in-svm_ra.patch
+pci-cadence-ep-fix-the-driver-to-send-msg-tlp-for-in.patch
+pci-brcmstb-use-internal-register-to-change-link-cap.patch
+pci-brcmstb-fix-error-path-after-a-call-to-regulator.patch
+pci-brcmstb-fix-potential-premature-regulator-disabl.patch
+pci-portdrv-only-disable-pciehp-interrupts-early-whe.patch
+pci-avoid-reset-when-disabled-via-sysfs.patch
+drm-amd-display-fix-type-mismatch-in-calculatedynami.patch
+pci-remove-stray-put_device-in-pci_register_host_bri.patch
+pci-xilinx-cpm-fix-irq-domain-leak-in-error-path-of-.patch
+drm-mediatek-dp-drm_err-dev_err-in-hpd-path-to-avoid.patch
+drm-mediatek-dsi-fix-error-codes-in-mtk_dsi_host_tra.patch
+drm-amd-display-avoid-npd-when-asic-does-not-support.patch
+pci-histb-fix-an-error-handling-path-in-histb_pcie_p.patch
+pci-pciehp-don-t-enable-hpie-when-resuming-in-poll-m.patch
+fbdev-au1100fb-move-a-variable-assignment-behind-a-n.patch
+mdacon-rework-dependency-list.patch
+fbdev-sm501fb-add-some-geometry-checks.patch
+clk-amlogic-gxbb-drop-incorrect-flag-on-32k-clock.patch
+crypto-hisilicon-sec2-fix-for-aead-authsize-alignmen.patch
+crypto-hisilicon-sec2-fix-for-sec-spec-check.patch
+remoteproc-core-clear-table_sz-when-rproc_shutdown.patch
+of-property-increase-nr_fwnode_reference_args.patch
+remoteproc-qcom_q6v5_pas-make-single-pd-handling-mor.patch
+libbpf-fix-hypothetical-stt_section-extern-null-dere.patch
+selftests-bpf-fix-string-read-in-strncmp-benchmark.patch
+x86-mm-pat-fix-vm_pat-handling-when-fork-fails-in-co.patch
+clk-samsung-fix-ubsan-panic-in-samsung_clk_init.patch
+clk-qcom-gcc-msm8953-fix-stuck-venus0_core0-clock.patch
+rdma-mana_ib-ensure-variable-err-is-initialized.patch
+remoteproc-qcom_q6v5_pas-use-resource-with-cx-pd-for.patch
+bpf-use-preempt_count-directly-in-bpf_send_signal_co.patch
+lib-842-improve-error-handling-in-sw842_compress.patch
+pinctrl-renesas-rza2-fix-missing-of_node_put-call.patch
+pinctrl-renesas-rzg2l-fix-missing-of_node_put-call.patch
+clk-rockchip-rk3328-fix-wrong-clk_ref_usb3otg-parent.patch
+rdma-core-don-t-expose-hw_counters-outside-of-init-n.patch
+rdma-mlx5-fix-calculation-of-total-invalidated-pages.patch
+rdma-erdma-prevent-use-after-free-in-erdma_accept_ne.patch
+remoteproc-qcom_q6v5_mss-handle-platforms-with-one-p.patch
+ib-mad-check-available-slots-before-posting-receive-.patch
+pinctrl-tegra-set-sfio-mode-to-mux-register.patch
+clk-amlogic-g12b-fix-cluster-a-parent-data.patch
+clk-amlogic-gxbb-drop-non-existing-32k-clock-parent.patch
+selftests-bpf-select-numa_no_node-to-create-map.patch
+rust-fix-signature-of-rust_fmt_argument.patch
+clk-clk-imx8mp-audiomix-fix-dsp-ocram_a-clock-parent.patch
+clk-amlogic-g12a-fix-mmc-a-peripheral-clock.patch
+x86-entry-fix-orc-unwinder-for-push_regs-with-save_r.patch
+power-supply-max77693-fix-wrong-conversion-of-charge.patch
+crypto-nx-fix-uninitialised-hv_nxc-on-error.patch
+rdma-mlx5-fix-mlx5_poll_one-cur_qp-update-flow.patch
+pinctrl-renesas-rzv2m-fix-missing-of_node_put-call.patch
+mfd-sm501-switch-to-bit-to-mitigate-integer-overflow.patch
+leds-fix-led_off-brightness-race.patch
+x86-dumpstack-fix-inaccurate-unwinding-from-exceptio.patch
+crypto-hisilicon-sec2-fix-for-aead-auth-key-length.patch
+pinctrl-intel-fix-wrong-bypass-assignment-in-intel_p.patch
+clk-qcom-mmcc-sdm660-fix-stuck-video_subcore0-clock.patch
+perf-stat-fix-find_stat-for-mixed-legacy-non-legacy-.patch
+isofs-fix-kmsan-uninit-value-bug-in-do_isofs_readdir.patch
+soundwire-slave-fix-an-of-node-reference-leak-in-sou.patch
+coresight-catu-fix-number-of-pages-while-using-64k-p.patch
+vhost-scsi-fix-handling-of-multiple-calls-to-vhost_s.patch
+coresight-etm4x-add-isb-before-reading-the-trcstatr.patch
+perf-pmu-don-t-double-count-common-sysfs-and-json-ev.patch
+ucsi_ccg-don-t-show-failed-to-get-fw-build-informati.patch
+iio-accel-mma8452-ensure-error-return-on-failure-to-.patch
+iio-accel-msa311-fix-failure-to-release-runtime-pm-i.patch
+perf-arm-spe-fix-load-store-operation-checking.patch
+perf-bench-fix-perf-bench-syscall-loop-count.patch
+usb-xhci-correct-debug-message-page-size-calculation.patch
+fs-ntfs3-fix-a-couple-integer-overflows-on-32bit-sys.patch
+fs-ntfs3-prevent-integer-overflow-in-hdr_first_de.patch
+dmaengine-fsl-edma-cleanup-chan-after-dma_async_devi.patch
+iio-adc-ad4130-fix-comparison-of-channel-setups.patch
+iio-adc-ad7124-fix-comparison-of-channel-configs.patch
+perf-evlist-add-success-path-to-evlist__create_syswi.patch
+perf-units-fix-insufficient-array-space.patch
+kernel-events-uprobes-handle-device-exclusive-entrie.patch
+kexec-initialize-elf-lowest-address-to-ulong_max.patch
+ocfs2-validate-l_tree_depth-to-avoid-out-of-bounds-a.patch
+arch-powerpc-drop-generic_ptdump-from-mpc885_ads_def.patch
+nfsv4-don-t-trigger-uneccessary-scans-for-return-on-.patch
+fuse-fix-dax-truncate-punch_hole-fault-path.patch
+selftests-mm-cow-fix-the-incorrect-error-handling.patch
+um-remove-copy_from_kernel_nofault_allowed.patch
+um-hostfs-avoid-issues-on-inode-number-reuse-by-host.patch
+i3c-master-svc-fix-missing-the-ibi-rules.patch
+perf-python-fixup-description-of-sample.id-event-mem.patch
+perf-python-decrement-the-refcount-of-just-created-e.patch
+perf-python-don-t-keep-a-raw_data-pointer-to-consume.patch
+perf-python-check-if-there-is-space-to-copy-all-the-.patch
+staging-rtl8723bs-select-config_crypto_lib_aes.patch
+tty-n_tty-use-uint-for-space-returned-by-tty_write_r.patch
+fs-procfs-fix-the-comment-above-proc_pid_wchan.patch
+perf-tools-annotate-asm_pure_loop.s.patch
+objtool-media-dib8000-prevent-divide-by-zero-in-dib8.patch
+nfs-shut-down-the-nfs_client-only-after-all-the-supe.patch
+smb-client-fix-netns-refcount-imbalance-causing-leak.patch
+exfat-fix-the-infinite-loop-in-exfat_find_last_clust.patch
+rtnetlink-allocate-vfinfo-size-for-vf-guids-when-sup.patch
+rndis_host-flag-rndis-modems-as-wwan-devices.patch
+ksmbd-use-aead_request_free-to-match-aead_request_al.patch
+ksmbd-fix-multichannel-connection-failure.patch
+ksmbd-fix-r_count-dec-increment-mismatch.patch
+net-mlx5e-shampo-make-reserved-size-independent-of-p.patch
+ring-buffer-fix-bytes_dropped-calculation-issue.patch
+objtool-fix-segfault-in-ignore_unreachable_insn.patch
+loongarch-fix-help-text-of-cmdline_extend-in-kconfig.patch
+loongarch-rework-the-arch_kgdb_breakpoint-implementa.patch
+acpi-processor-idle-return-an-error-if-both-p_lvl-2-.patch
+octeontx2-af-fix-mbox-intr-handler-when-num-vfs-64.patch
+octeontx2-af-free-nix_af_int_vec_gen-irq.patch
+objtool-fix-verbose-disassembly-if-cross_compile-isn.patch
+sched-smt-always-inline-sched_smt_active.patch
+context_tracking-always-inline-ct_-nmi-irq-_-enter-e.patch
+rcu-tasks-always-inline-rcu_irq_work_resched.patch
+wifi-iwlwifi-fw-allocate-chained-sg-tables-for-dump.patch
+wifi-iwlwifi-mvm-use-the-right-version-of-the-rate-a.patch
+nvme-tcp-fix-possible-uaf-in-nvme_tcp_poll.patch
+nvme-pci-clean-up-cmbmsc-when-registering-cmb-fails.patch
+nvme-pci-skip-cmb-blocks-incompatible-with-pci-p2p-d.patch
+wifi-brcmfmac-keep-power-during-suspend-if-board-req.patch
+affs-generate-ofs-sequence-numbers-starting-at-1.patch
+affs-don-t-write-overlarge-ofs-data-block-size-field.patch
+alsa-hda-realtek-fix-asus-z13-2025-audio.patch
+alsa-hda-fix-speakers-on-asus-expertbook-p5405csa-1..patch
+perf-core-fix-perf_pmu_register-vs.-perf_init_event.patch
+cifs-fix-incorrect-validation-for-num_aces-field-of-.patch
+platform-x86-intel-hid-fix-volume-buttons-on-microso.patch
+platform-x86-intel-vsec-add-diamond-rapids-support.patch
+hid-i2c-hid-improve-i2c_hid_get_report-error-message.patch
+alsa-hda-realtek-add-support-for-asus-rog-strix-g614.patch
+alsa-hda-realtek-add-support-for-asus-zenbook-um3406.patch
+sched-deadline-use-online-cpus-for-validating-runtim.patch
+x86-hyperv-vtl-stop-kernel-from-probing-vtl0-low-mem.patch
+wifi-mac80211-flush-the-station-before-moving-it-to-.patch
+locking-semaphore-use-wake_q-to-wake-up-processes-ou.patch
+x86-hyperv-fix-output-argument-to-hypercall-that-cha.patch
+x86-sgx-warn-explicitly-if-x86_feature_sgx_lc-is-not.patch
+nvme-pci-fix-stuck-reset-on-concurrent-dpc-and-hp.patch
+drm-amd-keep-display-off-while-going-into-s4.patch
+alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch
+can-statistics-use-atomic-access-in-hot-path.patch
+memory-omap-gpmc-drop-no-compatible-check.patch
+hwmon-nct6775-core-fix-out-of-bounds-access-for-nct6.patch
+spufs-fix-a-leak-on-spufs_new_file-failure.patch
+spufs-fix-gang-directory-lifetimes.patch
+spufs-fix-a-leak-in-spufs_create_context.patch
+riscv-ftrace-add-parentheses-in-macro-definitions-of.patch
+ntb_hw_switchtec-fix-shift-out-of-bounds-in-switchte.patch
+ntb-intel-fix-using-link-status-db-s.patch
+firmware-cs_dsp-ensure-cs_dsp_load-_coeff-returns-0-.patch
+alsa-hda-realtek-fix-built-in-mic-breakage-on-asus-v.patch
+risc-v-errata-use-medany-for-relocatable-builds.patch
+x86-uaccess-improve-performance-by-aligning-writes-t.patch
+asoc-codecs-rt5665-fix-some-error-handling-paths-in-.patch
+riscv-fix-hugetlb-retrieval-of-number-of-ptes-in-cas.patch
+nvme-pci-skip-nvme_write_sq_db-on-empty-rqlist.patch
+asoc-imx-card-add-null-check-in-imx_card_probe.patch
+e1000e-change-k1-configuration-on-mtp-and-later-plat.patch
+netfilter-nft_set_hash-gc-reaps-elements-with-connco.patch
+netfilter-nf_tables-don-t-unregister-hook-when-table.patch
+netlabel-fix-null-pointer-exception-caused-by-calips.patch
+net_sched-skbprio-remove-overly-strict-queue-asserti.patch
+net-mvpp2-prevent-parser-tcam-memory-corruption.patch
+udp-fix-memory-accounting-leak.patch
+vsock-avoid-timeout-during-connect-if-the-socket-is-.patch
+tunnels-accept-packet_host-in-skb_tunnel_check_pmtu.patch
+net-decrease-cached-dst-counters-in-dst_release.patch
+netfilter-nft_tunnel-fix-geneve_opt-type-confusion-a.patch
+ipv6-fix-omitted-netlink-attributes-when-using-rtext.patch
+net-dsa-mv88e6xxx-propperly-shutdown-ppu-re-enable-t.patch
+net-fix-geneve_opt-length-integer-overflow.patch
+ipv6-start-path-selection-from-the-first-nexthop.patch
+ipv6-do-not-consider-link-down-nexthops-in-path-sele.patch
+arcnet-add-null-check-in-com20020pci_probe.patch
+net-ibmveth-make-veth_pool_store-stop-hanging.patch
diff --git a/queue-6.6/smack-dont-compile-ipv6-code-unless-ipv6-is-configur.patch b/queue-6.6/smack-dont-compile-ipv6-code-unless-ipv6-is-configur.patch
new file mode 100644
index 0000000000..c88e0e05a7
--- /dev/null
+++ b/queue-6.6/smack-dont-compile-ipv6-code-unless-ipv6-is-configur.patch
@@ -0,0 +1,133 @@
+From 1eee1b8473096cdaa6e1aaef1201f938518ddff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2025 19:36:42 +0300
+Subject: smack: dont compile ipv6 code unless ipv6 is configured
+
+From: Konstantin Andreev <andreev@swemel.ru>
+
+[ Upstream commit bfcf4004bcbce2cb674b4e8dbd31ce0891766bac ]
+
+I want to be sure that ipv6-specific code
+is not compiled in kernel binaries
+if ipv6 is not configured.
+
+[1] was getting rid of "unused variable" warning, but,
+with that, it also mandated compilation of a handful ipv6-
+specific functions in ipv4-only kernel configurations:
+
+smk_ipv6_localhost, smack_ipv6host_label, smk_ipv6_check.
+
+Their compiled bodies are likely to be removed by compiler
+from the resulting binary, but, to be on the safe side,
+I remove them from the compiler view.
+
+[1]
+Fixes: 00720f0e7f28 ("smack: avoid unused 'sip' variable warning")
+
+Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack.h     |  6 ++++++
+ security/smack/smack_lsm.c | 10 +++++++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/security/smack/smack.h b/security/smack/smack.h
+index 041688e5a77a3..5e4a3c3144dd9 100644
+--- a/security/smack/smack.h
++++ b/security/smack/smack.h
+@@ -152,6 +152,7 @@ struct smk_net4addr {
+ 	struct smack_known	*smk_label;	/* label */
+ };
+ 
++#if IS_ENABLED(CONFIG_IPV6)
+ /*
+  * An entry in the table identifying IPv6 hosts.
+  */
+@@ -162,7 +163,9 @@ struct smk_net6addr {
+ 	int			smk_masks;	/* mask size */
+ 	struct smack_known	*smk_label;	/* label */
+ };
++#endif /* CONFIG_IPV6 */
+ 
++#ifdef SMACK_IPV6_PORT_LABELING
+ /*
+  * An entry in the table identifying ports.
+  */
+@@ -175,6 +178,7 @@ struct smk_port_label {
+ 	short			smk_sock_type;	/* Socket type */
+ 	short			smk_can_reuse;
+ };
++#endif /* SMACK_IPV6_PORT_LABELING */
+ 
+ struct smack_known_list_elem {
+ 	struct list_head	list;
+@@ -314,7 +318,9 @@ extern struct smack_known smack_known_web;
+ extern struct mutex	smack_known_lock;
+ extern struct list_head smack_known_list;
+ extern struct list_head smk_net4addr_list;
++#if IS_ENABLED(CONFIG_IPV6)
+ extern struct list_head smk_net6addr_list;
++#endif /* CONFIG_IPV6 */
+ 
+ extern struct mutex     smack_onlycap_lock;
+ extern struct list_head smack_onlycap_list;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 4625674f0e95b..d272cf8160d53 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2476,6 +2476,7 @@ static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)
+ 	return NULL;
+ }
+ 
++#if IS_ENABLED(CONFIG_IPV6)
+ /*
+  * smk_ipv6_localhost - Check for local ipv6 host address
+  * @sip: the address
+@@ -2543,6 +2544,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip)
+ 
+ 	return NULL;
+ }
++#endif /* CONFIG_IPV6 */
+ 
+ /**
+  * smack_netlbl_add - Set the secattr on a socket
+@@ -2646,6 +2648,7 @@ static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)
+ 	return rc;
+ }
+ 
++#if IS_ENABLED(CONFIG_IPV6)
+ /**
+  * smk_ipv6_check - check Smack access
+  * @subject: subject Smack label
+@@ -2678,6 +2681,7 @@ static int smk_ipv6_check(struct smack_known *subject,
+ 	rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc);
+ 	return rc;
+ }
++#endif /* CONFIG_IPV6 */
+ 
+ #ifdef SMACK_IPV6_PORT_LABELING
+ /**
+@@ -3010,7 +3014,9 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
+ 		return 0;
+ 	if (addrlen < offsetofend(struct sockaddr, sa_family))
+ 		return 0;
+-	if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) {
++
++#if IS_ENABLED(CONFIG_IPV6)
++	if (sap->sa_family == AF_INET6) {
+ 		struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
+ 		struct smack_known *rsp = NULL;
+ 
+@@ -3030,6 +3036,8 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
+ 
+ 		return rc;
+ 	}
++#endif /* CONFIG_IPV6 */
++
+ 	if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in))
+ 		return 0;
+ 	rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap);
+-- 
+2.39.5
+
diff --git a/queue-6.6/smb-client-fix-netns-refcount-imbalance-causing-leak.patch b/queue-6.6/smb-client-fix-netns-refcount-imbalance-causing-leak.patch
new file mode 100644
index 0000000000..5efb44e73b
--- /dev/null
+++ b/queue-6.6/smb-client-fix-netns-refcount-imbalance-causing-leak.patch
@@ -0,0 +1,175 @@
+From 56f5185aa5cd3613eeed953d4d3cdfa81da1a824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 22:30:05 +0800
+Subject: smb: client: Fix netns refcount imbalance causing leaks and
+ use-after-free
+
+From: Wang Zhaolong <wangzhaolong1@huawei.com>
+
+[ Upstream commit 4e7f1644f2ac6d01dc584f6301c3b1d5aac4eaef ]
+
+Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network
+namespace.") attempted to fix a netns use-after-free issue by manually
+adjusting reference counts via sk->sk_net_refcnt and sock_inuse_add().
+
+However, a later commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock
+after rmmod") pointed out that the approach of manually setting
+sk->sk_net_refcnt in the first commit was technically incorrect, as
+sk->sk_net_refcnt should only be set for user sockets. It led to issues
+like TCP timers not being cleared properly on close. The second commit
+moved to a model of just holding an extra netns reference for
+server->ssocket using get_net(), and dropping it when the server is torn
+down.
+
+But there remain some gaps in the get_net()/put_net() balancing added by
+these commits. The incomplete reference handling in these fixes results
+in two issues:
+
+1. Netns refcount leaks[1]
+
+The problem process is as follows:
+
+```
+mount.cifs                        cifsd
+
+cifs_do_mount
+  cifs_mount
+    cifs_mount_get_session
+      cifs_get_tcp_session
+        get_net()  /* First get net. */
+        ip_connect
+          generic_ip_connect /* Try port 445 */
+            get_net()
+            ->connect() /* Failed */
+            put_net()
+          generic_ip_connect /* Try port 139 */
+            get_net() /* Missing matching put_net() for this get_net().*/
+      cifs_get_smb_ses
+        cifs_negotiate_protocol
+          smb2_negotiate
+            SMB2_negotiate
+              cifs_send_recv
+                wait_for_response
+                                 cifs_demultiplex_thread
+                                   cifs_read_from_socket
+                                     cifs_readv_from_socket
+                                       cifs_reconnect
+                                         cifs_abort_connection
+                                           sock_release();
+                                           server->ssocket = NULL;
+                                           /* Missing put_net() here. */
+                                           generic_ip_connect
+                                             get_net()
+                                             ->connect() /* Failed */
+                                             put_net()
+                                             sock_release();
+                                             server->ssocket = NULL;
+          free_rsp_buf
+    ...
+                                   clean_demultiplex_info
+                                     /* It's only called once here. */
+                                     put_net()
+```
+
+When cifs_reconnect() is triggered, the server->ssocket is released
+without a corresponding put_net() for the reference acquired in
+generic_ip_connect() before. it ends up calling generic_ip_connect()
+again to retry get_net(). After that, server->ssocket is set to NULL
+in the error path of generic_ip_connect(), and the net count cannot be
+released in the final clean_demultiplex_info() function.
+
+2. Potential use-after-free
+
+The current refcounting scheme can lead to a potential use-after-free issue
+in the following scenario:
+
+```
+ cifs_do_mount
+   cifs_mount
+     cifs_mount_get_session
+       cifs_get_tcp_session
+         get_net()  /* First get net */
+           ip_connect
+             generic_ip_connect
+               get_net()
+               bind_socket
+	         kernel_bind /* failed */
+               put_net()
+         /* after out_err_crypto_release label */
+         put_net()
+         /* after out_err label */
+         put_net()
+```
+
+In the exception handling process where binding the socket fails, the
+get_net() and put_net() calls are unbalanced, which may cause the
+server->net reference count to drop to zero and be prematurely released.
+
+To address both issues, this patch ties the netns reference counting to
+the server->ssocket and server lifecycles. The extra reference is now
+acquired when the server or socket is created, and released when the
+socket is destroyed or the server is torn down.
+
+[1]: https://bugzilla.kernel.org/show_bug.cgi?id=219792
+
+Fixes: ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.")
+Fixes: e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod")
+Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index 198681d14153e..2d2e41ac9e9d8 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -316,6 +316,7 @@ cifs_abort_connection(struct TCP_Server_Info *server)
+ 			 server->ssocket->flags);
+ 		sock_release(server->ssocket);
+ 		server->ssocket = NULL;
++		put_net(cifs_net_ns(server));
+ 	}
+ 	server->sequence_number = 0;
+ 	server->session_estab = false;
+@@ -3147,8 +3148,12 @@ generic_ip_connect(struct TCP_Server_Info *server)
+ 		/*
+ 		 * Grab netns reference for the socket.
+ 		 *
+-		 * It'll be released here, on error, or in clean_demultiplex_info() upon server
+-		 * teardown.
++		 * This reference will be released in several situations:
++		 * - In the failure path before the cifsd thread is started.
++		 * - In the all place where server->socket is released, it is
++		 *   also set to NULL.
++		 * - Ultimately in clean_demultiplex_info(), during the final
++		 *   teardown.
+ 		 */
+ 		get_net(net);
+ 
+@@ -3164,10 +3169,8 @@ generic_ip_connect(struct TCP_Server_Info *server)
+ 	}
+ 
+ 	rc = bind_socket(server);
+-	if (rc < 0) {
+-		put_net(cifs_net_ns(server));
++	if (rc < 0)
+ 		return rc;
+-	}
+ 
+ 	/*
+ 	 * Eventually check for other socket options to change from
+@@ -3213,9 +3216,6 @@ generic_ip_connect(struct TCP_Server_Info *server)
+ 	if (sport == htons(RFC1001_PORT))
+ 		rc = ip_rfc1001_connect(server);
+ 
+-	if (rc < 0)
+-		put_net(cifs_net_ns(server));
+-
+ 	return rc;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/soundwire-slave-fix-an-of-node-reference-leak-in-sou.patch b/queue-6.6/soundwire-slave-fix-an-of-node-reference-leak-in-sou.patch
new file mode 100644
index 0000000000..9b4292e12e
--- /dev/null
+++ b/queue-6.6/soundwire-slave-fix-an-of-node-reference-leak-in-sou.patch
@@ -0,0 +1,40 @@
+From fcaa9859556831912d6d2807bc2d31c6d3ef04df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 12:48:44 +0900
+Subject: soundwire: slave: fix an OF node reference leak in soundwire slave
+ device
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit aac2f8363f773ae1f65aab140e06e2084ac6b787 ]
+
+When initializing a soundwire slave device, an OF node is stored to the
+device with refcount incremented. However, the refcount is not
+decremented in .release(), thus call of_node_put() in
+sdw_slave_release().
+
+Fixes: a2e484585ad3 ("soundwire: core: add device tree support for slave devices")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20241205034844.2784964-1-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/slave.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soundwire/slave.c b/drivers/soundwire/slave.c
+index 060c2982e26b0..0aadfc2010287 100644
+--- a/drivers/soundwire/slave.c
++++ b/drivers/soundwire/slave.c
+@@ -12,6 +12,7 @@ static void sdw_slave_release(struct device *dev)
+ {
+ 	struct sdw_slave *slave = dev_to_sdw_dev(dev);
+ 
++	of_node_put(slave->dev.of_node);
+ 	mutex_destroy(&slave->sdw_dev_lock);
+ 	kfree(slave);
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/spufs-fix-a-leak-in-spufs_create_context.patch b/queue-6.6/spufs-fix-a-leak-in-spufs_create_context.patch
new file mode 100644
index 0000000000..0bc9ebc986
--- /dev/null
+++ b/queue-6.6/spufs-fix-a-leak-in-spufs_create_context.patch
@@ -0,0 +1,39 @@
+From 2d484cc5035d8360cc7fa34acf0770e238bef4bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 19:38:28 -0400
+Subject: spufs: fix a leak in spufs_create_context()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 0f5cce3fc55b08ee4da3372baccf4bcd36a98396 ]
+
+Leak fixes back in 2008 missed one case - if we are trying to set affinity
+and spufs_mkdir() fails, we need to drop the reference to neighbor.
+
+Fixes: 58119068cb27 "[POWERPC] spufs: Fix memory leak on SPU affinity"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/cell/spufs/inode.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index a0f297581a66c..3216245a648ae 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -459,8 +459,11 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
+ 	}
+ 
+ 	ret = spufs_mkdir(inode, dentry, flags, mode & 0777);
+-	if (ret)
++	if (ret) {
++		if (neighbor)
++			put_spu_context(neighbor);
+ 		goto out_aff_unlock;
++	}
+ 
+ 	if (affinity) {
+ 		spufs_set_affinity(flags, SPUFS_I(d_inode(dentry))->i_ctx,
+-- 
+2.39.5
+
diff --git a/queue-6.6/spufs-fix-a-leak-on-spufs_new_file-failure.patch b/queue-6.6/spufs-fix-a-leak-on-spufs_new_file-failure.patch
new file mode 100644
index 0000000000..1a17c3b427
--- /dev/null
+++ b/queue-6.6/spufs-fix-a-leak-on-spufs_new_file-failure.patch
@@ -0,0 +1,40 @@
+From 09798c981a7198c2e4ccf5270e6a7f93d0556543 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Mar 2025 19:26:31 -0500
+Subject: spufs: fix a leak on spufs_new_file() failure
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit d1ca8698ca1332625d83ea0d753747be66f9906d ]
+
+It's called from spufs_fill_dir(), and caller of that will do
+spufs_rmdir() in case of failure.  That does remove everything
+we'd managed to create, but... the problem dentry is still
+negative.  IOW, it needs to be explicitly dropped.
+
+Fixes: 3f51dd91c807 "[PATCH] spufs: fix spufs_fill_dir error path"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/cell/spufs/inode.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index 38c5be34c8951..8acefe5f654c9 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -191,8 +191,10 @@ static int spufs_fill_dir(struct dentry *dir,
+ 			return -ENOMEM;
+ 		ret = spufs_new_file(dir->d_sb, dentry, files->ops,
+ 					files->mode & mode, files->size, ctx);
+-		if (ret)
++		if (ret) {
++			dput(dentry);
+ 			return ret;
++		}
+ 		files++;
+ 	}
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/spufs-fix-gang-directory-lifetimes.patch b/queue-6.6/spufs-fix-gang-directory-lifetimes.patch
new file mode 100644
index 0000000000..c8f0bee55c
--- /dev/null
+++ b/queue-6.6/spufs-fix-gang-directory-lifetimes.patch
@@ -0,0 +1,195 @@
+From b62285c77dd3774dab48c35c57558bacfa18b1a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 19:18:39 -0400
+Subject: spufs: fix gang directory lifetimes
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit c134deabf4784e155d360744d4a6a835b9de4dd4 ]
+
+prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have
+a problem with gang lifetimes - creation of a gang returns opened
+gang directory, which normally gets removed when that gets closed,
+but if somebody has created a context belonging to that gang and
+kept it alive until the gang got closed, removal failed and we
+ended up with a leak.
+
+Unfortunately, it had been fixed the wrong way.  Dentry of gang
+directory was no longer pinned, and rmdir on close was gone.
+One problem was that failure of open kept calling simple_rmdir()
+as cleanup, which meant an unbalanced dput().  Another bug was
+in the success case - gang creation incremented link count on
+root directory, but that was no longer undone when gang got
+destroyed.
+
+Fix consists of
+	* reverting the commit in question
+	* adding a counter to gang, protected by ->i_rwsem
+of gang directory inode.
+	* having it set to 1 at creation time, dropped
+in both spufs_dir_close() and spufs_gang_close() and bumped
+in spufs_create_context(), provided that it's not 0.
+	* using simple_recursive_removal() to take the gang
+directory out when counter reaches zero.
+
+Fixes: 877907d37da9 "[POWERPC] spufs: Fix gang destroy leaks"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/cell/spufs/gang.c  |  1 +
+ arch/powerpc/platforms/cell/spufs/inode.c | 54 +++++++++++++++++++----
+ arch/powerpc/platforms/cell/spufs/spufs.h |  2 +
+ 3 files changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/platforms/cell/spufs/gang.c b/arch/powerpc/platforms/cell/spufs/gang.c
+index 827d338deaf4c..2c2999de6bfa2 100644
+--- a/arch/powerpc/platforms/cell/spufs/gang.c
++++ b/arch/powerpc/platforms/cell/spufs/gang.c
+@@ -25,6 +25,7 @@ struct spu_gang *alloc_spu_gang(void)
+ 	mutex_init(&gang->aff_mutex);
+ 	INIT_LIST_HEAD(&gang->list);
+ 	INIT_LIST_HEAD(&gang->aff_list_head);
++	gang->alive = 1;
+ 
+ out:
+ 	return gang;
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index 8acefe5f654c9..a0f297581a66c 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -200,6 +200,23 @@ static int spufs_fill_dir(struct dentry *dir,
+ 	return 0;
+ }
+ 
++static void unuse_gang(struct dentry *dir)
++{
++	struct inode *inode = dir->d_inode;
++	struct spu_gang *gang = SPUFS_I(inode)->i_gang;
++
++	if (gang) {
++		bool dead;
++
++		inode_lock(inode); // exclusion with spufs_create_context()
++		dead = !--gang->alive;
++		inode_unlock(inode);
++
++		if (dead)
++			simple_recursive_removal(dir, NULL);
++	}
++}
++
+ static int spufs_dir_close(struct inode *inode, struct file *file)
+ {
+ 	struct inode *parent;
+@@ -214,6 +231,7 @@ static int spufs_dir_close(struct inode *inode, struct file *file)
+ 	inode_unlock(parent);
+ 	WARN_ON(ret);
+ 
++	unuse_gang(dir->d_parent);
+ 	return dcache_dir_close(inode, file);
+ }
+ 
+@@ -406,7 +424,7 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
+ {
+ 	int ret;
+ 	int affinity;
+-	struct spu_gang *gang;
++	struct spu_gang *gang = SPUFS_I(inode)->i_gang;
+ 	struct spu_context *neighbor;
+ 	struct path path = {.mnt = mnt, .dentry = dentry};
+ 
+@@ -421,11 +439,15 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
+ 	if ((flags & SPU_CREATE_ISOLATE) && !isolated_loader)
+ 		return -ENODEV;
+ 
+-	gang = NULL;
++	if (gang) {
++		if (!gang->alive)
++			return -ENOENT;
++		gang->alive++;
++	}
++
+ 	neighbor = NULL;
+ 	affinity = flags & (SPU_CREATE_AFFINITY_MEM | SPU_CREATE_AFFINITY_SPU);
+ 	if (affinity) {
+-		gang = SPUFS_I(inode)->i_gang;
+ 		if (!gang)
+ 			return -EINVAL;
+ 		mutex_lock(&gang->aff_mutex);
+@@ -454,6 +476,8 @@ spufs_create_context(struct inode *inode, struct dentry *dentry,
+ out_aff_unlock:
+ 	if (affinity)
+ 		mutex_unlock(&gang->aff_mutex);
++	if (ret && gang)
++		gang->alive--; // can't reach 0
+ 	return ret;
+ }
+ 
+@@ -483,6 +507,7 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode)
+ 	inode->i_fop = &simple_dir_operations;
+ 
+ 	d_instantiate(dentry, inode);
++	dget(dentry);
+ 	inc_nlink(dir);
+ 	inc_nlink(d_inode(dentry));
+ 	return ret;
+@@ -493,6 +518,21 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode)
+ 	return ret;
+ }
+ 
++static int spufs_gang_close(struct inode *inode, struct file *file)
++{
++	unuse_gang(file->f_path.dentry);
++	return dcache_dir_close(inode, file);
++}
++
++static const struct file_operations spufs_gang_fops = {
++	.open		= dcache_dir_open,
++	.release	= spufs_gang_close,
++	.llseek		= dcache_dir_lseek,
++	.read		= generic_read_dir,
++	.iterate_shared	= dcache_readdir,
++	.fsync		= noop_fsync,
++};
++
+ static int spufs_gang_open(const struct path *path)
+ {
+ 	int ret;
+@@ -512,7 +552,7 @@ static int spufs_gang_open(const struct path *path)
+ 		return PTR_ERR(filp);
+ 	}
+ 
+-	filp->f_op = &simple_dir_operations;
++	filp->f_op = &spufs_gang_fops;
+ 	fd_install(ret, filp);
+ 	return ret;
+ }
+@@ -527,10 +567,8 @@ static int spufs_create_gang(struct inode *inode,
+ 	ret = spufs_mkgang(inode, dentry, mode & 0777);
+ 	if (!ret) {
+ 		ret = spufs_gang_open(&path);
+-		if (ret < 0) {
+-			int err = simple_rmdir(inode, dentry);
+-			WARN_ON(err);
+-		}
++		if (ret < 0)
++			unuse_gang(dentry);
+ 	}
+ 	return ret;
+ }
+diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h
+index 84958487f696a..d33787c57c39a 100644
+--- a/arch/powerpc/platforms/cell/spufs/spufs.h
++++ b/arch/powerpc/platforms/cell/spufs/spufs.h
+@@ -151,6 +151,8 @@ struct spu_gang {
+ 	int aff_flags;
+ 	struct spu *aff_ref_spu;
+ 	atomic_t aff_sched_count;
++
++	int alive;
+ };
+ 
+ /* Flag bits for spu_gang aff_flags */
+-- 
+2.39.5
+
diff --git a/queue-6.6/staging-rtl8723bs-select-config_crypto_lib_aes.patch b/queue-6.6/staging-rtl8723bs-select-config_crypto_lib_aes.patch
new file mode 100644
index 0000000000..84332820e5
--- /dev/null
+++ b/queue-6.6/staging-rtl8723bs-select-config_crypto_lib_aes.patch
@@ -0,0 +1,44 @@
+From dd0eae7574ec4ac8a395f26e5a6f9fe4d89edff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Feb 2025 19:36:17 +0000
+Subject: staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
+
+[ Upstream commit b2a9a6a26b7e954297e51822e396572026480bad ]
+
+This fixes the following issue:
+ERROR: modpost: "aes_expandkey" [drivers/staging/rtl8723bs/r8723bs.ko]
+undefined!
+ERROR: modpost: "aes_encrypt" [drivers/staging/rtl8723bs/r8723bs.ko]
+undefined!
+
+Fixes: 7d40753d8820 ("staging: rtl8723bs: use in-kernel aes encryption in OMAC1 routines")
+Fixes: 3d3a170f6d80 ("staging: rtl8723bs: use in-kernel aes encryption")
+Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/tencent_0BDDF3A721708D16A2E7C3DAFF0FEC79A105@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8723bs/Kconfig b/drivers/staging/rtl8723bs/Kconfig
+index f23e29b679fb5..14afcbbd61045 100644
+--- a/drivers/staging/rtl8723bs/Kconfig
++++ b/drivers/staging/rtl8723bs/Kconfig
+@@ -5,6 +5,7 @@ config RTL8723BS
+ 	depends on m
+ 	select CFG80211_WEXT
+ 	select CRYPTO
++	select CRYPTO_LIB_AES
+ 	select CRYPTO_LIB_ARC4
+ 	help
+ 	This option enables support for RTL8723BS SDIO drivers, such as
+-- 
+2.39.5
+
diff --git a/queue-6.6/thermal-int340x-add-null-check-for-adev.patch b/queue-6.6/thermal-int340x-add-null-check-for-adev.patch
new file mode 100644
index 0000000000..a9e8e3c3e0
--- /dev/null
+++ b/queue-6.6/thermal-int340x-add-null-check-for-adev.patch
@@ -0,0 +1,50 @@
+From 80bb92ab6da7235ed62f1316c8f62289e0e588b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Mar 2025 23:36:11 -0500
+Subject: thermal: int340x: Add NULL check for adev
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ]
+
+Not all devices have an ACPI companion fwnode, so adev might be NULL.
+This is similar to the commit cd2fd6eab480
+("platform/x86: int3472: Check for adev == NULL").
+
+Add a check for adev not being set and return -ENODEV in that case to
+avoid a possible NULL pointer deref in int3402_thermal_probe().
+
+Note, under the same directory, int3400_thermal_probe() has such a
+check.
+
+Fixes: 77e337c6e23e ("Thermal: introduce INT3402 thermal driver")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://patch.msgid.link/20250313043611.1212116-1-chenyuan0y@gmail.com
+[ rjw: Subject edit, added Fixes: ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c
+index 43fa351e2b9ec..b7fdf25bfd237 100644
+--- a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c
++++ b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c
+@@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev)
+ 	struct int3402_thermal_data *d;
+ 	int ret;
+ 
++	if (!adev)
++		return -ENODEV;
++
+ 	if (!acpi_has_method(adev->handle, "_TMP"))
+ 		return -ENODEV;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/tty-n_tty-use-uint-for-space-returned-by-tty_write_r.patch b/queue-6.6/tty-n_tty-use-uint-for-space-returned-by-tty_write_r.patch
new file mode 100644
index 0000000000..9e78d1d265
--- /dev/null
+++ b/queue-6.6/tty-n_tty-use-uint-for-space-returned-by-tty_write_r.patch
@@ -0,0 +1,85 @@
+From 2661347bb84e73b9162544f4cad006306915504b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 08:00:20 +0100
+Subject: tty: n_tty: use uint for space returned by tty_write_room()
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+[ Upstream commit d97aa066678bd1e2951ee93db9690835dfe57ab6 ]
+
+tty_write_room() returns an "unsigned int". So in case some insane
+driver (like my tty test driver) returns (legitimate) UINT_MAX from its
+tty_operations::write_room(), n_tty is confused on several places.
+
+For example, in process_output_block(), the result of tty_write_room()
+is stored into (signed) "int". So this UINT_MAX suddenly becomes -1. And
+that is extended to ssize_t and returned from process_output_block().
+This causes a write() to such a node to receive -EPERM (which is -1).
+
+Fix that by using proper "unsigned int" and proper "== 0" test. And
+return 0 constant directly in that "if", so that it is immediately clear
+what is returned ("space" equals to 0 at that point).
+
+Similarly for process_output() and __process_echoes().
+
+Note this does not fix any in-tree driver as of now.
+
+If you want "Fixes: something", it would be commit 03b3b1a2405c ("tty:
+make tty_operations::write_room return uint"). I intentionally do not
+mark this patch by a real tag below.
+
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250317070046.24386-6-jirislaby@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_tty.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index e05341b85c599..788035f0c1ab2 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -491,7 +491,8 @@ static int do_output_char(u8 c, struct tty_struct *tty, int space)
+ static int process_output(u8 c, struct tty_struct *tty)
+ {
+ 	struct n_tty_data *ldata = tty->disc_data;
+-	int	space, retval;
++	unsigned int space;
++	int retval;
+ 
+ 	mutex_lock(&ldata->output_lock);
+ 
+@@ -527,16 +528,16 @@ static ssize_t process_output_block(struct tty_struct *tty,
+ 				    const u8 *buf, unsigned int nr)
+ {
+ 	struct n_tty_data *ldata = tty->disc_data;
+-	int	space;
+-	int	i;
++	unsigned int space;
++	int i;
+ 	const u8 *cp;
+ 
+ 	mutex_lock(&ldata->output_lock);
+ 
+ 	space = tty_write_room(tty);
+-	if (space <= 0) {
++	if (space == 0) {
+ 		mutex_unlock(&ldata->output_lock);
+-		return space;
++		return 0;
+ 	}
+ 	if (nr > space)
+ 		nr = space;
+@@ -701,7 +702,7 @@ static int n_tty_process_echo_ops(struct tty_struct *tty, size_t *tail,
+ static size_t __process_echoes(struct tty_struct *tty)
+ {
+ 	struct n_tty_data *ldata = tty->disc_data;
+-	int	space, old_space;
++	unsigned int space, old_space;
+ 	size_t tail;
+ 	u8 c;
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/tunnels-accept-packet_host-in-skb_tunnel_check_pmtu.patch b/queue-6.6/tunnels-accept-packet_host-in-skb_tunnel_check_pmtu.patch
new file mode 100644
index 0000000000..65bde25d55
--- /dev/null
+++ b/queue-6.6/tunnels-accept-packet_host-in-skb_tunnel_check_pmtu.patch
@@ -0,0 +1,83 @@
+From f6ca0e3ffbd0eb0f3d3e9e1f048e6a16ea18146c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Mar 2025 01:33:44 +0100
+Subject: tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
+
+From: Guillaume Nault <gnault@redhat.com>
+
+[ Upstream commit 8930424777e43257f5bf6f0f0f53defd0d30415c ]
+
+Because skb_tunnel_check_pmtu() doesn't handle PACKET_HOST packets,
+commit 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper
+pmtud support.") forced skb->pkt_type to PACKET_OUTGOING for
+openvswitch packets that are sent using the OVS_ACTION_ATTR_OUTPUT
+action. This allowed such packets to invoke the
+iptunnel_pmtud_check_icmp() or iptunnel_pmtud_check_icmpv6() helpers
+and thus trigger PMTU update on the input device.
+
+However, this also broke other parts of PMTU discovery. Since these
+packets don't have the PACKET_HOST type anymore, they won't trigger the
+sending of ICMP Fragmentation Needed or Packet Too Big messages to
+remote hosts when oversized (see the skb_in->pkt_type condition in
+__icmp_send() for example).
+
+These two skb->pkt_type checks are therefore incompatible as one
+requires skb->pkt_type to be PACKET_HOST, while the other requires it
+to be anything but PACKET_HOST.
+
+It makes sense to not trigger ICMP messages for non-PACKET_HOST packets
+as these messages should be generated only for incoming l2-unicast
+packets. However there doesn't seem to be any reason for
+skb_tunnel_check_pmtu() to ignore PACKET_HOST packets.
+
+Allow both cases to work by allowing skb_tunnel_check_pmtu() to work on
+PACKET_HOST packets and not overriding skb->pkt_type in openvswitch
+anymore.
+
+Fixes: 30a92c9e3d6b ("openvswitch: Set the skbuff pkt_type for proper pmtud support.")
+Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Reviewed-by: Aaron Conole <aconole@redhat.com>
+Tested-by: Aaron Conole <aconole@redhat.com>
+Link: https://patch.msgid.link/eac941652b86fddf8909df9b3bf0d97bc9444793.1743208264.git.gnault@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel_core.c | 2 +-
+ net/openvswitch/actions.c | 6 ------
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
+index 80ccd6661aa32..fda08e2c72899 100644
+--- a/net/ipv4/ip_tunnel_core.c
++++ b/net/ipv4/ip_tunnel_core.c
+@@ -415,7 +415,7 @@ int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
+ 
+ 	skb_dst_update_pmtu_no_confirm(skb, mtu);
+ 
+-	if (!reply || skb->pkt_type == PACKET_HOST)
++	if (!reply)
+ 		return 0;
+ 
+ 	if (skb->protocol == htons(ETH_P_IP))
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 9445ca97163b4..6c5afb4ad67bb 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -931,12 +931,6 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,
+ 				pskb_trim(skb, ovs_mac_header_len(key));
+ 		}
+ 
+-		/* Need to set the pkt_type to involve the routing layer.  The
+-		 * packet movement through the OVS datapath doesn't generally
+-		 * use routing, but this is needed for tunnel cases.
+-		 */
+-		skb->pkt_type = PACKET_OUTGOING;
+-
+ 		if (likely(!mru ||
+ 		           (skb->len <= mru + vport->dev->hard_header_len))) {
+ 			ovs_vport_send(vport, skb, ovs_key_mac_proto(key));
+-- 
+2.39.5
+
diff --git a/queue-6.6/ucsi_ccg-don-t-show-failed-to-get-fw-build-informati.patch b/queue-6.6/ucsi_ccg-don-t-show-failed-to-get-fw-build-informati.patch
new file mode 100644
index 0000000000..956f259e27
--- /dev/null
+++ b/queue-6.6/ucsi_ccg-don-t-show-failed-to-get-fw-build-informati.patch
@@ -0,0 +1,47 @@
+From c93e09645b48cd7de6101ba856cb9c7a0755bdf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 23:40:03 -0600
+Subject: ucsi_ccg: Don't show failed to get FW build information error
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit c16006852732dc4fe37c14b81f9b4458df05b832 ]
+
+The error `failed to get FW build information` is added for what looks
+to be for misdetection of the device property firmware-name.
+
+If the property is missing (such as on non-nvidia HW) this error shows up.
+Move the error into the scope of the property parser for "firmware-name"
+to avoid showing errors on systems without the firmware-name property.
+
+Fixes: 5c9ae5a87573d ("usb: typec: ucsi: ccg: add firmware flashing support")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250221054137.1631765-2-superm1@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi_ccg.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
+index cf3c8e552defe..7c7f388aac96b 100644
+--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
+@@ -1366,11 +1366,10 @@ static int ucsi_ccg_probe(struct i2c_client *client)
+ 			uc->fw_build = CCG_FW_BUILD_NVIDIA_TEGRA;
+ 		else if (!strcmp(fw_name, "nvidia,gpu"))
+ 			uc->fw_build = CCG_FW_BUILD_NVIDIA;
++		if (!uc->fw_build)
++			dev_err(uc->dev, "failed to get FW build information\n");
+ 	}
+ 
+-	if (!uc->fw_build)
+-		dev_err(uc->dev, "failed to get FW build information\n");
+-
+ 	/* reset ccg device and initialize ucsi */
+ 	status = ucsi_ccg_init(uc);
+ 	if (status < 0) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/udp-fix-memory-accounting-leak.patch b/queue-6.6/udp-fix-memory-accounting-leak.patch
new file mode 100644
index 0000000000..c4a9444151
--- /dev/null
+++ b/queue-6.6/udp-fix-memory-accounting-leak.patch
@@ -0,0 +1,171 @@
+From 876886f822fabe334d854628a514f423a00d0b91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 11:44:43 -0700
+Subject: udp: Fix memory accounting leak.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit df207de9d9e7a4d92f8567e2c539d9c8c12fd99d ]
+
+Matt Dowling reported a weird UDP memory usage issue.
+
+Under normal operation, the UDP memory usage reported in /proc/net/sockstat
+remains close to zero.  However, it occasionally spiked to 524,288 pages
+and never dropped.  Moreover, the value doubled when the application was
+terminated.  Finally, it caused intermittent packet drops.
+
+We can reproduce the issue with the script below [0]:
+
+  1. /proc/net/sockstat reports 0 pages
+
+    # cat /proc/net/sockstat | grep UDP:
+    UDP: inuse 1 mem 0
+
+  2. Run the script till the report reaches 524,288
+
+    # python3 test.py & sleep 5
+    # cat /proc/net/sockstat | grep UDP:
+    UDP: inuse 3 mem 524288  <-- (INT_MAX + 1) >> PAGE_SHIFT
+
+  3. Kill the socket and confirm the number never drops
+
+    # pkill python3 && sleep 5
+    # cat /proc/net/sockstat | grep UDP:
+    UDP: inuse 1 mem 524288
+
+  4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()
+
+    # python3 test.py & sleep 1 && pkill python3
+
+  5. The number doubles
+
+    # cat /proc/net/sockstat | grep UDP:
+    UDP: inuse 1 mem 1048577
+
+The application set INT_MAX to SO_RCVBUF, which triggered an integer
+overflow in udp_rmem_release().
+
+When a socket is close()d, udp_destruct_common() purges its receive
+queue and sums up skb->truesize in the queue.  This total is calculated
+and stored in a local unsigned integer variable.
+
+The total size is then passed to udp_rmem_release() to adjust memory
+accounting.  However, because the function takes a signed integer
+argument, the total size can wrap around, causing an overflow.
+
+Then, the released amount is calculated as follows:
+
+  1) Add size to sk->sk_forward_alloc.
+  2) Round down sk->sk_forward_alloc to the nearest lower multiple of
+      PAGE_SIZE and assign it to amount.
+  3) Subtract amount from sk->sk_forward_alloc.
+  4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().
+
+When the issue occurred, the total in udp_destruct_common() was 2147484480
+(INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().
+
+At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and
+2) sets -2147479552 to amount.  3) reverts the wraparound, so we don't
+see a warning in inet_sock_destruct().  However, udp_memory_allocated
+ends up doubling at 4).
+
+Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for
+memory_allocated"), memory usage no longer doubles immediately after
+a socket is close()d because __sk_mem_reduce_allocated() caches the
+amount in udp_memory_per_cpu_fw_alloc.  However, the next time a UDP
+socket receives a packet, the subtraction takes effect, causing UDP
+memory usage to double.
+
+This issue makes further memory allocation fail once the socket's
+sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet
+drops.
+
+To prevent this issue, let's use unsigned int for the calculation and
+call sk_forward_alloc_add() only once for the small delta.
+
+Note that first_packet_length() also potentially has the same problem.
+
+[0]:
+from socket import *
+
+SO_RCVBUFFORCE = 33
+INT_MAX = (2 ** 31) - 1
+
+s = socket(AF_INET, SOCK_DGRAM)
+s.bind(('', 0))
+s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)
+
+c = socket(AF_INET, SOCK_DGRAM)
+c.connect(s.getsockname())
+
+data = b'a' * 100
+
+while True:
+    c.send(data)
+
+Fixes: f970bd9e3a06 ("udp: implement memory accounting helpers")
+Reported-by: Matt Dowling <madowlin@amazon.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20250401184501.67377-3-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index b84d18fcd9e2c..dc91699ce0328 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1412,12 +1412,12 @@ static bool udp_skb_has_head_state(struct sk_buff *skb)
+ }
+ 
+ /* fully reclaim rmem/fwd memory allocated for skb */
+-static void udp_rmem_release(struct sock *sk, int size, int partial,
+-			     bool rx_queue_lock_held)
++static void udp_rmem_release(struct sock *sk, unsigned int size,
++			     int partial, bool rx_queue_lock_held)
+ {
+ 	struct udp_sock *up = udp_sk(sk);
+ 	struct sk_buff_head *sk_queue;
+-	int amt;
++	unsigned int amt;
+ 
+ 	if (likely(partial)) {
+ 		up->forward_deficit += size;
+@@ -1437,10 +1437,8 @@ static void udp_rmem_release(struct sock *sk, int size, int partial,
+ 	if (!rx_queue_lock_held)
+ 		spin_lock(&sk_queue->lock);
+ 
+-
+-	sk_forward_alloc_add(sk, size);
+-	amt = (sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1);
+-	sk_forward_alloc_add(sk, -amt);
++	amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1);
++	sk_forward_alloc_add(sk, size - amt);
+ 
+ 	if (amt)
+ 		__sk_mem_reduce_allocated(sk, amt >> PAGE_SHIFT);
+@@ -1630,7 +1628,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp);
+ 
+ static struct sk_buff *__first_packet_length(struct sock *sk,
+ 					     struct sk_buff_head *rcvq,
+-					     int *total)
++					     unsigned int *total)
+ {
+ 	struct sk_buff *skb;
+ 
+@@ -1663,8 +1661,8 @@ static int first_packet_length(struct sock *sk)
+ {
+ 	struct sk_buff_head *rcvq = &udp_sk(sk)->reader_queue;
+ 	struct sk_buff_head *sk_queue = &sk->sk_receive_queue;
++	unsigned int total = 0;
+ 	struct sk_buff *skb;
+-	int total = 0;
+ 	int res;
+ 
+ 	spin_lock_bh(&rcvq->lock);
+-- 
+2.39.5
+
diff --git a/queue-6.6/um-hostfs-avoid-issues-on-inode-number-reuse-by-host.patch b/queue-6.6/um-hostfs-avoid-issues-on-inode-number-reuse-by-host.patch
new file mode 100644
index 0000000000..51d6c7d152
--- /dev/null
+++ b/queue-6.6/um-hostfs-avoid-issues-on-inode-number-reuse-by-host.patch
@@ -0,0 +1,172 @@
+From 2eda0cb69930b665e1ec88fca4e3a96debe1c51c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 10:28:22 +0100
+Subject: um: hostfs: avoid issues on inode number reuse by host
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 0bc754d1e31f40f4a343b692096d9e092ccc0370 ]
+
+Some file systems (e.g. ext4) may reuse inode numbers once the inode is
+not in use anymore. Usually hostfs will keep an FD open for each inode,
+but this is not always the case. In the case of sockets, this cannot
+even be done properly.
+
+As such, the following sequence of events was possible:
+ * application creates and deletes a socket
+ * hostfs creates/deletes the socket on the host
+ * inode is still in the hostfs cache
+ * hostfs creates a new file
+ * ext4 on the outside reuses the inode number
+ * hostfs finds the socket inode for the newly created file
+ * application receives -ENXIO when opening the file
+
+As mentioned, this can only happen if the deleted file is a special file
+that is never opened on the host (i.e. no .open fop).
+
+As such, to prevent issues, it is sufficient to check that the inode
+has the expected type. That said, also add a check for the inode birth
+time, just to be on the safe side.
+
+Fixes: 74ce793bcbde ("hostfs: Fix ephemeral inodes")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Reviewed-by: Mickaël Salaün <mic@digikod.net>
+Tested-by: Mickaël Salaün <mic@digikod.net>
+Link: https://patch.msgid.link/20250214092822.1241575-1-benjamin@sipsolutions.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hostfs/hostfs.h      |  2 +-
+ fs/hostfs/hostfs_kern.c |  7 ++++-
+ fs/hostfs/hostfs_user.c | 59 ++++++++++++++++++++++++-----------------
+ 3 files changed, 41 insertions(+), 27 deletions(-)
+
+diff --git a/fs/hostfs/hostfs.h b/fs/hostfs/hostfs.h
+index 8b39c15c408cc..15b2f094d36ef 100644
+--- a/fs/hostfs/hostfs.h
++++ b/fs/hostfs/hostfs.h
+@@ -60,7 +60,7 @@ struct hostfs_stat {
+ 	unsigned int uid;
+ 	unsigned int gid;
+ 	unsigned long long size;
+-	struct hostfs_timespec atime, mtime, ctime;
++	struct hostfs_timespec atime, mtime, ctime, btime;
+ 	unsigned int blksize;
+ 	unsigned long long blocks;
+ 	struct {
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index ff201753fd181..44fe76174e122 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -27,6 +27,7 @@ struct hostfs_inode_info {
+ 	struct inode vfs_inode;
+ 	struct mutex open_mutex;
+ 	dev_t dev;
++	struct hostfs_timespec btime;
+ };
+ 
+ static inline struct hostfs_inode_info *HOSTFS_I(struct inode *inode)
+@@ -557,6 +558,7 @@ static int hostfs_inode_set(struct inode *ino, void *data)
+ 	}
+ 
+ 	HOSTFS_I(ino)->dev = dev;
++	HOSTFS_I(ino)->btime = st->btime;
+ 	ino->i_ino = st->ino;
+ 	ino->i_mode = st->mode;
+ 	return hostfs_inode_update(ino, st);
+@@ -567,7 +569,10 @@ static int hostfs_inode_test(struct inode *inode, void *data)
+ 	const struct hostfs_stat *st = data;
+ 	dev_t dev = MKDEV(st->dev.maj, st->dev.min);
+ 
+-	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev;
++	return inode->i_ino == st->ino && HOSTFS_I(inode)->dev == dev &&
++	       (inode->i_mode & S_IFMT) == (st->mode & S_IFMT) &&
++	       HOSTFS_I(inode)->btime.tv_sec == st->btime.tv_sec &&
++	       HOSTFS_I(inode)->btime.tv_nsec == st->btime.tv_nsec;
+ }
+ 
+ static struct inode *hostfs_iget(struct super_block *sb, char *name)
+diff --git a/fs/hostfs/hostfs_user.c b/fs/hostfs/hostfs_user.c
+index 97e9c40a94488..3bcd9f35e70b2 100644
+--- a/fs/hostfs/hostfs_user.c
++++ b/fs/hostfs/hostfs_user.c
+@@ -18,39 +18,48 @@
+ #include "hostfs.h"
+ #include <utime.h>
+ 
+-static void stat64_to_hostfs(const struct stat64 *buf, struct hostfs_stat *p)
++static void statx_to_hostfs(const struct statx *buf, struct hostfs_stat *p)
+ {
+-	p->ino = buf->st_ino;
+-	p->mode = buf->st_mode;
+-	p->nlink = buf->st_nlink;
+-	p->uid = buf->st_uid;
+-	p->gid = buf->st_gid;
+-	p->size = buf->st_size;
+-	p->atime.tv_sec = buf->st_atime;
+-	p->atime.tv_nsec = 0;
+-	p->ctime.tv_sec = buf->st_ctime;
+-	p->ctime.tv_nsec = 0;
+-	p->mtime.tv_sec = buf->st_mtime;
+-	p->mtime.tv_nsec = 0;
+-	p->blksize = buf->st_blksize;
+-	p->blocks = buf->st_blocks;
+-	p->rdev.maj = os_major(buf->st_rdev);
+-	p->rdev.min = os_minor(buf->st_rdev);
+-	p->dev.maj = os_major(buf->st_dev);
+-	p->dev.min = os_minor(buf->st_dev);
++	p->ino = buf->stx_ino;
++	p->mode = buf->stx_mode;
++	p->nlink = buf->stx_nlink;
++	p->uid = buf->stx_uid;
++	p->gid = buf->stx_gid;
++	p->size = buf->stx_size;
++	p->atime.tv_sec = buf->stx_atime.tv_sec;
++	p->atime.tv_nsec = buf->stx_atime.tv_nsec;
++	p->ctime.tv_sec = buf->stx_ctime.tv_sec;
++	p->ctime.tv_nsec = buf->stx_ctime.tv_nsec;
++	p->mtime.tv_sec = buf->stx_mtime.tv_sec;
++	p->mtime.tv_nsec = buf->stx_mtime.tv_nsec;
++	if (buf->stx_mask & STATX_BTIME) {
++		p->btime.tv_sec = buf->stx_btime.tv_sec;
++		p->btime.tv_nsec = buf->stx_btime.tv_nsec;
++	} else {
++		memset(&p->btime, 0, sizeof(p->btime));
++	}
++	p->blksize = buf->stx_blksize;
++	p->blocks = buf->stx_blocks;
++	p->rdev.maj = buf->stx_rdev_major;
++	p->rdev.min = buf->stx_rdev_minor;
++	p->dev.maj = buf->stx_dev_major;
++	p->dev.min = buf->stx_dev_minor;
+ }
+ 
+ int stat_file(const char *path, struct hostfs_stat *p, int fd)
+ {
+-	struct stat64 buf;
++	struct statx buf;
++	int flags = AT_SYMLINK_NOFOLLOW;
+ 
+ 	if (fd >= 0) {
+-		if (fstat64(fd, &buf) < 0)
+-			return -errno;
+-	} else if (lstat64(path, &buf) < 0) {
+-		return -errno;
++		flags |= AT_EMPTY_PATH;
++		path = "";
+ 	}
+-	stat64_to_hostfs(&buf, p);
++
++	if ((statx(fd, path, flags, STATX_BASIC_STATS | STATX_BTIME, &buf)) < 0)
++		return -errno;
++
++	statx_to_hostfs(&buf, p);
+ 	return 0;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/um-remove-copy_from_kernel_nofault_allowed.patch b/queue-6.6/um-remove-copy_from_kernel_nofault_allowed.patch
new file mode 100644
index 0000000000..7b785c1a02
--- /dev/null
+++ b/queue-6.6/um-remove-copy_from_kernel_nofault_allowed.patch
@@ -0,0 +1,144 @@
+From 0491e184a41adfcdc2152134e6fa7ab0d381b0b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 17:09:26 +0100
+Subject: um: remove copy_from_kernel_nofault_allowed
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 84a6fc378471fbeaf48f8604566a5a33a3d63c18 ]
+
+There is no need to override the default version of this function
+anymore as UML now has proper _nofault memory access functions.
+
+Doing this also fixes the fact that the implementation was incorrect as
+using mincore() will incorrectly flag pages as inaccessible if they were
+swapped out by the host.
+
+Fixes: f75b1b1bedfb ("um: Implement probe_kernel_read()")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://patch.msgid.link/20250210160926.420133-3-benjamin@sipsolutions.net
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/shared/os.h |  1 -
+ arch/um/kernel/Makefile     |  2 +-
+ arch/um/kernel/maccess.c    | 19 --------------
+ arch/um/os-Linux/process.c  | 51 -------------------------------------
+ 4 files changed, 1 insertion(+), 72 deletions(-)
+ delete mode 100644 arch/um/kernel/maccess.c
+
+diff --git a/arch/um/include/shared/os.h b/arch/um/include/shared/os.h
+index 0df646c6651ea..3b382da2996f0 100644
+--- a/arch/um/include/shared/os.h
++++ b/arch/um/include/shared/os.h
+@@ -211,7 +211,6 @@ extern int os_protect_memory(void *addr, unsigned long len,
+ extern int os_unmap_memory(void *addr, int len);
+ extern int os_drop_memory(void *addr, int length);
+ extern int can_drop_memory(void);
+-extern int os_mincore(void *addr, unsigned long len);
+ 
+ /* execvp.c */
+ extern int execvp_noalloc(char *buf, const char *file, char *const argv[]);
+diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
+index 811188be954ca..321250f3f5703 100644
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -17,7 +17,7 @@ extra-y := vmlinux.lds
+ obj-y = config.o exec.o exitcode.o irq.o ksyms.o mem.o \
+ 	physmem.o process.o ptrace.o reboot.o sigio.o \
+ 	signal.o sysrq.o time.o tlb.o trap.o \
+-	um_arch.o umid.o maccess.o kmsg_dump.o capflags.o skas/
++	um_arch.o umid.o kmsg_dump.o capflags.o skas/
+ obj-y += load_file.o
+ 
+ obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
+diff --git a/arch/um/kernel/maccess.c b/arch/um/kernel/maccess.c
+deleted file mode 100644
+index 8ccd56813f684..0000000000000
+--- a/arch/um/kernel/maccess.c
++++ /dev/null
+@@ -1,19 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * Copyright (C) 2013 Richard Weinberger <richrd@nod.at>
+- */
+-
+-#include <linux/uaccess.h>
+-#include <linux/kernel.h>
+-#include <os.h>
+-
+-bool copy_from_kernel_nofault_allowed(const void *src, size_t size)
+-{
+-	void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
+-
+-	if ((unsigned long)src < PAGE_SIZE || size <= 0)
+-		return false;
+-	if (os_mincore(psrc, size + src - psrc) <= 0)
+-		return false;
+-	return true;
+-}
+diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
+index e52dd37ddadcc..2686120ab2325 100644
+--- a/arch/um/os-Linux/process.c
++++ b/arch/um/os-Linux/process.c
+@@ -223,57 +223,6 @@ int __init can_drop_memory(void)
+ 	return ok;
+ }
+ 
+-static int os_page_mincore(void *addr)
+-{
+-	char vec[2];
+-	int ret;
+-
+-	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
+-	if (ret < 0) {
+-		if (errno == ENOMEM || errno == EINVAL)
+-			return 0;
+-		else
+-			return -errno;
+-	}
+-
+-	return vec[0] & 1;
+-}
+-
+-int os_mincore(void *addr, unsigned long len)
+-{
+-	char *vec;
+-	int ret, i;
+-
+-	if (len <= UM_KERN_PAGE_SIZE)
+-		return os_page_mincore(addr);
+-
+-	vec = calloc(1, (len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE);
+-	if (!vec)
+-		return -ENOMEM;
+-
+-	ret = mincore(addr, UM_KERN_PAGE_SIZE, vec);
+-	if (ret < 0) {
+-		if (errno == ENOMEM || errno == EINVAL)
+-			ret = 0;
+-		else
+-			ret = -errno;
+-
+-		goto out;
+-	}
+-
+-	for (i = 0; i < ((len + UM_KERN_PAGE_SIZE - 1) / UM_KERN_PAGE_SIZE); i++) {
+-		if (!(vec[i] & 1)) {
+-			ret = 0;
+-			goto out;
+-		}
+-	}
+-
+-	ret = 1;
+-out:
+-	free(vec);
+-	return ret;
+-}
+-
+ void init_new_thread_signals(void)
+ {
+ 	set_handler(SIGSEGV);
+-- 
+2.39.5
+
diff --git a/queue-6.6/usb-xhci-correct-debug-message-page-size-calculation.patch b/queue-6.6/usb-xhci-correct-debug-message-page-size-calculation.patch
new file mode 100644
index 0000000000..46e2bd4c97
--- /dev/null
+++ b/queue-6.6/usb-xhci-correct-debug-message-page-size-calculation.patch
@@ -0,0 +1,52 @@
+From 5fef5a5aa26ab050a3230edde0e7ca618322036d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 16:49:47 +0200
+Subject: usb: xhci: correct debug message page size calculation
+
+From: Niklas Neronin <niklas.neronin@linux.intel.com>
+
+[ Upstream commit 55741c723318905e6d5161bf1e12749020b161e3 ]
+
+The ffs() function returns the index of the first set bit, starting from 1.
+If no bits are set, it returns zero. This behavior causes an off-by-one
+page size in the debug message, as the page size calculation [1]
+is zero-based, while ffs() is one-based.
+
+Fix this by subtracting one from the result of ffs(). Note that since
+variable 'val' is unsigned, subtracting one from zero will result in the
+maximum unsigned integer value. Consequently, the condition 'if (val < 16)'
+will still function correctly.
+
+[1], Page size: (2^(n+12)), where 'n' is the set page size bit.
+
+Fixes: 81720ec5320c ("usb: host: xhci: use ffs() in xhci_mem_init()")
+Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250306144954.3507700-9-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mem.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index b0137eac7ab38..fbc486546b853 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -2318,10 +2318,10 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+ 	page_size = readl(&xhci->op_regs->page_size);
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ 			"Supported page size register = 0x%x", page_size);
+-	i = ffs(page_size);
+-	if (i < 16)
++	val = ffs(page_size) - 1;
++	if (val < 16)
+ 		xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+-			"Supported page size of %iK", (1 << (i+12)) / 1024);
++			"Supported page size of %iK", (1 << (val + 12)) / 1024);
+ 	else
+ 		xhci_warn(xhci, "WARN: no supported page size\n");
+ 	/* Use 4K pages, since that's common and the minimum the HC supports */
+-- 
+2.39.5
+
diff --git a/queue-6.6/vhost-scsi-fix-handling-of-multiple-calls-to-vhost_s.patch b/queue-6.6/vhost-scsi-fix-handling-of-multiple-calls-to-vhost_s.patch
new file mode 100644
index 0000000000..f8ad3e9291
--- /dev/null
+++ b/queue-6.6/vhost-scsi-fix-handling-of-multiple-calls-to-vhost_s.patch
@@ -0,0 +1,176 @@
+From ba5144021ead7ead0935b31726813e7fdb1182e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2025 15:09:22 -0600
+Subject: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ]
+
+If vhost_scsi_set_endpoint is called multiple times without a
+vhost_scsi_clear_endpoint between them, we can hit multiple bugs
+found by Haoran Zhang:
+
+1. Use-after-free when no tpgs are found:
+
+This fixes a use after free that occurs when vhost_scsi_set_endpoint is
+called more than once and calls after the first call do not find any
+tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds
+tpgs to add to the vs_tpg array match=true, so we will do:
+
+vhost_vq_set_backend(vq, vs_tpg);
+...
+
+kfree(vs->vs_tpg);
+vs->vs_tpg = vs_tpg;
+
+If vhost_scsi_set_endpoint is called again and no tpgs are found
+match=false so we skip the vhost_vq_set_backend call leaving the
+pointer to the vs_tpg we then free via:
+
+kfree(vs->vs_tpg);
+vs->vs_tpg = vs_tpg;
+
+If a scsi request is then sent we do:
+
+vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend
+
+which sees the vs_tpg we just did a kfree on.
+
+2. Tpg dir removal hang:
+
+This patch fixes an issue where we cannot remove a LIO/target layer
+tpg (and structs above it like the target) dir due to the refcount
+dropping to -1.
+
+The problem is that if vhost_scsi_set_endpoint detects a tpg is already
+in the vs->vs_tpg array or if the tpg has been removed so
+target_depend_item fails, the undepend goto handler will do
+target_undepend_item on all tpgs in the vs_tpg array dropping their
+refcount to 0. At this time vs_tpg contains both the tpgs we have added
+in the current vhost_scsi_set_endpoint call as well as tpgs we added in
+previous calls which are also in vs->vs_tpg.
+
+Later, when vhost_scsi_clear_endpoint runs it will do
+target_undepend_item on all the tpgs in the vs->vs_tpg which will drop
+their refcount to -1. Userspace will then not be able to remove the tpg
+and will hang when it tries to do rmdir on the tpg dir.
+
+3. Tpg leak:
+
+This fixes a bug where we can leak tpgs and cause them to be
+un-removable because the target name is overwritten when
+vhost_scsi_set_endpoint is called multiple times but with different
+target names.
+
+The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup
+a vhost-scsi device to target/tpg mapping, then calls
+VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we
+haven't seen before (target1 has tpg1 but target2 has tpg2). When this
+happens we don't teardown the old target tpg mapping and just overwrite
+the target name and the vs->vs_tpg array. Later when we do
+vhost_scsi_clear_endpoint, we are passed in either target1 or target2's
+name and we will only match that target's tpgs when we loop over the
+vs->vs_tpg. We will then return from the function without doing
+target_undepend_item on the tpgs.
+
+Because of all these bugs, it looks like being able to call
+vhost_scsi_set_endpoint multiple times was never supported. The major
+user, QEMU, already has checks to prevent this use case. So to fix the
+issues, this patch prevents vhost_scsi_set_endpoint from being called
+if it's already successfully added tpgs. To add, remove or change the
+tpg config or target name, you must do a vhost_scsi_clear_endpoint
+first.
+
+Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session")
+Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup")
+Reported-by: Haoran Zhang <wh1sper@zju.edu.cn>
+Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e@oracle.com/T/#me6c0041ce376677419b9b2563494172a01487ecb
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-Id: <20250129210922.121533-1-michael.christie@oracle.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/scsi.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 99813232c25e9..8d8a22504d71f 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1688,14 +1688,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 		}
+ 	}
+ 
++	if (vs->vs_tpg) {
++		pr_err("vhost-scsi endpoint already set for %s.\n",
++		       vs->vs_vhost_wwpn);
++		ret = -EEXIST;
++		goto out;
++	}
++
+ 	len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
+ 	vs_tpg = kzalloc(len, GFP_KERNEL);
+ 	if (!vs_tpg) {
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
+-	if (vs->vs_tpg)
+-		memcpy(vs_tpg, vs->vs_tpg, len);
+ 
+ 	mutex_lock(&vhost_scsi_mutex);
+ 	list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) {
+@@ -1711,12 +1716,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 		tv_tport = tpg->tport;
+ 
+ 		if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
+-			if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) {
+-				mutex_unlock(&tpg->tv_tpg_mutex);
+-				mutex_unlock(&vhost_scsi_mutex);
+-				ret = -EEXIST;
+-				goto undepend;
+-			}
+ 			/*
+ 			 * In order to ensure individual vhost-scsi configfs
+ 			 * groups cannot be removed while in use by vhost ioctl,
+@@ -1763,15 +1762,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 		}
+ 		ret = 0;
+ 	} else {
+-		ret = -EEXIST;
++		ret = -ENODEV;
++		goto free_tpg;
+ 	}
+ 
+ 	/*
+-	 * Act as synchronize_rcu to make sure access to
+-	 * old vs->vs_tpg is finished.
++	 * Act as synchronize_rcu to make sure requests after this point
++	 * see a fully setup device.
+ 	 */
+ 	vhost_scsi_flush(vs);
+-	kfree(vs->vs_tpg);
+ 	vs->vs_tpg = vs_tpg;
+ 	goto out;
+ 
+@@ -1791,6 +1790,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
+ 			target_undepend_item(&tpg->se_tpg.tpg_group.cg_item);
+ 		}
+ 	}
++free_tpg:
+ 	kfree(vs_tpg);
+ out:
+ 	mutex_unlock(&vs->dev.mutex);
+@@ -1893,6 +1893,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
+ 	vhost_scsi_flush(vs);
+ 	kfree(vs->vs_tpg);
+ 	vs->vs_tpg = NULL;
++	memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn));
+ 	WARN_ON(vs->vs_events_nr);
+ 	mutex_unlock(&vs->dev.mutex);
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/vsock-avoid-timeout-during-connect-if-the-socket-is-.patch b/queue-6.6/vsock-avoid-timeout-during-connect-if-the-socket-is-.patch
new file mode 100644
index 0000000000..9a9b16f16d
--- /dev/null
+++ b/queue-6.6/vsock-avoid-timeout-during-connect-if-the-socket-is-.patch
@@ -0,0 +1,62 @@
+From 8411f3e6c0a50f321390da5aed4ea7337a0d3efd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 15:15:28 +0100
+Subject: vsock: avoid timeout during connect() if the socket is closing
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit fccd2b711d9628c7ce0111d5e4938652101ee30a ]
+
+When a peer attempts to establish a connection, vsock_connect() contains
+a loop that waits for the state to be TCP_ESTABLISHED. However, the
+other peer can be fast enough to accept the connection and close it
+immediately, thus moving the state to TCP_CLOSING.
+
+When this happens, the peer in the vsock_connect() is properly woken up,
+but since the state is not TCP_ESTABLISHED, it goes back to sleep
+until the timeout expires, returning -ETIMEDOUT.
+
+If the socket state is TCP_CLOSING, waiting for the timeout is pointless.
+vsock_connect() can return immediately without errors or delay since the
+connection actually happened. The socket will be in a closing state,
+but this is not an issue, and subsequent calls will fail as expected.
+
+We discovered this issue while developing a test that accepts and
+immediately closes connections to stress the transport switch between
+two connect() calls, where the first one was interrupted by a signal
+(see Closes link).
+
+Reported-by: Luigi Leonardi <leonardi@redhat.com>
+Closes: https://lore.kernel.org/virtualization/bq6hxrolno2vmtqwcvb5bljfpb7mvwb3kohrvaed6auz5vxrfv@ijmd2f3grobn/
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Tested-by: Luigi Leonardi <leonardi@redhat.com>
+Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
+Link: https://patch.msgid.link/20250328141528.420719-1-sgarzare@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 622875a6f787c..f8f1a49689da6 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1485,7 +1485,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr,
+ 	timeout = vsk->connect_timeout;
+ 	prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+ 
+-	while (sk->sk_state != TCP_ESTABLISHED && sk->sk_err == 0) {
++	/* If the socket is already closing or it is in an error state, there
++	 * is no point in waiting.
++	 */
++	while (sk->sk_state != TCP_ESTABLISHED &&
++	       sk->sk_state != TCP_CLOSING && sk->sk_err == 0) {
+ 		if (flags & O_NONBLOCK) {
+ 			/* If we're not going to block, we schedule a timeout
+ 			 * function to generate a timeout on the connection
+-- 
+2.39.5
+
diff --git a/queue-6.6/watch_queue-fix-pipe-accounting-mismatch.patch b/queue-6.6/watch_queue-fix-pipe-accounting-mismatch.patch
new file mode 100644
index 0000000000..19deb6f705
--- /dev/null
+++ b/queue-6.6/watch_queue-fix-pipe-accounting-mismatch.patch
@@ -0,0 +1,55 @@
+From fb6c2ec8b9dfa17f21762933e2aa5258e035a1b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 11:41:08 -0600
+Subject: watch_queue: fix pipe accounting mismatch
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+[ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ]
+
+Currently, watch_queue_set_size() modifies the pipe buffers charged to
+user->pipe_bufs without updating the pipe->nr_accounted on the pipe
+itself, due to the if (!pipe_has_watch_queue()) test in
+pipe_resize_ring(). This means that when the pipe is ultimately freed,
+we decrement user->pipe_bufs by something other than what than we had
+charged to it, potentially leading to an underflow. This in turn can
+cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.
+
+To remedy this, explicitly account for the pipe usage in
+watch_queue_set_size() to match the number set via account_pipe_buffers()
+
+(It's unclear why watch_queue_set_size() does not update nr_accounted;
+it may be due to intentional overprovisioning in watch_queue_set_size()?)
+
+Fixes: e95aada4cb93d ("pipe: wakeup wr_wait after setting max_usage")
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Link: https://lore.kernel.org/r/206682a8-0604-49e5-8224-fdbe0c12b460@redhat.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watch_queue.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
+index 778b4056700ff..17254597accd4 100644
+--- a/kernel/watch_queue.c
++++ b/kernel/watch_queue.c
+@@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
+ 	if (ret < 0)
+ 		goto error;
+ 
++	/*
++	 * pipe_resize_ring() does not update nr_accounted for watch_queue
++	 * pipes, because the above vastly overprovisions. Set nr_accounted on
++	 * and max_usage this pipe to the number that was actually charged to
++	 * the user above via account_pipe_buffers.
++	 */
++	pipe->max_usage = nr_pages;
++	pipe->nr_accounted = nr_pages;
++
+ 	ret = -ENOMEM;
+ 	pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL);
+ 	if (!pages)
+-- 
+2.39.5
+
diff --git a/queue-6.6/wifi-brcmfmac-keep-power-during-suspend-if-board-req.patch b/queue-6.6/wifi-brcmfmac-keep-power-during-suspend-if-board-req.patch
new file mode 100644
index 0000000000..b79a48165e
--- /dev/null
+++ b/queue-6.6/wifi-brcmfmac-keep-power-during-suspend-if-board-req.patch
@@ -0,0 +1,100 @@
+From c96c83c737161e6e1e439812a1d150b94b688dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 19:59:35 +0100
+Subject: wifi: brcmfmac: keep power during suspend if board requires it
+
+From: Matthias Proske <email@matthias-proske.de>
+
+[ Upstream commit 8c3170628a9ce24a59647bd24f897e666af919b8 ]
+
+After commit 92cadedd9d5f ("brcmfmac: Avoid keeping power to SDIO card
+unless WOWL is used"), the wifi adapter by default is turned off on
+suspend and then re-probed on resume.
+
+This conflicts with some embedded boards that require to remain powered.
+They will fail on resume with:
+
+brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
+ieee80211 phy1: brcmf_bus_started: failed: -110
+ieee80211 phy1: brcmf_attach: dongle is not responding: err=-110
+brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
+
+This commit checks for the Device Tree property 'cap-power-off-cards'.
+If this property is not set, it means that we do not have the capability
+to power off and should therefore remain powered.
+
+Signed-off-by: Matthias Proske <email@matthias-proske.de>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Link: https://patch.msgid.link/20250212185941.146958-2-email@matthias-proske.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcmsdh.c      | 20 ++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index 7710367c319ec..14f3c4900f56c 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -1167,6 +1167,7 @@ static int brcmf_ops_sdio_suspend(struct device *dev)
+ 	struct brcmf_bus *bus_if;
+ 	struct brcmf_sdio_dev *sdiodev;
+ 	mmc_pm_flag_t sdio_flags;
++	bool cap_power_off;
+ 	int ret = 0;
+ 
+ 	func = container_of(dev, struct sdio_func, dev);
+@@ -1174,19 +1175,23 @@ static int brcmf_ops_sdio_suspend(struct device *dev)
+ 	if (func->num != 1)
+ 		return 0;
+ 
++	cap_power_off = !!(func->card->host->caps & MMC_CAP_POWER_OFF_CARD);
+ 
+ 	bus_if = dev_get_drvdata(dev);
+ 	sdiodev = bus_if->bus_priv.sdio;
+ 
+-	if (sdiodev->wowl_enabled) {
++	if (sdiodev->wowl_enabled || !cap_power_off) {
+ 		brcmf_sdiod_freezer_on(sdiodev);
+ 		brcmf_sdio_wd_timer(sdiodev->bus, 0);
+ 
+ 		sdio_flags = MMC_PM_KEEP_POWER;
+-		if (sdiodev->settings->bus.sdio.oob_irq_supported)
+-			enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
+-		else
+-			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
++
++		if (sdiodev->wowl_enabled) {
++			if (sdiodev->settings->bus.sdio.oob_irq_supported)
++				enable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
++			else
++				sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
++		}
+ 
+ 		if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
+ 			brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
+@@ -1208,18 +1213,19 @@ static int brcmf_ops_sdio_resume(struct device *dev)
+ 	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+ 	struct sdio_func *func = container_of(dev, struct sdio_func, dev);
+ 	int ret = 0;
++	bool cap_power_off = !!(func->card->host->caps & MMC_CAP_POWER_OFF_CARD);
+ 
+ 	brcmf_dbg(SDIO, "Enter: F%d\n", func->num);
+ 	if (func->num != 2)
+ 		return 0;
+ 
+-	if (!sdiodev->wowl_enabled) {
++	if (!sdiodev->wowl_enabled && cap_power_off) {
+ 		/* bus was powered off and device removed, probe again */
+ 		ret = brcmf_sdiod_probe(sdiodev);
+ 		if (ret)
+ 			brcmf_err("Failed to probe device on resume\n");
+ 	} else {
+-		if (sdiodev->settings->bus.sdio.oob_irq_supported)
++		if (sdiodev->wowl_enabled && sdiodev->settings->bus.sdio.oob_irq_supported)
+ 			disable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
+ 
+ 		brcmf_sdiod_freezer_off(sdiodev);
+-- 
+2.39.5
+
diff --git a/queue-6.6/wifi-iwlwifi-fw-allocate-chained-sg-tables-for-dump.patch b/queue-6.6/wifi-iwlwifi-fw-allocate-chained-sg-tables-for-dump.patch
new file mode 100644
index 0000000000..e6423c9d3e
--- /dev/null
+++ b/queue-6.6/wifi-iwlwifi-fw-allocate-chained-sg-tables-for-dump.patch
@@ -0,0 +1,140 @@
+From 8ac522e354a93bddfdb545309949c8e525308d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Feb 2025 14:34:45 +0200
+Subject: wifi: iwlwifi: fw: allocate chained SG tables for dump
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 7774e3920029398ad49dc848b23840593f14d515 ]
+
+The firmware dumps can be pretty big, and since we use single
+pages for each SG table entry, even the table itself may end
+up being an order-5 allocation. Build chained tables so that
+we need not allocate a higher-order table here.
+
+This could be improved and cleaned up, e.g. by using the SG
+pool code or simply kvmalloc(), but all of that would require
+also updating the devcoredump first since that frees it all,
+so we need to be more careful. SG pool might also run against
+the CONFIG_ARCH_NO_SG_CHAIN limitation, which is irrelevant
+here.
+
+Also use _devcd_free_sgtable() for the error paths now, much
+simpler especially since it's in two places now.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250209143303.697c7a465ac9.Iea982df46b5c075bfb77ade36f187d99a70c63db@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 86 ++++++++++++++-------
+ 1 file changed, 58 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 2a408e1ce06ec..0a1f302ad6d3f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -559,41 +559,71 @@ static void iwl_dump_prph(struct iwl_fw_runtime *fwrt,
+ }
+ 
+ /*
+- * alloc_sgtable - allocates scallerlist table in the given size,
+- * fills it with pages and returns it
++ * alloc_sgtable - allocates (chained) scatterlist in the given size,
++ *	fills it with pages and returns it
+  * @size: the size (in bytes) of the table
+-*/
+-static struct scatterlist *alloc_sgtable(int size)
++ */
++static struct scatterlist *alloc_sgtable(ssize_t size)
+ {
+-	int alloc_size, nents, i;
+-	struct page *new_page;
+-	struct scatterlist *iter;
+-	struct scatterlist *table;
++	struct scatterlist *result = NULL, *prev;
++	int nents, i, n_prev;
+ 
+ 	nents = DIV_ROUND_UP(size, PAGE_SIZE);
+-	table = kcalloc(nents, sizeof(*table), GFP_KERNEL);
+-	if (!table)
+-		return NULL;
+-	sg_init_table(table, nents);
+-	iter = table;
+-	for_each_sg(table, iter, sg_nents(table), i) {
+-		new_page = alloc_page(GFP_KERNEL);
+-		if (!new_page) {
+-			/* release all previous allocated pages in the table */
+-			iter = table;
+-			for_each_sg(table, iter, sg_nents(table), i) {
+-				new_page = sg_page(iter);
+-				if (new_page)
+-					__free_page(new_page);
+-			}
+-			kfree(table);
++
++#define N_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(*result))
++	/*
++	 * We need an additional entry for table chaining,
++	 * this ensures the loop can finish i.e. we can
++	 * fit at least two entries per page (obviously,
++	 * many more really fit.)
++	 */
++	BUILD_BUG_ON(N_ENTRIES_PER_PAGE < 2);
++
++	while (nents > 0) {
++		struct scatterlist *new, *iter;
++		int n_fill, n_alloc;
++
++		if (nents <= N_ENTRIES_PER_PAGE) {
++			/* last needed table */
++			n_fill = nents;
++			n_alloc = nents;
++			nents = 0;
++		} else {
++			/* fill a page with entries */
++			n_alloc = N_ENTRIES_PER_PAGE;
++			/* reserve one for chaining */
++			n_fill = n_alloc - 1;
++			nents -= n_fill;
++		}
++
++		new = kcalloc(n_alloc, sizeof(*new), GFP_KERNEL);
++		if (!new) {
++			if (result)
++				_devcd_free_sgtable(result);
+ 			return NULL;
+ 		}
+-		alloc_size = min_t(int, size, PAGE_SIZE);
+-		size -= PAGE_SIZE;
+-		sg_set_page(iter, new_page, alloc_size, 0);
++		sg_init_table(new, n_alloc);
++
++		if (!result)
++			result = new;
++		else
++			sg_chain(prev, n_prev, new);
++		prev = new;
++		n_prev = n_alloc;
++
++		for_each_sg(new, iter, n_fill, i) {
++			struct page *new_page = alloc_page(GFP_KERNEL);
++
++			if (!new_page) {
++				_devcd_free_sgtable(result);
++				return NULL;
++			}
++
++			sg_set_page(iter, new_page, PAGE_SIZE, 0);
++		}
+ 	}
+-	return table;
++
++	return result;
+ }
+ 
+ static void iwl_fw_get_prph_len(struct iwl_fw_runtime *fwrt,
+-- 
+2.39.5
+
diff --git a/queue-6.6/wifi-iwlwifi-mvm-use-the-right-version-of-the-rate-a.patch b/queue-6.6/wifi-iwlwifi-mvm-use-the-right-version-of-the-rate-a.patch
new file mode 100644
index 0000000000..23ff968b3f
--- /dev/null
+++ b/queue-6.6/wifi-iwlwifi-mvm-use-the-right-version-of-the-rate-a.patch
@@ -0,0 +1,56 @@
+From 002a92f62257ef830301c038bb1bd39f4225ed48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Feb 2025 14:34:50 +0200
+Subject: wifi: iwlwifi: mvm: use the right version of the rate API
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit a03e2082e678ea10d0d8bdf3ed933eb05a8ddbb0 ]
+
+The firmware uses the newer version of the API in recent devices. For
+older devices, we translate the rate to the new format.
+Don't parse the rate with old parsing macros.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250209143303.13d70cdcbb4e.Ic92193bce4013b70a823cfef250ee79c16cf7c17@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 8cff24d5f5f40..e4efd3349bc1b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -1275,7 +1275,7 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
+ 	 */
+ 	u8 ru = le32_get_bits(phy_data->d1, IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK);
+ 	u32 rate_n_flags = phy_data->rate_n_flags;
+-	u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK_V1;
++	u32 he_type = rate_n_flags & RATE_MCS_HE_TYPE_MSK;
+ 	u8 offs = 0;
+ 
+ 	rx_status->bw = RATE_INFO_BW_HE_RU;
+@@ -1330,13 +1330,13 @@ iwl_mvm_decode_he_phy_ru_alloc(struct iwl_mvm_rx_phy_data *phy_data,
+ 
+ 	if (he_mu)
+ 		he_mu->flags2 |=
+-			le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
++			le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
+ 						   rate_n_flags),
+ 					 IEEE80211_RADIOTAP_HE_MU_FLAGS2_BW_FROM_SIG_A_BW);
+-	else if (he_type == RATE_MCS_HE_TYPE_TRIG_V1)
++	else if (he_type == RATE_MCS_HE_TYPE_TRIG)
+ 		he->data6 |=
+ 			cpu_to_le16(IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW_KNOWN) |
+-			le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK_V1,
++			le16_encode_bits(FIELD_GET(RATE_MCS_CHAN_WIDTH_MSK,
+ 						   rate_n_flags),
+ 					 IEEE80211_RADIOTAP_HE_DATA6_TB_PPDU_BW);
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/wifi-mac80211-flush-the-station-before-moving-it-to-.patch b/queue-6.6/wifi-mac80211-flush-the-station-before-moving-it-to-.patch
new file mode 100644
index 0000000000..5009440e36
--- /dev/null
+++ b/queue-6.6/wifi-mac80211-flush-the-station-before-moving-it-to-.patch
@@ -0,0 +1,78 @@
+From dad149b20a3c5e5272dcfdbbbb92e9ec83f36817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 12:37:55 +0200
+Subject: wifi: mac80211: flush the station before moving it to UN-AUTHORIZED
+ state
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 43e04077170799d0e6289f3e928f727e401b3d79 ]
+
+We first want to flush the station to make sure we no longer have any
+frames being Tx by the station before the station is moved to
+un-authorized state. Failing to do that will lead to races: a frame may
+be sent after the station's state has been changed.
+
+Since the API clearly states that the driver can't fail the sta_state()
+transition down the list of state, we can easily flush the station
+first, and only then call the driver's sta_state().
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250306123626.450bc40e8b04.I636ba96843c77f13309c15c9fd6eb0c5a52a7976@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 5d71e8d084c45..64cf5589989bb 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -4,7 +4,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018-2023 Intel Corporation
++ * Copyright (C) 2018-2024 Intel Corporation
+  */
+ 
+ #include <linux/module.h>
+@@ -1321,9 +1321,13 @@ static int _sta_info_move_state(struct sta_info *sta,
+ 		sta->sta.addr, new_state);
+ 
+ 	/* notify the driver before the actual changes so it can
+-	 * fail the transition
++	 * fail the transition if the state is increasing.
++	 * The driver is required not to fail when the transition
++	 * is decreasing the state, so first, do all the preparation
++	 * work and only then, notify the driver.
+ 	 */
+-	if (test_sta_flag(sta, WLAN_STA_INSERTED)) {
++	if (new_state > sta->sta_state &&
++	    test_sta_flag(sta, WLAN_STA_INSERTED)) {
+ 		int err = drv_sta_state(sta->local, sta->sdata, sta,
+ 					sta->sta_state, new_state);
+ 		if (err)
+@@ -1399,6 +1403,16 @@ static int _sta_info_move_state(struct sta_info *sta,
+ 		break;
+ 	}
+ 
++	if (new_state < sta->sta_state &&
++	    test_sta_flag(sta, WLAN_STA_INSERTED)) {
++		int err = drv_sta_state(sta->local, sta->sdata, sta,
++					sta->sta_state, new_state);
++
++		WARN_ONCE(err,
++			  "Driver is not allowed to fail if the sta_state is transitioning down the list: %d\n",
++			  err);
++	}
++
+ 	sta->sta_state = new_state;
+ 
+ 	return 0;
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-dumpstack-fix-inaccurate-unwinding-from-exceptio.patch b/queue-6.6/x86-dumpstack-fix-inaccurate-unwinding-from-exceptio.patch
new file mode 100644
index 0000000000..9454c4cc6b
--- /dev/null
+++ b/queue-6.6/x86-dumpstack-fix-inaccurate-unwinding-from-exceptio.patch
@@ -0,0 +1,69 @@
+From 8d5b68c05ce2ce064839586f66e408bf4eb14e67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 03:01:23 +0100
+Subject: x86/dumpstack: Fix inaccurate unwinding from exception stacks due to
+ misplaced assignment
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 2c118f50d7fd4d9aefc4533a26f83338b2906b7a ]
+
+Commit:
+
+  2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again")
+
+was intended to ensure alignment of the stack pointer; but it also moved
+the initialization of the "stack" variable down into the loop header.
+
+This was likely intended as a no-op cleanup, since the commit
+message does not mention it; however, this caused a behavioral change
+because the value of "regs" is different between the two places.
+
+Originally, get_stack_pointer() used the regs provided by the caller; after
+that commit, get_stack_pointer() instead uses the regs at the top of the
+stack frame the unwinder is looking at. Often, there are no such regs at
+all, and "regs" is NULL, causing get_stack_pointer() to fall back to the
+task's current stack pointer, which is not what we want here, but probably
+happens to mostly work. Other times, the original regs will point to
+another regs frame - in that case, the linear guess unwind logic in
+show_trace_log_lvl() will start unwinding too far up the stack, causing the
+first frame found by the proper unwinder to never be visited, resulting in
+a stack trace consisting purely of guess lines.
+
+Fix it by moving the "stack = " assignment back where it belongs.
+
+Fixes: 2e4be0d011f2 ("x86/show_trace_log_lvl: Ensure stack pointer is aligned, again")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-2-acd774364768@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/dumpstack.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
+index f18ca44c904b7..52dc5839d1e8e 100644
+--- a/arch/x86/kernel/dumpstack.c
++++ b/arch/x86/kernel/dumpstack.c
+@@ -195,6 +195,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ 	printk("%sCall Trace:\n", log_lvl);
+ 
+ 	unwind_start(&state, task, regs, stack);
++	stack = stack ?: get_stack_pointer(task, regs);
+ 	regs = unwind_get_entry_regs(&state, &partial);
+ 
+ 	/*
+@@ -213,9 +214,7 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
+ 	 * - hardirq stack
+ 	 * - entry stack
+ 	 */
+-	for (stack = stack ?: get_stack_pointer(task, regs);
+-	     stack;
+-	     stack = stack_info.next_sp) {
++	for (; stack; stack = stack_info.next_sp) {
+ 		const char *stack_name;
+ 
+ 		stack = PTR_ALIGN(stack, sizeof(long));
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-entry-fix-orc-unwinder-for-push_regs-with-save_r.patch b/queue-6.6/x86-entry-fix-orc-unwinder-for-push_regs-with-save_r.patch
new file mode 100644
index 0000000000..c3bb66921e
--- /dev/null
+++ b/queue-6.6/x86-entry-fix-orc-unwinder-for-push_regs-with-save_r.patch
@@ -0,0 +1,55 @@
+From 3fc889e15f9a93bb95f9a08cde767658089b1a69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Mar 2025 03:01:22 +0100
+Subject: x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 57e2428f8df8263275344566e02c277648a4b7f1 ]
+
+PUSH_REGS with save_ret=1 is used by interrupt entry helper functions that
+initially start with a UNWIND_HINT_FUNC ORC state.
+
+However, save_ret=1 means that we clobber the helper function's return
+address (and then later restore the return address further down on the
+stack); after that point, the only thing on the stack we can unwind through
+is the IRET frame, so use UNWIND_HINT_IRET_REGS until we have a full
+pt_regs frame.
+
+( An alternate approach would be to move the pt_regs->di overwrite down
+  such that it is the final step of pt_regs setup; but I don't want to
+  rearrange entry code just to make unwinding a tiny bit more elegant. )
+
+Fixes: 9e809d15d6b6 ("x86/entry: Reduce the code footprint of the 'idtentry' macro")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/20250325-2025-03-unwind-fixes-v1-1-acd774364768@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/calling.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
+index f6907627172ba..01e9593e2bd95 100644
+--- a/arch/x86/entry/calling.h
++++ b/arch/x86/entry/calling.h
+@@ -70,6 +70,8 @@ For 32-bit we have the following conventions - kernel is built with
+ 	pushq	%rsi		/* pt_regs->si */
+ 	movq	8(%rsp), %rsi	/* temporarily store the return address in %rsi */
+ 	movq	%rdi, 8(%rsp)	/* pt_regs->di (overwriting original return address) */
++	/* We just clobbered the return address - use the IRET frame for unwinding: */
++	UNWIND_HINT_IRET_REGS offset=3*8
+ 	.else
+ 	pushq   %rdi		/* pt_regs->di */
+ 	pushq   %rsi		/* pt_regs->si */
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-fpu-avoid-copying-dynamic-fp-state-from-init_tas.patch b/queue-6.6/x86-fpu-avoid-copying-dynamic-fp-state-from-init_tas.patch
new file mode 100644
index 0000000000..8f2f7be65d
--- /dev/null
+++ b/queue-6.6/x86-fpu-avoid-copying-dynamic-fp-state-from-init_tas.patch
@@ -0,0 +1,57 @@
+From 4fb6de0d52c2ce505242a5488ba8e3a9dacae692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 14:31:36 +0100
+Subject: x86/fpu: Avoid copying dynamic FP state from init_task in
+ arch_dup_task_struct()
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 5d3b81d4d8520efe888536b6906dc10fd1a228a8 ]
+
+The init_task instance of struct task_struct is statically allocated and
+may not contain the full FP state for userspace. As such, limit the copy
+to the valid area of both init_task and 'dst' and ensure all memory is
+initialized.
+
+Note that the FP state is only needed for userspace, and as such it is
+entirely reasonable for init_task to not contain parts of it.
+
+Fixes: 5aaeb5c01c5b ("x86/fpu, sched: Introduce CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT and use it on x86")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Link: https://lore.kernel.org/r/20250226133136.816901-1-benjamin@sipsolutions.net
+----
+
+v2:
+- Fix code if arch_task_struct_size < sizeof(init_task) by using
+  memcpy_and_pad.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/process.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 5351f293f770b..bbe11363550be 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -92,7 +92,12 @@ EXPORT_PER_CPU_SYMBOL_GPL(__tss_limit_invalid);
+  */
+ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+ {
+-	memcpy(dst, src, arch_task_struct_size);
++	/* init_task is not dynamically sized (incomplete FPU state) */
++	if (unlikely(src == &init_task))
++		memcpy_and_pad(dst, arch_task_struct_size, src, sizeof(init_task), 0);
++	else
++		memcpy(dst, src, arch_task_struct_size);
++
+ #ifdef CONFIG_VM86
+ 	dst->thread.vm86 = NULL;
+ #endif
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-fpu-fix-guest-fpu-state-buffer-allocation-size.patch b/queue-6.6/x86-fpu-fix-guest-fpu-state-buffer-allocation-size.patch
new file mode 100644
index 0000000000..8803f1c6ec
--- /dev/null
+++ b/queue-6.6/x86-fpu-fix-guest-fpu-state-buffer-allocation-size.patch
@@ -0,0 +1,49 @@
+From cd3e10055d676af8b135170ac2080f4b99fbaa9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 14:10:45 +0000
+Subject: x86/fpu: Fix guest FPU state buffer allocation size
+
+From: Stanislav Spassov <stanspas@amazon.de>
+
+[ Upstream commit 1937e18cc3cf27e2b3ef70e8c161437051ab7608 ]
+
+Ongoing work on an optimization to batch-preallocate vCPU state buffers
+for KVM revealed a mismatch between the allocation sizes used in
+fpu_alloc_guest_fpstate() and fpstate_realloc(). While the former
+allocates a buffer sized to fit the default set of XSAVE features
+in UABI form (as per fpu_user_cfg), the latter uses its ksize argument
+derived (for the requested set of features) in the same way as the sizes
+found in fpu_kernel_cfg, i.e. using the compacted in-kernel
+representation.
+
+The correct size to use for guest FPU state should indeed be the
+kernel one as seen in fpstate_realloc(). The original issue likely
+went unnoticed through a combination of UABI size typically being
+larger than or equal to kernel size, and/or both amounting to the
+same number of allocated 4K pages.
+
+Fixes: 69f6ed1d14c6 ("x86/fpu: Provide infrastructure for KVM FPU cleanup")
+Signed-off-by: Stanislav Spassov <stanspas@amazon.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20250218141045.85201-1-stanspas@amazon.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index 4b414b0ab0692..db200990b5569 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -220,7 +220,7 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)
+ 	struct fpstate *fpstate;
+ 	unsigned int size;
+ 
+-	size = fpu_user_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64);
++	size = fpu_kernel_cfg.default_size + ALIGN(offsetof(struct fpstate, regs), 64);
+ 	fpstate = vzalloc(size);
+ 	if (!fpstate)
+ 		return false;
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-fpu-xstate-fix-inconsistencies-in-guest-fpu-xfea.patch b/queue-6.6/x86-fpu-xstate-fix-inconsistencies-in-guest-fpu-xfea.patch
new file mode 100644
index 0000000000..63178bcae6
--- /dev/null
+++ b/queue-6.6/x86-fpu-xstate-fix-inconsistencies-in-guest-fpu-xfea.patch
@@ -0,0 +1,86 @@
+From 7a7c77fbe6d022590a44b2cb73ee3b4047fc986f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 22:06:11 +0800
+Subject: x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
+
+From: Chao Gao <chao.gao@intel.com>
+
+[ Upstream commit dda366083e5ff307a4a728757db874bbfe7550be ]
+
+Guest FPUs manage vCPU FPU states. They are allocated via
+fpu_alloc_guest_fpstate() and are resized in fpstate_realloc() when XFD
+features are enabled.
+
+Since the introduction of guest FPUs, there have been inconsistencies in
+the kernel buffer size and xfeatures:
+
+ 1. fpu_alloc_guest_fpstate() uses fpu_user_cfg since its introduction. See:
+
+    69f6ed1d14c6 ("x86/fpu: Provide infrastructure for KVM FPU cleanup")
+    36487e6228c4 ("x86/fpu: Prepare guest FPU for dynamically enabled FPU features")
+
+ 2. __fpstate_reset() references fpu_kernel_cfg to set storage attributes.
+
+ 3. fpu->guest_perm uses fpu_kernel_cfg, affecting fpstate_realloc().
+
+A recent commit in the tip:x86/fpu tree partially addressed the inconsistency
+between (1) and (3) by using fpu_kernel_cfg for size calculation in (1),
+but left fpu_guest->xfeatures and fpu_guest->perm still referencing
+fpu_user_cfg:
+
+  https://lore.kernel.org/all/20250218141045.85201-1-stanspas@amazon.de/
+
+  1937e18cc3cf ("x86/fpu: Fix guest FPU state buffer allocation size")
+
+The inconsistencies within fpu_alloc_guest_fpstate() and across the
+mentioned functions cause confusion.
+
+Fix them by using fpu_kernel_cfg consistently in fpu_alloc_guest_fpstate(),
+except for fields related to the UABI buffer. Referencing fpu_kernel_cfg
+won't impact functionalities, as:
+
+ 1. fpu_guest->perm is overwritten shortly in fpu_init_guest_permissions()
+    with fpstate->guest_perm, which already uses fpu_kernel_cfg.
+
+ 2. fpu_guest->xfeatures is solely used to check if XFD features are enabled.
+    Including supervisor xfeatures doesn't affect the check.
+
+Fixes: 36487e6228c4 ("x86/fpu: Prepare guest FPU for dynamically enabled FPU features")
+Suggested-by: Chang S. Bae <chang.seok.bae@intel.com>
+Signed-off-by: Chao Gao <chao.gao@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Cc: Sean Christopherson <seanjc@google.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Link: https://lore.kernel.org/r/20250317140613.1761633-1-chao.gao@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index db200990b5569..aaed20f46be4c 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -232,8 +232,8 @@ bool fpu_alloc_guest_fpstate(struct fpu_guest *gfpu)
+ 	fpstate->is_guest	= true;
+ 
+ 	gfpu->fpstate		= fpstate;
+-	gfpu->xfeatures		= fpu_user_cfg.default_features;
+-	gfpu->perm		= fpu_user_cfg.default_features;
++	gfpu->xfeatures		= fpu_kernel_cfg.default_features;
++	gfpu->perm		= fpu_kernel_cfg.default_features;
+ 
+ 	/*
+ 	 * KVM sets the FP+SSE bits in the XSAVE header when copying FPU state
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-hyperv-fix-output-argument-to-hypercall-that-cha.patch b/queue-6.6/x86-hyperv-fix-output-argument-to-hypercall-that-cha.patch
new file mode 100644
index 0000000000..2ed88fb355
--- /dev/null
+++ b/queue-6.6/x86-hyperv-fix-output-argument-to-hypercall-that-cha.patch
@@ -0,0 +1,53 @@
+From 6efac850f930fae2352d88fa55ef87974598b815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 12:06:06 -0800
+Subject: x86/hyperv: Fix output argument to hypercall that changes page
+ visibility
+
+From: Michael Kelley <mhklinux@outlook.com>
+
+[ Upstream commit 09beefefb57bbc3a06d98f319d85db4d719d7bcb ]
+
+The hypercall in hv_mark_gpa_visibility() is invoked with an input
+argument and an output argument. The output argument ostensibly returns
+the number of pages that were processed. But in fact, the hypercall does
+not provide any output, so the output argument is spurious.
+
+The spurious argument is harmless because Hyper-V ignores it, but in the
+interest of correctness and to avoid the potential for future problems,
+remove it.
+
+Signed-off-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Link: https://lore.kernel.org/r/20250226200612.2062-2-mhklinux@outlook.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Message-ID: <20250226200612.2062-2-mhklinux@outlook.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/ivm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/x86/hyperv/ivm.c b/arch/x86/hyperv/ivm.c
+index 8c6bf07f7d2b8..e50e43d1d4c87 100644
+--- a/arch/x86/hyperv/ivm.c
++++ b/arch/x86/hyperv/ivm.c
+@@ -464,7 +464,6 @@ static int hv_mark_gpa_visibility(u16 count, const u64 pfn[],
+ 			   enum hv_mem_host_visibility visibility)
+ {
+ 	struct hv_gpa_range_for_visibility *input;
+-	u16 pages_processed;
+ 	u64 hv_status;
+ 	unsigned long flags;
+ 
+@@ -493,7 +492,7 @@ static int hv_mark_gpa_visibility(u16 count, const u64 pfn[],
+ 	memcpy((void *)input->gpa_page_list, pfn, count * sizeof(*pfn));
+ 	hv_status = hv_do_rep_hypercall(
+ 			HVCALL_MODIFY_SPARSE_GPA_PAGE_HOST_VISIBILITY, count,
+-			0, input, &pages_processed);
++			0, input, NULL);
+ 	local_irq_restore(flags);
+ 
+ 	if (hv_result_success(hv_status))
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-hyperv-vtl-stop-kernel-from-probing-vtl0-low-mem.patch b/queue-6.6/x86-hyperv-vtl-stop-kernel-from-probing-vtl0-low-mem.patch
new file mode 100644
index 0000000000..e35a4671ff
--- /dev/null
+++ b/queue-6.6/x86-hyperv-vtl-stop-kernel-from-probing-vtl0-low-mem.patch
@@ -0,0 +1,44 @@
+From cd3a98fc3b876850aea4eb7d3aa9fd13328b4696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 06:12:24 +0000
+Subject: x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
+
+From: Naman Jain <namjain@linux.microsoft.com>
+
+[ Upstream commit 59115e2e25f42924181055ed7cc1d123af7598b7 ]
+
+For Linux, running in Hyper-V VTL (Virtual Trust Level), kernel in VTL2
+tries to access VTL0 low memory in probe_roms. This memory is not
+described in the e820 map. Initialize probe_roms call to no-ops
+during boot for VTL2 kernel to avoid this. The issue got identified
+in OpenVMM which detects invalid accesses initiated from kernel running
+in VTL2.
+
+Co-developed-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
+Tested-by: Roman Kisel <romank@linux.microsoft.com>
+Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
+Link: https://lore.kernel.org/r/20250116061224.1701-1-namjain@linux.microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Message-ID: <20250116061224.1701-1-namjain@linux.microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/hv_vtl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c
+index c2f78fabc865b..b12bef0ff7bb6 100644
+--- a/arch/x86/hyperv/hv_vtl.c
++++ b/arch/x86/hyperv/hv_vtl.c
+@@ -30,6 +30,7 @@ void __init hv_vtl_init_platform(void)
+ 	x86_platform.realmode_init = x86_init_noop;
+ 	x86_init.irqs.pre_vector_init = x86_init_noop;
+ 	x86_init.timers.timer_init = x86_init_noop;
++	x86_init.resources.probe_roms = x86_init_noop;
+ 
+ 	/* Avoid searching for BIOS MP tables */
+ 	x86_init.mpparse.find_smp_config = x86_init_noop;
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-mm-pat-cpa-test-fix-length-for-cpa_array-test.patch b/queue-6.6/x86-mm-pat-cpa-test-fix-length-for-cpa_array-test.patch
new file mode 100644
index 0000000000..97f50a0c81
--- /dev/null
+++ b/queue-6.6/x86-mm-pat-cpa-test-fix-length-for-cpa_array-test.patch
@@ -0,0 +1,40 @@
+From 4aeac9c34e896e6be5c2a2776f58549b03d15752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jan 2025 09:47:25 +0200
+Subject: x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
+
+From: Mike Rapoport (Microsoft) <rppt@kernel.org>
+
+[ Upstream commit 33ea120582a638b2f2e380a50686c2b1d7cce795 ]
+
+The CPA_ARRAY test always uses len[1] as numpages argument to
+change_page_attr_set() although the addresses array is different each
+iteration of the test loop.
+
+Replace len[1] with len[i] to have numpages matching the addresses array.
+
+Fixes: ecc729f1f471 ("x86/mm/cpa: Add ARRAY and PAGES_ARRAY selftests")
+Signed-off-by: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250126074733.1384926-2-rppt@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pat/cpa-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/mm/pat/cpa-test.c b/arch/x86/mm/pat/cpa-test.c
+index 3d2f7f0a6ed14..ad3c1feec990d 100644
+--- a/arch/x86/mm/pat/cpa-test.c
++++ b/arch/x86/mm/pat/cpa-test.c
+@@ -183,7 +183,7 @@ static int pageattr_test(void)
+ 			break;
+ 
+ 		case 1:
+-			err = change_page_attr_set(addrs, len[1], PAGE_CPA_TEST, 1);
++			err = change_page_attr_set(addrs, len[i], PAGE_CPA_TEST, 1);
+ 			break;
+ 
+ 		case 2:
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-mm-pat-fix-vm_pat-handling-when-fork-fails-in-co.patch b/queue-6.6/x86-mm-pat-fix-vm_pat-handling-when-fork-fails-in-co.patch
new file mode 100644
index 0000000000..3d6510ea19
--- /dev/null
+++ b/queue-6.6/x86-mm-pat-fix-vm_pat-handling-when-fork-fails-in-co.patch
@@ -0,0 +1,297 @@
+From 954f7c81c690ec4641921891c347d2b10b1f9594 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 12:23:23 +0100
+Subject: x86/mm/pat: Fix VM_PAT handling when fork() fails in
+ copy_page_range()
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit dc84bc2aba85a1508f04a936f9f9a15f64ebfb31 ]
+
+If track_pfn_copy() fails, we already added the dst VMA to the maple
+tree. As fork() fails, we'll cleanup the maple tree, and stumble over
+the dst VMA for which we neither performed any reservation nor copied
+any page tables.
+
+Consequently untrack_pfn() will see VM_PAT and try obtaining the
+PAT information from the page table -- which fails because the page
+table was not copied.
+
+The easiest fix would be to simply clear the VM_PAT flag of the dst VMA
+if track_pfn_copy() fails. However, the whole thing is about "simply"
+clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()
+and performed a reservation, but copying the page tables fails, we'll
+simply clear the VM_PAT flag, not properly undoing the reservation ...
+which is also wrong.
+
+So let's fix it properly: set the VM_PAT flag only if the reservation
+succeeded (leaving it clear initially), and undo the reservation if
+anything goes wrong while copying the page tables: clearing the VM_PAT
+flag after undoing the reservation.
+
+Note that any copied page table entries will get zapped when the VMA will
+get removed later, after copy_page_range() succeeded; as VM_PAT is not set
+then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be
+happy. Note that leaving these page tables in place without a reservation
+is not a problem, as we are aborting fork(); this process will never run.
+
+A reproducer can trigger this usually at the first try:
+
+  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c
+
+  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110
+  Modules linked in: ...
+  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92
+  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014
+  RIP: 0010:get_pat_info+0xf6/0x110
+  ...
+  Call Trace:
+   <TASK>
+   ...
+   untrack_pfn+0x52/0x110
+   unmap_single_vma+0xa6/0xe0
+   unmap_vmas+0x105/0x1f0
+   exit_mmap+0xf6/0x460
+   __mmput+0x4b/0x120
+   copy_process+0x1bf6/0x2aa0
+   kernel_clone+0xab/0x440
+   __do_sys_clone+0x66/0x90
+   do_syscall_64+0x95/0x180
+
+Likely this case was missed in:
+
+  d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed")
+
+... and instead of undoing the reservation we simply cleared the VM_PAT flag.
+
+Keep the documentation of these functions in include/linux/pgtable.h,
+one place is more than sufficient -- we should clean that up for the other
+functions like track_pfn_remap/untrack_pfn separately.
+
+Fixes: d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed")
+Fixes: 2ab640379a0a ("x86: PAT: hooks in generic vm code to help archs to track pfnmap regions - v3")
+Reported-by: xingwei lee <xrivendell7@gmail.com>
+Reported-by: yuxin wang <wang1315768607@163.com>
+Reported-by: Marius Fleischer <fleischermarius@gmail.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: linux-mm@kvack.org
+Link: https://lore.kernel.org/r/20250321112323.153741-1-david@redhat.com
+Closes: https://lore.kernel.org/lkml/CABOYnLx_dnqzpCW99G81DmOr+2UzdmZMk=T3uxwNxwz+R1RAwg@mail.gmail.com/
+Closes: https://lore.kernel.org/lkml/CAJg=8jwijTP5fre8woS4JVJQ8iUA6v+iNcsOgtj9Zfpc3obDOQ@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------
+ include/linux/pgtable.h   | 28 ++++++++++++++++-----
+ kernel/fork.c             |  4 +++
+ mm/memory.c               | 11 +++------
+ 4 files changed, 58 insertions(+), 37 deletions(-)
+
+diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c
+index e7b9ac63bb02a..8dc4eedd49475 100644
+--- a/arch/x86/mm/pat/memtype.c
++++ b/arch/x86/mm/pat/memtype.c
+@@ -982,29 +982,42 @@ static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,
+ 	return -EINVAL;
+ }
+ 
+-/*
+- * track_pfn_copy is called when vma that is covering the pfnmap gets
+- * copied through copy_page_range().
+- *
+- * If the vma has a linear pfn mapping for the entire range, we get the prot
+- * from pte and reserve the entire vma range with single reserve_pfn_range call.
+- */
+-int track_pfn_copy(struct vm_area_struct *vma)
++int track_pfn_copy(struct vm_area_struct *dst_vma,
++		struct vm_area_struct *src_vma, unsigned long *pfn)
+ {
++	const unsigned long vma_size = src_vma->vm_end - src_vma->vm_start;
+ 	resource_size_t paddr;
+-	unsigned long vma_size = vma->vm_end - vma->vm_start;
+ 	pgprot_t pgprot;
++	int rc;
+ 
+-	if (vma->vm_flags & VM_PAT) {
+-		if (get_pat_info(vma, &paddr, &pgprot))
+-			return -EINVAL;
+-		/* reserve the whole chunk covered by vma. */
+-		return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
+-	}
++	if (!(src_vma->vm_flags & VM_PAT))
++		return 0;
++
++	/*
++	 * Duplicate the PAT information for the dst VMA based on the src
++	 * VMA.
++	 */
++	if (get_pat_info(src_vma, &paddr, &pgprot))
++		return -EINVAL;
++	rc = reserve_pfn_range(paddr, vma_size, &pgprot, 1);
++	if (rc)
++		return rc;
+ 
++	/* Reservation for the destination VMA succeeded. */
++	vm_flags_set(dst_vma, VM_PAT);
++	*pfn = PHYS_PFN(paddr);
+ 	return 0;
+ }
+ 
++void untrack_pfn_copy(struct vm_area_struct *dst_vma, unsigned long pfn)
++{
++	untrack_pfn(dst_vma, pfn, dst_vma->vm_end - dst_vma->vm_start, true);
++	/*
++	 * Reservation was freed, any copied page tables will get cleaned
++	 * up later, but without getting PAT involved again.
++	 */
++}
++
+ /*
+  * prot is passed in as a parameter for the new mapping. If the vma has
+  * a linear pfn mapping for the entire range, or no vma is provided,
+@@ -1093,15 +1106,6 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
+ 	}
+ }
+ 
+-/*
+- * untrack_pfn_clear is called if the following situation fits:
+- *
+- * 1) while mremapping a pfnmap for a new region,  with the old vma after
+- * its pfnmap page table has been removed.  The new vma has a new pfnmap
+- * to the same pfn & cache type with VM_PAT set.
+- * 2) while duplicating vm area, the new vma fails to copy the pgtable from
+- * old vma.
+- */
+ void untrack_pfn_clear(struct vm_area_struct *vma)
+ {
+ 	vm_flags_clear(vma, VM_PAT);
+diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h
+index 8b7daccd11bef..3c3a7dede0ef5 100644
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -1286,14 +1286,25 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot,
+ }
+ 
+ /*
+- * track_pfn_copy is called when vma that is covering the pfnmap gets
+- * copied through copy_page_range().
++ * track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page
++ * tables copied during copy_page_range(). On success, stores the pfn to be
++ * passed to untrack_pfn_copy().
+  */
+-static inline int track_pfn_copy(struct vm_area_struct *vma)
++static inline int track_pfn_copy(struct vm_area_struct *dst_vma,
++		struct vm_area_struct *src_vma, unsigned long *pfn)
+ {
+ 	return 0;
+ }
+ 
++/*
++ * untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during
++ * copy_page_range(), but after track_pfn_copy() was already called.
++ */
++static inline void untrack_pfn_copy(struct vm_area_struct *dst_vma,
++		unsigned long pfn)
++{
++}
++
+ /*
+  * untrack_pfn is called while unmapping a pfnmap for a region.
+  * untrack can be called for a specific region indicated by pfn and size or
+@@ -1306,8 +1317,10 @@ static inline void untrack_pfn(struct vm_area_struct *vma,
+ }
+ 
+ /*
+- * untrack_pfn_clear is called while mremapping a pfnmap for a new region
+- * or fails to copy pgtable during duplicate vm area.
++ * untrack_pfn_clear is called in the following cases on a VM_PFNMAP VMA:
++ *
++ * 1) During mremap() on the src VMA after the page tables were moved.
++ * 2) During fork() on the dst VMA, immediately after duplicating the src VMA.
+  */
+ static inline void untrack_pfn_clear(struct vm_area_struct *vma)
+ {
+@@ -1318,7 +1331,10 @@ extern int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
+ 			   unsigned long size);
+ extern void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot,
+ 			     pfn_t pfn);
+-extern int track_pfn_copy(struct vm_area_struct *vma);
++extern int track_pfn_copy(struct vm_area_struct *dst_vma,
++		struct vm_area_struct *src_vma, unsigned long *pfn);
++extern void untrack_pfn_copy(struct vm_area_struct *dst_vma,
++		unsigned long pfn);
+ extern void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
+ 			unsigned long size, bool mm_wr_locked);
+ extern void untrack_pfn_clear(struct vm_area_struct *vma);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 23efaa2c42e4f..97f433fb4b5ef 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -518,6 +518,10 @@ struct vm_area_struct *vm_area_dup(struct vm_area_struct *orig)
+ 	vma_numab_state_init(new);
+ 	dup_anon_vma_name(orig, new);
+ 
++	/* track_pfn_copy() will later take care of copying internal state. */
++	if (unlikely(new->vm_flags & VM_PFNMAP))
++		untrack_pfn_clear(new);
++
+ 	return new;
+ }
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index c39a45481c443..d04faa09eaf6c 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1268,12 +1268,12 @@ int
+ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ {
+ 	pgd_t *src_pgd, *dst_pgd;
+-	unsigned long next;
+ 	unsigned long addr = src_vma->vm_start;
+ 	unsigned long end = src_vma->vm_end;
+ 	struct mm_struct *dst_mm = dst_vma->vm_mm;
+ 	struct mm_struct *src_mm = src_vma->vm_mm;
+ 	struct mmu_notifier_range range;
++	unsigned long next, pfn;
+ 	bool is_cow;
+ 	int ret;
+ 
+@@ -1284,11 +1284,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ 		return copy_hugetlb_page_range(dst_mm, src_mm, dst_vma, src_vma);
+ 
+ 	if (unlikely(src_vma->vm_flags & VM_PFNMAP)) {
+-		/*
+-		 * We do not free on error cases below as remove_vma
+-		 * gets called on error from higher level routine
+-		 */
+-		ret = track_pfn_copy(src_vma);
++		ret = track_pfn_copy(dst_vma, src_vma, &pfn);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -1325,7 +1321,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ 			continue;
+ 		if (unlikely(copy_p4d_range(dst_vma, src_vma, dst_pgd, src_pgd,
+ 					    addr, next))) {
+-			untrack_pfn_clear(dst_vma);
+ 			ret = -ENOMEM;
+ 			break;
+ 		}
+@@ -1335,6 +1330,8 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ 		raw_write_seqcount_end(&src_mm->write_protect_seq);
+ 		mmu_notifier_invalidate_range_end(&range);
+ 	}
++	if (ret && unlikely(src_vma->vm_flags & VM_PFNMAP))
++		untrack_pfn_copy(dst_vma, pfn);
+ 	return ret;
+ }
+ 
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-platform-only-allow-config_eisa-for-32-bit.patch b/queue-6.6/x86-platform-only-allow-config_eisa-for-32-bit.patch
new file mode 100644
index 0000000000..115fbd8a33
--- /dev/null
+++ b/queue-6.6/x86-platform-only-allow-config_eisa-for-32-bit.patch
@@ -0,0 +1,43 @@
+From 39a106941d9f15e2d1907fa51f5a7333aa34c913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2025 22:37:14 +0100
+Subject: x86/platform: Only allow CONFIG_EISA for 32-bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 976ba8da2f3c2f1e997f4f620da83ae65c0e3728 ]
+
+The CONFIG_EISA menu was cleaned up in 2018, but this inadvertently
+brought the option back on 64-bit machines: ISA remains guarded by
+a CONFIG_X86_32 check, but EISA no longer depends on ISA.
+
+The last Intel machines ith EISA support used a 82375EB PCI/EISA bridge
+from 1993 that could be paired with the 440FX chipset on early Pentium-II
+CPUs, long before the first x86-64 products.
+
+Fixes: 6630a8e50105 ("eisa: consolidate EISA Kconfig entry in drivers/eisa")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20250226213714.4040853-11-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index a06fab5016fdf..a0af6e8d584b0 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -215,7 +215,7 @@ config X86
+ 	select HAVE_SAMPLE_FTRACE_DIRECT_MULTI	if X86_64
+ 	select HAVE_EBPF_JIT
+ 	select HAVE_EFFICIENT_UNALIGNED_ACCESS
+-	select HAVE_EISA
++	select HAVE_EISA			if X86_32
+ 	select HAVE_EXIT_THREAD
+ 	select HAVE_FAST_GUP
+ 	select HAVE_FENTRY			if X86_64 || DYNAMIC_FTRACE
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-sev-add-missing-rip_rel_ref-invocations-during-s.patch b/queue-6.6/x86-sev-add-missing-rip_rel_ref-invocations-during-s.patch
new file mode 100644
index 0000000000..fd53c605d8
--- /dev/null
+++ b/queue-6.6/x86-sev-add-missing-rip_rel_ref-invocations-during-s.patch
@@ -0,0 +1,52 @@
+From 4941139ffac43e6cda47aa5783faf1883a5d32cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 20:23:22 +0000
+Subject: x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
+
+From: Kevin Loughlin <kevinloughlin@google.com>
+
+[ Upstream commit 72dafb567760320f2de7447cd6e979bf9d4e5d17 ]
+
+The following commit:
+
+  1c811d403afd ("x86/sev: Fix position dependent variable references in startup code")
+
+introduced RIP_REL_REF() to force RIP-relative accesses to global variables,
+as needed to prevent crashes during early SEV/SME startup code.
+
+For completeness, RIP_REL_REF() should be used with additional variables during
+sme_enable():
+
+  https://lore.kernel.org/all/CAMj1kXHnA0fJu6zh634=fbJswp59kSRAbhW+ubDGj1+NYwZJ-Q@mail.gmail.com/
+
+Access these vars with RIP_REL_REF() to prevent problem reoccurence.
+
+Fixes: 1c811d403afd ("x86/sev: Fix position dependent variable references in startup code")
+Signed-off-by: Kevin Loughlin <kevinloughlin@google.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/r/20241122202322.977678-1-kevinloughlin@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/mem_encrypt_identity.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index cc47a818a640a..075899e3fc8a4 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -562,7 +562,7 @@ void __head sme_enable(struct boot_params *bp)
+ 	}
+ 
+ 	RIP_REL_REF(sme_me_mask) = me_mask;
+-	physical_mask &= ~me_mask;
+-	cc_vendor = CC_VENDOR_AMD;
++	RIP_REL_REF(physical_mask) &= ~me_mask;
++	RIP_REL_REF(cc_vendor) = CC_VENDOR_AMD;
+ 	cc_set_mask(me_mask);
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-sgx-warn-explicitly-if-x86_feature_sgx_lc-is-not.patch b/queue-6.6/x86-sgx-warn-explicitly-if-x86_feature_sgx_lc-is-not.patch
new file mode 100644
index 0000000000..23d58e649f
--- /dev/null
+++ b/queue-6.6/x86-sgx-warn-explicitly-if-x86_feature_sgx_lc-is-not.patch
@@ -0,0 +1,87 @@
+From 52452842bf0a66391a5c59c022ea1dbd5b6fa5ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Mar 2025 18:22:16 +0100
+Subject: x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
+
+From: Vladis Dronov <vdronov@redhat.com>
+
+[ Upstream commit 65be5c95d08eedda570a6c888a12384c77fe7614 ]
+
+The kernel requires X86_FEATURE_SGX_LC to be able to create SGX enclaves,
+not just X86_FEATURE_SGX.
+
+There is quite a number of hardware which has X86_FEATURE_SGX but not
+X86_FEATURE_SGX_LC. A kernel running on such hardware does not create
+the /dev/sgx_enclave file and does so silently.
+
+Explicitly warn if X86_FEATURE_SGX_LC is not enabled to properly notify
+users that the kernel disabled the SGX driver.
+
+The X86_FEATURE_SGX_LC, a.k.a. SGX Launch Control, is a CPU feature
+that enables LE (Launch Enclave) hash MSRs to be writable (with
+additional opt-in required in the 'feature control' MSR) when running
+enclaves, i.e. using a custom root key rather than the Intel proprietary
+key for enclave signing.
+
+I've hit this issue myself and have spent some time researching where
+my /dev/sgx_enclave file went on SGX-enabled hardware.
+
+Related links:
+
+  https://github.com/intel/linux-sgx/issues/837
+  https://patchwork.kernel.org/project/platform-driver-x86/patch/20180827185507.17087-3-jarkko.sakkinen@linux.intel.com/
+
+[ mingo: Made the error message a bit more verbose, and added other cases
+         where the kernel fails to create the /dev/sgx_enclave device node. ]
+
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Kai Huang <kai.huang@intel.com>
+Cc: Jarkko Sakkinen <jarkko@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Sean Christopherson <sean.j.christopherson@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250309172215.21777-2-vdronov@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/sgx/driver.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/sgx/driver.c b/arch/x86/kernel/cpu/sgx/driver.c
+index 262f5fb18d74d..c453953d5a33f 100644
+--- a/arch/x86/kernel/cpu/sgx/driver.c
++++ b/arch/x86/kernel/cpu/sgx/driver.c
+@@ -150,13 +150,15 @@ int __init sgx_drv_init(void)
+ 	u64 xfrm_mask;
+ 	int ret;
+ 
+-	if (!cpu_feature_enabled(X86_FEATURE_SGX_LC))
++	if (!cpu_feature_enabled(X86_FEATURE_SGX_LC)) {
++		pr_info("SGX disabled: SGX launch control CPU feature is not available, /dev/sgx_enclave disabled.\n");
+ 		return -ENODEV;
++	}
+ 
+ 	cpuid_count(SGX_CPUID, 0, &eax, &ebx, &ecx, &edx);
+ 
+ 	if (!(eax & 1))  {
+-		pr_err("SGX disabled: SGX1 instruction support not available.\n");
++		pr_info("SGX disabled: SGX1 instruction support not available, /dev/sgx_enclave disabled.\n");
+ 		return -ENODEV;
+ 	}
+ 
+@@ -173,8 +175,10 @@ int __init sgx_drv_init(void)
+ 	}
+ 
+ 	ret = misc_register(&sgx_dev_enclave);
+-	if (ret)
++	if (ret) {
++		pr_info("SGX disabled: Unable to register the /dev/sgx_enclave driver (%d).\n", ret);
+ 		return ret;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-traps-make-exc_double_fault-consistently-noretur.patch b/queue-6.6/x86-traps-make-exc_double_fault-consistently-noretur.patch
new file mode 100644
index 0000000000..5da07f4f0a
--- /dev/null
+++ b/queue-6.6/x86-traps-make-exc_double_fault-consistently-noretur.patch
@@ -0,0 +1,127 @@
+From 6a11e95b63ae18b3ce58de48cc78dd5c3e4c4066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 12:28:59 -0700
+Subject: x86/traps: Make exc_double_fault() consistently noreturn
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 8085fcd78c1a3dbdf2278732579009d41ce0bc4e ]
+
+The CONFIG_X86_ESPFIX64 version of exc_double_fault() can return to its
+caller, but the !CONFIG_X86_ESPFIX64 version never does.  In the latter
+case the compiler and/or objtool may consider it to be implicitly
+noreturn.
+
+However, due to the currently inflexible way objtool detects noreturns,
+a function's noreturn status needs to be consistent across configs.
+
+The current workaround for this issue is to suppress unreachable
+warnings for exc_double_fault()'s callers.  Unfortunately that can
+result in ORC coverage gaps and potentially worse issues like inert
+static calls and silently disabled CPU mitigations.
+
+Instead, prevent exc_double_fault() from ever being implicitly marked
+noreturn by forcing a return behind a never-taken conditional.
+
+Until a more integrated noreturn detection method exists, this is likely
+the least objectionable workaround.
+
+Fixes: 55eeab2a8a11 ("objtool: Ignore exc_double_fault() __noreturn warnings")
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Brendan Jackman <jackmanb@google.com>
+Link: https://lore.kernel.org/r/d1f4026f8dc35d0de6cc61f2684e0cb6484009d1.1741975349.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/traps.c | 18 +++++++++++++++++-
+ tools/objtool/check.c   | 31 +------------------------------
+ 2 files changed, 18 insertions(+), 31 deletions(-)
+
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 37b8e20c03a9f..d8d9bc5a9b328 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -377,6 +377,21 @@ __visible void __noreturn handle_stack_overflow(struct pt_regs *regs,
+ }
+ #endif
+ 
++/*
++ * Prevent the compiler and/or objtool from marking the !CONFIG_X86_ESPFIX64
++ * version of exc_double_fault() as noreturn.  Otherwise the noreturn mismatch
++ * between configs triggers objtool warnings.
++ *
++ * This is a temporary hack until we have compiler or plugin support for
++ * annotating noreturns.
++ */
++#ifdef CONFIG_X86_ESPFIX64
++#define always_true() true
++#else
++bool always_true(void);
++bool __weak always_true(void) { return true; }
++#endif
++
+ /*
+  * Runs on an IST stack for x86_64 and on a special task stack for x86_32.
+  *
+@@ -512,7 +527,8 @@ DEFINE_IDTENTRY_DF(exc_double_fault)
+ 
+ 	pr_emerg("PANIC: double fault, error_code: 0x%lx\n", error_code);
+ 	die("double fault", regs, error_code);
+-	panic("Machine halted.");
++	if (always_true())
++		panic("Machine halted.");
+ 	instrumentation_end();
+ }
+ 
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 6e59e7f578ffe..5824aa68ff961 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4511,35 +4511,6 @@ static int validate_sls(struct objtool_file *file)
+ 	return warnings;
+ }
+ 
+-static bool ignore_noreturn_call(struct instruction *insn)
+-{
+-	struct symbol *call_dest = insn_call_dest(insn);
+-
+-	/*
+-	 * FIXME: hack, we need a real noreturn solution
+-	 *
+-	 * Problem is, exc_double_fault() may or may not return, depending on
+-	 * whether CONFIG_X86_ESPFIX64 is set.  But objtool has no visibility
+-	 * to the kernel config.
+-	 *
+-	 * Other potential ways to fix it:
+-	 *
+-	 *   - have compiler communicate __noreturn functions somehow
+-	 *   - remove CONFIG_X86_ESPFIX64
+-	 *   - read the .config file
+-	 *   - add a cmdline option
+-	 *   - create a generic objtool annotation format (vs a bunch of custom
+-	 *     formats) and annotate it
+-	 */
+-	if (!strcmp(call_dest->name, "exc_double_fault")) {
+-		/* prevent further unreachable warnings for the caller */
+-		insn->sym->warned = 1;
+-		return true;
+-	}
+-
+-	return false;
+-}
+-
+ static int validate_reachable_instructions(struct objtool_file *file)
+ {
+ 	struct instruction *insn, *prev_insn;
+@@ -4556,7 +4527,7 @@ static int validate_reachable_instructions(struct objtool_file *file)
+ 		prev_insn = prev_insn_same_sec(file, insn);
+ 		if (prev_insn && prev_insn->dead_end) {
+ 			call_dest = insn_call_dest(prev_insn);
+-			if (call_dest && !ignore_noreturn_call(prev_insn)) {
++			if (call_dest) {
+ 				WARN_INSN(insn, "%s() is missing a __noreturn annotation",
+ 					  call_dest->name);
+ 				warnings++;
+-- 
+2.39.5
+
diff --git a/queue-6.6/x86-uaccess-improve-performance-by-aligning-writes-t.patch b/queue-6.6/x86-uaccess-improve-performance-by-aligning-writes-t.patch
new file mode 100644
index 0000000000..f42ff4cade
--- /dev/null
+++ b/queue-6.6/x86-uaccess-improve-performance-by-aligning-writes-t.patch
@@ -0,0 +1,190 @@
+From 62341b0ed971308f73f48faa2ffb91d430cec74a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 11:22:13 -0300
+Subject: x86/uaccess: Improve performance by aligning writes to 8 bytes in
+ copy_user_generic(), on non-FSRM/ERMS CPUs
+
+From: Herton R. Krzesinski <herton@redhat.com>
+
+[ Upstream commit b5322b6ec06a6c58650f52abcd2492000396363b ]
+
+History of the performance regression:
+======================================
+
+Since the following series of user copy updates were merged upstream
+~2 years ago via:
+
+  a5624566431d ("Merge branch 'x86-rep-insns': x86 user copy clarifications")
+
+.. copy_user_generic() on x86_64 stopped doing alignment of the
+writes to the destination to a 8 byte boundary for the non FSRM case.
+
+Previously, this was done through the ALIGN_DESTINATION macro that
+was used in the now removed copy_user_generic_unrolled function.
+
+Turns out this change causes some loss of performance/throughput on
+some use cases and specific CPU/platforms without FSRM and ERMS.
+
+Lately I got two reports of performance/throughput issues after a
+RHEL 9 kernel pulled the same upstream series with updates to user
+copy functions. Both reports consisted of running specific
+networking/TCP related testing using iperf3.
+
+Partial upstream fix
+====================
+
+The first report was related to a Linux Bridge testing using VMs on a
+specific machine with an AMD CPU (EPYC 7402), and after a brief
+investigation it turned out that the later change via:
+
+  ca96b162bfd2 ("x86: bring back rep movsq for user access on CPUs without ERMS")
+
+... helped/fixed the performance issue.
+
+However, after the later commit/fix was applied, then I got another
+regression reported in a multistream TCP test on a 100Gbit mlx5 nic, also
+running on an AMD based platform (AMD EPYC 7302 CPU), again that was using
+iperf3 to run the test. That regression was after applying the later
+fix/commit, but only this didn't help in telling the whole history.
+
+Testing performed to pinpoint residual regression
+=================================================
+
+So I narrowed down the second regression use case, but running it
+without traffic through a NIC, on localhost, in trying to narrow down
+CPU usage and not being limited by other factor like network bandwidth.
+I used another system also with an AMD CPU (AMD EPYC 7742). Basically,
+I run iperf3 in server and client mode in the same system, for example:
+
+ - Start the server binding it to CPU core/thread 19:
+   $ taskset -c 19 iperf3 -D -s -B 127.0.0.1 -p 12000
+
+ - Start the client always binding/running on CPU core/thread 17, using
+   perf to get statistics:
+   $ perf stat -o stat.txt taskset -c 17 iperf3 -c 127.0.0.1 -b 0/1000 -V \
+       -n 50G --repeating-payload -l 16384 -p 12000 --cport 12001 2>&1 \
+       > stat-19.txt
+
+For the client, always running/pinned to CPU 17. But for the iperf3 in
+server mode, I did test runs using CPUs 19, 21, 23 or not pinned to any
+specific CPU. So it basically consisted with four runs of the same
+commands, just changing the CPU which the server is pinned, or without
+pinning by removing the taskset call before the server command. The CPUs
+were chosen based on NUMA node they were on, this is the relevant output
+of lscpu on the system:
+
+  $ lscpu
+  ...
+    Model name:             AMD EPYC 7742 64-Core Processor
+  ...
+  Caches (sum of all):
+    L1d:                    2 MiB (64 instances)
+    L1i:                    2 MiB (64 instances)
+    L2:                     32 MiB (64 instances)
+    L3:                     256 MiB (16 instances)
+  NUMA:
+    NUMA node(s):           4
+    NUMA node0 CPU(s):      0,1,8,9,16,17,24,25,32,33,40,41,48,49,56,57,64,65,72,73,80,81,88,89,96,97,104,105,112,113,120,121
+    NUMA node1 CPU(s):      2,3,10,11,18,19,26,27,34,35,42,43,50,51,58,59,66,67,74,75,82,83,90,91,98,99,106,107,114,115,122,123
+    NUMA node2 CPU(s):      4,5,12,13,20,21,28,29,36,37,44,45,52,53,60,61,68,69,76,77,84,85,92,93,100,101,108,109,116,117,124,125
+    NUMA node3 CPU(s):      6,7,14,15,22,23,30,31,38,39,46,47,54,55,62,63,70,71,78,79,86,87,94,95,102,103,110,111,118,119,126,127
+  ...
+
+So for the server run, when picking a CPU, I chose CPUs to be not on the same
+node. The reason is with that I was able to get/measure relevant
+performance differences when changing the alignment of the writes to the
+destination in copy_user_generic.
+
+Testing shows up to +81% performance improvement under iperf3
+=============================================================
+
+Here's a summary of the iperf3 runs:
+
+  # Vanilla upstream alignment:
+
+		     CPU      RATE          SYS          TIME     sender-receiver
+	Server bind   19: 13.0Gbits/sec 28.371851000 33.233499566 86.9%-70.8%
+	Server bind   21: 12.9Gbits/sec 28.283381000 33.586486621 85.8%-69.9%
+	Server bind   23: 11.1Gbits/sec 33.660190000 39.012243176 87.7%-64.5%
+	Server bind none: 18.9Gbits/sec 19.215339000 22.875117865 86.0%-80.5%
+
+  # With the attached patch (aligning writes in non ERMS/FSRM case):
+
+		     CPU      RATE          SYS          TIME     sender-receiver
+	Server bind   19: 20.8Gbits/sec 14.897284000 20.811101382 75.7%-89.0%
+	Server bind   21: 20.4Gbits/sec 15.205055000 21.263165909 75.4%-89.7%
+	Server bind   23: 20.2Gbits/sec 15.433801000 21.456175000 75.5%-89.8%
+	Server bind none: 26.1Gbits/sec 12.534022000 16.632447315 79.8%-89.6%
+
+So I consistently got better results when aligning the write. The
+results above were run on 6.14.0-rc6/rc7 based kernels. The sys is sys
+time and then the total time to run/transfer 50G of data. The last
+field is the CPU usage of sender/receiver iperf3 process. It's also
+worth to note that each pair of iperf3 runs may get slightly different
+results on each run, but I always got consistent higher results with
+the write alignment for this specific test of running the processes
+on CPUs in different NUMA nodes.
+
+Linus Torvalds helped/provided this version of the patch. Initially I
+proposed a version which aligned writes for all cases in
+rep_movs_alternative, however it used two extra registers and thus
+Linus provided an enhanced version that only aligns the write on the
+large_movsq case, which is sufficient since the problem happens only
+on those AMD CPUs like ones mentioned above without ERMS/FSRM, and
+also doesn't require using extra registers. Also, I validated that
+aligning only on large_movsq case is really enough for getting the
+performance back.
+
+I also tested this patch on an old Intel based non-ERMS/FRMS system
+(with Xeon E5-2667 - Sandy Bridge based) and didn't get any problems:
+no performance enhancement but also no regression either, using the
+same iperf3 based benchmark. Also newer Intel processors after
+Sandy Bridge usually have ERMS and should not be affected by this change.
+
+[ mingo: Updated the changelog. ]
+
+Fixes: ca96b162bfd2 ("x86: bring back rep movsq for user access on CPUs without ERMS")
+Fixes: 034ff37d3407 ("x86: rewrite '__copy_user_nocache' function")
+Reported-by: Ondrej Lichtner <olichtne@redhat.com>
+Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Herton R. Krzesinski <herton@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20250320142213.2623518-1-herton@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/copy_user_64.S | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
+index 0a81aafed7f88..0544a24baedb5 100644
+--- a/arch/x86/lib/copy_user_64.S
++++ b/arch/x86/lib/copy_user_64.S
+@@ -74,6 +74,24 @@ SYM_FUNC_START(rep_movs_alternative)
+ 	_ASM_EXTABLE_UA( 0b, 1b)
+ 
+ .Llarge_movsq:
++	/* Do the first possibly unaligned word */
++0:	movq (%rsi),%rax
++1:	movq %rax,(%rdi)
++
++	_ASM_EXTABLE_UA( 0b, .Lcopy_user_tail)
++	_ASM_EXTABLE_UA( 1b, .Lcopy_user_tail)
++
++	/* What would be the offset to the aligned destination? */
++	leaq 8(%rdi),%rax
++	andq $-8,%rax
++	subq %rdi,%rax
++
++	/* .. and update pointers and count to match */
++	addq %rax,%rdi
++	addq %rax,%rsi
++	subq %rax,%rcx
++
++	/* make %rcx contain the number of words, %rax the remainder */
+ 	movq %rcx,%rax
+ 	shrq $3,%rcx
+ 	andl $7,%eax
+-- 
+2.39.5
+
-- 
2.47.3