From a2c72afe7435906e0e0a479c1030cf94c2bbdd55 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sun, 1 Dec 2024 07:06:14 -0500
Subject: [PATCH] Fixes for 6.6

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...t-error-handling-procedure-in-gtdt_p.patch |   46 +
 ...cppc-fix-_cpc-register-setting-issue.patch |   42 +
 ...re-release-resources-at-card-release.patch |   78 +
 ...nd_card_free_when_closed-at-disconne.patch |  168 ++
 ...ealtek-update-alc256-depop-procedure.patch |  102 ++
 ...snd_card_free_when_closed-at-disconn.patch |   50 +
 ...nd_card_free_when_closed-at-disconne.patch |   46 +
 ...in_perf-to-nominal_perf-for-active-m.patch |   45 +
 ...simple-duplicate-message-elimination.patch |   35 +
 ...ard4-fix-dcdc5-regulator-constraints.patch |   56 +
 ...p-sam9x60-add-missing-property-atmel.patch |  137 ++
 ...m-dts-renesas-genmai-add-flash-nodes.patch |  129 ++
 ...genmai-fix-partition-size-for-qspi-n.patch |   40 +
 ...remove-unused-lbsc-nodes-from-board-.patch |  144 ++
 ...ek-add-adc-node-on-mt6357-mt6358-mt6.patch |   75 +
 ...mediatek-mt6358-fix-dtbs_check-error.patch |   47 +
 ...ek-mt8173-elm-hana-add-vdd-supply-to.patch |   50 +
 ...ek-mt8183-kukui-jacuzzi-add-supplies.patch |   64 +
 ...ek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch |  112 ++
 ...-burnet-add-i2c2-s-i2c-scl-internal-.patch |   37 +
 ...-cozmo-add-i2c2-s-i2c-scl-internal-d.patch |   39 +
 ...-damu-add-i2c2-s-i2c-scl-internal-de.patch |   37 +
 ...-fennel-add-i2c2-s-i2c-scl-internal-.patch |   38 +
 ...-krane-fix-the-address-of-eeprom-at-.patch |   41 +
 ...-kukui-fix-the-address-of-eeprom-at-.patch |   59 +
 ...-fix-dtbs_check-error-for-infracfg_a.patch |   44 +
 ...-fix-dtbs_check-error-for-mutex-node.patch |   45 +
 ...c8180x-add-a-soc-specific-compatible.patch |   40 +
 ...m6350-fix-gpu-frequencies-missing-on.patch |   88 +
 ...-renesas-hihope-drop-sound-dai-cells.patch |   61 +
 ...ip-correct-analog-audio-name-on-indi.patch |   39 +
 ...j7200-fix-clock-ids-for-mcspi-instan.patch |  139 ++
 ...j7200-fix-register-map-for-main-doma.patch |  100 ++
 ...j7200-use-ti-j7200-padconf-compatibl.patch |  125 ++
 ...j721e-fix-clock-ids-for-mcspi-instan.patch |   59 +
 ...j721s2-fix-clock-ids-for-mcspi-insta.patch |  136 ++
 ...rel.ro-size-assertion-when-config_lt.patch |   56 +
 ...able-kprobes-uprobes-on-mops-instruc.patch |   60 +
 ...for-enabling-dmic-on-acp6x-via-_dsd-.patch |   65 +
 ...-mt6359-update-generic-node-name-and.patch |   77 +
 ...l_micfil-fix-regmap_write_bits-usage.patch |   47 +
 ...remove-logically-deadcode-in-rt722-s.patch |   47 +
 ...lit_rw_at-to-take-zone_write_granula.patch |   54 +
 ...e-after-free-in-device_for_each_chil.patch |  150 ++
 ...luetooth-mgmt-fix-possible-deadlocks.patch |  150 ++
 ...ix-slab-use-after-free-read-in-set_p.patch |  126 ++
 .../bnxt_en-refactor-bnxt_ptp_init.patch      |   98 ++
 ...rings-after-pcie-aer-recovery-if-nic.patch |   54 +
 ...er-ptp-during-pci-shutdown-and-suspe.patch |   66 +
 ...-garbage-frame-for-struct_ops-trampo.patch |  140 ++
 .../bpf-bpftool-fix-incorrect-disasm-pc.patch |  163 ++
 ...e-lock-when-verdict-program-return-s.patch |   66 +
 ...he-xdp_adjust_tail-sample-prog-issue.patch |   41 +
 ...probe-bpf-program-to-always-return-0.patch |   59 +
 .../bpf-sockmap-fix-sk_msg_reset_curr.patch   |   70 +
 ...ap-several-fixes-to-bpf_msg_pop_data.patch |  104 ++
 ...p-several-fixes-to-bpf_msg_push_data.patch |  132 ++
 ...tic-disk-creation-until-module-initi.patch |  209 +++
 ...issing-pos-updates-in-cachefiles_ond.patch |   51 +
 ...cgroup-v2-can-be-attached-by-bpf-pro.patch |   70 +
 ...lways-parse-orig_commit-in-fixes-tag.patch |  120 ++
 ...ckpatch-check-for-missing-fixes-tags.patch |  147 ++
 ...-nco-add-null-check-in-applnco_probe.patch |   42 +
 ...en-make-sure-to-enable-the-axi-bus-c.patch |   82 +
 ...fix-clk-enable-state-save-and-restor.patch |   45 +
 ...ppll-correct-pll-initialization-flow.patch |   60 +
 ...clk-imx-fracn-gppll-fix-pll-power-up.patch |   87 +
 ...-fix-return-value-check-in-clk_imx_a.patch |   43 +
 ...-scu-sw-workaround-for-errata-e10858.patch |  113 ++
 ...ediatek-drop-two-dead-config-options.patch |   64 +
 ...s-fix-clock-plan-for-ralink-soc-rt38.patch |   58 +
 ...s-fix-clocks-probe-order-in-oldest-r.patch |  133 ++
 ...lk-renesas-rzg2l-fix-foutpostdiv-clk.patch |   56 +
 ...lk-sunxi-ng-d1-fix-pll_audio0-preset.patch |   42 +
 ...e-drivers-sp804-make-user-selectable.patch |   49 +
 ...ers-timer-ti-dm-fix-child-node-refco.patch |   46 +
 ...2-timer-cnt-add-check-for-clk_enable.patch |   62 +
 ...cap-capture-add-check-for-clk_enable.patch |   44 +
 ...-desired-perf-if-feedback-ctrs-are-0.patch |  128 ++
 ...-possible-null-ptr-deref-for-cppc_ge.patch |   38 +
 ...-possible-null-ptr-deref-for-cpufreq.patch |   37 +
 ...-wrong-return-value-in-cppc_get_cpu_.patch |   42 +
 ...-return-value-in-cppc_get_cpu_.patch-19495 |   40 +
 ...2-unregister-platform_driver-on-fail.patch |   39 +
 ...10-use-the-correct-bit-to-test-for-p.patch |   38 +
 ...rror-check-in-the-ahash_hmac_init-fu.patch |   47 +
 ...error-check-to-caam_rsa_set_priv_key.patch |   78 +
 ...the-pointer-passed-to-caam_qi_shutdo.patch |   40 +
 ...x-an-error-handling-path-in-cpt_ucod.patch |   38 +
 ...x-the-if-condition-to-exit-loop-afte.patch |   53 +
 ...-qm-disable-same-error-report-before.patch |  340 ++++
 ...cure-fix-the-return-value-of-safexce.patch |   41 +
 ...ll-crypto-layer-directly-when-padata.patch |   59 +
 ...10-aes-gcm-add-dependency-on-crypto_.patch |   42 +
 ...p10-aes-gcm-register-modules-as-simd.patch |  310 ++++
 ..._4xxx-fix-off-by-one-in-uof_get_name.patch |   37 +
 ...emove-check-after-debugfs_create_dir.patch |   76 +
 ...t-remove-faulty-arbiter-config-reset.patch |   45 +
 .../dax-delete-a-stale-directory-pmem.patch   |   61 +
 ...update-printed-dynticks-counter-bits.patch |   38 +
 ...nx-add-the-missing-kfree-in-xlnx_add.patch |   42 +
 ...fix-null-check-for-pipe_ctx-plane_st.patch |   41 +
 ...-amdkfd-fix-wrong-usage-of-init_work.patch |   49 +
 ...25-drop-edid-cache-on-bridge-power-o.patch |   45 +
 ...5-drop-edid-cache-on-bridge-power-of.patch |   45 +
 ...358767-fix-link-properties-discovery.patch |   60 +
 ...old-gpu-lock-across-perfmon-sampling.patch |   78 +
 ...est-pages-from-dma32-zone-on-address.patch |   68 +
 ...drm-fsl-dcu-enable-pixclk-on-ls1021a.patch |   88 +
 ...e-irqf_no_autoen-flag-in-request_irq.patch |   49 +
 ...e-irqf_no_autoen-flag-in-request_irq.patch |   48 +
 ...mm_interval_tree-functions-with-__ma.patch |   52 +
 ...se-irqf_no_autoen-flag-in-request_ir.patch |   47 +
 ...-crtc_clk-calculation-to-u64-in-_dpu.patch |   46 +
 ...rm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch |   49 +
 ...drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch |   48 +
 ...-on-sdm845-move-dspp_3-to-lm_5-block.patch |   45 +
 ...k-the-status-of-registration-to-pm-q.patch |   51 +
 ...f100-fix-missing-unlock-in-gf100_gr_.patch |   41 +
 ...p-fix-locking-in-omap_gem_new_dmabuf.patch |   75 +
 ...m-omap-fix-possible-null-dereference.patch |  135 ++
 ...ove-unused-id_mask-from-struct-panfr.patch |   35 +
 ...m-radeon-add-helper-rdev_to_drm-rdev.patch |   43 +
 ...change-rdev-ddev-to-rdev_to_drm-rdev.patch | 1459 +++++++++++++++++
 ...spurious-unplug-event-on-radeon-hdmi.patch |   64 +
 ...drm-use-atomic64_init-for-atomic64_t.patch |   37 +
 ...-address-race-condition-in-mmu-flush.patch |   80 +
 ...id-hang-with-debug-registers-when-su.patch |   53 +
 ...ect-logic-on-stopping-an-hvs-channel.patch |   55 +
 ...4-hvs-don-t-write-gamma-luts-on-2711.patch |   41 +
 ...dlist-debug-not-resetting-the-next-e.patch |   46 +
 ...ve-incorrect-limit-from-hvs_dlist-de.patch |   74 +
 ...m_dev_enter-and-exit-calls-in-vc4_hv.patch |   51 +
 ...unnecessary-call-to-drm_crtc_cleanup.patch |   52 +
 ...kms-unplug-drm-device-before-removal.patch |   40 +
 ...ngs-clock-axi-clkgen-include-axi-clk.patch |   72 +
 ...-vendor-prefixes-add-neofidelity-inc.patch |   36 +
 ...field-fix-potential-integer-overflow.patch |   43 +
 ...fsl_ddr-fix-bad-bit-shift-operations.patch |   75 +
 ...-segmentation-fault-on-module-unload.patch |   56 +
 ...n-differentiate-memory-error-sources.patch |  147 ++
 ...i10nm-fix-incorrect-far-memory-error.patch |  107 ++
 ...efi_parse_options-ignoring-the-defau.patch |   41 +
 ...nonhead-delta-1-lclusters-gracefully.patch |   90 +
 ...mount-errors-with-abort-mount-option.patch |   66 +
 ...-in-buffer_head-read-fault-injection.patch |  293 ++++
 ...buffer-reads-in-mext_page_mkuptodate.patch |   86 +
 ...y-of-buffer_heads-from-mext_page_mku.patch |   79 +
 ...s-to-to-set-clear-the-folio-error-fl.patch |   77 +
 ...g-inited-before-write_sum_page-in-ch.patch |   39 +
 ...x-inconsistent-update-of-i_blocks-in.patch |   67 +
 ...ce-in-concurrent-f2fs_stop_gc_thread.patch |   93 ++
 ...ng-f2fs_bug_on-condition-in-f2fs_do_.patch |   40 +
 ...unt-dirty-data-in-__get_secs_require.patch |  132 ++
 ...d-forcing-direct-write-to-use-buffer.patch |   49 +
 ...d-potential-deadlock-in-f2fs_record_.patch |  230 +++
 ...d-use-gc_at-when-setting-gc_mode-as-.patch |   70 +
 ...ix-a-possible-memory-leak-in-sh7760f.patch |   43 +
 ...i-check-the-dvfs-opp-count-returned-.patch |   93 ++
 ...le-unregister-driver_info-on-failure.patch |   53 +
 ...fix-possible-resource-leak-in-fw_log.patch |   58 +
 ...fix-coccinelle-reported-error-instan.patch |   79 +
 ...-mount_api-doc-to-match-function-sig.patch |   45 +
 ...low-immediate-glf_verify_delete-work.patch |   64 +
 ...t-glf_lock-in-gfs2_dispose_glock_lru.patch |   43 +
 .../gfs2-fix-unlinked-inode-cleanup.patch     |   85 +
 ...gfs2_glock_queue_put-in-signal_our_w.patch |   36 +
 ...ve-and-replace-gfs2_glock_queue_work.patch |  163 ++
 ...lf_verify_evict-to-glf_verify_delete.patch |   99 ++
 ...2_glock_queue_put-with-gfs2_glock_pu.patch |  129 ++
 ...evio-add-missed-label-initialisation.patch |   55 +
 ...ery-the-device-logical-block-size-mu.patch |  139 ++
 ...mline-driver-probe-to-avoid-devres-i.patch |  182 ++
 ...re-fix-overflows-seen-when-writing-l.patch |   58 +
 ...-clear-faults-after-setting-smbalert.patch |   61 +
 ...re-allow-to-hook-pmbus_smbalert_mask.patch |   41 +
 ...ix-reporting-of-negative-temperature.patch |   42 +
 ...-resources-just-before-first-qp-srq-.patch |  295 ++++
 ...ently-use-q_idx-in-ice_vc_cfg_qs_msg.patch |  105 ++
 ...support-fcs-crc-strip-disable-for-vf.patch |   60 +
 ...-fix-an-error-handling-path-in-al301.patch |   58 +
 ...tramfs-avoid-filename-buffer-overrun.patch |  118 ++
 ...hecks-and-print-in-dmar_fault_dump_p.patch |  131 ++
 ...fix-checks-and-print-in-pgtable_walk.patch |   62 +
 ...p6mr-fix-tables-suspicious-rcu-usage.patch |  140 ++
 ...ipmr-fix-tables-suspicious-rcu-usage.patch |  154 ++
 ...v6-release-nexthop-on-device-removal.patch |   99 ++
 ...x-incorrect-assumption-in-read_seqbe.patch |   78 +
 ...san-seqlock-support-seqcount_latch_t.patch |  210 +++
 ...mte-fix-printf-type-warnings-about-_.patch |   59 +
 ...mte-fix-printf-type-warnings-about-l.patch |   51 +
 ...v-avoid-returning-to-nested-hypervis.patch |   78 +
 ...v-stop-using-vc-dpdes-for-nested-kvm.patch |  113 ++
 ...ted_attach_type-set-handling-in-prog.patch |   68 +
 ...ut-.symtab-byte-order-during-linking.patch |   40 +
 ...s_subprog-logic-for-weak-global-subp.patch |   49 +
 ...erpret-subprogs-in-.text-as-entry-pr.patch |   47 +
 ...ockopt-handling-of-malformed-user-in.patch |   42 +
 ...ngarch-bpf-sign-extend-return-values.patch |   91 +
 ...-build-failure-with-gcc-15-std-gnu23.patch |   68 +
 ...vice.c-only-build-fec-when-hw-macros.patch |   77 +
 ...-incorrect-register-offset-for-confi.patch |   37 +
 ...e147-fix-scsi-controller-irq-numbers.patch |   46 +
 ...m68k-mvme147-reinstate-early-console.patch |  113 ++
 .../m68k-mvme16x-add-and-use-mvme16x.h.patch  |   76 +
 ...2-clean-up-loop-in-get_irq_chan_comb.patch |   58 +
 ...th-fix-call-balance-of-pep-clk-handl.patch |   76 +
 ...d-check-for-rgby_data-memory-allocat.patch |   42 +
 ...960-fix-missing-return-check-on-ub96.patch |   41 +
 ...-venus-fix-enc-dec-destruction-order.patch |   74 +
 ...-with-threaded-irq-during-inst-destr.patch |  146 ++
 ...2-spi-change-read-mask-to-write-mask.patch |   38 +
 ...ic_bxtwc-use-irq-domain-for-pmic-dev.patch |  118 ++
 ...ic_bxtwc-use-irq-domain-for-tmu-devi.patch |  147 ++
 ...ic_bxtwc-use-irq-domain-for-usb-type.patch |  142 ++
 ...5033-fix-missing-regmap_del_irq_chip.patch |   39 +
 ...-irqf_no_autoen-flag-in-request_irq-.patch |   49 +
 ...roblaze-export-xmb_manager-functions.patch |   58 +
 ...rning-when-disabling-mips_fp_support.patch |   49 +
 ...s990x-fix-missing-pm_runtime_disable.patch |   67 +
 .../mmc-mmc_spi-drop-buggy-snprintf.patch     |   66 +
 ...c-if-add-missing-module_device_table.patch |   48 +
 ...-if-convert-to-platform-remove-callb.patch |   66 +
 ...wnand-atmel-fix-possible-memory-leak.patch |   70 +
 ...sion-use-nor-addr_nbytes-in-octal-dt.patch |   38 +
 ...init_sk-vs-network-transport-headers.patch |   61 +
 ...temporary-address-if-mngtmpaddr-is-r.patch |  105 ++
 ...mdio-ipq4019-add-missing-error-check.patch |   43 +
 ...ap-add-typegroup-table-terminators-i.patch |  134 ++
 ...rfkill-gpio-add-check-for-clk_enable.patch |   44 +
 ...-socfpga-set-rx-watchdog-interrupt-a.patch |   50 +
 ...fix-double-free-issue-with-interrupt.patch |  101 ++
 ...fix-memory-leak-on-device-unplug-by-.patch |   51 +
 ...fix-refcounting-and-autosuspend-on-i.patch |   49 +
 queue-6.6/net-use-unrcu_pointer-helper.patch  |  251 +++
 ...-addresses-for-both-in-and-out-paths.patch |   70 +
 ...les-avoid-false-positive-lockdep-spl.patch |  133 ++
 ...les-introduce-nf_tables_getrule_sing.patch |  147 ++
 ...les-must-hold-rcu-read-lock-while-it.patch |   84 +
 ...must-hold-rcu-read-lock-while-it.patch-562 |   75 +
 ...les-open-code-audit-log-call-in-nf_t.patch |   77 +
 ...les-skip-transaction-if-update-objec.patch |   54 +
 ...d-a-memory-barrier-for-fscache_volum.patch |   67 +
 ...hical-error-in-nlmsg_type-constants-.patch |   36 +
 ..._access_pointer-in-netpoll_poll_lock.patch |   45 +
 ...ber-of-bytes-copied-by-nfs4_reset_re.patch |   37 +
 queue-6.6/nfsd-fix-nfsd4_shutdown_copy.patch  |   73 +
 ...l-dereference-in-nfsd4_process_cb_up.patch |   37 +
 ...-svc_expkey-svc_export-with-rcu_work.patch |  199 +++
 ...-freeing-of-the-hmb-descriptor-table.patch |   94 ++
 ...erse-request-order-in-nvme_queue_rqs.patch |   93 ++
 ...ialized-value-in-ocfs2_file_read_ite.patch |   98 ++
 ...iesce-traffic-before-nix-block-reset.patch |  337 ++++
 ...2-af-rpm-fix-low-network-performance.patch |  157 ++
 ...tx2-af-rpm-fix-mismatch-in-lmac-type.patch |   37 +
 ...ntx2-af-rpm-fix-stale-fcfec-counters.patch |   90 +
 ...ntx2-af-rpm-fix-stale-rsfec-counters.patch |   83 +
 ...dle-otx2_mbox_get_rsp-errors-in-cn10.patch |   39 +
 ...dle-otx2_mbox_get_rsp-errors-in-otx2.patch |   38 +
 ...tx2_mbox_get_rsp-errors-in-otx2.patch-1819 |   60 +
 ...x2_mbox_get_rsp-errors-in-otx2.patch-18928 |   52 +
 ...tx2_mbox_get_rsp-errors-in-otx2.patch-5160 |   39 +
 ...otx2_mbox_get_rsp-errors-in-otx2.patch-921 |   51 +
 ...ntx2-pf-reset-mac-stats-during-probe.patch |  270 +++
 ...ys-arg-to-early_init_dt_scan-and-ear.patch |  385 +++++
 ...isc-implement-fixmap-to-fix-earlycon.patch |  164 ++
 queue-6.6/pci-add-t_pvperl-macro.patch        |   44 +
 ...act-link-setup-sequence-from-cdns_pc.patch |  110 ++
 ...dence-set-cdns_pcie_host_init-global.patch |   78 +
 ...-fix-pcibios_-return-value-confusion.patch |   85 +
 ...ci_possible_error-to-check-config-re.patch |   47 +
 ...-mhi-avoid-null-dereference-if-dt-la.patch |   55 +
 ...i-fix-reset_method_store-memory-leak.patch |   57 +
 ...e-add-pcie-4x-lane-selection-support.patch |   78 +
 ...d-per-platform-maximum-lane-settings.patch |  107 ++
 ...-add-reset-gpio-to-struct-j721e_pcie.patch |   48 +
 ...j721e-add-suspend-and-resume-support.patch |  169 ++
 ...rt-perst-after-a-delay-of-pcie_t_pvp.patch |   85 +
 .../pci-j721e-use-t_perst_clk_us-macro.patch  |   40 +
 ...n-t-flush-when-packet_queue-fills-up.patch |  121 ++
 ...ncy-fix-unit-on-histogram-first-entr.patch |   93 ++
 ...ix-topic-and-pmu_name-argument-order.patch |  171 ++
 ...rrect-demangled-symbols-in-c-program.patch |  141 ++
 .../perf-probe-fix-libdw-memory-leak.patch    |   69 +
 ...cork_fd-when-create_perf_stat_counte.patch |  236 +++
 ...-affinity-memory-leaks-on-error-path.patch |   43 +
 ...attr-add-back-missing-topdown-events.patch | 1005 ++++++++++++
 ...-garbage-when-not-printing-a-syscall.patch |   63 +
 ...-garbage-when-not-printing-a-trace-e.patch |   41 +
 ...ce-do-not-lose-last-events-in-a-race.patch |   74 +
 ...racing-itself-creating-feedback-loop.patch |  219 +++
 ...race-keep-exited-threads-for-summary.patch |   77 +
 .../pinctrl-k210-undef-k210_pc_default.patch  |   39 +
 ...rop-excess-struct-member-description.patch |   36 +
 ...asonic-laptop-return-errno-correctly.patch |   60 +
 ...-add-missing-of_node_put-for-args.np.patch |   48 +
 ...ply-bq27xxx-fix-registers-of-bq27426.patch |   88 +
 ...e-remove-might_sleep-from-power_supp.patch |   44 +
 ...471-fix-wrong-wdt-function-regfield-.patch |   39 +
 ...471-use-ic-status-regfield-to-report.patch |  100 ++
 ...ove-fadump_cma_init-to-setup_arch-af.patch |  131 ++
 ...efactor-and-prepare-fadump_cma_init-.patch |   99 ++
 ...fix-return-of-uninitialized-variable.patch |   49 +
 ...ault-fix-kfence-page-fault-reporting.patch |   85 +
 ...fix-dtl_access_lock-to-be-a-rw_semap.patch |  153 ++
 ...ke-emulate_vsx_load-and-emulate_vsx_.patch |   76 +
 ...lag-vdso64-entry-points-as-functions.patch |  112 ++
 ...ound-of-the-pwm-output-bug-when-decr.patch |  190 +++
 ...ata-race-in-__mod_timer-kvfree_call_.patch |  112 ++
 ...oper-cleanup-if-kfree_scale_init-fai.patch |   70 +
 ...ck-cqe-flags-to-know-imm_data-vs-inv.patch |   80 +
 ...aeqe-overflow-error-caused-by-untime.patch |  292 ++++
 ...-stuck-caused-by-printings-during-re.patch |  274 ++++
 ...l-pointer-derefernce-in-hns_roce_map.patch |   57 +
 ...-of-order-issue-of-requester-when-se.patch |   58 +
 ..._-printings-in-hem-code-instead-of-i.patch |  182 ++
 ...vents-notifier-registration-to-be-af.patch |  194 +++
 ...rxe-fix-the-qp-flush-warnings-in-req.patch |   84 +
 ...ue-pair-cur_qp_state-when-being-quer.patch |   38 +
 ...ockdep-class-for-hierarchical-irq-do.patch |   85 +
 ...restrict-dvs-gpios-to-the-rk808-vari.patch |  106 ++
 ...pas-add-minidump_id-to-sm8350-resour.patch |   46 +
 ...q6v5_mss-re-order-writes-to-the-imem.patch |   52 +
 ...x-memory-leak-caused-by-missing-cgro.patch |   43 +
 ...plic-in_clrip-and-clripnum-write-emu.patch |   55 +
 ...only-lower-16-bits-of-param2-for-cmd.patch |   44 +
 ...fix-documentation-of-the-paste-macro.patch |   38 +
 ...tsockopt-handling-of-malformed-user-.patch |   47 +
 ...unregister-the-subchannel-based-on-d.patch |  112 ++
 ...ek-causes-memory-leak-in-iucv_sock_d.patch |  113 ++
 ...mplement-missing-kernel_page_present.patch |   68 +
 ...void-creation-of-arch-arch-directory.patch |   54 +
 ...se-after-free-in-bfad_im_module_exit.patch |  109 ++
 ...csi-fusion-remove-unused-variable-rc.patch |   46 +
 ...able-all-phys-that-are-not-disabled-.patch |   57 +
 ...possible-memory-leak-in-qedf_alloc_a.patch |   37 +
 ...possible-memory-leak-in-qedi_alloc_a.patch |   37 +
 ...i-sg-enable-runtime-power-management.patch |   74 +
 ...d-push-pop-checking-for-msg_verify_d.patch |  246 +++
 ...d-txmsg_pass-to-pull-push-pop-in-tes.patch |   80 +
 ...-fix-msg_verify_data-in-test_sockmap.patch |  150 ++
 ...x-sendpage-data-logic-in-test_sockma.patch |   86 +
 ...x-test_spin_lock_fail.c-s-global-var.patch |   50 +
 ...x-total_bytes-in-msg_loop_rx-in-test.patch |   71 +
 ...x-txmsg_redir-of-test_txmsg_pull-in-.patch |   38 +
 ...setattr-fix-failures-on-64k-page_siz.patch |   67 +
 ...ally-check-for-bg-process-completion.patch |   43 +
 ...l-fix-memory-overflow-due-to-unhandl.patch |   53 +
 ...l-protect-against-array-overrun-duri.patch |   67 +
 ...-resctrl-refactor-fill_buf-functions.patch |  145 ++
 ...l-split-fill_buf-to-allow-tests-fine.patch |   92 ++
 queue-6.6/series                              |  404 +++++
 ...tories-can-be-more-than-root-file-ha.patch |   37 +
 ...-fix-array-underflow-in-geni_se_clk_.patch |   40 +
 ...ex-use-irqf_no_autoen-flag-in-reques.patch |   45 +
 ...dule-pointer-to-struct-sock_diag_han.patch |  152 ++
 ...concurrent-operation-in-sock_diag_rc.patch |  168 ++
 ...ock_diag-allow-concurrent-operations.patch |  174 ++
 ...i-fix-register-name-in-verbose-loggi.patch |   43 +
 ...i-use-irqf_no_autoen-flag-in-request.patch |   56 +
 ...ra210-quad-avoid-shift-out-of-bounds.patch |   49 +
 ...-undo-runtime-pm-changes-at-driver-e.patch |   51 +
 ...uart-fix-atomicity-violation-in-get_.patch |   49 +
 .../svcrdma-address-an-integer-overflow.patch |   68 +
 ...-destroy-percpu_counter-in-svc_rdma_.patch |  100 ++
 ...r-free-of-nreq-in-reqsk_timer_handle.patch |   49 +
 ...-dma-mask-bits-to-31-for-bcm57766-ch.patch |   61 +
 ...tialize-thermal-zones-before-registe.patch |   46 +
 ...memory-leak-on-error-in-thermal_genl.patch |   64 +
 ...ces-to-_msecs_to_jiffies-handling-of.patch |   55 +
 ...evert-cleanup-on-msecs_to_jiffies-do.patch |   42 +
 ...l-make-more-generic-the-command-enco.patch |  115 ++
 ...nsigned-bug-when-checking-event-logs.patch |   83 +
 ...t_perf-remove-duplicate-samples-on-t.patch |   83 +
 ...itionally-call-unflatten_device_tree.patch |   78 +
 .../unicode-fix-utf8_load-error-path.patch    |   64 +
 ...usb-chaoskey-fail-open-after-removal.patch |  146 ++
 ...-possible-deadlock-chaoskey_list_loc.patch |  154 ++
 ...lock-and-supporting-o_nonblock-flag-.patch |  130 ++
 ...waiting-on-yurex_write-interruptible.patch |   68 +
 ...-suboptimal-range-on-iotlb-iteration.patch |   53 +
 ...y-hide-first-in-list-pcie-extended-c.patch |  115 ++
 ...irtchnl-add-crc-stripping-capability.patch |   64 +
 ...se-request-order-in-virtio_queue_rqs.patch |  112 ++
 ...invalid-vht-parameters-in-supported_.patch |   52 +
 ...d-vht-parameters-in-supported_.patch-17860 |   56 +
 ...ce-offset-address-calculation-for-wc.patch |   62 +
 ...2k-skip-rx-tid-cleanup-for-self-peer.patch |   66 +
 ...ange-check-for-conn_rsp_epid-in-htc_.patch |   61 +
 ...-memcpy-field-spanning-write-warning.patch |   56 +
 ...e-irqf_no_autoen-flag-in-request_irq.patch |   48 +
 ...e-irqf_no_autoen-flag-in-request_irq.patch |   47 +
 ...-fix-error-handling-in-wfx_core_init.patch |   60 +
 ...sts-load-nf_conntrack-if-not-present.patch |   40 +
 ...onally-call-unflatten_and_copy_devic.patch |   77 +
 ...-code-via-the-kernel-virtual-mapping.patch |   54 +
 ...ys_base-when-calling-xen_prepare_pvh.patch |   52 +
 ...lly-disable-sept-violations-from-cau.patch |  172 ++
 ...e-wrappers-to-read-and-write-td-meta.patch |  106 ++
 ...ros-of-tdcalls-consistent-with-the-s.patch |  121 ++
 ...all-seamcall-input-output-registers-.patch |  455 +++++
 ...rename-__tdx_module_call-to-__tdcall.patch |  158 ++
 ...rename-tdx_parse_tdinfo-to-tdx_setup.patch |   67 +
 ...ing-output-regs-when-seamcall-fails-.patch |  125 ++
 ...rc-fix-unwind-for-newly-forked-tasks.patch |   49 +
 405 files changed, 36262 insertions(+)
 create mode 100644 queue-6.6/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch
 create mode 100644 queue-6.6/acpi-cppc-fix-_cpc-register-setting-issue.patch
 create mode 100644 queue-6.6/alsa-6fire-release-resources-at-card-release.patch
 create mode 100644 queue-6.6/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch
 create mode 100644 queue-6.6/alsa-hda-realtek-update-alc256-depop-procedure.patch
 create mode 100644 queue-6.6/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch
 create mode 100644 queue-6.6/alsa-usx2y-use-snd_card_free_when_closed-at-disconne.patch
 create mode 100644 queue-6.6/amd-pstate-set-min_perf-to-nominal_perf-for-active-m.patch
 create mode 100644 queue-6.6/apparmor-fix-do-simple-duplicate-message-elimination.patch
 create mode 100644 queue-6.6/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch
 create mode 100644 queue-6.6/arm-dts-microchip-sam9x60-add-missing-property-atmel.patch
 create mode 100644 queue-6.6/arm-dts-renesas-genmai-add-flash-nodes.patch
 create mode 100644 queue-6.6/arm-dts-renesas-genmai-fix-partition-size-for-qspi-n.patch
 create mode 100644 queue-6.6/arm-dts-renesas-remove-unused-lbsc-nodes-from-board-.patch
 create mode 100644 queue-6.6/arm64-dts-mediatek-add-adc-node-on-mt6357-mt6358-mt6.patch
 create mode 100644 queue-6.6/arm64-dts-mediatek-mt6358-fix-dtbs_check-error.patch
 create mode 100644 queue-6.6/arm64-dts-mediatek-mt8173-elm-hana-add-vdd-supply-to.patch
 create mode 100644 queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-supplies.patch
 create mode 100644 queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-burnet-add-i2c2-s-i2c-scl-internal-.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-cozmo-add-i2c2-s-i2c-scl-internal-d.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-damu-add-i2c2-s-i2c-scl-internal-de.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-fennel-add-i2c2-s-i2c-scl-internal-.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-krane-fix-the-address-of-eeprom-at-.patch
 create mode 100644 queue-6.6/arm64-dts-mt8183-kukui-fix-the-address-of-eeprom-at-.patch
 create mode 100644 queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-infracfg_a.patch
 create mode 100644 queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-mutex-node.patch
 create mode 100644 queue-6.6/arm64-dts-qcom-sc8180x-add-a-soc-specific-compatible.patch
 create mode 100644 queue-6.6/arm64-dts-qcom-sm6350-fix-gpu-frequencies-missing-on.patch
 create mode 100644 queue-6.6/arm64-dts-renesas-hihope-drop-sound-dai-cells.patch
 create mode 100644 queue-6.6/arm64-dts-rockchip-correct-analog-audio-name-on-indi.patch
 create mode 100644 queue-6.6/arm64-dts-ti-k3-j7200-fix-clock-ids-for-mcspi-instan.patch
 create mode 100644 queue-6.6/arm64-dts-ti-k3-j7200-fix-register-map-for-main-doma.patch
 create mode 100644 queue-6.6/arm64-dts-ti-k3-j7200-use-ti-j7200-padconf-compatibl.patch
 create mode 100644 queue-6.6/arm64-dts-ti-k3-j721e-fix-clock-ids-for-mcspi-instan.patch
 create mode 100644 queue-6.6/arm64-dts-ti-k3-j721s2-fix-clock-ids-for-mcspi-insta.patch
 create mode 100644 queue-6.6/arm64-fix-.data.rel.ro-size-assertion-when-config_lt.patch
 create mode 100644 queue-6.6/arm64-probes-disable-kprobes-uprobes-on-mops-instruc.patch
 create mode 100644 queue-6.6/asoc-amd-yc-fix-for-enabling-dmic-on-acp6x-via-_dsd-.patch
 create mode 100644 queue-6.6/asoc-dt-bindings-mt6359-update-generic-node-name-and.patch
 create mode 100644 queue-6.6/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch
 create mode 100644 queue-6.6/asoc-rt722-sdca-remove-logically-deadcode-in-rt722-s.patch
 create mode 100644 queue-6.6/block-fix-bio_split_rw_at-to-take-zone_write_granula.patch
 create mode 100644 queue-6.6/bluetooth-fix-use-after-free-in-device_for_each_chil.patch
 create mode 100644 queue-6.6/bluetooth-mgmt-fix-possible-deadlocks.patch
 create mode 100644 queue-6.6/bluetooth-mgmt-fix-slab-use-after-free-read-in-set_p.patch
 create mode 100644 queue-6.6/bnxt_en-refactor-bnxt_ptp_init.patch
 create mode 100644 queue-6.6/bnxt_en-reserve-rings-after-pcie-aer-recovery-if-nic.patch
 create mode 100644 queue-6.6/bnxt_en-unregister-ptp-during-pci-shutdown-and-suspe.patch
 create mode 100644 queue-6.6/bpf-arm64-remove-garbage-frame-for-struct_ops-trampo.patch
 create mode 100644 queue-6.6/bpf-bpftool-fix-incorrect-disasm-pc.patch
 create mode 100644 queue-6.6/bpf-fix-recursive-lock-when-verdict-program-return-s.patch
 create mode 100644 queue-6.6/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch
 create mode 100644 queue-6.6/bpf-force-uprobe-bpf-program-to-always-return-0.patch
 create mode 100644 queue-6.6/bpf-sockmap-fix-sk_msg_reset_curr.patch
 create mode 100644 queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch
 create mode 100644 queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch
 create mode 100644 queue-6.6/brd-defer-automatic-disk-creation-until-module-initi.patch
 create mode 100644 queue-6.6/cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch
 create mode 100644 queue-6.6/cgroup-bpf-only-cgroup-v2-can-be-attached-by-bpf-pro.patch
 create mode 100644 queue-6.6/checkpatch-always-parse-orig_commit-in-fixes-tag.patch
 create mode 100644 queue-6.6/checkpatch-check-for-missing-fixes-tags.patch
 create mode 100644 queue-6.6/clk-clk-apple-nco-add-null-check-in-applnco_probe.patch
 create mode 100644 queue-6.6/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch
 create mode 100644 queue-6.6/clk-imx-clk-scu-fix-clk-enable-state-save-and-restor.patch
 create mode 100644 queue-6.6/clk-imx-fracn-gppll-correct-pll-initialization-flow.patch
 create mode 100644 queue-6.6/clk-imx-fracn-gppll-fix-pll-power-up.patch
 create mode 100644 queue-6.6/clk-imx-imx8-acm-fix-return-value-check-in-clk_imx_a.patch
 create mode 100644 queue-6.6/clk-imx-lpcg-scu-sw-workaround-for-errata-e10858.patch
 create mode 100644 queue-6.6/clk-mediatek-drop-two-dead-config-options.patch
 create mode 100644 queue-6.6/clk-ralink-mtmips-fix-clock-plan-for-ralink-soc-rt38.patch
 create mode 100644 queue-6.6/clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
 create mode 100644 queue-6.6/clk-renesas-rzg2l-fix-foutpostdiv-clk.patch
 create mode 100644 queue-6.6/clk-sunxi-ng-d1-fix-pll_audio0-preset.patch
 create mode 100644 queue-6.6/clocksource-drivers-sp804-make-user-selectable.patch
 create mode 100644 queue-6.6/clocksource-drivers-timer-ti-dm-fix-child-node-refco.patch
 create mode 100644 queue-6.6/counter-stm32-timer-cnt-add-check-for-clk_enable.patch
 create mode 100644 queue-6.6/counter-ti-ecap-capture-add-check-for-clk_enable.patch
 create mode 100644 queue-6.6/cppc_cpufreq-use-desired-perf-if-feedback-ctrs-are-0.patch
 create mode 100644 queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cppc_ge.patch
 create mode 100644 queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cpufreq.patch
 create mode 100644 queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch
 create mode 100644 queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch-19495
 create mode 100644 queue-6.6/cpufreq-loongson2-unregister-platform_driver-on-fail.patch
 create mode 100644 queue-6.6/crypto-aes-gcm-p10-use-the-correct-bit-to-test-for-p.patch
 create mode 100644 queue-6.6/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch
 create mode 100644 queue-6.6/crypto-caam-add-error-check-to-caam_rsa_set_priv_key.patch
 create mode 100644 queue-6.6/crypto-caam-fix-the-pointer-passed-to-caam_qi_shutdo.patch
 create mode 100644 queue-6.6/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch
 create mode 100644 queue-6.6/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch
 create mode 100644 queue-6.6/crypto-hisilicon-qm-disable-same-error-report-before.patch
 create mode 100644 queue-6.6/crypto-inside-secure-fix-the-return-value-of-safexce.patch
 create mode 100644 queue-6.6/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch
 create mode 100644 queue-6.6/crypto-powerpc-p10-aes-gcm-add-dependency-on-crypto_.patch
 create mode 100644 queue-6.6/crypto-powerpc-p10-aes-gcm-register-modules-as-simd.patch
 create mode 100644 queue-6.6/crypto-qat-qat_4xxx-fix-off-by-one-in-uof_get_name.patch
 create mode 100644 queue-6.6/crypto-qat-remove-check-after-debugfs_create_dir.patch
 create mode 100644 queue-6.6/crypto-qat-remove-faulty-arbiter-config-reset.patch
 create mode 100644 queue-6.6/dax-delete-a-stale-directory-pmem.patch
 create mode 100644 queue-6.6/doc-rcu-update-printed-dynticks-counter-bits.patch
 create mode 100644 queue-6.6/drivers-soc-xilinx-add-the-missing-kfree-in-xlnx_add.patch
 create mode 100644 queue-6.6/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch
 create mode 100644 queue-6.6/drm-amdkfd-fix-wrong-usage-of-init_work.patch
 create mode 100644 queue-6.6/drm-bridge-anx7625-drop-edid-cache-on-bridge-power-o.patch
 create mode 100644 queue-6.6/drm-bridge-it6505-drop-edid-cache-on-bridge-power-of.patch
 create mode 100644 queue-6.6/drm-bridge-tc358767-fix-link-properties-discovery.patch
 create mode 100644 queue-6.6/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch
 create mode 100644 queue-6.6/drm-etnaviv-request-pages-from-dma32-zone-on-address.patch
 create mode 100644 queue-6.6/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch
 create mode 100644 queue-6.6/drm-imx-dcss-use-irqf_no_autoen-flag-in-request_irq.patch
 create mode 100644 queue-6.6/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch
 create mode 100644 queue-6.6/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch
 create mode 100644 queue-6.6/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch
 create mode 100644 queue-6.6/drm-msm-dpu-cast-crtc_clk-calculation-to-u64-in-_dpu.patch
 create mode 100644 queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch
 create mode 100644 queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch
 create mode 100644 queue-6.6/drm-msm-dpu-on-sdm845-move-dspp_3-to-lm_5-block.patch
 create mode 100644 queue-6.6/drm-msm-gpu-check-the-status-of-registration-to-pm-q.patch
 create mode 100644 queue-6.6/drm-nouveau-gr-gf100-fix-missing-unlock-in-gf100_gr_.patch
 create mode 100644 queue-6.6/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch
 create mode 100644 queue-6.6/drm-omap-fix-possible-null-dereference.patch
 create mode 100644 queue-6.6/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch
 create mode 100644 queue-6.6/drm-radeon-add-helper-rdev_to_drm-rdev.patch
 create mode 100644 queue-6.6/drm-radeon-change-rdev-ddev-to-rdev_to_drm-rdev.patch
 create mode 100644 queue-6.6/drm-radeon-fix-spurious-unplug-event-on-radeon-hdmi.patch
 create mode 100644 queue-6.6/drm-use-atomic64_init-for-atomic64_t.patch
 create mode 100644 queue-6.6/drm-v3d-address-race-condition-in-mmu-flush.patch
 create mode 100644 queue-6.6/drm-vc4-hdmi-avoid-hang-with-debug-registers-when-su.patch
 create mode 100644 queue-6.6/drm-vc4-hvs-correct-logic-on-stopping-an-hvs-channel.patch
 create mode 100644 queue-6.6/drm-vc4-hvs-don-t-write-gamma-luts-on-2711.patch
 create mode 100644 queue-6.6/drm-vc4-hvs-fix-dlist-debug-not-resetting-the-next-e.patch
 create mode 100644 queue-6.6/drm-vc4-hvs-remove-incorrect-limit-from-hvs_dlist-de.patch
 create mode 100644 queue-6.6/drm-vc4-match-drm_dev_enter-and-exit-calls-in-vc4_hv.patch
 create mode 100644 queue-6.6/drm-vkms-drop-unnecessary-call-to-drm_crtc_cleanup.patch
 create mode 100644 queue-6.6/drm-zynqmp_kms-unplug-drm-device-before-removal.patch
 create mode 100644 queue-6.6/dt-bindings-clock-axi-clkgen-include-axi-clk.patch
 create mode 100644 queue-6.6/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch
 create mode 100644 queue-6.6/edac-bluefield-fix-potential-integer-overflow.patch
 create mode 100644 queue-6.6/edac-fsl_ddr-fix-bad-bit-shift-operations.patch
 create mode 100644 queue-6.6/edac-igen6-avoid-segmentation-fault-on-module-unload.patch
 create mode 100644 queue-6.6/edac-skx_common-differentiate-memory-error-sources.patch
 create mode 100644 queue-6.6/edac-skx_common-i10nm-fix-incorrect-far-memory-error.patch
 create mode 100644 queue-6.6/efi-libstub-fix-efi_parse_options-ignoring-the-defau.patch
 create mode 100644 queue-6.6/erofs-handle-nonhead-delta-1-lclusters-gracefully.patch
 create mode 100644 queue-6.6/ext4-avoid-remount-errors-with-abort-mount-option.patch
 create mode 100644 queue-6.6/ext4-fix-race-in-buffer_head-read-fault-injection.patch
 create mode 100644 queue-6.6/ext4-pipeline-buffer-reads-in-mext_page_mkuptodate.patch
 create mode 100644 queue-6.6/ext4-remove-array-of-buffer_heads-from-mext_page_mku.patch
 create mode 100644 queue-6.6/ext4-remove-calls-to-to-set-clear-the-folio-error-fl.patch
 create mode 100644 queue-6.6/f2fs-check-curseg-inited-before-write_sum_page-in-ch.patch
 create mode 100644 queue-6.6/f2fs-compress-fix-inconsistent-update-of-i_blocks-in.patch
 create mode 100644 queue-6.6/f2fs-fix-race-in-concurrent-f2fs_stop_gc_thread.patch
 create mode 100644 queue-6.6/f2fs-fix-the-wrong-f2fs_bug_on-condition-in-f2fs_do_.patch
 create mode 100644 queue-6.6/f2fs-fix-to-account-dirty-data-in-__get_secs_require.patch
 create mode 100644 queue-6.6/f2fs-fix-to-avoid-forcing-direct-write-to-use-buffer.patch
 create mode 100644 queue-6.6/f2fs-fix-to-avoid-potential-deadlock-in-f2fs_record_.patch
 create mode 100644 queue-6.6/f2fs-fix-to-avoid-use-gc_at-when-setting-gc_mode-as-.patch
 create mode 100644 queue-6.6/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch
 create mode 100644 queue-6.6/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch
 create mode 100644 queue-6.6/firmware-google-unregister-driver_info-on-failure.patch
 create mode 100644 queue-6.6/firmware_loader-fix-possible-resource-leak-in-fw_log.patch
 create mode 100644 queue-6.6/fs-proc-kcore.c-fix-coccinelle-reported-error-instan.patch
 create mode 100644 queue-6.6/fs_parser-update-mount_api-doc-to-match-function-sig.patch
 create mode 100644 queue-6.6/gfs2-allow-immediate-glf_verify_delete-work.patch
 create mode 100644 queue-6.6/gfs2-don-t-set-glf_lock-in-gfs2_dispose_glock_lru.patch
 create mode 100644 queue-6.6/gfs2-fix-unlinked-inode-cleanup.patch
 create mode 100644 queue-6.6/gfs2-get-rid-of-gfs2_glock_queue_put-in-signal_our_w.patch
 create mode 100644 queue-6.6/gfs2-remove-and-replace-gfs2_glock_queue_work.patch
 create mode 100644 queue-6.6/gfs2-rename-glf_verify_evict-to-glf_verify_delete.patch
 create mode 100644 queue-6.6/gfs2-replace-gfs2_glock_queue_put-with-gfs2_glock_pu.patch
 create mode 100644 queue-6.6/gpio-zevio-add-missed-label-initialisation.patch
 create mode 100644 queue-6.6/hfsplus-don-t-query-the-device-logical-block-size-mu.patch
 create mode 100644 queue-6.6/hid-hyperv-streamline-driver-probe-to-avoid-devres-i.patch
 create mode 100644 queue-6.6/hwmon-nct6775-core-fix-overflows-seen-when-writing-l.patch
 create mode 100644 queue-6.6/hwmon-pmbus-core-clear-faults-after-setting-smbalert.patch
 create mode 100644 queue-6.6/hwmon-pmbus_core-allow-to-hook-pmbus_smbalert_mask.patch
 create mode 100644 queue-6.6/hwmon-tps23861-fix-reporting-of-negative-temperature.patch
 create mode 100644 queue-6.6/ib-mlx5-allocate-resources-just-before-first-qp-srq-.patch
 create mode 100644 queue-6.6/ice-consistently-use-q_idx-in-ice_vc_cfg_qs_msg.patch
 create mode 100644 queue-6.6/ice-support-fcs-crc-strip-disable-for-vf.patch
 create mode 100644 queue-6.6/iio-light-al3010-fix-an-error-handling-path-in-al301.patch
 create mode 100644 queue-6.6/initramfs-avoid-filename-buffer-overrun.patch
 create mode 100644 queue-6.6/iommu-vt-d-fix-checks-and-print-in-dmar_fault_dump_p.patch
 create mode 100644 queue-6.6/iommu-vt-d-fix-checks-and-print-in-pgtable_walk.patch
 create mode 100644 queue-6.6/ip6mr-fix-tables-suspicious-rcu-usage.patch
 create mode 100644 queue-6.6/ipmr-fix-tables-suspicious-rcu-usage.patch
 create mode 100644 queue-6.6/ipv6-release-nexthop-on-device-removal.patch
 create mode 100644 queue-6.6/kcsan-seqlock-fix-incorrect-assumption-in-read_seqbe.patch
 create mode 100644 queue-6.6/kcsan-seqlock-support-seqcount_latch_t.patch
 create mode 100644 queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-_.patch
 create mode 100644 queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-l.patch
 create mode 100644 queue-6.6/kvm-ppc-book3s-hv-avoid-returning-to-nested-hypervis.patch
 create mode 100644 queue-6.6/kvm-ppc-book3s-hv-stop-using-vc-dpdes-for-nested-kvm.patch
 create mode 100644 queue-6.6/libbpf-fix-expected_attach_type-set-handling-in-prog.patch
 create mode 100644 queue-6.6/libbpf-fix-output-.symtab-byte-order-during-linking.patch
 create mode 100644 queue-6.6/libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
 create mode 100644 queue-6.6/libbpf-never-interpret-subprogs-in-.text-as-entry-pr.patch
 create mode 100644 queue-6.6/llc-improve-setsockopt-handling-of-malformed-user-in.patch
 create mode 100644 queue-6.6/loongarch-bpf-sign-extend-return-values.patch
 create mode 100644 queue-6.6/loongarch-fix-build-failure-with-gcc-15-std-gnu23.patch
 create mode 100644 queue-6.6/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch
 create mode 100644 queue-6.6/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch
 create mode 100644 queue-6.6/m68k-mvme147-fix-scsi-controller-irq-numbers.patch
 create mode 100644 queue-6.6/m68k-mvme147-reinstate-early-console.patch
 create mode 100644 queue-6.6/m68k-mvme16x-add-and-use-mvme16x.h.patch
 create mode 100644 queue-6.6/mailbox-arm_mhuv2-clean-up-loop-in-get_irq_chan_comb.patch
 create mode 100644 queue-6.6/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch
 create mode 100644 queue-6.6/media-atomisp-add-check-for-rgby_data-memory-allocat.patch
 create mode 100644 queue-6.6/media-i2c-ds90ub960-fix-missing-return-check-on-ub96.patch
 create mode 100644 queue-6.6/media-venus-fix-enc-dec-destruction-order.patch
 create mode 100644 queue-6.6/media-venus-sync-with-threaded-irq-during-inst-destr.patch
 create mode 100644 queue-6.6/mfd-da9052-spi-change-read-mask-to-write-mask.patch
 create mode 100644 queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch
 create mode 100644 queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch
 create mode 100644 queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch
 create mode 100644 queue-6.6/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch
 create mode 100644 queue-6.6/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch
 create mode 100644 queue-6.6/microblaze-export-xmb_manager-functions.patch
 create mode 100644 queue-6.6/mips-asm-fix-warning-when-disabling-mips_fp_support.patch
 create mode 100644 queue-6.6/misc-apds990x-fix-missing-pm_runtime_disable.patch
 create mode 100644 queue-6.6/mmc-mmc_spi-drop-buggy-snprintf.patch
 create mode 100644 queue-6.6/mtd-hyperbus-rpc-if-add-missing-module_device_table.patch
 create mode 100644 queue-6.6/mtd-hyperbus-rpc-if-convert-to-platform-remove-callb.patch
 create mode 100644 queue-6.6/mtd-rawnand-atmel-fix-possible-memory-leak.patch
 create mode 100644 queue-6.6/mtd-spi-nor-spansion-use-nor-addr_nbytes-in-octal-dt.patch
 create mode 100644 queue-6.6/net-hsr-fix-hsr_init_sk-vs-network-transport-headers.patch
 create mode 100644 queue-6.6/net-ipv6-delete-temporary-address-if-mngtmpaddr-is-r.patch
 create mode 100644 queue-6.6/net-mdio-ipq4019-add-missing-error-check.patch
 create mode 100644 queue-6.6/net-microchip-vcap-add-typegroup-table-terminators-i.patch
 create mode 100644 queue-6.6/net-rfkill-gpio-add-check-for-clk_enable.patch
 create mode 100644 queue-6.6/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch
 create mode 100644 queue-6.6/net-usb-lan78xx-fix-double-free-issue-with-interrupt.patch
 create mode 100644 queue-6.6/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch
 create mode 100644 queue-6.6/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch
 create mode 100644 queue-6.6/net-use-unrcu_pointer-helper.patch
 create mode 100644 queue-6.6/netdevsim-copy-addresses-for-both-in-and-out-paths.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-avoid-false-positive-lockdep-spl.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-introduce-nf_tables_getrule_sing.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch-562
 create mode 100644 queue-6.6/netfilter-nf_tables-open-code-audit-log-call-in-nf_t.patch
 create mode 100644 queue-6.6/netfilter-nf_tables-skip-transaction-if-update-objec.patch
 create mode 100644 queue-6.6/netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch
 create mode 100644 queue-6.6/netlink-typographical-error-in-nlmsg_type-constants-.patch
 create mode 100644 queue-6.6/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch
 create mode 100644 queue-6.6/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch
 create mode 100644 queue-6.6/nfsd-fix-nfsd4_shutdown_copy.patch
 create mode 100644 queue-6.6/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch
 create mode 100644 queue-6.6/nfsd-release-svc_expkey-svc_export-with-rcu_work.patch
 create mode 100644 queue-6.6/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch
 create mode 100644 queue-6.6/nvme-pci-reverse-request-order-in-nvme_queue_rqs.patch
 create mode 100644 queue-6.6/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch
 create mode 100644 queue-6.6/octeontx2-af-quiesce-traffic-before-nix-block-reset.patch
 create mode 100644 queue-6.6/octeontx2-af-rpm-fix-low-network-performance.patch
 create mode 100644 queue-6.6/octeontx2-af-rpm-fix-mismatch-in-lmac-type.patch
 create mode 100644 queue-6.6/octeontx2-af-rpm-fix-stale-fcfec-counters.patch
 create mode 100644 queue-6.6/octeontx2-af-rpm-fix-stale-rsfec-counters.patch
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-cn10.patch
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-1819
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-18928
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-5160
 create mode 100644 queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-921
 create mode 100644 queue-6.6/octeontx2-pf-reset-mac-stats-during-probe.patch
 create mode 100644 queue-6.6/of-fdt-add-dt_phys-arg-to-early_init_dt_scan-and-ear.patch
 create mode 100644 queue-6.6/openrisc-implement-fixmap-to-fix-earlycon.patch
 create mode 100644 queue-6.6/pci-add-t_pvperl-macro.patch
 create mode 100644 queue-6.6/pci-cadence-extract-link-setup-sequence-from-cdns_pc.patch
 create mode 100644 queue-6.6/pci-cadence-set-cdns_pcie_host_init-global.patch
 create mode 100644 queue-6.6/pci-cpqphp-fix-pcibios_-return-value-confusion.patch
 create mode 100644 queue-6.6/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch
 create mode 100644 queue-6.6/pci-endpoint-epf-mhi-avoid-null-dereference-if-dt-la.patch
 create mode 100644 queue-6.6/pci-fix-reset_method_store-memory-leak.patch
 create mode 100644 queue-6.6/pci-j721e-add-pcie-4x-lane-selection-support.patch
 create mode 100644 queue-6.6/pci-j721e-add-per-platform-maximum-lane-settings.patch
 create mode 100644 queue-6.6/pci-j721e-add-reset-gpio-to-struct-j721e_pcie.patch
 create mode 100644 queue-6.6/pci-j721e-add-suspend-and-resume-support.patch
 create mode 100644 queue-6.6/pci-j721e-deassert-perst-after-a-delay-of-pcie_t_pvp.patch
 create mode 100644 queue-6.6/pci-j721e-use-t_perst_clk_us-macro.patch
 create mode 100644 queue-6.6/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch
 create mode 100644 queue-6.6/perf-ftrace-latency-fix-unit-on-histogram-first-entr.patch
 create mode 100644 queue-6.6/perf-list-fix-topic-and-pmu_name-argument-order.patch
 create mode 100644 queue-6.6/perf-probe-correct-demangled-symbols-in-c-program.patch
 create mode 100644 queue-6.6/perf-probe-fix-libdw-memory-leak.patch
 create mode 100644 queue-6.6/perf-stat-close-cork_fd-when-create_perf_stat_counte.patch
 create mode 100644 queue-6.6/perf-stat-fix-affinity-memory-leaks-on-error-path.patch
 create mode 100644 queue-6.6/perf-test-attr-add-back-missing-topdown-events.patch
 create mode 100644 queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch
 create mode 100644 queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-trace-e.patch
 create mode 100644 queue-6.6/perf-trace-do-not-lose-last-events-in-a-race.patch
 create mode 100644 queue-6.6/perf-trace-fix-tracing-itself-creating-feedback-loop.patch
 create mode 100644 queue-6.6/perf-trace-keep-exited-threads-for-summary.patch
 create mode 100644 queue-6.6/pinctrl-k210-undef-k210_pc_default.patch
 create mode 100644 queue-6.6/pinctrl-zynqmp-drop-excess-struct-member-description.patch
 create mode 100644 queue-6.6/platform-x86-panasonic-laptop-return-errno-correctly.patch
 create mode 100644 queue-6.6/pmdomain-ti-sci-add-missing-of_node_put-for-args.np.patch
 create mode 100644 queue-6.6/power-supply-bq27xxx-fix-registers-of-bq27426.patch
 create mode 100644 queue-6.6/power-supply-core-remove-might_sleep-from-power_supp.patch
 create mode 100644 queue-6.6/power-supply-rt9471-fix-wrong-wdt-function-regfield-.patch
 create mode 100644 queue-6.6/power-supply-rt9471-use-ic-status-regfield-to-report.patch
 create mode 100644 queue-6.6/powerpc-fadump-move-fadump_cma_init-to-setup_arch-af.patch
 create mode 100644 queue-6.6/powerpc-fadump-refactor-and-prepare-fadump_cma_init-.patch
 create mode 100644 queue-6.6/powerpc-kexec-fix-return-of-uninitialized-variable.patch
 create mode 100644 queue-6.6/powerpc-mm-fault-fix-kfence-page-fault-reporting.patch
 create mode 100644 queue-6.6/powerpc-pseries-fix-dtl_access_lock-to-be-a-rw_semap.patch
 create mode 100644 queue-6.6/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch
 create mode 100644 queue-6.6/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch
 create mode 100644 queue-6.6/pwm-imx27-workaround-of-the-pwm-output-bug-when-decr.patch
 create mode 100644 queue-6.6/rcu-kvfree-fix-data-race-in-__mod_timer-kvfree_call_.patch
 create mode 100644 queue-6.6/rcuscale-do-a-proper-cleanup-if-kfree_scale_init-fai.patch
 create mode 100644 queue-6.6/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch
 create mode 100644 queue-6.6/rdma-hns-fix-an-aeqe-overflow-error-caused-by-untime.patch
 create mode 100644 queue-6.6/rdma-hns-fix-cpu-stuck-caused-by-printings-during-re.patch
 create mode 100644 queue-6.6/rdma-hns-fix-null-pointer-derefernce-in-hns_roce_map.patch
 create mode 100644 queue-6.6/rdma-hns-fix-out-of-order-issue-of-requester-when-se.patch
 create mode 100644 queue-6.6/rdma-hns-use-dev_-printings-in-hem-code-instead-of-i.patch
 create mode 100644 queue-6.6/rdma-mlx5-move-events-notifier-registration-to-be-af.patch
 create mode 100644 queue-6.6/rdma-rxe-fix-the-qp-flush-warnings-in-req.patch
 create mode 100644 queue-6.6/rdma-rxe-set-queue-pair-cur_qp_state-when-being-quer.patch
 create mode 100644 queue-6.6/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch
 create mode 100644 queue-6.6/regulator-rk808-restrict-dvs-gpios-to-the-rk808-vari.patch
 create mode 100644 queue-6.6/remoteproc-qcom-pas-add-minidump_id-to-sm8350-resour.patch
 create mode 100644 queue-6.6/remoteproc-qcom_q6v5_mss-re-order-writes-to-the-imem.patch
 create mode 100644 queue-6.6/revert-cgroup-fix-memory-leak-caused-by-missing-cgro.patch
 create mode 100644 queue-6.6/risc-v-kvm-fix-aplic-in_clrip-and-clripnum-write-emu.patch
 create mode 100644 queue-6.6/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch
 create mode 100644 queue-6.6/rust-macros-fix-documentation-of-the-paste-macro.patch
 create mode 100644 queue-6.6/rxrpc-improve-setsockopt-handling-of-malformed-user-.patch
 create mode 100644 queue-6.6/s390-cio-do-not-unregister-the-subchannel-based-on-d.patch
 create mode 100644 queue-6.6/s390-iucv-msg_peek-causes-memory-leak-in-iucv_sock_d.patch
 create mode 100644 queue-6.6/s390-pageattr-implement-missing-kernel_page_present.patch
 create mode 100644 queue-6.6/s390-syscalls-avoid-creation-of-arch-arch-directory.patch
 create mode 100644 queue-6.6/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch
 create mode 100644 queue-6.6/scsi-fusion-remove-unused-variable-rc.patch
 create mode 100644 queue-6.6/scsi-hisi_sas-enable-all-phys-that-are-not-disabled-.patch
 create mode 100644 queue-6.6/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch
 create mode 100644 queue-6.6/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch
 create mode 100644 queue-6.6/scsi-sg-enable-runtime-power-management.patch
 create mode 100644 queue-6.6/selftests-bpf-add-push-pop-checking-for-msg_verify_d.patch
 create mode 100644 queue-6.6/selftests-bpf-add-txmsg_pass-to-pull-push-pop-in-tes.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-msg_verify_data-in-test_sockmap.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-sendpage-data-logic-in-test_sockma.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-test_spin_lock_fail.c-s-global-var.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-total_bytes-in-msg_loop_rx-in-test.patch
 create mode 100644 queue-6.6/selftests-bpf-fix-txmsg_redir-of-test_txmsg_pull-in-.patch
 create mode 100644 queue-6.6/selftests-mount_setattr-fix-failures-on-64k-page_siz.patch
 create mode 100644 queue-6.6/selftests-net-really-check-for-bg-process-completion.patch
 create mode 100644 queue-6.6/selftests-resctrl-fix-memory-overflow-due-to-unhandl.patch
 create mode 100644 queue-6.6/selftests-resctrl-protect-against-array-overrun-duri.patch
 create mode 100644 queue-6.6/selftests-resctrl-refactor-fill_buf-functions.patch
 create mode 100644 queue-6.6/selftests-resctrl-split-fill_buf-to-allow-tests-fine.patch
 create mode 100644 queue-6.6/smb-cached-directories-can-be-more-than-root-file-ha.patch
 create mode 100644 queue-6.6/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch
 create mode 100644 queue-6.6/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch
 create mode 100644 queue-6.6/sock_diag-add-module-pointer-to-struct-sock_diag_han.patch
 create mode 100644 queue-6.6/sock_diag-allow-concurrent-operation-in-sock_diag_rc.patch
 create mode 100644 queue-6.6/sock_diag-allow-concurrent-operations.patch
 create mode 100644 queue-6.6/spi-atmel-quadspi-fix-register-name-in-verbose-loggi.patch
 create mode 100644 queue-6.6/spi-spi-fsl-lpspi-use-irqf_no_autoen-flag-in-request.patch
 create mode 100644 queue-6.6/spi-tegra210-quad-avoid-shift-out-of-bounds.patch
 create mode 100644 queue-6.6/spi-zynqmp-gqspi-undo-runtime-pm-changes-at-driver-e.patch
 create mode 100644 queue-6.6/staging-greybus-uart-fix-atomicity-violation-in-get_.patch
 create mode 100644 queue-6.6/svcrdma-address-an-integer-overflow.patch
 create mode 100644 queue-6.6/svcrdma-fix-miss-destroy-percpu_counter-in-svc_rdma_.patch
 create mode 100644 queue-6.6/tcp-fix-use-after-free-of-nreq-in-reqsk_timer_handle.patch
 create mode 100644 queue-6.6/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch
 create mode 100644 queue-6.6/thermal-core-initialize-thermal-zones-before-registe.patch
 create mode 100644 queue-6.6/thermal-lib-fix-memory-leak-on-error-in-thermal_genl.patch
 create mode 100644 queue-6.6/time-fix-references-to-_msecs_to_jiffies-handling-of.patch
 create mode 100644 queue-6.6/time-partially-revert-cleanup-on-msecs_to_jiffies-do.patch
 create mode 100644 queue-6.6/tools-lib-thermal-make-more-generic-the-command-enco.patch
 create mode 100644 queue-6.6/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch
 create mode 100644 queue-6.6/trace-trace_event_perf-remove-duplicate-samples-on-t.patch
 create mode 100644 queue-6.6/um-unconditionally-call-unflatten_device_tree.patch
 create mode 100644 queue-6.6/unicode-fix-utf8_load-error-path.patch
 create mode 100644 queue-6.6/usb-chaoskey-fail-open-after-removal.patch
 create mode 100644 queue-6.6/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch
 create mode 100644 queue-6.6/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch
 create mode 100644 queue-6.6/usb-yurex-make-waiting-on-yurex_write-interruptible.patch
 create mode 100644 queue-6.6/vdpa-mlx5-fix-suboptimal-range-on-iotlb-iteration.patch
 create mode 100644 queue-6.6/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch
 create mode 100644 queue-6.6/virtchnl-add-crc-stripping-capability.patch
 create mode 100644 queue-6.6/virtio_blk-reverse-request-order-in-virtio_queue_rqs.patch
 create mode 100644 queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch
 create mode 100644 queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch-17860
 create mode 100644 queue-6.6/wifi-ath11k-fix-ce-offset-address-calculation-for-wc.patch
 create mode 100644 queue-6.6/wifi-ath12k-skip-rx-tid-cleanup-for-self-peer.patch
 create mode 100644 queue-6.6/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch
 create mode 100644 queue-6.6/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch
 create mode 100644 queue-6.6/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch
 create mode 100644 queue-6.6/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch
 create mode 100644 queue-6.6/wifi-wfx-fix-error-handling-in-wfx_core_init.patch
 create mode 100644 queue-6.6/wireguard-selftests-load-nf_conntrack-if-not-present.patch
 create mode 100644 queue-6.6/x86-of-unconditionally-call-unflatten_and_copy_devic.patch
 create mode 100644 queue-6.6/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
 create mode 100644 queue-6.6/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch
 create mode 100644 queue-6.6/x86-tdx-dynamically-disable-sept-violations-from-cau.patch
 create mode 100644 queue-6.6/x86-tdx-introduce-wrappers-to-read-and-write-td-meta.patch
 create mode 100644 queue-6.6/x86-tdx-make-macros-of-tdcalls-consistent-with-the-s.patch
 create mode 100644 queue-6.6/x86-tdx-pass-tdcall-seamcall-input-output-registers-.patch
 create mode 100644 queue-6.6/x86-tdx-rename-__tdx_module_call-to-__tdcall.patch
 create mode 100644 queue-6.6/x86-tdx-rename-tdx_parse_tdinfo-to-tdx_setup.patch
 create mode 100644 queue-6.6/x86-tdx-skip-saving-output-regs-when-seamcall-fails-.patch
 create mode 100644 queue-6.6/x86-unwind-orc-fix-unwind-for-newly-forked-tasks.patch

diff --git a/queue-6.6/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch b/queue-6.6/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch
new file mode 100644
index 00000000000..1b45d055353
--- /dev/null
+++ b/queue-6.6/acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch
@@ -0,0 +1,46 @@
+From bee89205b707de45e8a39e3d3894743bec1174e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 13:12:39 +0300
+Subject: acpi/arm64: Adjust error handling procedure in
+ gtdt_parse_timer_block()
+
+From: Aleksandr Mishin <amishin@t-argos.ru>
+
+[ Upstream commit 1a9de2f6fda69d5f105dd8af776856a66abdaa64 ]
+
+In case of error in gtdt_parse_timer_block() invalid 'gtdt_frame'
+will be used in 'do {} while (i-- >= 0 && gtdt_frame--);' statement block
+because do{} block will be executed even if 'i == 0'.
+
+Adjust error handling procedure by replacing 'i-- >= 0' with 'i-- > 0'.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver")
+Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
+Acked-by: Hanjun Guo <guohanjun@huawei.com>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Aleksandr Mishin <amishin@t-argos.ru>
+Link: https://lore.kernel.org/r/20240827101239.22020-1-amishin@t-argos.ru
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/arm64/gtdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c
+index c0e77c1c8e09d..eb6c2d3603874 100644
+--- a/drivers/acpi/arm64/gtdt.c
++++ b/drivers/acpi/arm64/gtdt.c
+@@ -283,7 +283,7 @@ static int __init gtdt_parse_timer_block(struct acpi_gtdt_timer_block *block,
+ 		if (frame->virt_irq > 0)
+ 			acpi_unregister_gsi(gtdt_frame->virtual_timer_interrupt);
+ 		frame->virt_irq = 0;
+-	} while (i-- >= 0 && gtdt_frame--);
++	} while (i-- > 0 && gtdt_frame--);
+ 
+ 	return -EINVAL;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/acpi-cppc-fix-_cpc-register-setting-issue.patch b/queue-6.6/acpi-cppc-fix-_cpc-register-setting-issue.patch
new file mode 100644
index 00000000000..d577709429d
--- /dev/null
+++ b/queue-6.6/acpi-cppc-fix-_cpc-register-setting-issue.patch
@@ -0,0 +1,42 @@
+From 30e348feb4c8c9b9c1b436cae5ae8a9c6f597290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 18:33:09 +0800
+Subject: ACPI: CPPC: Fix _CPC register setting issue
+
+From: Lifeng Zheng <zhenglifeng1@huawei.com>
+
+[ Upstream commit 2388b266c9fcc7c9169ba85c7f9ebe325b7622d7 ]
+
+Since commit 60949b7b8054 ("ACPI: CPPC: Fix MASK_VAL() usage"), _CPC
+registers cannot be changed from 1 to 0.
+
+It turns out that there is an extra OR after MASK_VAL_WRITE(), which
+has already ORed prev_val with the register mask.
+
+Remove the extra OR to fix the problem.
+
+Fixes: 60949b7b8054 ("ACPI: CPPC: Fix MASK_VAL() usage")
+Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
+Link: https://patch.msgid.link/20241113103309.761031-1-zhenglifeng1@huawei.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 26d1beec99137..ed02a2a9970aa 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -1142,7 +1142,6 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
+ 			return -EFAULT;
+ 		}
+ 		val = MASK_VAL_WRITE(reg, prev_val, val);
+-		val |= prev_val;
+ 	}
+ 
+ 	switch (size) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/alsa-6fire-release-resources-at-card-release.patch b/queue-6.6/alsa-6fire-release-resources-at-card-release.patch
new file mode 100644
index 00000000000..661c153c3ce
--- /dev/null
+++ b/queue-6.6/alsa-6fire-release-resources-at-card-release.patch
@@ -0,0 +1,78 @@
+From e7a847171c9ea75d978b613121f1871fdf6020f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 12:10:39 +0100
+Subject: ALSA: 6fire: Release resources at card release
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit a0810c3d6dd2d29a9b92604d682eacd2902ce947 ]
+
+The current 6fire code tries to release the resources right after the
+call of usb6fire_chip_abort().  But at this moment, the card object
+might be still in use (as we're calling snd_card_free_when_closed()).
+
+For avoid potential UAFs, move the release of resources to the card's
+private_free instead of the manual call of usb6fire_chip_destroy() at
+the USB disconnect callback.
+
+Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241113111042.15058-6-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/6fire/chip.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c
+index 33e962178c936..d562a30b087f0 100644
+--- a/sound/usb/6fire/chip.c
++++ b/sound/usb/6fire/chip.c
+@@ -61,8 +61,10 @@ static void usb6fire_chip_abort(struct sfire_chip *chip)
+ 	}
+ }
+ 
+-static void usb6fire_chip_destroy(struct sfire_chip *chip)
++static void usb6fire_card_free(struct snd_card *card)
+ {
++	struct sfire_chip *chip = card->private_data;
++
+ 	if (chip) {
+ 		if (chip->pcm)
+ 			usb6fire_pcm_destroy(chip);
+@@ -72,8 +74,6 @@ static void usb6fire_chip_destroy(struct sfire_chip *chip)
+ 			usb6fire_comm_destroy(chip);
+ 		if (chip->control)
+ 			usb6fire_control_destroy(chip);
+-		if (chip->card)
+-			snd_card_free(chip->card);
+ 	}
+ }
+ 
+@@ -136,6 +136,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,
+ 	chip->regidx = regidx;
+ 	chip->intf_count = 1;
+ 	chip->card = card;
++	card->private_free = usb6fire_card_free;
+ 
+ 	ret = usb6fire_comm_init(chip);
+ 	if (ret < 0)
+@@ -162,7 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf,
+ 	return 0;
+ 
+ destroy_chip:
+-	usb6fire_chip_destroy(chip);
++	snd_card_free(card);
+ 	return ret;
+ }
+ 
+@@ -181,7 +182,6 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf)
+ 
+ 			chip->shutdown = true;
+ 			usb6fire_chip_abort(chip);
+-			usb6fire_chip_destroy(chip);
+ 		}
+ 	}
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch b/queue-6.6/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch
new file mode 100644
index 00000000000..f479977ae8d
--- /dev/null
+++ b/queue-6.6/alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch
@@ -0,0 +1,168 @@
+From 1dd18a76b09d78fde6c0de07f3403aa67b934243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 12:10:38 +0100
+Subject: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c ]
+
+The USB disconnect callback is supposed to be short and not too-long
+waiting.  OTOH, the current code uses snd_card_free() at
+disconnection, but this waits for the close of all used fds, hence it
+can take long.  It eventually blocks the upper layer USB ioctls, which
+may trigger a soft lockup.
+
+An easy workaround is to replace snd_card_free() with
+snd_card_free_when_closed().  This variant returns immediately while
+the release of resources is done asynchronously by the card device
+release at the last close.
+
+This patch also splits the code to the disconnect and the free phases;
+the former is called immediately at the USB disconnect callback while
+the latter is called from the card destructor.
+
+Fixes: 523f1dce3743 ("[ALSA] Add Native Instrument usb audio device support")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241113111042.15058-5-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/caiaq/audio.c  | 10 ++++++++--
+ sound/usb/caiaq/audio.h  |  1 +
+ sound/usb/caiaq/device.c | 19 +++++++++++++++----
+ sound/usb/caiaq/input.c  | 12 +++++++++---
+ sound/usb/caiaq/input.h  |  1 +
+ 5 files changed, 34 insertions(+), 9 deletions(-)
+
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index 4981753652a7f..7a89872aa0cbd 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -869,14 +869,20 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev)
+ 	return 0;
+ }
+ 
+-void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev)
++void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev)
+ {
+ 	struct device *dev = caiaqdev_to_dev(cdev);
+ 
+ 	dev_dbg(dev, "%s(%p)\n", __func__, cdev);
+ 	stream_stop(cdev);
++}
++
++void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev)
++{
++	struct device *dev = caiaqdev_to_dev(cdev);
++
++	dev_dbg(dev, "%s(%p)\n", __func__, cdev);
+ 	free_urbs(cdev->data_urbs_in);
+ 	free_urbs(cdev->data_urbs_out);
+ 	kfree(cdev->data_cb_info);
+ }
+-
+diff --git a/sound/usb/caiaq/audio.h b/sound/usb/caiaq/audio.h
+index 869bf6264d6a0..07f5d064456cf 100644
+--- a/sound/usb/caiaq/audio.h
++++ b/sound/usb/caiaq/audio.h
+@@ -3,6 +3,7 @@
+ #define CAIAQ_AUDIO_H
+ 
+ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *cdev);
++void snd_usb_caiaq_audio_disconnect(struct snd_usb_caiaqdev *cdev);
+ void snd_usb_caiaq_audio_free(struct snd_usb_caiaqdev *cdev);
+ 
+ #endif /* CAIAQ_AUDIO_H */
+diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
+index b5cbf1f195c48..dfd820483849e 100644
+--- a/sound/usb/caiaq/device.c
++++ b/sound/usb/caiaq/device.c
+@@ -376,6 +376,17 @@ static void setup_card(struct snd_usb_caiaqdev *cdev)
+ 		dev_err(dev, "Unable to set up control system (ret=%d)\n", ret);
+ }
+ 
++static void card_free(struct snd_card *card)
++{
++	struct snd_usb_caiaqdev *cdev = caiaqdev(card);
++
++#ifdef CONFIG_SND_USB_CAIAQ_INPUT
++	snd_usb_caiaq_input_free(cdev);
++#endif
++	snd_usb_caiaq_audio_free(cdev);
++	usb_reset_device(cdev->chip.dev);
++}
++
+ static int create_card(struct usb_device *usb_dev,
+ 		       struct usb_interface *intf,
+ 		       struct snd_card **cardp)
+@@ -489,6 +500,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
+ 		       cdev->vendor_name, cdev->product_name, usbpath);
+ 
+ 	setup_card(cdev);
++	card->private_free = card_free;
+ 	return 0;
+ 
+  err_kill_urb:
+@@ -534,15 +546,14 @@ static void snd_disconnect(struct usb_interface *intf)
+ 	snd_card_disconnect(card);
+ 
+ #ifdef CONFIG_SND_USB_CAIAQ_INPUT
+-	snd_usb_caiaq_input_free(cdev);
++	snd_usb_caiaq_input_disconnect(cdev);
+ #endif
+-	snd_usb_caiaq_audio_free(cdev);
++	snd_usb_caiaq_audio_disconnect(cdev);
+ 
+ 	usb_kill_urb(&cdev->ep1_in_urb);
+ 	usb_kill_urb(&cdev->midi_out_urb);
+ 
+-	snd_card_free(card);
+-	usb_reset_device(interface_to_usbdev(intf));
++	snd_card_free_when_closed(card);
+ }
+ 
+ 
+diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c
+index 84f26dce7f5d0..a9130891bb696 100644
+--- a/sound/usb/caiaq/input.c
++++ b/sound/usb/caiaq/input.c
+@@ -829,15 +829,21 @@ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev)
+ 	return ret;
+ }
+ 
+-void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev)
++void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev)
+ {
+ 	if (!cdev || !cdev->input_dev)
+ 		return;
+ 
+ 	usb_kill_urb(cdev->ep4_in_urb);
++	input_unregister_device(cdev->input_dev);
++}
++
++void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev)
++{
++	if (!cdev || !cdev->input_dev)
++		return;
++
+ 	usb_free_urb(cdev->ep4_in_urb);
+ 	cdev->ep4_in_urb = NULL;
+-
+-	input_unregister_device(cdev->input_dev);
+ 	cdev->input_dev = NULL;
+ }
+diff --git a/sound/usb/caiaq/input.h b/sound/usb/caiaq/input.h
+index c42891e7be884..fbe267f85d025 100644
+--- a/sound/usb/caiaq/input.h
++++ b/sound/usb/caiaq/input.h
+@@ -4,6 +4,7 @@
+ 
+ void snd_usb_caiaq_input_dispatch(struct snd_usb_caiaqdev *cdev, char *buf, unsigned int len);
+ int snd_usb_caiaq_input_init(struct snd_usb_caiaqdev *cdev);
++void snd_usb_caiaq_input_disconnect(struct snd_usb_caiaqdev *cdev);
+ void snd_usb_caiaq_input_free(struct snd_usb_caiaqdev *cdev);
+ 
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/alsa-hda-realtek-update-alc256-depop-procedure.patch b/queue-6.6/alsa-hda-realtek-update-alc256-depop-procedure.patch
new file mode 100644
index 00000000000..eda963fc545
--- /dev/null
+++ b/queue-6.6/alsa-hda-realtek-update-alc256-depop-procedure.patch
@@ -0,0 +1,102 @@
+From 07eadcfc66ef26c80f9736ca71ed88749a7cc4b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 15:21:09 +0800
+Subject: ALSA: hda/realtek: Update ALC256 depop procedure
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit cc3d0b5dd989d3238d456f9fd385946379a9c13d ]
+
+Old procedure has a chance to meet Headphone no output.
+
+Fixes: 4a219ef8f370 ("ALSA: hda/realtek - Add ALC256 HP depop function")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/463c5f93715d4714967041a0a8cec28e@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 42 ++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 75be41086b462..839c0628f2792 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3602,25 +3602,22 @@ static void alc256_init(struct hda_codec *codec)
+ 
+ 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+ 
+-	if (hp_pin_sense)
++	if (hp_pin_sense) {
+ 		msleep(2);
++		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
+ 
+-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
+-
+-	snd_hda_codec_write(codec, hp_pin, 0,
+-			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+-
+-	if (hp_pin_sense || spec->ultra_low_power)
+-		msleep(85);
+-
+-	snd_hda_codec_write(codec, hp_pin, 0,
++		snd_hda_codec_write(codec, hp_pin, 0,
+ 			    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+ 
+-	if (hp_pin_sense || spec->ultra_low_power)
+-		msleep(100);
++		msleep(75);
++
++		snd_hda_codec_write(codec, hp_pin, 0,
++			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
+ 
++		msleep(75);
++		alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
++	}
+ 	alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
+-	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+ 	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+ 	alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
+ 	/*
+@@ -3644,29 +3641,28 @@ static void alc256_shutup(struct hda_codec *codec)
+ 	alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
+ 	hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+ 
+-	if (hp_pin_sense)
++	if (hp_pin_sense) {
+ 		msleep(2);
+ 
+-	snd_hda_codec_write(codec, hp_pin, 0,
++		snd_hda_codec_write(codec, hp_pin, 0,
+ 			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+ 
+-	if (hp_pin_sense || spec->ultra_low_power)
+-		msleep(85);
++		msleep(75);
+ 
+ 	/* 3k pull low control for Headset jack. */
+ 	/* NOTE: call this before clearing the pin, otherwise codec stalls */
+ 	/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ 	 * when booting with headset plugged. So skip setting it for the codec alc257
+ 	 */
+-	if (spec->en_3kpull_low)
+-		alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
++		if (spec->en_3kpull_low)
++			alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+ 
+-	if (!spec->no_shutup_pins)
+-		snd_hda_codec_write(codec, hp_pin, 0,
++		if (!spec->no_shutup_pins)
++			snd_hda_codec_write(codec, hp_pin, 0,
+ 				    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+ 
+-	if (hp_pin_sense || spec->ultra_low_power)
+-		msleep(100);
++		msleep(75);
++	}
+ 
+ 	alc_auto_setup_eapd(codec, false);
+ 	alc_shutup_pins(codec);
+-- 
+2.43.0
+
diff --git a/queue-6.6/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch b/queue-6.6/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch
new file mode 100644
index 00000000000..56fe38c2c92
--- /dev/null
+++ b/queue-6.6/alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch
@@ -0,0 +1,50 @@
+From cfc24be6e3bd1a6a01fdab6e9d7a71f544bb9cbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 12:10:36 +0100
+Subject: ALSA: us122l: Use snd_card_free_when_closed() at disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b7df09bb348016943f56b09dcaafe221e3f73947 ]
+
+The USB disconnect callback is supposed to be short and not too-long
+waiting.  OTOH, the current code uses snd_card_free() at
+disconnection, but this waits for the close of all used fds, hence it
+can take long.  It eventually blocks the upper layer USB ioctls, which
+may trigger a soft lockup.
+
+An easy workaround is to replace snd_card_free() with
+snd_card_free_when_closed().  This variant returns immediately while
+the release of resources is done asynchronously by the card device
+release at the last close.
+
+The loop of us122l->mmap_count check is dropped as well.  The check is
+useless for the asynchronous operation with *_when_closed().
+
+Fixes: 030a07e44129 ("ALSA: Add USB US122L driver")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241113111042.15058-3-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/usx2y/us122l.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
+index 709ccad972e2f..612047ca5fe7a 100644
+--- a/sound/usb/usx2y/us122l.c
++++ b/sound/usb/usx2y/us122l.c
+@@ -617,10 +617,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)
+ 	usb_put_intf(usb_ifnum_to_if(us122l->dev, 1));
+ 	usb_put_dev(us122l->dev);
+ 
+-	while (atomic_read(&us122l->mmap_count))
+-		msleep(500);
+-
+-	snd_card_free(card);
++	snd_card_free_when_closed(card);
+ }
+ 
+ static int snd_us122l_suspend(struct usb_interface *intf, pm_message_t message)
+-- 
+2.43.0
+
diff --git a/queue-6.6/alsa-usx2y-use-snd_card_free_when_closed-at-disconne.patch b/queue-6.6/alsa-usx2y-use-snd_card_free_when_closed-at-disconne.patch
new file mode 100644
index 00000000000..65dae28c340
--- /dev/null
+++ b/queue-6.6/alsa-usx2y-use-snd_card_free_when_closed-at-disconne.patch
@@ -0,0 +1,46 @@
+From aac86a704913a516aac8e2689838731a8c47f3a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 12:10:35 +0100
+Subject: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit dafb28f02be407e07a6f679e922a626592b481b0 ]
+
+The USB disconnect callback is supposed to be short and not too-long
+waiting.  OTOH, the current code uses snd_card_free() at
+disconnection, but this waits for the close of all used fds, hence it
+can take long.  It eventually blocks the upper layer USB ioctls, which
+may trigger a soft lockup.
+
+An easy workaround is to replace snd_card_free() with
+snd_card_free_when_closed().  This variant returns immediately while
+the release of resources is done asynchronously by the card device
+release at the last close.
+
+Fixes: 230cd5e24853 ("[ALSA] prevent oops & dead keyboard on usb unplugging while the device is be ing used")
+Reported-by: syzbot+73582d08864d8268b6fd@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=73582d08864d8268b6fd
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241113111042.15058-2-tiwai@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/usx2y/usbusx2y.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
+index 52f4e6652407d..4c4ce0319d624 100644
+--- a/sound/usb/usx2y/usbusx2y.c
++++ b/sound/usb/usx2y/usbusx2y.c
+@@ -423,7 +423,7 @@ static void snd_usx2y_disconnect(struct usb_interface *intf)
+ 	}
+ 	if (usx2y->us428ctls_sharedmem)
+ 		wake_up(&usx2y->us428ctls_wait_queue_head);
+-	snd_card_free(card);
++	snd_card_free_when_closed(card);
+ }
+ 
+ static int snd_usx2y_probe(struct usb_interface *intf,
+-- 
+2.43.0
+
diff --git a/queue-6.6/amd-pstate-set-min_perf-to-nominal_perf-for-active-m.patch b/queue-6.6/amd-pstate-set-min_perf-to-nominal_perf-for-active-m.patch
new file mode 100644
index 00000000000..a36d9054274
--- /dev/null
+++ b/queue-6.6/amd-pstate-set-min_perf-to-nominal_perf-for-active-m.patch
@@ -0,0 +1,45 @@
+From 3eb5e0305011570ce50f426ab769f7e7eee99d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 15:48:35 +0530
+Subject: amd-pstate: Set min_perf to nominal_perf for active mode performance
+ gov
+
+From: Gautham R. Shenoy <gautham.shenoy@amd.com>
+
+[ Upstream commit 0c411b39e4f4ce8861301fa201cb4f817751311e ]
+
+The amd-pstate driver sets CPPC_REQ.min_perf to CPPC_REQ.max_perf when
+in active mode with performance governor. Typically CPPC_REQ.max_perf
+is set to CPPC.highest_perf. This causes frequency throttling on
+power-limited platforms which causes performance regressions on
+certain classes of workloads.
+
+Hence, set the CPPC_REQ.min_perf to the CPPC.nominal_perf or
+CPPC_REQ.max_perf, whichever is lower of the two.
+
+Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors")
+Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20241021101836.9047-2-gautham.shenoy@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/amd-pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c
+index 8c16d67b98bfe..cdead37d0823a 100644
+--- a/drivers/cpufreq/amd-pstate.c
++++ b/drivers/cpufreq/amd-pstate.c
+@@ -1383,7 +1383,7 @@ static void amd_pstate_epp_update_limit(struct cpufreq_policy *policy)
+ 	value = READ_ONCE(cpudata->cppc_req_cached);
+ 
+ 	if (cpudata->policy == CPUFREQ_POLICY_PERFORMANCE)
+-		min_perf = max_perf;
++		min_perf = min(cpudata->nominal_perf, max_perf);
+ 
+ 	/* Initial min/max values for CPPC Performance Controls Register */
+ 	value &= ~AMD_CPPC_MIN_PERF(~0L);
+-- 
+2.43.0
+
diff --git a/queue-6.6/apparmor-fix-do-simple-duplicate-message-elimination.patch b/queue-6.6/apparmor-fix-do-simple-duplicate-message-elimination.patch
new file mode 100644
index 00000000000..c4f21d86ffc
--- /dev/null
+++ b/queue-6.6/apparmor-fix-do-simple-duplicate-message-elimination.patch
@@ -0,0 +1,35 @@
+From e50f2fcbdb2efe4cba0fd87ba5bb498099168dc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 10:03:16 +0800
+Subject: apparmor: fix 'Do simple duplicate message elimination'
+
+From: chao liu <liuzgyid@outlook.com>
+
+[ Upstream commit 9b897132424fe76bf6c61f22f9cf12af7f1d1e6a ]
+
+Multiple profiles shared 'ent->caps', so some logs missed.
+
+Fixes: 0ed3b28ab8bf ("AppArmor: mediation of non file objects")
+Signed-off-by: chao liu <liuzgyid@outlook.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/capability.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
+index 2fb6a2ea0b998..8248597200623 100644
+--- a/security/apparmor/capability.c
++++ b/security/apparmor/capability.c
+@@ -96,6 +96,8 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile
+ 		return error;
+ 	} else {
+ 		aa_put_profile(ent->profile);
++		if (profile != ent->profile)
++			cap_clear(ent->caps);
+ 		ent->profile = aa_get_profile(profile);
+ 		cap_raise(ent->caps, cap);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch b/queue-6.6/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch
new file mode 100644
index 00000000000..ddbb6c21186
--- /dev/null
+++ b/queue-6.6/arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch
@@ -0,0 +1,56 @@
+From a21117733942fb1e2e9d1a64dc137be9672ea27e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 23:29:16 +0100
+Subject: ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit dd36ad71ad65968f97630808bc8d605c929b128e ]
+
+The DCDC5 voltage rail in the X-Powers AXP809 PMIC has a resolution of
+50mV, so the currently enforced limits of 1.475 and 1.525 volts cannot
+be set, when the existing regulator value is beyond this range.
+
+This will lead to the whole regulator driver to give up and fail
+probing, which in turn will hang the system, as essential devices depend
+on the PMIC.
+In this case a bug in U-Boot set the voltage to 1.75V (meant for DCDC4),
+and the AXP driver's attempt to correct this lead to this error:
+==================
+[    4.447653] axp20x-rsb sunxi-rsb-3a3: AXP20X driver loaded
+[    4.450066] vcc-dram: Bringing 1750000uV into 1575000-1575000uV
+[    4.460272] vcc-dram: failed to apply 1575000-1575000uV constraint: -EINVAL
+[    4.474788] axp20x-regulator axp20x-regulator.0: Failed to register dcdc5
+[    4.482276] axp20x-regulator axp20x-regulator.0: probe with driver axp20x-regulator failed with error -22
+==================
+
+Set the limits to values that can be programmed, so any correction will
+be successful.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Fixes: 1e1dea72651b ("ARM: dts: sun9i: cubieboard4: Add AXP809 PMIC device node and regulators")
+Link: https://patch.msgid.link/20241007222916.19013-1-andre.przywara@arm.com
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts
+index c8ca8cb7f5c94..52ad95a2063aa 100644
+--- a/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts
++++ b/arch/arm/boot/dts/allwinner/sun9i-a80-cubieboard4.dts
+@@ -280,8 +280,8 @@ reg_dcdc4: dcdc4 {
+ 
+ 			reg_dcdc5: dcdc5 {
+ 				regulator-always-on;
+-				regulator-min-microvolt = <1425000>;
+-				regulator-max-microvolt = <1575000>;
++				regulator-min-microvolt = <1450000>;
++				regulator-max-microvolt = <1550000>;
+ 				regulator-name = "vcc-dram";
+ 			};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm-dts-microchip-sam9x60-add-missing-property-atmel.patch b/queue-6.6/arm-dts-microchip-sam9x60-add-missing-property-atmel.patch
new file mode 100644
index 00000000000..6d325896df1
--- /dev/null
+++ b/queue-6.6/arm-dts-microchip-sam9x60-add-missing-property-atmel.patch
@@ -0,0 +1,137 @@
+From 0d8648bcfc671911f452fc2b102649432cb03d9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 12:33:07 +0300
+Subject: ARM: dts: microchip: sam9x60: Add missing property atmel,usart-mode
+
+From: Andrei Simion <andrei.simion@microchip.com>
+
+[ Upstream commit 2f9d013a0c6f1b9109ada5acb28ee26eefc77c03 ]
+
+Add the atmel,usart-mode property to the UART nodes. This ensures
+compliance with the atmel,at91-usart.yaml schema and resolves the errors
+below:
+serial@200: $nodename:0: 'serial@200' does not match
+'^spi(@.*|-([0-9]|[1-9][0-9]+))?$'
+serial@200: atmel,use-dma-rx: False schema does not allow True
+serial@200: atmel,use-dma-tx: False schema does not allow True
+serial@200: atmel,fifo-size: False schema does not allow [[16]]
+
+These errors indicate that the property
+atmel,usart-mode = <AT91_USART_MODE_SERIAL> is missing for
+UART nodes 0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, and 12.
+
+Fixes: 99c808335877 ("ARM: dts: at91: sam9x60: Add missing flexcom definitions")
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Andrei Simion <andrei.simion@microchip.com>
+Link: https://lore.kernel.org/r/20240912093307.40488-1-andrei.simion@microchip.com
+[claudiu.beznea: move the atmel,usart-mode close to vendor specific
+ properties to cope with DTS coding style]
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/microchip/sam9x60.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm/boot/dts/microchip/sam9x60.dtsi b/arch/arm/boot/dts/microchip/sam9x60.dtsi
+index 1705c96f4221e..ae089d4bd660e 100644
+--- a/arch/arm/boot/dts/microchip/sam9x60.dtsi
++++ b/arch/arm/boot/dts/microchip/sam9x60.dtsi
+@@ -186,6 +186,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 13>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -384,6 +385,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 32>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -433,6 +435,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 33>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -590,6 +593,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 9>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -639,6 +643,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 10>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -688,6 +693,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 11>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -737,6 +743,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 5>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -805,6 +812,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 6>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -873,6 +881,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 7>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -941,6 +950,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 8>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -1064,6 +1074,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 15>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+@@ -1113,6 +1124,7 @@ AT91_XDMAC_DT_PER_IF(1) |
+ 					dma-names = "tx", "rx";
+ 					clocks = <&pmc PMC_TYPE_PERIPHERAL 16>;
+ 					clock-names = "usart";
++					atmel,usart-mode = <AT91_USART_MODE_SERIAL>;
+ 					atmel,use-dma-rx;
+ 					atmel,use-dma-tx;
+ 					atmel,fifo-size = <16>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm-dts-renesas-genmai-add-flash-nodes.patch b/queue-6.6/arm-dts-renesas-genmai-add-flash-nodes.patch
new file mode 100644
index 00000000000..c2dc167a346
--- /dev/null
+++ b/queue-6.6/arm-dts-renesas-genmai-add-flash-nodes.patch
@@ -0,0 +1,129 @@
+From a670e8540da2de723c0eae14ef8234b0ada6b542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 13:52:32 +0200
+Subject: ARM: dts: renesas: genmai: Add FLASH nodes
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 30e0a8cf886cb459dc8a895ba9a4fb5132b41499 ]
+
+Add device nodes for the dual Spansion S25FL512S QSPI NOR FLASH and the
+two Spansion S29GL512S CFI NOR FLASHes on the Genmai development board.
+The former is mapped directly through the SPI Multi I/O Bus Controller.
+The latter reside in the address space of the Bus State Controller
+(BSC).
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/53c89c70c6b010702fd9ab5247e19986857671ba.1693481518.git.geert+renesas@glider.be
+Stable-dep-of: 48e17816c3ef ("ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 85 +++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+
+diff --git a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+index ee52c6d5349d0..29ba098f5dd5e 100644
+--- a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
++++ b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+@@ -29,6 +29,35 @@ memory@8000000 {
+ 		reg = <0x08000000 0x08000000>;
+ 	};
+ 
++	flash@18000000 {
++		compatible = "mtd-rom";
++		reg = <0x18000000 0x08000000>;
++		bank-width = <4>;
++		device-width = <1>;
++
++		clocks = <&mstp9_clks R7S72100_CLK_SPIBSC0>;
++		power-domains = <&cpg_clocks>;
++
++		#address-cells = <1>;
++		#size-cells = <1>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "user";
++				reg = <0x00000000 0x04000000>;
++			};
++
++			partition@4000000 {
++				label = "user1";
++				reg = <0x04000000 0x40000000>;
++			};
++		};
++	};
++
+ 	leds {
+ 		status = "okay";
+ 		compatible = "gpio-leds";
+@@ -82,6 +111,62 @@ &extal_clk {
+ 	clock-frequency = <13330000>;
+ };
+ 
++&bsc {
++	flash@0 {
++		compatible = "cfi-flash";
++		reg = <0x00000000 0x04000000>;
++		bank-width = <2>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "uboot";
++				reg = <0x00000000 0x00040000>;
++			};
++
++			partition@40000 {
++				label = "uboot-env";
++				reg = <0x00040000 0x00020000>;
++			};
++
++			partition@60000 {
++				label = "flash";
++				reg = <0x00060000 0x03fa0000>;
++			};
++		};
++	};
++
++	flash@4000000 {
++		compatible = "cfi-flash";
++		reg = <0x04000000 0x04000000>;
++		bank-width = <2>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "uboot1";
++				reg = <0x00000000 0x00040000>;
++			};
++
++			partition@40000 {
++				label = "uboot-env1";
++				reg = <0x00040000 0x00020000>;
++			};
++
++			partition@60000 {
++				label = "flash1";
++				reg = <0x00060000 0x03fa0000>;
++			};
++		};
++	};
++};
++
+ &usb_x1_clk {
+ 	clock-frequency = <48000000>;
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm-dts-renesas-genmai-fix-partition-size-for-qspi-n.patch b/queue-6.6/arm-dts-renesas-genmai-fix-partition-size-for-qspi-n.patch
new file mode 100644
index 00000000000..60f2f2c0883
--- /dev/null
+++ b/queue-6.6/arm-dts-renesas-genmai-fix-partition-size-for-qspi-n.patch
@@ -0,0 +1,40 @@
+From 6c09c60f2dcb961d8c45f1bdbc5195f7595b6b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2024 20:28:44 +0200
+Subject: ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 48e17816c3effa3545e21cd4f7d5a00c55c17a18 ]
+
+Second partition was too large, looks like two digits got mixed up.
+Fixes:
+
+mtd: partition "user1" extends beyond the end of device "18000000.flash" -- size truncated to 0x4000000
+
+Fixes: 30e0a8cf886c ("ARM: dts: renesas: genmai: Add FLASH nodes")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20240914182948.94031-2-wsa+renesas@sang-engineering.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r7s72100-genmai.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+index 29ba098f5dd5e..28e703e0f152b 100644
+--- a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
++++ b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+@@ -53,7 +53,7 @@ partition@0 {
+ 
+ 			partition@4000000 {
+ 				label = "user1";
+-				reg = <0x04000000 0x40000000>;
++				reg = <0x04000000 0x04000000>;
+ 			};
+ 		};
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm-dts-renesas-remove-unused-lbsc-nodes-from-board-.patch b/queue-6.6/arm-dts-renesas-remove-unused-lbsc-nodes-from-board-.patch
new file mode 100644
index 00000000000..e33a21b106b
--- /dev/null
+++ b/queue-6.6/arm-dts-renesas-remove-unused-lbsc-nodes-from-board-.patch
@@ -0,0 +1,144 @@
+From 7be17c95180dabc384599c5ac342e5d4c2226031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 13:52:25 +0200
+Subject: ARM: dts: renesas: Remove unused LBSC nodes from board DTS
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7801764bb8ff68d9ca3dc6967d4642e205a22a0f ]
+
+Several board DTS files contain minimal device nodes that represent
+on-SoC Local Bus State Controllers (LBSC), although they belong in the
+SoC-specific DTS files instead.  As these device nodes are incomplete
+and unused, and hamper adding proper nodes later, it is better to just
+remove them.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/76ece7602045670cbb8dff684c3366ba6eb89add.1693481518.git.geert+renesas@glider.be
+Stable-dep-of: 48e17816c3ef ("ARM: dts: renesas: genmai: Fix partition size for QSPI NOR Flash")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r7s72100-genmai.dts   | 5 -----
+ arch/arm/boot/dts/renesas/r7s72100-gr-peach.dts | 5 -----
+ arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts  | 5 -----
+ arch/arm/boot/dts/renesas/r7s9210-rza2mevb.dts  | 5 -----
+ arch/arm/boot/dts/renesas/r8a7790-lager.dts     | 5 -----
+ arch/arm/boot/dts/renesas/r8a7791-koelsch.dts   | 5 -----
+ arch/arm/boot/dts/renesas/r8a7794-alt.dts       | 5 -----
+ 7 files changed, 35 deletions(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+index 1e8447176b105..ee52c6d5349d0 100644
+--- a/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
++++ b/arch/arm/boot/dts/renesas/r7s72100-genmai.dts
+@@ -29,11 +29,6 @@ memory@8000000 {
+ 		reg = <0x08000000 0x08000000>;
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	leds {
+ 		status = "okay";
+ 		compatible = "gpio-leds";
+diff --git a/arch/arm/boot/dts/renesas/r7s72100-gr-peach.dts b/arch/arm/boot/dts/renesas/r7s72100-gr-peach.dts
+index 105f9c71f9fd5..f3a0eaf22f52d 100644
+--- a/arch/arm/boot/dts/renesas/r7s72100-gr-peach.dts
++++ b/arch/arm/boot/dts/renesas/r7s72100-gr-peach.dts
+@@ -29,11 +29,6 @@ memory@20000000 {
+ 		reg = <0x20000000 0x00a00000>;
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	flash@18000000 {
+ 		compatible = "mtd-rom";
+ 		probe-type = "map_rom";
+diff --git a/arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts b/arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts
+index 1c5acf6944074..14249be7435a5 100644
+--- a/arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts
++++ b/arch/arm/boot/dts/renesas/r7s72100-rskrza1.dts
+@@ -60,11 +60,6 @@ key-3 {
+ 		};
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
+diff --git a/arch/arm/boot/dts/renesas/r7s9210-rza2mevb.dts b/arch/arm/boot/dts/renesas/r7s9210-rza2mevb.dts
+index 69a5a44b8a2fd..cd2324b8e8ffb 100644
+--- a/arch/arm/boot/dts/renesas/r7s9210-rza2mevb.dts
++++ b/arch/arm/boot/dts/renesas/r7s9210-rza2mevb.dts
+@@ -63,11 +63,6 @@ key-3 {
+ 		};
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
+diff --git a/arch/arm/boot/dts/renesas/r8a7790-lager.dts b/arch/arm/boot/dts/renesas/r8a7790-lager.dts
+index ab7e9fa90b9fe..b17a9f9307e59 100644
+--- a/arch/arm/boot/dts/renesas/r8a7790-lager.dts
++++ b/arch/arm/boot/dts/renesas/r8a7790-lager.dts
+@@ -73,11 +73,6 @@ memory@140000000 {
+ 		reg = <1 0x40000000 0 0xc0000000>;
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	keyboard {
+ 		compatible = "gpio-keys";
+ 
+diff --git a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts
+index 4a76be68887b4..ec01cc8595161 100644
+--- a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts
+@@ -73,11 +73,6 @@ memory@200000000 {
+ 		reg = <2 0x00000000 0 0x40000000>;
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	keyboard {
+ 		compatible = "gpio-keys";
+ 
+diff --git a/arch/arm/boot/dts/renesas/r8a7794-alt.dts b/arch/arm/boot/dts/renesas/r8a7794-alt.dts
+index 3a9db455ddec9..73ec4d3541541 100644
+--- a/arch/arm/boot/dts/renesas/r8a7794-alt.dts
++++ b/arch/arm/boot/dts/renesas/r8a7794-alt.dts
+@@ -90,11 +90,6 @@ vccq_sdhi1: regulator-vccq-sdhi1 {
+ 		states = <3300000 1>, <1800000 0>;
+ 	};
+ 
+-	lbsc {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-	};
+-
+ 	keyboard {
+ 		compatible = "gpio-keys";
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mediatek-add-adc-node-on-mt6357-mt6358-mt6.patch b/queue-6.6/arm64-dts-mediatek-add-adc-node-on-mt6357-mt6358-mt6.patch
new file mode 100644
index 00000000000..a71af607830
--- /dev/null
+++ b/queue-6.6/arm64-dts-mediatek-add-adc-node-on-mt6357-mt6358-mt6.patch
@@ -0,0 +1,75 @@
+From 71aa9e7231791cb5f830a99028dbfd6841600bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2024 14:30:08 +0200
+Subject: arm64: dts: mediatek: Add ADC node on MT6357, MT6358, MT6359 PMICs
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit b0a4ce81f327eae06c1088f1a437edc48a94a3e8 ]
+
+Add support for the ADC on MT6357/8/9 and keep it default enabled
+as this IP is always present on those PMICs.
+Users may use different IIO channels depending on board-specific
+routing.
+
+Link: https://lore.kernel.org/r/20240604123008.327424-6-angelogioacchino.delregno@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Stable-dep-of: 76ab2ae0ab9e ("arm64: dts: mediatek: mt6358: fix dtbs_check error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6357.dtsi | 5 +++++
+ arch/arm64/boot/dts/mediatek/mt6358.dtsi | 5 +++++
+ arch/arm64/boot/dts/mediatek/mt6359.dtsi | 5 +++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6357.dtsi b/arch/arm64/boot/dts/mediatek/mt6357.dtsi
+index 3330a03c2f745..5fafa842d312f 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6357.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6357.dtsi
+@@ -10,6 +10,11 @@ &pwrap {
+ 	mt6357_pmic: pmic {
+ 		compatible = "mediatek,mt6357";
+ 
++		pmic_adc: adc {
++			compatible = "mediatek,mt6357-auxadc";
++			#io-channel-cells = <1>;
++		};
++
+ 		regulators {
+ 			mt6357_vproc_reg: buck-vproc {
+ 				regulator-name = "vproc";
+diff --git a/arch/arm64/boot/dts/mediatek/mt6358.dtsi b/arch/arm64/boot/dts/mediatek/mt6358.dtsi
+index b605313bed99d..8c9b6f662e9bc 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6358.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6358.dtsi
+@@ -12,6 +12,11 @@ pmic: pmic {
+ 		interrupts = <182 IRQ_TYPE_LEVEL_HIGH>;
+ 		#interrupt-cells = <2>;
+ 
++		pmic_adc: adc {
++			compatible = "mediatek,mt6358-auxadc";
++			#io-channel-cells = <1>;
++		};
++
+ 		mt6358codec: mt6358codec {
+ 			compatible = "mediatek,mt6358-sound";
+ 			mediatek,dmic-mode = <0>; /* two-wires */
+diff --git a/arch/arm64/boot/dts/mediatek/mt6359.dtsi b/arch/arm64/boot/dts/mediatek/mt6359.dtsi
+index df3e822232d34..8e1b8c85c6ede 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6359.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6359.dtsi
+@@ -9,6 +9,11 @@ pmic: pmic {
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+ 
++		pmic_adc: adc {
++			compatible = "mediatek,mt6359-auxadc";
++			#io-channel-cells = <1>;
++		};
++
+ 		mt6359codec: mt6359codec {
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mediatek-mt6358-fix-dtbs_check-error.patch b/queue-6.6/arm64-dts-mediatek-mt6358-fix-dtbs_check-error.patch
new file mode 100644
index 00000000000..4b84a9c29ca
--- /dev/null
+++ b/queue-6.6/arm64-dts-mediatek-mt6358-fix-dtbs_check-error.patch
@@ -0,0 +1,47 @@
+From 6c8dc8e3eb2b856f71f1b810dc49fcb0d73f56b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 14:46:47 +0800
+Subject: arm64: dts: mediatek: mt6358: fix dtbs_check error
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+[ Upstream commit 76ab2ae0ab9ebb2d70e6ee8a9f59911621192c37 ]
+
+Fix DTBS check errors for 'mt6358codec' and 'mt6358regulator':
+
+Error message is:
+pmic: 'mt6358codec' and 'mt6358regulator' does not match any of the
+regexes: 'pinctrl-[0-9]+'.
+Rename these two device node to generic 'audio-codec' and 'regulators'.
+
+Fixes: 9f8872221674 ("arm64: dts: mt6358: add PMIC MT6358 related nodes")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Link: https://lore.kernel.org/r/20241029064647.13370-1-macpaul.lin@mediatek.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt6358.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt6358.dtsi b/arch/arm64/boot/dts/mediatek/mt6358.dtsi
+index 8c9b6f662e9bc..9a549069a483e 100644
+--- a/arch/arm64/boot/dts/mediatek/mt6358.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt6358.dtsi
+@@ -17,12 +17,12 @@ pmic_adc: adc {
+ 			#io-channel-cells = <1>;
+ 		};
+ 
+-		mt6358codec: mt6358codec {
++		mt6358codec: audio-codec {
+ 			compatible = "mediatek,mt6358-sound";
+ 			mediatek,dmic-mode = <0>; /* two-wires */
+ 		};
+ 
+-		mt6358regulator: mt6358regulator {
++		mt6358regulator: regulators {
+ 			compatible = "mediatek,mt6358-regulator";
+ 
+ 			mt6358_vdram1_reg: buck_vdram1 {
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mediatek-mt8173-elm-hana-add-vdd-supply-to.patch b/queue-6.6/arm64-dts-mediatek-mt8173-elm-hana-add-vdd-supply-to.patch
new file mode 100644
index 00000000000..4399512ff92
--- /dev/null
+++ b/queue-6.6/arm64-dts-mediatek-mt8173-elm-hana-add-vdd-supply-to.patch
@@ -0,0 +1,50 @@
+From 7280691816a078193003de50f077b8627f639a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 16:20:00 +0800
+Subject: arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second
+ source trackpad
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit f766fae08f6a2eaeb45d8d2c053724c91526835c ]
+
+The Hana device has a second source option trackpad, but it is missing
+its regulator supply. It only works because the regulator is marked as
+always-on.
+
+Add the regulator supply, but leave out the post-power-on delay. Instead,
+document the post-power-on delay along with the reason for not adding
+it in a comment.
+
+Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241018082001.1296963-1-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi
+index bdcd35cecad90..fd6230352f4fd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm-hana.dtsi
+@@ -43,6 +43,14 @@ trackpad2: trackpad@2c {
+ 		interrupts = <117 IRQ_TYPE_LEVEL_LOW>;
+ 		reg = <0x2c>;
+ 		hid-descr-addr = <0x0020>;
++		/*
++		 * The trackpad needs a post-power-on delay of 100ms,
++		 * but at time of writing, the power supply for it on
++		 * this board is always on. The delay is therefore not
++		 * added to avoid impacting the readiness of the
++		 * trackpad.
++		 */
++		vdd-supply = <&mt6397_vgp6_reg>;
+ 		wakeup-source;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-supplies.patch b/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-supplies.patch
new file mode 100644
index 00000000000..6f690d65839
--- /dev/null
+++ b/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-supplies.patch
@@ -0,0 +1,64 @@
+From 3d545b0dc0e44b8c2787f7e80c8c706a5dddce44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 15:02:22 +0800
+Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add supplies for fixed
+ regulators
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit aaecb1da58a72bfbd2c35d4aadc43caa02f11862 ]
+
+When the fixed regulators for the LCD panel and DP bridge were added,
+their supplies were not modeled in. These, except for the 1.0V supply,
+are just load switches, and need and have a supply.
+
+Add the supplies for each of the fixed regulators.
+
+Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241030070224.1006331-4-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+index beec6f0e4f274..629c4b7ecbc62 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+@@ -20,6 +20,7 @@ pp1000_mipibrdg: pp1000-mipibrdg {
+ 		regulator-boot-on;
+ 
+ 		gpio = <&pio 54 GPIO_ACTIVE_HIGH>;
++		vin-supply = <&pp1800_alw>;
+ 	};
+ 
+ 	pp1800_mipibrdg: pp1800-mipibrdg {
+@@ -32,6 +33,7 @@ pp1800_mipibrdg: pp1800-mipibrdg {
+ 		regulator-boot-on;
+ 
+ 		gpio = <&pio 36 GPIO_ACTIVE_HIGH>;
++		vin-supply = <&pp1800_alw>;
+ 	};
+ 
+ 	pp3300_panel: pp3300-panel {
+@@ -46,6 +48,7 @@ pp3300_panel: pp3300-panel {
+ 		regulator-boot-on;
+ 
+ 		gpio = <&pio 35 GPIO_ACTIVE_HIGH>;
++		vin-supply = <&pp3300_alw>;
+ 	};
+ 
+ 	pp3300_mipibrdg: pp3300-mipibrdg {
+@@ -58,6 +61,7 @@ pp3300_mipibrdg: pp3300-mipibrdg {
+ 		regulator-boot-on;
+ 
+ 		gpio = <&pio 37 GPIO_ACTIVE_HIGH>;
++		vin-supply = <&pp3300_alw>;
+ 	};
+ 
+ 	volume_buttons: volume-buttons {
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch b/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch
new file mode 100644
index 00000000000..f9afad80d14
--- /dev/null
+++ b/queue-6.6/arm64-dts-mediatek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch
@@ -0,0 +1,112 @@
+From 03093a8c0da5d5e66ccc21412d9f090760aa91b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 15:02:21 +0800
+Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Fix DP bridge supply
+ names
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit c4e8cf13f1740037483565d5b802764e2426515b ]
+
+Some of the regulator supplies for the MIPI-DPI-to-DP bridge and their
+associated nodes are incorrectly named. In particular, the 1.0V supply
+was modeled as a 1.2V supply.
+
+Fix all the incorrect names, and also fix the voltage of the 1.0V
+regulator.
+
+Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241030070224.1006331-3-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi    | 26 ++++++++++---------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+index 32f6899f885ef..beec6f0e4f274 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+@@ -8,11 +8,13 @@
+ #include <arm/cros-ec-keyboard.dtsi>
+ 
+ / {
+-	pp1200_mipibrdg: pp1200-mipibrdg {
++	pp1000_mipibrdg: pp1000-mipibrdg {
+ 		compatible = "regulator-fixed";
+-		regulator-name = "pp1200_mipibrdg";
++		regulator-name = "pp1000_mipibrdg";
++		regulator-min-microvolt = <1000000>;
++		regulator-max-microvolt = <1000000>;
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&pp1200_mipibrdg_en>;
++		pinctrl-0 = <&pp1000_mipibrdg_en>;
+ 
+ 		enable-active-high;
+ 		regulator-boot-on;
+@@ -24,7 +26,7 @@ pp1800_mipibrdg: pp1800-mipibrdg {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "pp1800_mipibrdg";
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&pp1800_lcd_en>;
++		pinctrl-0 = <&pp1800_mipibrdg_en>;
+ 
+ 		enable-active-high;
+ 		regulator-boot-on;
+@@ -46,11 +48,11 @@ pp3300_panel: pp3300-panel {
+ 		gpio = <&pio 35 GPIO_ACTIVE_HIGH>;
+ 	};
+ 
+-	vddio_mipibrdg: vddio-mipibrdg {
++	pp3300_mipibrdg: pp3300-mipibrdg {
+ 		compatible = "regulator-fixed";
+-		regulator-name = "vddio_mipibrdg";
++		regulator-name = "pp3300_mipibrdg";
+ 		pinctrl-names = "default";
+-		pinctrl-0 = <&vddio_mipibrdg_en>;
++		pinctrl-0 = <&pp3300_mipibrdg_en>;
+ 
+ 		enable-active-high;
+ 		regulator-boot-on;
+@@ -152,9 +154,9 @@ anx_bridge: anx7625@58 {
+ 		panel_flags = <1>;
+ 		enable-gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
+ 		reset-gpios = <&pio 73 GPIO_ACTIVE_HIGH>;
+-		vdd10-supply = <&pp1200_mipibrdg>;
++		vdd10-supply = <&pp1000_mipibrdg>;
+ 		vdd18-supply = <&pp1800_mipibrdg>;
+-		vdd33-supply = <&vddio_mipibrdg>;
++		vdd33-supply = <&pp3300_mipibrdg>;
+ 
+ 		ports {
+ 			#address-cells = <1>;
+@@ -397,14 +399,14 @@ &pio {
+ 		"",
+ 		"";
+ 
+-	pp1200_mipibrdg_en: pp1200-mipibrdg-en {
++	pp1000_mipibrdg_en: pp1000-mipibrdg-en {
+ 		pins1 {
+ 			pinmux = <PINMUX_GPIO54__FUNC_GPIO54>;
+ 			output-low;
+ 		};
+ 	};
+ 
+-	pp1800_lcd_en: pp1800-lcd-en {
++	pp1800_mipibrdg_en: pp1800-mipibrdg-en {
+ 		pins1 {
+ 			pinmux = <PINMUX_GPIO36__FUNC_GPIO36>;
+ 			output-low;
+@@ -466,7 +468,7 @@ trackpad-int {
+ 		};
+ 	};
+ 
+-	vddio_mipibrdg_en: vddio-mipibrdg-en {
++	pp3300_mipibrdg_en: pp3300-mipibrdg-en {
+ 		pins1 {
+ 			pinmux = <PINMUX_GPIO37__FUNC_GPIO37>;
+ 			output-low;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-burnet-add-i2c2-s-i2c-scl-internal-.patch b/queue-6.6/arm64-dts-mt8183-burnet-add-i2c2-s-i2c-scl-internal-.patch
new file mode 100644
index 00000000000..bbf126b065b
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-burnet-add-i2c2-s-i2c-scl-internal-.patch
@@ -0,0 +1,37 @@
+From cf73737e8f0209cfe7b7c92bc24926e51530476a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 16:03:49 +0800
+Subject: arm64: dts: mt8183: burnet: add i2c2's i2c-scl-internal-delay-ns
+
+From: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+
+[ Upstream commit 85af64983889c621e8868b744c8ca03bd5038c02 ]
+
+Add i2c2's i2c-scl-internal-delay-ns.
+
+Fixes: dd6e3b06214f ("arm64: dts: mt8183: Add kukui-jacuzzi-burnet board")
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://lore.kernel.org/r/20241025-i2c-delay-v2-2-9be1bcaf35e0@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts
+index 19c1e2bee494c..20b71f2e7159a 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dts
+@@ -30,3 +30,6 @@ touchscreen@2c {
+ 	};
+ };
+ 
++&i2c2 {
++	i2c-scl-internal-delay-ns = <4100>;
++};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-cozmo-add-i2c2-s-i2c-scl-internal-d.patch b/queue-6.6/arm64-dts-mt8183-cozmo-add-i2c2-s-i2c-scl-internal-d.patch
new file mode 100644
index 00000000000..5f5c1a9f3e4
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-cozmo-add-i2c2-s-i2c-scl-internal-d.patch
@@ -0,0 +1,39 @@
+From cd02268e83c84e712bd35f474395dd035eb4380a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 16:03:50 +0800
+Subject: arm64: dts: mt8183: cozmo: add i2c2's i2c-scl-internal-delay-ns
+
+From: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+
+[ Upstream commit bd0eb3b1f7aee698b86513edf10a50e2d0c7cb14 ]
+
+Add i2c2's i2c-scl-internal-delay-ns.
+
+Fixes: 52e84f233459 ("arm64: dts: mt8183: Add kukui-jacuzzi-cozmo board")
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://lore.kernel.org/r/20241025-i2c-delay-v2-3-9be1bcaf35e0@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts
+index 072133fb0f016..47905f84bc161 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-cozmo.dts
+@@ -17,6 +17,8 @@ &i2c_tunnel {
+ };
+ 
+ &i2c2 {
++	i2c-scl-internal-delay-ns = <25000>;
++
+ 	trackpad@2c {
+ 		compatible = "hid-over-i2c";
+ 		reg = <0x2c>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-damu-add-i2c2-s-i2c-scl-internal-de.patch b/queue-6.6/arm64-dts-mt8183-damu-add-i2c2-s-i2c-scl-internal-de.patch
new file mode 100644
index 00000000000..e7ec016afbc
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-damu-add-i2c2-s-i2c-scl-internal-de.patch
@@ -0,0 +1,37 @@
+From 60ea8c526c54466d1b775c51cb4be2c04c72a169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 16:03:51 +0800
+Subject: arm64: dts: mt8183: Damu: add i2c2's i2c-scl-internal-delay-ns
+
+From: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+
+[ Upstream commit 6ff2d45f2121c698a57c959ae21885a048615908 ]
+
+Add i2c2's i2c-scl-internal-delay-ns.
+
+Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board")
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://lore.kernel.org/r/20241025-i2c-delay-v2-4-9be1bcaf35e0@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
+index 552bfc7269994..9a166dccd727c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
+@@ -31,3 +31,6 @@ &qca_wifi {
+ 	qcom,ath10k-calibration-variant = "GO_DAMU";
+ };
+ 
++&i2c2 {
++	i2c-scl-internal-delay-ns = <20000>;
++};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-fennel-add-i2c2-s-i2c-scl-internal-.patch b/queue-6.6/arm64-dts-mt8183-fennel-add-i2c2-s-i2c-scl-internal-.patch
new file mode 100644
index 00000000000..679c1f2bd5a
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-fennel-add-i2c2-s-i2c-scl-internal-.patch
@@ -0,0 +1,38 @@
+From a0935b88e84a046b8cfaee1d45df63bc9739df82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 16:03:48 +0800
+Subject: arm64: dts: mt8183: fennel: add i2c2's i2c-scl-internal-delay-ns
+
+From: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+
+[ Upstream commit c802db127dfb9602aaa9338e433c0553d34f1a9c ]
+
+Add i2c2's i2c-scl-internal-delay-ns.
+
+Fixes: 6cd7fdc8c530 ("arm64: dts: mt8183: Add kukui-jacuzzi-fennel board")
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Daolong Zhu <jg_daolongzhu@mediatek.corp-partner.google.com>
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by:
+Link: https://lore.kernel.org/r/20241025-i2c-delay-v2-1-9be1bcaf35e0@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi
+index bbe6c338f465e..f9c1ec366b266 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-fennel.dtsi
+@@ -25,3 +25,6 @@ trackpad@2c {
+ 	};
+ };
+ 
++&i2c2 {
++	i2c-scl-internal-delay-ns = <21500>;
++};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-krane-fix-the-address-of-eeprom-at-.patch b/queue-6.6/arm64-dts-mt8183-krane-fix-the-address-of-eeprom-at-.patch
new file mode 100644
index 00000000000..43aed24b043
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-krane-fix-the-address-of-eeprom-at-.patch
@@ -0,0 +1,41 @@
+From d9f5f3ec62e9d10d02518e61c15f0861115f2cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 08:33:46 +0000
+Subject: arm64: dts: mt8183: krane: Fix the address of eeprom at i2c4
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit e9c60c34948662b5d47573490ee538439b29e462 ]
+
+The address of eeprom should be 50.
+
+Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/20240909-eeprom-v1-1-1ed2bc5064f4@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+index 181da69d18f46..b0469a95ddc43 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+@@ -89,9 +89,9 @@ &i2c4 {
+ 	clock-frequency = <400000>;
+ 	vbus-supply = <&mt6358_vcn18_reg>;
+ 
+-	eeprom@54 {
++	eeprom@50 {
+ 		compatible = "atmel,24c32";
+-		reg = <0x54>;
++		reg = <0x50>;
+ 		pagesize = <32>;
+ 		vcc-supply = <&mt6358_vcn18_reg>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8183-kukui-fix-the-address-of-eeprom-at-.patch b/queue-6.6/arm64-dts-mt8183-kukui-fix-the-address-of-eeprom-at-.patch
new file mode 100644
index 00000000000..9dd8c9dde1e
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8183-kukui-fix-the-address-of-eeprom-at-.patch
@@ -0,0 +1,59 @@
+From ec77f48a21fdfae8370bfda9866a24a086303ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 08:33:47 +0000
+Subject: arm64: dts: mt8183: kukui: Fix the address of eeprom at i2c4
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit edbde4923f208aa83abb48d4b2463299e5fc2586 ]
+
+The address of eeprom should be 50.
+
+Fixes: ff33d889567e ("arm64: dts: mt8183: Add kukui kodama board")
+Fixes: d1eaf77f2c66 ("arm64: dts: mt8183: Add kukui kakadu board")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240909-eeprom-v1-2-1ed2bc5064f4@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++--
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+index 0d3c7b8162ff0..9eca1c80fe010 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+@@ -105,9 +105,9 @@ &i2c4 {
+ 	clock-frequency = <400000>;
+ 	vbus-supply = <&mt6358_vcn18_reg>;
+ 
+-	eeprom@54 {
++	eeprom@50 {
+ 		compatible = "atmel,24c32";
+-		reg = <0x54>;
++		reg = <0x50>;
+ 		pagesize = <32>;
+ 		vcc-supply = <&mt6358_vcn18_reg>;
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+index e73113cb51f53..29216ebe4de84 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+@@ -80,9 +80,9 @@ &i2c4 {
+ 	clock-frequency = <400000>;
+ 	vbus-supply = <&mt6358_vcn18_reg>;
+ 
+-	eeprom@54 {
++	eeprom@50 {
+ 		compatible = "atmel,24c64";
+-		reg = <0x54>;
++		reg = <0x50>;
+ 		pagesize = <32>;
+ 		vcc-supply = <&mt6358_vcn18_reg>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-infracfg_a.patch b/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-infracfg_a.patch
new file mode 100644
index 00000000000..f5e14afa25e
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-infracfg_a.patch
@@ -0,0 +1,44 @@
+From f86848c5f8bc125d3a1fb93d3cdfc90ea1f5448f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 13:16:16 +0800
+Subject: arm64: dts: mt8195: Fix dtbs_check error for infracfg_ao node
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+[ Upstream commit c14ab45f5d458073248ddc62d31045d5d616806f ]
+
+The infracfg_ao node in mt8195.dtsi was causing a dtbs_check error.
+The error message was:
+
+syscon@10001000: compatible: ['mediatek,mt8195-infracfg_ao', 'syscon',
+                 'simple-mfd'] is too long
+
+To resolve this, remove 'simple-mfd' from the 'compatible' property of the
+infracfg_ao node.
+
+Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241002051620.2050-1-macpaul.lin@mediatek.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index e2bc4b0d8bc6c..5a087404ccc2d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -487,7 +487,7 @@ topckgen: syscon@10000000 {
+ 		};
+ 
+ 		infracfg_ao: syscon@10001000 {
+-			compatible = "mediatek,mt8195-infracfg_ao", "syscon", "simple-mfd";
++			compatible = "mediatek,mt8195-infracfg_ao", "syscon";
+ 			reg = <0 0x10001000 0 0x1000>;
+ 			#clock-cells = <1>;
+ 			#reset-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-mutex-node.patch b/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-mutex-node.patch
new file mode 100644
index 00000000000..428f15a90f3
--- /dev/null
+++ b/queue-6.6/arm64-dts-mt8195-fix-dtbs_check-error-for-mutex-node.patch
@@ -0,0 +1,45 @@
+From 520ad3003db2ef33433390573c292a79b5b56613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 13:16:19 +0800
+Subject: arm64: dts: mt8195: Fix dtbs_check error for mutex node
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+[ Upstream commit 0fc557b539a1e11bdc5053a308b12d84ea754786 ]
+
+The mutex node in mt8195.dtsi was triggering a dtbs_check error:
+  mutex@1c101000: 'clock-names', 'reg-names' do not match any of the
+                  regexes: 'pinctrl-[0-9]+'
+
+This seems no need by inspecting the DT schemas and other reference boards,
+so drop 'clock-names' and 'reg-names' in mt8195.dtsi.
+
+Fixes: 92d2c23dc269 ("arm64: dts: mt8195: add display node for vdosys1")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241002051620.2050-4-macpaul.lin@mediatek.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index d21ba00a5bd5d..e2bc4b0d8bc6c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -2845,11 +2845,9 @@ &larb19 &larb21 &larb24 &larb25
+ 		mutex1: mutex@1c101000 {
+ 			compatible = "mediatek,mt8195-disp-mutex";
+ 			reg = <0 0x1c101000 0 0x1000>;
+-			reg-names = "vdo1_mutex";
+ 			interrupts = <GIC_SPI 494 IRQ_TYPE_LEVEL_HIGH 0>;
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			clocks = <&vdosys1 CLK_VDO1_DISP_MUTEX>;
+-			clock-names = "vdo1_mutex";
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x1000 0x1000>;
+ 			mediatek,gce-events = <CMDQ_EVENT_VDO1_STREAM_DONE_ENG_0>;
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-qcom-sc8180x-add-a-soc-specific-compatible.patch b/queue-6.6/arm64-dts-qcom-sc8180x-add-a-soc-specific-compatible.patch
new file mode 100644
index 00000000000..472d7648062
--- /dev/null
+++ b/queue-6.6/arm64-dts-qcom-sc8180x-add-a-soc-specific-compatible.patch
@@ -0,0 +1,40 @@
+From 75f49102b4413ad0408a6d18c3008f09a84e335c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 12:31:18 +0100
+Subject: arm64: dts: qcom: sc8180x: Add a SoC-specific compatible to
+ cpufreq-hw
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 5df30684415d5a902f23862ab5bbed2a2df7fbf1 ]
+
+Comply with bindings guidelines and get rid of errors such as:
+
+cpufreq@18323000: compatible: 'oneOf' conditional failed, one must be fixed:
+        ['qcom,cpufreq-hw'] is too short
+
+Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 92b85de7706d3..dfeeada91b780 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -3618,7 +3618,7 @@ lmh@18358800 {
+ 		};
+ 
+ 		cpufreq_hw: cpufreq@18323000 {
+-			compatible = "qcom,cpufreq-hw";
++			compatible = "qcom,sc8180x-cpufreq-hw", "qcom,cpufreq-hw";
+ 			reg = <0 0x18323000 0 0x1400>, <0 0x18325800 0 0x1400>;
+ 			reg-names = "freq-domain0", "freq-domain1";
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-qcom-sm6350-fix-gpu-frequencies-missing-on.patch b/queue-6.6/arm64-dts-qcom-sm6350-fix-gpu-frequencies-missing-on.patch
new file mode 100644
index 00000000000..3013c1b8e1f
--- /dev/null
+++ b/queue-6.6/arm64-dts-qcom-sm6350-fix-gpu-frequencies-missing-on.patch
@@ -0,0 +1,88 @@
+From ff36bc6427bece7bbef6a67adca2bf98a165e865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 14:58:06 +0200
+Subject: arm64: dts: qcom: sm6350: Fix GPU frequencies missing on some
+ speedbins
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 600c499f8f5297c2c91e8146a8217f299e445ef6 ]
+
+Make sure the GPU frequencies are marked as supported for the respective
+speedbins according to downstream msm-4.19 kernel:
+
+* 850 MHz: Speedbins 0 + 180
+* 800 MHz: Speedbins 0 + 180 + 169
+* 650 MHz: Speedbins 0 + 180 + 169 + 138
+* 565 MHz: Speedbins 0 + 180 + 169 + 138 + 120
+* 430 MHz: Speedbins 0 + 180 + 169 + 138 + 120
+* 355 MHz: Speedbins 0 + 180 + 169 + 138 + 120
+* 253 MHz: Speedbins 0 + 180 + 169 + 138 + 120
+
+Fixes: bd9b76750280 ("arm64: dts: qcom: sm6350: Add GPU nodes")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Link: https://lore.kernel.org/r/20241002-sm6350-gpu-speedbin-fix-v1-1-8a5d90c5097d@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index 2efceb49a3218..f271b69485c5c 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -1351,43 +1351,43 @@ gpu_opp_table: opp-table {
+ 				opp-850000000 {
+ 					opp-hz = /bits/ 64 <850000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_TURBO_L1>;
+-					opp-supported-hw = <0x02>;
++					opp-supported-hw = <0x03>;
+ 				};
+ 
+ 				opp-800000000 {
+ 					opp-hz = /bits/ 64 <800000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_TURBO>;
+-					opp-supported-hw = <0x04>;
++					opp-supported-hw = <0x07>;
+ 				};
+ 
+ 				opp-650000000 {
+ 					opp-hz = /bits/ 64 <650000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_NOM_L1>;
+-					opp-supported-hw = <0x08>;
++					opp-supported-hw = <0x0f>;
+ 				};
+ 
+ 				opp-565000000 {
+ 					opp-hz = /bits/ 64 <565000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_NOM>;
+-					opp-supported-hw = <0x10>;
++					opp-supported-hw = <0x1f>;
+ 				};
+ 
+ 				opp-430000000 {
+ 					opp-hz = /bits/ 64 <430000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_SVS_L1>;
+-					opp-supported-hw = <0xff>;
++					opp-supported-hw = <0x1f>;
+ 				};
+ 
+ 				opp-355000000 {
+ 					opp-hz = /bits/ 64 <355000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_SVS>;
+-					opp-supported-hw = <0xff>;
++					opp-supported-hw = <0x1f>;
+ 				};
+ 
+ 				opp-253000000 {
+ 					opp-hz = /bits/ 64 <253000000>;
+ 					opp-level = <RPMH_REGULATOR_LEVEL_LOW_SVS>;
+-					opp-supported-hw = <0xff>;
++					opp-supported-hw = <0x1f>;
+ 				};
+ 			};
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-renesas-hihope-drop-sound-dai-cells.patch b/queue-6.6/arm64-dts-renesas-hihope-drop-sound-dai-cells.patch
new file mode 100644
index 00000000000..87cd3e0242e
--- /dev/null
+++ b/queue-6.6/arm64-dts-renesas-hihope-drop-sound-dai-cells.patch
@@ -0,0 +1,61 @@
+From 927decab37f5e5017297e824dbaad9565a6063df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 14:53:31 +0100
+Subject: arm64: dts: renesas: hihope: Drop #sound-dai-cells
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 9cc926e3fab42dd292219796cfc94e41f4ab749d ]
+
+"#sound-dai-cells" is required if the board is using "simple-card".
+However, the HiHope board uses "audio-graph", thus remove the unneeded
+`#sound-dai-cells`.
+
+Commit 9e72606cd2db ("arm64: dts: renesas: #sound-dai-cells is used when
+simple-card") updated the comment regarding usage of "#sound-dai-cells"
+in the SoC DTSI but missed to remove "#sound-dai-cells" from board DTS
+files.
+
+Fixes: 9e72606cd2db ("arm64: dts: renesas: #sound-dai-cells is used when simple-card")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/20241010135332.710648-1-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/hihope-rev2.dtsi | 3 ---
+ arch/arm64/boot/dts/renesas/hihope-rev4.dtsi | 3 ---
+ 2 files changed, 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi b/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi
+index 8e2db1d6ca81e..25c55b32aafe5 100644
+--- a/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi
++++ b/arch/arm64/boot/dts/renesas/hihope-rev2.dtsi
+@@ -69,9 +69,6 @@ &rcar_sound {
+ 
+ 	status = "okay";
+ 
+-	/* Single DAI */
+-	#sound-dai-cells = <0>;
+-
+ 	rsnd_port: port {
+ 		rsnd_endpoint: endpoint {
+ 			remote-endpoint = <&dw_hdmi0_snd_in>;
+diff --git a/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi b/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi
+index 7fc0339a3ac97..e59191562d06c 100644
+--- a/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi
++++ b/arch/arm64/boot/dts/renesas/hihope-rev4.dtsi
+@@ -84,9 +84,6 @@ &rcar_sound {
+ 	pinctrl-names = "default";
+ 	status = "okay";
+ 
+-	/* Single DAI */
+-	#sound-dai-cells = <0>;
+-
+ 	/* audio_clkout0/1/2/3 */
+ 	#clock-cells = <1>;
+ 	clock-frequency = <12288000 11289600>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-rockchip-correct-analog-audio-name-on-indi.patch b/queue-6.6/arm64-dts-rockchip-correct-analog-audio-name-on-indi.patch
new file mode 100644
index 00000000000..8ffeb791d54
--- /dev/null
+++ b/queue-6.6/arm64-dts-rockchip-correct-analog-audio-name-on-indi.patch
@@ -0,0 +1,39 @@
+From 5ff5e43f9cc5632fe79d83d80bedc9992efbac98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 10:05:03 -0500
+Subject: arm64: dts: rockchip: correct analog audio name on Indiedroid Nova
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 42d85557527266804579bc5d20c101d93f6be3c6 ]
+
+Correct the audio name for the Indiedroid Nova from
+rockchip,es8388-codec to rockchip,es8388. This name change corrects a
+kernel log error of "ASoC: driver name too long 'rockchip,es8388-codec'
+-> 'rockchip_es8388'".
+
+Fixes: 3900160e164b ("arm64: dts: rockchip: Add Indiedroid Nova board")
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Link: https://lore.kernel.org/r/20241031150505.967909-2-macroalpha82@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts b/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts
+index 9299fa7e3e215..e813d426be105 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3588s-indiedroid-nova.dts
+@@ -34,7 +34,7 @@ sdio_pwrseq: sdio-pwrseq {
+ 
+ 	sound {
+ 		compatible = "audio-graph-card";
+-		label = "rockchip,es8388-codec";
++		label = "rockchip,es8388";
+ 		widgets = "Microphone", "Mic Jack",
+ 			  "Headphone", "Headphones";
+ 		routing = "LINPUT2", "Mic Jack",
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j7200-fix-clock-ids-for-mcspi-instan.patch b/queue-6.6/arm64-dts-ti-k3-j7200-fix-clock-ids-for-mcspi-instan.patch
new file mode 100644
index 00000000000..002f41a6c84
--- /dev/null
+++ b/queue-6.6/arm64-dts-ti-k3-j7200-fix-clock-ids-for-mcspi-instan.patch
@@ -0,0 +1,139 @@
+From 672505315c929faf1eaeac6ab3bae5718083d3d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 16:15:29 +0530
+Subject: arm64: dts: ti: k3-j7200: Fix clock ids for MCSPI instances
+
+From: Anurag Dutta <a-dutta@ti.com>
+
+[ Upstream commit 3a47e381670f130870caef6e1155ac531b17b032 ]
+
+The clock IDs for multiple MCSPI instances across wakeup as
+well as main domain in J7200 are incorrect when compared with
+documentation [1]. This results in kernel crashes when the said
+instances are enabled. Fix the clock ids to their appropriate
+values.
+
+[1]https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j7200/clocks.html
+
+Fixes: 8f6c475f4ca7 ("arm64: dts: ti: k3-j7200: Add MCSPI nodes")
+
+Signed-off-by: Anurag Dutta <a-dutta@ti.com>
+Reviewed-by: Aniket Limaye <a-limaye@ti.com>
+Link: https://lore.kernel.org/r/20241023104532.3438851-2-a-dutta@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j7200-main.dtsi       | 16 ++++++++--------
+ arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi |  6 +++---
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+index 6a221a50d7006..e5ff6f038a9ac 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+@@ -915,7 +915,7 @@ main_spi0: spi@2100000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 266 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 266 1>;
++		clocks = <&k3_clks 266 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -926,7 +926,7 @@ main_spi1: spi@2110000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 267 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 267 1>;
++		clocks = <&k3_clks 267 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -937,7 +937,7 @@ main_spi2: spi@2120000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 268 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 268 1>;
++		clocks = <&k3_clks 268 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -948,7 +948,7 @@ main_spi3: spi@2130000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 269 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 269 1>;
++		clocks = <&k3_clks 269 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -959,7 +959,7 @@ main_spi4: spi@2140000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 270 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 270 1>;
++		clocks = <&k3_clks 270 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -970,7 +970,7 @@ main_spi5: spi@2150000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 271 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 271 1>;
++		clocks = <&k3_clks 271 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -981,7 +981,7 @@ main_spi6: spi@2160000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 272 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 272 1>;
++		clocks = <&k3_clks 272 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -992,7 +992,7 @@ main_spi7: spi@2170000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 273 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 273 1>;
++		clocks = <&k3_clks 273 4>;
+ 		status = "disabled";
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+index e5c35a53bb499..8e9d0a25e2366 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+@@ -481,7 +481,7 @@ mcu_spi0: spi@40300000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 274 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 274 0>;
++		clocks = <&k3_clks 274 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -492,7 +492,7 @@ mcu_spi1: spi@40310000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 275 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 275 0>;
++		clocks = <&k3_clks 275 4>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -503,7 +503,7 @@ mcu_spi2: spi@40320000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 276 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 276 0>;
++		clocks = <&k3_clks 276 2>;
+ 		status = "disabled";
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j7200-fix-register-map-for-main-doma.patch b/queue-6.6/arm64-dts-ti-k3-j7200-fix-register-map-for-main-doma.patch
new file mode 100644
index 00000000000..9a7a534a580
--- /dev/null
+++ b/queue-6.6/arm64-dts-ti-k3-j7200-fix-register-map-for-main-doma.patch
@@ -0,0 +1,100 @@
+From 6aa4919b5394d825de70ec87a22d3d20e002e63e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 15:55:33 +0530
+Subject: arm64: dts: ti: k3-j7200: Fix register map for main domain pmx
+
+From: Jared McArthur <j-mcarthur@ti.com>
+
+[ Upstream commit b7af8b4acb3e08c710cd48f098ce8cd07cf43a1e ]
+
+Commit 0d0a0b441346 ("arm64: dts: ti: k3-j7200: fix main pinmux
+range") split the main_pmx0 into two nodes: main_pmx0 and main_pmx1
+due to a non-addressable region, but incorrectly represented the
+ranges. As a result, the memory map for the pinctrl is incorrect. Fix
+this by introducing the correct ranges.
+
+The ranges are taken from the J7200 TRM [1] (Table 5-695. CTRL_MMR0
+Registers).
+
+Padconfig starting addresses and ranges:
+-  0 to 66: 0x11c000, 0x10c
+-       68: 0x11c110, 0x004
+- 71 to 73: 0x11c11c, 0x00c
+- 89 to 90: 0x11c164, 0x008
+
+The datasheet [2] doesn't contain PADCONFIG63 (Table 6-106. Pin
+Multiplexing), but the pin is necessary for enabling the MMC1 CLKLP
+pad loopback and should be included in the pinmux register map.
+
+Due to the change in pinmux node addresses, change the pinmux node for
+the USB0_DRVVBUS pin to main_pmx2. The offset has not changed since the
+new main_pmx2 node has the same base address and range as the original
+main_pmx1 node. All other pinmuxing done within J7200 dts or dtso files
+only uses main_pmx0 which has not changed.
+
+[1] https://www.ti.com/lit/pdf/spruiu1
+[2] https://www.ti.com/lit/gpn/dra821u
+
+Fixes: 0d0a0b441346 ("arm64: dts: ti: k3-j7200: fix main pinmux range")
+Signed-off-by: Aniket Limaye <a-limaye@ti.com>
+Signed-off-by: Jared McArthur <j-mcarthur@ti.com>
+Reviewed-by: Vaishnav Achath <vaishnav.a@ti.com>
+Link: https://lore.kernel.org/r/20240926102533.398139-1-a-limaye@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/ti/k3-j7200-common-proc-board.dts     |  2 +-
+ arch/arm64/boot/dts/ti/k3-j7200-main.dtsi     | 22 +++++++++++++++++--
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+index 7a0c599f2b1c3..9b122117ef72d 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+@@ -192,7 +192,7 @@ J721E_IOPAD(0xd0, PIN_OUTPUT, 7) /* (T5) SPI0_D1.GPIO0_55 */
+ 	};
+ };
+ 
+-&main_pmx1 {
++&main_pmx2 {
+ 	main_usbss0_pins_default: main-usbss0-default-pins {
+ 		pinctrl-single,pins = <
+ 			J721E_IOPAD(0x04, PIN_OUTPUT, 0) /* (T4) USB0_DRVVBUS */
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+index 484254a68d9da..6a221a50d7006 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+@@ -420,10 +420,28 @@ main_pmx0: pinctrl@11c000 {
+ 		pinctrl-single,function-mask = <0xffffffff>;
+ 	};
+ 
+-	main_pmx1: pinctrl@11c11c {
++	main_pmx1: pinctrl@11c110 {
+ 		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+-		reg = <0x00 0x11c11c 0x00 0xc>;
++		reg = <0x00 0x11c110 0x00 0x004>;
++		#pinctrl-cells = <1>;
++		pinctrl-single,register-width = <32>;
++		pinctrl-single,function-mask = <0xffffffff>;
++	};
++
++	main_pmx2: pinctrl@11c11c {
++		compatible = "ti,j7200-padconf", "pinctrl-single";
++		/* Proxy 0 addressing */
++		reg = <0x00 0x11c11c 0x00 0x00c>;
++		#pinctrl-cells = <1>;
++		pinctrl-single,register-width = <32>;
++		pinctrl-single,function-mask = <0xffffffff>;
++	};
++
++	main_pmx3: pinctrl@11c164 {
++		compatible = "ti,j7200-padconf", "pinctrl-single";
++		/* Proxy 0 addressing */
++		reg = <0x00 0x11c164 0x00 0x008>;
+ 		#pinctrl-cells = <1>;
+ 		pinctrl-single,register-width = <32>;
+ 		pinctrl-single,function-mask = <0xffffffff>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j7200-use-ti-j7200-padconf-compatibl.patch b/queue-6.6/arm64-dts-ti-k3-j7200-use-ti-j7200-padconf-compatibl.patch
new file mode 100644
index 00000000000..eb1772d6418
--- /dev/null
+++ b/queue-6.6/arm64-dts-ti-k3-j7200-use-ti-j7200-padconf-compatibl.patch
@@ -0,0 +1,125 @@
+From 08fa66add9abf90c6038cbeaf9592d9ccca7b09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 16:35:01 +0100
+Subject: arm64: dts: ti: k3-j7200: use ti,j7200-padconf compatible
+
+From: Thomas Richard <thomas.richard@bootlin.com>
+
+[ Upstream commit 4eb42afed5d488c4707be5362e8e0f0771f5218e ]
+
+For suspend to ram on j7200, use ti,j7200-padconf compatible to save and
+restore pinctrl contexts.
+
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20231128-j7200-pinctrl-s2r-v1-3-704e7dc24460@bootlin.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Stable-dep-of: b7af8b4acb3e ("arm64: dts: ti: k3-j7200: Fix register map for main domain pmx")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j7200-main.dtsi       |  8 ++++----
+ arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 12 ++++++------
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+index cdb1d6b2a9829..484254a68d9da 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi
+@@ -395,7 +395,7 @@ cpts@3d000 {
+ 
+ 	/* TIMERIO pad input CTRLMMR_TIMER*_CTRL registers */
+ 	main_timerio_input: pinctrl@104200 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		reg = <0x0 0x104200 0x0 0x50>;
+ 		#pinctrl-cells = <1>;
+ 		pinctrl-single,register-width = <32>;
+@@ -404,7 +404,7 @@ main_timerio_input: pinctrl@104200 {
+ 
+ 	/* TIMERIO pad output CTCTRLMMR_TIMERIO*_CTRL registers */
+ 	main_timerio_output: pinctrl@104280 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		reg = <0x0 0x104280 0x0 0x20>;
+ 		#pinctrl-cells = <1>;
+ 		pinctrl-single,register-width = <32>;
+@@ -412,7 +412,7 @@ main_timerio_output: pinctrl@104280 {
+ 	};
+ 
+ 	main_pmx0: pinctrl@11c000 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x11c000 0x00 0x10c>;
+ 		#pinctrl-cells = <1>;
+@@ -421,7 +421,7 @@ main_pmx0: pinctrl@11c000 {
+ 	};
+ 
+ 	main_pmx1: pinctrl@11c11c {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x11c11c 0x00 0xc>;
+ 		#pinctrl-cells = <1>;
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+index 6ffaf85fa63f5..e5c35a53bb499 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi
+@@ -185,7 +185,7 @@ chipid@43000014 {
+ 
+ 	/* MCU_TIMERIO pad input CTRLMMR_MCU_TIMER*_CTRL registers */
+ 	mcu_timerio_input: pinctrl@40f04200 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		reg = <0x0 0x40f04200 0x0 0x28>;
+ 		#pinctrl-cells = <1>;
+ 		pinctrl-single,register-width = <32>;
+@@ -195,7 +195,7 @@ mcu_timerio_input: pinctrl@40f04200 {
+ 
+ 	/* MCU_TIMERIO pad output CTRLMMR_MCU_TIMERIO*_CTRL registers */
+ 	mcu_timerio_output: pinctrl@40f04280 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		reg = <0x0 0x40f04280 0x0 0x28>;
+ 		#pinctrl-cells = <1>;
+ 		pinctrl-single,register-width = <32>;
+@@ -204,7 +204,7 @@ mcu_timerio_output: pinctrl@40f04280 {
+ 	};
+ 
+ 	wkup_pmx0: pinctrl@4301c000 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x4301c000 0x00 0x34>;
+ 		#pinctrl-cells = <1>;
+@@ -213,7 +213,7 @@ wkup_pmx0: pinctrl@4301c000 {
+ 	};
+ 
+ 	wkup_pmx1: pinctrl@4301c038 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x4301c038 0x00 0x8>;
+ 		#pinctrl-cells = <1>;
+@@ -222,7 +222,7 @@ wkup_pmx1: pinctrl@4301c038 {
+ 	};
+ 
+ 	wkup_pmx2: pinctrl@4301c068 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x4301c068 0x00 0xec>;
+ 		#pinctrl-cells = <1>;
+@@ -231,7 +231,7 @@ wkup_pmx2: pinctrl@4301c068 {
+ 	};
+ 
+ 	wkup_pmx3: pinctrl@4301c174 {
+-		compatible = "pinctrl-single";
++		compatible = "ti,j7200-padconf", "pinctrl-single";
+ 		/* Proxy 0 addressing */
+ 		reg = <0x00 0x4301c174 0x00 0x20>;
+ 		#pinctrl-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-fix-clock-ids-for-mcspi-instan.patch b/queue-6.6/arm64-dts-ti-k3-j721e-fix-clock-ids-for-mcspi-instan.patch
new file mode 100644
index 00000000000..d6331159453
--- /dev/null
+++ b/queue-6.6/arm64-dts-ti-k3-j721e-fix-clock-ids-for-mcspi-instan.patch
@@ -0,0 +1,59 @@
+From d3ff93c56ba5c27b952ef80809ae78b923eb53ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 16:15:30 +0530
+Subject: arm64: dts: ti: k3-j721e: Fix clock IDs for MCSPI instances
+
+From: Anurag Dutta <a-dutta@ti.com>
+
+[ Upstream commit ab09a68f3be04b2f9d1fc7cfc0e2225025cb9421 ]
+
+The clock IDs for multiple MCSPI instances across wakeup domain
+in J721e are incorrect when compared with documentation [1]. Fix
+the clock ids to their appropriate values.
+
+[1]https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j721e/clocks.html
+
+Fixes: 76aa309f9fa7 ("arm64: dts: ti: k3-j721e: Add MCSPI nodes")
+
+Signed-off-by: Anurag Dutta <a-dutta@ti.com>
+Link: https://lore.kernel.org/r/20241023104532.3438851-3-a-dutta@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
+index 05d6ef127ba78..1893d611b1735 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
+@@ -637,7 +637,7 @@ mcu_spi0: spi@40300000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 274 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 274 0>;
++		clocks = <&k3_clks 274 1>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -648,7 +648,7 @@ mcu_spi1: spi@40310000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 275 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 275 0>;
++		clocks = <&k3_clks 275 1>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -659,7 +659,7 @@ mcu_spi2: spi@40320000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 276 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 276 0>;
++		clocks = <&k3_clks 276 1>;
+ 		status = "disabled";
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j721s2-fix-clock-ids-for-mcspi-insta.patch b/queue-6.6/arm64-dts-ti-k3-j721s2-fix-clock-ids-for-mcspi-insta.patch
new file mode 100644
index 00000000000..7694a54e005
--- /dev/null
+++ b/queue-6.6/arm64-dts-ti-k3-j721s2-fix-clock-ids-for-mcspi-insta.patch
@@ -0,0 +1,136 @@
+From 56c6447e3533efcc84cce611413f84a7b0ed07e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 16:15:31 +0530
+Subject: arm64: dts: ti: k3-j721s2: Fix clock IDs for MCSPI instances
+
+From: Anurag Dutta <a-dutta@ti.com>
+
+[ Upstream commit 891874f015e98f67ab2fda76f2e859921e136621 ]
+
+The clock IDs for multiple MCSPI instances across wakeup domain
+in J721s2 are incorrect when compared with documentation [1]. Fix the
+clock IDs to their appropriate values.
+
+[1]https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j721s2/clocks.html
+
+Fixes: 04d7cb647b85 ("arm64: dts: ti: k3-j721s2: Add MCSPI nodes")
+
+Signed-off-by: Anurag Dutta <a-dutta@ti.com>
+Link: https://lore.kernel.org/r/20241023104532.3438851-4-a-dutta@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi       | 16 ++++++++--------
+ arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi |  6 +++---
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi
+index 084f8f5b66993..9484347acba79 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721s2-main.dtsi
+@@ -1569,7 +1569,7 @@ main_spi0: spi@2100000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 339 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 339 1>;
++		clocks = <&k3_clks 339 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1580,7 +1580,7 @@ main_spi1: spi@2110000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 340 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 340 1>;
++		clocks = <&k3_clks 340 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1591,7 +1591,7 @@ main_spi2: spi@2120000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 341 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 341 1>;
++		clocks = <&k3_clks 341 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1602,7 +1602,7 @@ main_spi3: spi@2130000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 342 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 342 1>;
++		clocks = <&k3_clks 342 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1613,7 +1613,7 @@ main_spi4: spi@2140000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 343 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 343 1>;
++		clocks = <&k3_clks 343 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1624,7 +1624,7 @@ main_spi5: spi@2150000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 344 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 344 1>;
++		clocks = <&k3_clks 344 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1635,7 +1635,7 @@ main_spi6: spi@2160000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 345 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 345 1>;
++		clocks = <&k3_clks 345 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -1646,7 +1646,7 @@ main_spi7: spi@2170000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 346 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 346 1>;
++		clocks = <&k3_clks 346 2>;
+ 		status = "disabled";
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
+index 71324fec415ae..6fc008fbfb003 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
+@@ -416,7 +416,7 @@ mcu_spi0: spi@40300000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 347 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 347 0>;
++		clocks = <&k3_clks 347 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -427,7 +427,7 @@ mcu_spi1: spi@40310000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 348 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 348 0>;
++		clocks = <&k3_clks 348 2>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -438,7 +438,7 @@ mcu_spi2: spi@40320000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		power-domains = <&k3_pds 349 TI_SCI_PD_EXCLUSIVE>;
+-		clocks = <&k3_clks 349 0>;
++		clocks = <&k3_clks 349 2>;
+ 		status = "disabled";
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-fix-.data.rel.ro-size-assertion-when-config_lt.patch b/queue-6.6/arm64-fix-.data.rel.ro-size-assertion-when-config_lt.patch
new file mode 100644
index 00000000000..3141cc12b81
--- /dev/null
+++ b/queue-6.6/arm64-fix-.data.rel.ro-size-assertion-when-config_lt.patch
@@ -0,0 +1,56 @@
+From 86ef38a6abdf1ee2596d881c6658fb8b75d2a02c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 01:18:42 +0900
+Subject: arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 340fd66c856651d8c1d29f392dd26ad674d2db0e ]
+
+Commit be2881824ae9 ("arm64/build: Assert for unwanted sections")
+introduced an assertion to ensure that the .data.rel.ro section does
+not exist.
+
+However, this check does not work when CONFIG_LTO_CLANG is enabled,
+because .data.rel.ro matches the .data.[0-9a-zA-Z_]* pattern in the
+DATA_MAIN macro.
+
+Move the ASSERT() above the RW_DATA() line.
+
+Fixes: be2881824ae9 ("arm64/build: Assert for unwanted sections")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20241106161843.189927-1-masahiroy@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/vmlinux.lds.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index 3cd7e76cc5626..a553dae9a0d48 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -285,6 +285,9 @@ SECTIONS
+ 	__initdata_end = .;
+ 	__init_end = .;
+ 
++	.data.rel.ro : { *(.data.rel.ro) }
++	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
++
+ 	_data = .;
+ 	_sdata = .;
+ 	RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
+@@ -336,9 +339,6 @@ SECTIONS
+ 		*(.plt) *(.plt.*) *(.iplt) *(.igot .igot.plt)
+ 	}
+ 	ASSERT(SIZEOF(.plt) == 0, "Unexpected run-time procedure linkages detected!")
+-
+-	.data.rel.ro : { *(.data.rel.ro) }
+-	ASSERT(SIZEOF(.data.rel.ro) == 0, "Unexpected RELRO detected!")
+ }
+ 
+ #include "image-vars.h"
+-- 
+2.43.0
+
diff --git a/queue-6.6/arm64-probes-disable-kprobes-uprobes-on-mops-instruc.patch b/queue-6.6/arm64-probes-disable-kprobes-uprobes-on-mops-instruc.patch
new file mode 100644
index 00000000000..d9de7437ba0
--- /dev/null
+++ b/queue-6.6/arm64-probes-disable-kprobes-uprobes-on-mops-instruc.patch
@@ -0,0 +1,60 @@
+From c289cbac889fdf694e7e3f8783f13af9c3831e4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 17:10:47 +0100
+Subject: arm64: probes: Disable kprobes/uprobes on MOPS instructions
+
+From: Kristina Martsenko <kristina.martsenko@arm.com>
+
+[ Upstream commit c56c599d9002d44f559be3852b371db46adac87c ]
+
+FEAT_MOPS instructions require that all three instructions (prologue,
+main and epilogue) appear consecutively in memory. Placing a
+kprobe/uprobe on one of them doesn't work as only a single instruction
+gets executed out-of-line or simulated. So don't allow placing a probe
+on a MOPS instruction.
+
+Fixes: b7564127ffcb ("arm64: mops: detect and enable FEAT_MOPS")
+Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
+Link: https://lore.kernel.org/r/20240930161051.3777828-2-kristina.martsenko@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/insn.h          | 1 +
+ arch/arm64/kernel/probes/decode-insn.c | 7 +++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
+index db1aeacd4cd99..0ccf51afde31a 100644
+--- a/arch/arm64/include/asm/insn.h
++++ b/arch/arm64/include/asm/insn.h
+@@ -347,6 +347,7 @@ __AARCH64_INSN_FUNCS(ldrsw_lit,	0xFF000000, 0x98000000)
+ __AARCH64_INSN_FUNCS(exclusive,	0x3F800000, 0x08000000)
+ __AARCH64_INSN_FUNCS(load_ex,	0x3F400000, 0x08400000)
+ __AARCH64_INSN_FUNCS(store_ex,	0x3F400000, 0x08000000)
++__AARCH64_INSN_FUNCS(mops,	0x3B200C00, 0x19000400)
+ __AARCH64_INSN_FUNCS(stp,	0x7FC00000, 0x29000000)
+ __AARCH64_INSN_FUNCS(ldp,	0x7FC00000, 0x29400000)
+ __AARCH64_INSN_FUNCS(stp_post,	0x7FC00000, 0x28800000)
+diff --git a/arch/arm64/kernel/probes/decode-insn.c b/arch/arm64/kernel/probes/decode-insn.c
+index 3496d6169e59b..42b69936cee34 100644
+--- a/arch/arm64/kernel/probes/decode-insn.c
++++ b/arch/arm64/kernel/probes/decode-insn.c
+@@ -58,10 +58,13 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn)
+ 	 * Instructions which load PC relative literals are not going to work
+ 	 * when executed from an XOL slot. Instructions doing an exclusive
+ 	 * load/store are not going to complete successfully when single-step
+-	 * exception handling happens in the middle of the sequence.
++	 * exception handling happens in the middle of the sequence. Memory
++	 * copy/set instructions require that all three instructions be placed
++	 * consecutively in memory.
+ 	 */
+ 	if (aarch64_insn_uses_literal(insn) ||
+-	    aarch64_insn_is_exclusive(insn))
++	    aarch64_insn_is_exclusive(insn) ||
++	    aarch64_insn_is_mops(insn))
+ 		return false;
+ 
+ 	return true;
+-- 
+2.43.0
+
diff --git a/queue-6.6/asoc-amd-yc-fix-for-enabling-dmic-on-acp6x-via-_dsd-.patch b/queue-6.6/asoc-amd-yc-fix-for-enabling-dmic-on-acp6x-via-_dsd-.patch
new file mode 100644
index 00000000000..773eae1413d
--- /dev/null
+++ b/queue-6.6/asoc-amd-yc-fix-for-enabling-dmic-on-acp6x-via-_dsd-.patch
@@ -0,0 +1,65 @@
+From b3a95092bfa5f679ec93b04c8214104c4a2061e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 16:52:25 +0530
+Subject: ASoC: amd: yc: Fix for enabling DMIC on acp6x via _DSD entry
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit 4095cf872084ecfdfdb0e681f3e9ff9745acfa75 ]
+
+Add condition check to register ACP PDM sound card by reading
+_WOV acpi entry.
+
+Fixes: 5426f506b584 ("ASoC: amd: Add support for enabling DMIC on acp6x via _DSD")
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Link: https://patch.msgid.link/20241127112227.227106-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 04700e7471ca5..f3c0db24bc76b 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -537,8 +537,14 @@ static int acp6x_probe(struct platform_device *pdev)
+ 	struct acp6x_pdm *machine = NULL;
+ 	struct snd_soc_card *card;
+ 	struct acpi_device *adev;
++	acpi_handle handle;
++	acpi_integer dmic_status;
+ 	int ret;
++	bool is_dmic_enable, wov_en;
+ 
++	/* IF WOV entry not found, enable dmic based on AcpDmicConnected entry*/
++	is_dmic_enable = false;
++	wov_en = true;
+ 	/* check the parent device's firmware node has _DSD or not */
+ 	adev = ACPI_COMPANION(pdev->dev.parent);
+ 	if (adev) {
+@@ -546,9 +552,19 @@ static int acp6x_probe(struct platform_device *pdev)
+ 
+ 		if (!acpi_dev_get_property(adev, "AcpDmicConnected", ACPI_TYPE_INTEGER, &obj) &&
+ 		    obj->integer.value == 1)
+-			platform_set_drvdata(pdev, &acp6x_card);
++			is_dmic_enable = true;
+ 	}
+ 
++	handle = ACPI_HANDLE(pdev->dev.parent);
++	ret = acpi_evaluate_integer(handle, "_WOV", NULL, &dmic_status);
++	if (!ACPI_FAILURE(ret))
++		wov_en = dmic_status;
++
++	if (is_dmic_enable && wov_en)
++		platform_set_drvdata(pdev, &acp6x_card);
++	else
++		return 0;
++
+ 	/* check for any DMI overrides */
+ 	dmi_id = dmi_first_match(yc_acp_quirk_table);
+ 	if (dmi_id)
+-- 
+2.43.0
+
diff --git a/queue-6.6/asoc-dt-bindings-mt6359-update-generic-node-name-and.patch b/queue-6.6/asoc-dt-bindings-mt6359-update-generic-node-name-and.patch
new file mode 100644
index 00000000000..f485c81992b
--- /dev/null
+++ b/queue-6.6/asoc-dt-bindings-mt6359-update-generic-node-name-and.patch
@@ -0,0 +1,77 @@
+From 8233dd85a281796d830975f00dcced5c44c17ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 15:54:50 +0800
+Subject: ASoC: dt-bindings: mt6359: Update generic node name and dmic-mode
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+[ Upstream commit 4649cbd97fdae5069e9a71cd7669b62b90e03669 ]
+
+Some fix and updates in the following items:
+1. examples:
+   Update generic node name to 'audio-codec' to comply with the
+   coming change in 'mt6359.dtsi'. This change is necessary to fix the
+   dtbs_check error:
+   pmic: 'mt6359codec' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+2. mediatek,dmic-mode:
+   After inspecting the .dts and .dtsi files using 'mt6359-codec', it was
+   discovered that the definitions of 'two wires' and 'one wire' are
+   inverted compared to the DT schema.
+   For example, the following boards using MT6359 PMIC:
+    - mt8192-asurada.dtsi
+    - mt8195-cherry.dtsi
+   These boards use the same definitions of 'dmic-mode' as other boards
+   using MT6358 PMIC. The meaning of '0' or '1' has been noted as comments
+   in the device trees.
+
+   Upon examining the code in [1] and [2], it was confirmed that the
+   definitions of 'dmic-mode' are consistent between "MT6359 PMIC" and
+   "MT6358 PMIC". Therefore, the DT Schema should be correct as is.
+
+References:
+[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/sound/soc/codecs/mt6358.c#n1875
+[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/sound/soc/codecs/mt6359.c#L1515
+
+Fixes: 539237d1c609 ("dt-bindings: mediatek: mt6359: add codec document")
+Signed-off-by: Jiaxin Yu <jiaxin.yu@mediatek.com>
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patch.msgid.link/20240930075451.14196-1-macpaul.lin@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/sound/mt6359.yaml | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/sound/mt6359.yaml b/Documentation/devicetree/bindings/sound/mt6359.yaml
+index 23d411fc4200e..128698630c865 100644
+--- a/Documentation/devicetree/bindings/sound/mt6359.yaml
++++ b/Documentation/devicetree/bindings/sound/mt6359.yaml
+@@ -23,8 +23,8 @@ properties:
+       Indicates how many data pins are used to transmit two channels of PDM
+       signal. 0 means two wires, 1 means one wire. Default value is 0.
+     enum:
+-      - 0 # one wire
+-      - 1 # two wires
++      - 0 # two wires
++      - 1 # one wire
+ 
+   mediatek,mic-type-0:
+     $ref: /schemas/types.yaml#/definitions/uint32
+@@ -53,9 +53,9 @@ additionalProperties: false
+ 
+ examples:
+   - |
+-    mt6359codec: mt6359codec {
+-      mediatek,dmic-mode = <0>;
+-      mediatek,mic-type-0 = <2>;
++    mt6359codec: audio-codec {
++        mediatek,dmic-mode = <0>;
++        mediatek,mic-type-0 = <2>;
+     };
+ 
+ ...
+-- 
+2.43.0
+
diff --git a/queue-6.6/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch b/queue-6.6/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch
new file mode 100644
index 00000000000..64948ffe5ee
--- /dev/null
+++ b/queue-6.6/asoc-fsl_micfil-fix-regmap_write_bits-usage.patch
@@ -0,0 +1,47 @@
+From ad254dc450fd1520eba770d35977cfca0aee7aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 16:00:29 +0800
+Subject: ASoC: fsl_micfil: fix regmap_write_bits usage
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 06df673d20230afb0e383e39235a4fa8b9a62464 ]
+
+The last parameter 1 means BIT(0), which should be the
+correct BIT(X).
+
+Fixes: 47a70e6fc9a8 ("ASoC: Add MICFIL SoC Digital Audio Interface driver.")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://patch.msgid.link/1727424031-19551-2-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_micfil.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c
+index 8478a4ac59f9d..f57f0ab8a1add 100644
+--- a/sound/soc/fsl/fsl_micfil.c
++++ b/sound/soc/fsl/fsl_micfil.c
+@@ -1051,7 +1051,7 @@ static irqreturn_t micfil_isr(int irq, void *devid)
+ 			regmap_write_bits(micfil->regmap,
+ 					  REG_MICFIL_STAT,
+ 					  MICFIL_STAT_CHXF(i),
+-					  1);
++					  MICFIL_STAT_CHXF(i));
+ 	}
+ 
+ 	for (i = 0; i < MICFIL_FIFO_NUM; i++) {
+@@ -1086,7 +1086,7 @@ static irqreturn_t micfil_err_isr(int irq, void *devid)
+ 	if (stat_reg & MICFIL_STAT_LOWFREQF) {
+ 		dev_dbg(&pdev->dev, "isr: ipg_clk_app is too low\n");
+ 		regmap_write_bits(micfil->regmap, REG_MICFIL_STAT,
+-				  MICFIL_STAT_LOWFREQF, 1);
++				  MICFIL_STAT_LOWFREQF, MICFIL_STAT_LOWFREQF);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+-- 
+2.43.0
+
diff --git a/queue-6.6/asoc-rt722-sdca-remove-logically-deadcode-in-rt722-s.patch b/queue-6.6/asoc-rt722-sdca-remove-logically-deadcode-in-rt722-s.patch
new file mode 100644
index 00000000000..6fd7471a80d
--- /dev/null
+++ b/queue-6.6/asoc-rt722-sdca-remove-logically-deadcode-in-rt722-s.patch
@@ -0,0 +1,47 @@
+From 0781d11f8c60b116aaccf058b2caca20f39c72a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 11:57:54 -0600
+Subject: ASoC: rt722-sdca: Remove logically deadcode in rt722-sdca.c
+
+From: Everest K.C <everestkc@everestkc.com.np>
+
+[ Upstream commit 22206e569fb54bf9c95db9a0138a7485ba9e13bc ]
+
+As the same condition was checked in inner and outer if statements.
+The code never reaches the inner else statement.
+Fix this by removing the logically dead inner else statement.
+
+Fixes: 7f5d6036ca00 ("ASoC: rt722-sdca: Add RT722 SDCA driver")
+Reported-by: Shuah Khan <skhan@linuxfoundation.org>
+Closes: https://lore.kernel.org/all/e44527e8-b7c6-4712-97a6-d54f02ad2dc9@linuxfoundation.org/
+Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
+Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20241010175755.5278-1-everestkc@everestkc.com.np
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt722-sdca.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/rt722-sdca.c b/sound/soc/codecs/rt722-sdca.c
+index 9ff607984ea19..b9b330375adda 100644
+--- a/sound/soc/codecs/rt722-sdca.c
++++ b/sound/soc/codecs/rt722-sdca.c
+@@ -607,12 +607,8 @@ static int rt722_sdca_dmic_set_gain_get(struct snd_kcontrol *kcontrol,
+ 
+ 		if (!adc_vol_flag) /* boost gain */
+ 			ctl = regvalue / boost_step;
+-		else { /* ADC gain */
+-			if (adc_vol_flag)
+-				ctl = p->max - (((vol_max - regvalue) & 0xffff) / interval_offset);
+-			else
+-				ctl = p->max - (((0 - regvalue) & 0xffff) / interval_offset);
+-		}
++		else /* ADC gain */
++			ctl = p->max - (((vol_max - regvalue) & 0xffff) / interval_offset);
+ 
+ 		ucontrol->value.integer.value[i] = ctl;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/block-fix-bio_split_rw_at-to-take-zone_write_granula.patch b/queue-6.6/block-fix-bio_split_rw_at-to-take-zone_write_granula.patch
new file mode 100644
index 00000000000..def5db42c8d
--- /dev/null
+++ b/queue-6.6/block-fix-bio_split_rw_at-to-take-zone_write_granula.patch
@@ -0,0 +1,54 @@
+From 93ea33b4b880d3088b8f7b72e669a2bd66189622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 07:26:30 +0100
+Subject: block: fix bio_split_rw_at to take zone_write_granularity into
+ account
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 7ecd2cd4fae3e8410c0a6620f3a83dcdbb254f02 ]
+
+Otherwise it can create unaligned writes on zoned devices.
+
+Fixes: a805a4fa4fa3 ("block: introduce zone_write_granularity limit")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20241104062647.91160-3-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 07bf758c523a9..889ac59759a26 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -256,6 +256,14 @@ static bool bvec_split_segs(const struct queue_limits *lim,
+ 	return len > 0 || bv->bv_len > max_len;
+ }
+ 
++static unsigned int bio_split_alignment(struct bio *bio,
++		const struct queue_limits *lim)
++{
++	if (op_is_write(bio_op(bio)) && lim->zone_write_granularity)
++		return lim->zone_write_granularity;
++	return lim->logical_block_size;
++}
++
+ /**
+  * bio_split_rw - split a bio in two bios
+  * @bio:  [in] bio to be split
+@@ -326,7 +334,7 @@ struct bio *bio_split_rw(struct bio *bio, const struct queue_limits *lim,
+ 	 * split size so that each bio is properly block size aligned, even if
+ 	 * we do not use the full hardware limits.
+ 	 */
+-	bytes = ALIGN_DOWN(bytes, lim->logical_block_size);
++	bytes = ALIGN_DOWN(bytes, bio_split_alignment(bio, lim));
+ 
+ 	/*
+ 	 * Bio splitting may cause subtle trouble such as hang when doing sync
+-- 
+2.43.0
+
diff --git a/queue-6.6/bluetooth-fix-use-after-free-in-device_for_each_chil.patch b/queue-6.6/bluetooth-fix-use-after-free-in-device_for_each_chil.patch
new file mode 100644
index 00000000000..7aca4cef0ff
--- /dev/null
+++ b/queue-6.6/bluetooth-fix-use-after-free-in-device_for_each_chil.patch
@@ -0,0 +1,150 @@
+From b329a1d030acc1655fb8eeedf33106fafe82efed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 14:44:10 +0300
+Subject: Bluetooth: fix use-after-free in device_for_each_child()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d ]
+
+Syzbot has reported the following KASAN splat:
+
+BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0
+Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980
+
+CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x100/0x190
+ ? device_for_each_child+0x18f/0x1a0
+ print_report+0x13a/0x4cb
+ ? __virt_addr_valid+0x5e/0x590
+ ? __phys_addr+0xc6/0x150
+ ? device_for_each_child+0x18f/0x1a0
+ kasan_report+0xda/0x110
+ ? device_for_each_child+0x18f/0x1a0
+ ? __pfx_dev_memalloc_noio+0x10/0x10
+ device_for_each_child+0x18f/0x1a0
+ ? __pfx_device_for_each_child+0x10/0x10
+ pm_runtime_set_memalloc_noio+0xf2/0x180
+ netdev_unregister_kobject+0x1ed/0x270
+ unregister_netdevice_many_notify+0x123c/0x1d80
+ ? __mutex_trylock_common+0xde/0x250
+ ? __pfx_unregister_netdevice_many_notify+0x10/0x10
+ ? trace_contention_end+0xe6/0x140
+ ? __mutex_lock+0x4e7/0x8f0
+ ? __pfx_lock_acquire.part.0+0x10/0x10
+ ? rcu_is_watching+0x12/0xc0
+ ? unregister_netdev+0x12/0x30
+ unregister_netdevice_queue+0x30d/0x3f0
+ ? __pfx_unregister_netdevice_queue+0x10/0x10
+ ? __pfx_down_write+0x10/0x10
+ unregister_netdev+0x1c/0x30
+ bnep_session+0x1fb3/0x2ab0
+ ? __pfx_bnep_session+0x10/0x10
+ ? __pfx_lock_release+0x10/0x10
+ ? __pfx_woken_wake_function+0x10/0x10
+ ? __kthread_parkme+0x132/0x200
+ ? __pfx_bnep_session+0x10/0x10
+ ? kthread+0x13a/0x370
+ ? __pfx_bnep_session+0x10/0x10
+ kthread+0x2b7/0x370
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x48/0x80
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Allocated by task 4974:
+ kasan_save_stack+0x30/0x50
+ kasan_save_track+0x14/0x30
+ __kasan_kmalloc+0xaa/0xb0
+ __kmalloc_noprof+0x1d1/0x440
+ hci_alloc_dev_priv+0x1d/0x2820
+ __vhci_create_device+0xef/0x7d0
+ vhci_write+0x2c7/0x480
+ vfs_write+0x6a0/0xfc0
+ ksys_write+0x12f/0x260
+ do_syscall_64+0xc7/0x250
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 4979:
+ kasan_save_stack+0x30/0x50
+ kasan_save_track+0x14/0x30
+ kasan_save_free_info+0x3b/0x60
+ __kasan_slab_free+0x4f/0x70
+ kfree+0x141/0x490
+ hci_release_dev+0x4d9/0x600
+ bt_host_release+0x6a/0xb0
+ device_release+0xa4/0x240
+ kobject_put+0x1ec/0x5a0
+ put_device+0x1f/0x30
+ vhci_release+0x81/0xf0
+ __fput+0x3f6/0xb30
+ task_work_run+0x151/0x250
+ do_exit+0xa79/0x2c30
+ do_group_exit+0xd5/0x2a0
+ get_signal+0x1fcd/0x2210
+ arch_do_signal_or_restart+0x93/0x780
+ syscall_exit_to_user_mode+0x140/0x290
+ do_syscall_64+0xd4/0x250
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when
+an underlying (kobject) reference counter is greater than 1. This
+means that reparenting (happened when the device is actually freed)
+is delayed and, during that delay, parent controller device (hciX)
+may be deleted. Since the latter may create a dangling pointer to
+freed parent, avoid that scenario by reparenting to NULL explicitly.
+
+Reported-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
+Tested-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f
+Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sysfs.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
+index 367e32fe30eb8..4b54dbbf0729a 100644
+--- a/net/bluetooth/hci_sysfs.c
++++ b/net/bluetooth/hci_sysfs.c
+@@ -21,16 +21,6 @@ static const struct device_type bt_link = {
+ 	.release = bt_link_release,
+ };
+ 
+-/*
+- * The rfcomm tty device will possibly retain even when conn
+- * is down, and sysfs doesn't support move zombie device,
+- * so we should move the device before conn device is destroyed.
+- */
+-static int __match_tty(struct device *dev, void *data)
+-{
+-	return !strncmp(dev_name(dev), "rfcomm", 6);
+-}
+-
+ void hci_conn_init_sysfs(struct hci_conn *conn)
+ {
+ 	struct hci_dev *hdev = conn->hdev;
+@@ -73,10 +63,13 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
+ 		return;
+ 	}
+ 
++	/* If there are devices using the connection as parent reset it to NULL
++	 * before unregistering the device.
++	 */
+ 	while (1) {
+ 		struct device *dev;
+ 
+-		dev = device_find_child(&conn->dev, NULL, __match_tty);
++		dev = device_find_any_child(&conn->dev);
+ 		if (!dev)
+ 			break;
+ 		device_move(dev, NULL, DPM_ORDER_DEV_LAST);
+-- 
+2.43.0
+
diff --git a/queue-6.6/bluetooth-mgmt-fix-possible-deadlocks.patch b/queue-6.6/bluetooth-mgmt-fix-possible-deadlocks.patch
new file mode 100644
index 00000000000..42abd67bafe
--- /dev/null
+++ b/queue-6.6/bluetooth-mgmt-fix-possible-deadlocks.patch
@@ -0,0 +1,150 @@
+From 8b9ec958fefd5f2c684c056d4b7225e79a97df2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 11:09:22 -0500
+Subject: Bluetooth: MGMT: Fix possible deadlocks
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a66dfaf18fd61bb75ef8cee83db46b2aadf153d0 ]
+
+This fixes possible deadlocks like the following caused by
+hci_cmd_sync_dequeue causing the destroy function to run:
+
+ INFO: task kworker/u19:0:143 blocked for more than 120 seconds.
+       Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1
+ "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2      flags:0x00004000
+ Workqueue: hci0 hci_cmd_sync_work [bluetooth]
+ Call Trace:
+  <TASK>
+  __schedule+0x374/0xaf0
+  schedule+0x3c/0xf0
+  schedule_preempt_disabled+0x1c/0x30
+  __mutex_lock.constprop.0+0x3ef/0x7a0
+  __mutex_lock_slowpath+0x13/0x20
+  mutex_lock+0x3c/0x50
+  mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]
+  ? kfree+0x211/0x2a0
+  hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]
+  ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]
+  cmd_complete_rsp+0x26/0x80 [bluetooth]
+  mgmt_pending_foreach+0x4d/0x70 [bluetooth]
+  __mgmt_power_off+0x8d/0x180 [bluetooth]
+  ? _raw_spin_unlock_irq+0x23/0x40
+  hci_dev_close_sync+0x445/0x5b0 [bluetooth]
+  hci_set_powered_sync+0x149/0x250 [bluetooth]
+  set_powered_sync+0x24/0x60 [bluetooth]
+  hci_cmd_sync_work+0x90/0x150 [bluetooth]
+  process_one_work+0x13e/0x300
+  worker_thread+0x2f7/0x420
+  ? __pfx_worker_thread+0x10/0x10
+  kthread+0x107/0x140
+  ? __pfx_kthread+0x10/0x10
+  ret_from_fork+0x3d/0x60
+  ? __pfx_kthread+0x10/0x10
+  ret_from_fork_asm+0x1b/0x30
+  </TASK>
+
+Tested-by: Kiran K <kiran.k@intel.com>
+Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index f84912552d294..1175248e4bec4 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -1510,7 +1510,8 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
+ 	bt_dev_dbg(hdev, "err %d", err);
+ 
+ 	/* Make sure cmd still outstanding. */
+-	if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
+ 		return;
+ 
+ 	hci_dev_lock(hdev);
+@@ -1684,7 +1685,8 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
+ 	bt_dev_dbg(hdev, "err %d", err);
+ 
+ 	/* Make sure cmd still outstanding. */
+-	if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
+ 		return;
+ 
+ 	hci_dev_lock(hdev);
+@@ -1917,7 +1919,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
+ 	bool changed;
+ 
+ 	/* Make sure cmd still outstanding. */
+-	if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
++	if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev))
+ 		return;
+ 
+ 	if (err) {
+@@ -3782,7 +3784,8 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)
+ 
+ 	bt_dev_dbg(hdev, "err %d", err);
+ 
+-	if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
+ 		return;
+ 
+ 	if (status) {
+@@ -3957,7 +3960,8 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
+ 	struct sk_buff *skb = cmd->skb;
+ 	u8 status = mgmt_status(err);
+ 
+-	if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
+ 		return;
+ 
+ 	if (!status) {
+@@ -5848,13 +5852,16 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
+ {
+ 	struct mgmt_pending_cmd *cmd = data;
+ 
++	bt_dev_dbg(hdev, "err %d", err);
++
++	if (err == -ECANCELED)
++		return;
++
+ 	if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
+ 	    cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
+ 	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
+ 		return;
+ 
+-	bt_dev_dbg(hdev, "err %d", err);
+-
+ 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
+ 			  cmd->param, 1);
+ 	mgmt_pending_remove(cmd);
+@@ -6087,7 +6094,8 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
+ {
+ 	struct mgmt_pending_cmd *cmd = data;
+ 
+-	if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
+ 		return;
+ 
+ 	bt_dev_dbg(hdev, "err %d", err);
+@@ -8032,7 +8040,8 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
+ 	u8 status = mgmt_status(err);
+ 	u16 eir_len;
+ 
+-	if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
+ 		return;
+ 
+ 	if (!status) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/bluetooth-mgmt-fix-slab-use-after-free-read-in-set_p.patch b/queue-6.6/bluetooth-mgmt-fix-slab-use-after-free-read-in-set_p.patch
new file mode 100644
index 00000000000..daf3d28e5d4
--- /dev/null
+++ b/queue-6.6/bluetooth-mgmt-fix-slab-use-after-free-read-in-set_p.patch
@@ -0,0 +1,126 @@
+From d98dcb2590e682ecc29662df49dcc0c50e128087 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 10:45:31 -0500
+Subject: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 0b882940665ca2849386ee459d4331aa2f8c4e7d ]
+
+This fixes the following crash:
+
+==================================================================
+BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
+Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54
+
+CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
+Workqueue: hci0 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:93 [inline]
+ dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
+ print_address_description mm/kasan/report.c:377 [inline]
+ print_report+0x169/0x550 mm/kasan/report.c:488
+q kasan_report+0x143/0x180 mm/kasan/report.c:601
+ set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353
+ hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328
+ process_one_work kernel/workqueue.c:3231 [inline]
+ process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
+ worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
+ kthread+0x2f0/0x390 kernel/kthread.c:389
+ ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+ </TASK>
+
+Allocated by task 5247:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
+ __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
+ kasan_kmalloc include/linux/kasan.h:211 [inline]
+ __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193
+ kmalloc_noprof include/linux/slab.h:681 [inline]
+ kzalloc_noprof include/linux/slab.h:807 [inline]
+ mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
+ mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
+ set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394
+ hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
+ hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
+ sock_sendmsg_nosec net/socket.c:730 [inline]
+ __sock_sendmsg+0x221/0x270 net/socket.c:745
+ sock_write_iter+0x2dd/0x400 net/socket.c:1160
+ new_sync_write fs/read_write.c:497 [inline]
+ vfs_write+0xa72/0xc90 fs/read_write.c:590
+ ksys_write+0x1a0/0x2c0 fs/read_write.c:643
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 5246:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
+ poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
+ __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
+ kasan_slab_free include/linux/kasan.h:184 [inline]
+ slab_free_hook mm/slub.c:2256 [inline]
+ slab_free mm/slub.c:4477 [inline]
+ kfree+0x149/0x360 mm/slub.c:4598
+ settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443
+ mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
+ __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455
+ hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191
+ hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
+ hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
+ sock_do_ioctl+0x158/0x460 net/socket.c:1222
+ sock_ioctl+0x629/0x8e0 net/socket.c:1341
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:907 [inline]
+ __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
+Tested-by: syzbot+03d6270b6425df1605bf@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=03d6270b6425df1605bf
+Fixes: 275f3f648702 ("Bluetooth: Fix not checking MGMT cmd pending queue")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 1f3a39c20a911..f84912552d294 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -1318,7 +1318,8 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
+ 	struct mgmt_mode *cp;
+ 
+ 	/* Make sure cmd still outstanding. */
+-	if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
++	if (err == -ECANCELED ||
++	    cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ 		return;
+ 
+ 	cp = cmd->param;
+@@ -1351,7 +1352,13 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
+ static int set_powered_sync(struct hci_dev *hdev, void *data)
+ {
+ 	struct mgmt_pending_cmd *cmd = data;
+-	struct mgmt_mode *cp = cmd->param;
++	struct mgmt_mode *cp;
++
++	/* Make sure cmd still outstanding. */
++	if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
++		return -ECANCELED;
++
++	cp = cmd->param;
+ 
+ 	BT_DBG("%s", hdev->name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/bnxt_en-refactor-bnxt_ptp_init.patch b/queue-6.6/bnxt_en-refactor-bnxt_ptp_init.patch
new file mode 100644
index 00000000000..230b5bf2503
--- /dev/null
+++ b/queue-6.6/bnxt_en-refactor-bnxt_ptp_init.patch
@@ -0,0 +1,98 @@
+From 13c62c805b3c08487aeae6b36ec076e1c5b00abb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 14:45:45 -0800
+Subject: bnxt_en: Refactor bnxt_ptp_init()
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 1e9614cd956268e10a669c0593e7e54d03d0c087 ]
+
+Instead of passing the 2nd parameter phc_cfg to bnxt_ptp_init().
+Store it in bp->ptp_cfg so that the caller doesn't need to know what
+the value should be.
+
+In the next patch, we'll need to call bnxt_ptp_init() in bnxt_resume()
+and this will make it easier.
+
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 3661c05c54e8 ("bnxt_en: Unregister PTP during PCI shutdown and suspend")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c     | 6 +++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 4 ++--
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 3 ++-
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index bc6206543e8e9..c216d95809282 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7597,7 +7597,6 @@ static int __bnxt_hwrm_ptp_qcfg(struct bnxt *bp)
+ 	struct hwrm_port_mac_ptp_qcfg_output *resp;
+ 	struct hwrm_port_mac_ptp_qcfg_input *req;
+ 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
+-	bool phc_cfg;
+ 	u8 flags;
+ 	int rc;
+ 
+@@ -7640,8 +7639,9 @@ static int __bnxt_hwrm_ptp_qcfg(struct bnxt *bp)
+ 		rc = -ENODEV;
+ 		goto exit;
+ 	}
+-	phc_cfg = (flags & PORT_MAC_PTP_QCFG_RESP_FLAGS_RTC_CONFIGURED) != 0;
+-	rc = bnxt_ptp_init(bp, phc_cfg);
++	ptp->rtc_configured =
++		(flags & PORT_MAC_PTP_QCFG_RESP_FLAGS_RTC_CONFIGURED) != 0;
++	rc = bnxt_ptp_init(bp);
+ 	if (rc)
+ 		netdev_warn(bp->dev, "PTP initialization failed.\n");
+ exit:
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+index 6e3da3362bd61..bbe8657f6545b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c
+@@ -922,7 +922,7 @@ static void bnxt_ptp_free(struct bnxt *bp)
+ 	}
+ }
+ 
+-int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg)
++int bnxt_ptp_init(struct bnxt *bp)
+ {
+ 	struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;
+ 	int rc;
+@@ -944,7 +944,7 @@ int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg)
+ 
+ 	if (BNXT_PTP_USE_RTC(bp)) {
+ 		bnxt_ptp_timecounter_init(bp, false);
+-		rc = bnxt_ptp_init_rtc(bp, phc_cfg);
++		rc = bnxt_ptp_init_rtc(bp, ptp->rtc_configured);
+ 		if (rc)
+ 			goto out;
+ 	} else {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h
+index 34162e07a1195..7d6a215b10b1f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h
+@@ -115,6 +115,7 @@ struct bnxt_ptp_cfg {
+ 					 BNXT_PTP_MSG_PDELAY_REQ |	\
+ 					 BNXT_PTP_MSG_PDELAY_RESP)
+ 	u8			tx_tstamp_en:1;
++	u8			rtc_configured:1;
+ 	int			rx_filter;
+ 	u32			tstamp_filters;
+ 
+@@ -145,6 +146,6 @@ int bnxt_get_tx_ts_p5(struct bnxt *bp, struct sk_buff *skb);
+ int bnxt_get_rx_ts_p5(struct bnxt *bp, u64 *ts, u32 pkt_ts);
+ void bnxt_ptp_rtc_timecounter_init(struct bnxt_ptp_cfg *ptp, u64 ns);
+ int bnxt_ptp_init_rtc(struct bnxt *bp, bool phc_cfg);
+-int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg);
++int bnxt_ptp_init(struct bnxt *bp);
+ void bnxt_ptp_clear(struct bnxt *bp);
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/bnxt_en-reserve-rings-after-pcie-aer-recovery-if-nic.patch b/queue-6.6/bnxt_en-reserve-rings-after-pcie-aer-recovery-if-nic.patch
new file mode 100644
index 00000000000..cd628c3ac12
--- /dev/null
+++ b/queue-6.6/bnxt_en-reserve-rings-after-pcie-aer-recovery-if-nic.patch
@@ -0,0 +1,54 @@
+From 3608ac7e819de42a511c9edece78a6eacc9e00f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 14:45:41 -0800
+Subject: bnxt_en: Reserve rings after PCIe AER recovery if NIC interface is
+ down
+
+From: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+
+[ Upstream commit 5311598f7f3293683cdc761df71ae3469327332c ]
+
+After successful PCIe AER recovery, FW will reset all resource
+reservations.  If it is IF_UP, the driver will call bnxt_open() and
+all resources will be reserved again.  It it is IF_DOWN, we should
+call bnxt_reserve_rings() so that we can reserve resources including
+RoCE resources to allow RoCE to resume after AER.  Without this
+patch, RoCE fails to resume in this IF_DOWN scenario.
+
+Later, if it becomes IF_UP, bnxt_open() will see that resources have
+been reserved and will not reserve again.
+
+Fixes: fb1e6e562b37 ("bnxt_en: Fix AER recovery.")
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Saravanan Vajravel <saravanan.vajravel@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 58a7bb75506a3..bc6206543e8e9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -14102,8 +14102,12 @@ static void bnxt_io_resume(struct pci_dev *pdev)
+ 	rtnl_lock();
+ 
+ 	err = bnxt_hwrm_func_qcaps(bp);
+-	if (!err && netif_running(netdev))
+-		err = bnxt_open(netdev);
++	if (!err) {
++		if (netif_running(netdev))
++			err = bnxt_open(netdev);
++		else
++			err = bnxt_reserve_rings(bp, true);
++	}
+ 
+ 	bnxt_ulp_start(bp, err);
+ 	if (!err) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/bnxt_en-unregister-ptp-during-pci-shutdown-and-suspe.patch b/queue-6.6/bnxt_en-unregister-ptp-during-pci-shutdown-and-suspe.patch
new file mode 100644
index 00000000000..6e97be19210
--- /dev/null
+++ b/queue-6.6/bnxt_en-unregister-ptp-during-pci-shutdown-and-suspe.patch
@@ -0,0 +1,66 @@
+From c77d65e72f4e27bd48236afa6c6dffd49bf06d22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 14:45:46 -0800
+Subject: bnxt_en: Unregister PTP during PCI shutdown and suspend
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 3661c05c54e8db7064aa96a0774654740974dffc ]
+
+If we go through the PCI shutdown or suspend path, we shutdown the
+NIC but PTP remains registered.  If the kernel continues to run for
+a little bit, the periodic PTP .do_aux_work() function may be called
+and it will read the PHC from the BAR register.  Since the device
+has already been disabled, it will cause a PCIe completion timeout.
+Fix it by calling bnxt_ptp_clear() in the PCI shutdown/suspend
+handlers.  bnxt_ptp_clear() will unregister from PTP and
+.do_aux_work() will be canceled.
+
+In bnxt_resume(), we need to re-initialize PTP.
+
+Fixes: a521c8a01d26 ("bnxt_en: Move bnxt_ptp_init() from bnxt_open() back to bnxt_init_one()")
+Cc: Richard Cochran <richardcochran@gmail.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c216d95809282..c440f4d8d43a2 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -13857,6 +13857,7 @@ static void bnxt_shutdown(struct pci_dev *pdev)
+ 	if (netif_running(dev))
+ 		dev_close(dev);
+ 
++	bnxt_ptp_clear(bp);
+ 	bnxt_clear_int_mode(bp);
+ 	pci_disable_device(pdev);
+ 
+@@ -13883,6 +13884,7 @@ static int bnxt_suspend(struct device *device)
+ 		rc = bnxt_close(dev);
+ 	}
+ 	bnxt_hwrm_func_drv_unrgtr(bp);
++	bnxt_ptp_clear(bp);
+ 	pci_disable_device(bp->pdev);
+ 	bnxt_free_ctx_mem(bp);
+ 	kfree(bp->ctx);
+@@ -13926,6 +13928,10 @@ static int bnxt_resume(struct device *device)
+ 		goto resume_exit;
+ 	}
+ 
++	if (bnxt_ptp_init(bp)) {
++		kfree(bp->ptp_cfg);
++		bp->ptp_cfg = NULL;
++	}
+ 	bnxt_get_wol_settings(bp);
+ 	if (netif_running(dev)) {
+ 		rc = bnxt_open(dev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-arm64-remove-garbage-frame-for-struct_ops-trampo.patch b/queue-6.6/bpf-arm64-remove-garbage-frame-for-struct_ops-trampo.patch
new file mode 100644
index 00000000000..524f5a3e907
--- /dev/null
+++ b/queue-6.6/bpf-arm64-remove-garbage-frame-for-struct_ops-trampo.patch
@@ -0,0 +1,140 @@
+From 4f8b85548628d259aad39701fef97b3e5c8a0567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 16:52:20 +0800
+Subject: bpf, arm64: Remove garbage frame for struct_ops trampoline
+
+From: Xu Kuohai <xukuohai@huawei.com>
+
+[ Upstream commit 87cb58aebdf7005661a07e9fd5a900f924d48c75 ]
+
+The callsite layout for arm64 fentry is:
+
+mov x9, lr
+nop
+
+When a bpf prog is attached, the nop instruction is patched to a call
+to bpf trampoline:
+
+mov x9, lr
+bl <bpf trampoline>
+
+So two return addresses are passed to bpf trampoline: the return address
+for the traced function/prog, stored in x9, and the return address for
+the bpf trampoline itself, stored in lr. To obtain a full and accurate
+call stack, the bpf trampoline constructs two fake function frames using
+x9 and lr.
+
+However, struct_ops progs are invoked directly as function callbacks,
+meaning that x9 is not set as it is in the fentry callsite. In this case,
+the frame constructed using x9 is garbage. The following stack trace for
+struct_ops, captured by perf sampling, illustrates this issue, where
+tcp_ack+0x404 is a garbage frame:
+
+ffffffc0801a04b4 bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid+0x98 (bpf_prog_50992e55a0f655a9_bpf_cubic_cong_avoid)
+ffffffc0801a228c [unknown] ([kernel.kallsyms]) // bpf trampoline
+ffffffd08d362590 tcp_ack+0x798 ([kernel.kallsyms]) // caller for bpf trampoline
+ffffffd08d3621fc tcp_ack+0x404 ([kernel.kallsyms]) // garbage frame
+ffffffd08d36452c tcp_rcv_established+0x4ac ([kernel.kallsyms])
+ffffffd08d375c58 tcp_v4_do_rcv+0x1f0 ([kernel.kallsyms])
+ffffffd08d378630 tcp_v4_rcv+0xeb8 ([kernel.kallsyms])
+
+To fix it, construct only one frame using lr for struct_ops.
+
+The above stack trace also indicates that there is no kernel symbol for
+struct_ops bpf trampoline. This will be addressed in a follow-up patch.
+
+Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64")
+Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
+Acked-by: Puranjay Mohan <puranjay@kernel.org>
+Tested-by: Puranjay Mohan <puranjay@kernel.org>
+Link: https://lore.kernel.org/r/20241025085220.533949-1-xukuohai@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 47 +++++++++++++++++++++++------------
+ 1 file changed, 31 insertions(+), 16 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 166619348b98e..5074bd1d37b5f 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -1816,6 +1816,12 @@ static void restore_args(struct jit_ctx *ctx, int args_off, int nregs)
+ 	}
+ }
+ 
++static bool is_struct_ops_tramp(const struct bpf_tramp_links *fentry_links)
++{
++	return fentry_links->nr_links == 1 &&
++		fentry_links->links[0]->link.type == BPF_LINK_TYPE_STRUCT_OPS;
++}
++
+ /* Based on the x86's implementation of arch_prepare_bpf_trampoline().
+  *
+  * bpf prog and function entry before bpf trampoline hooked:
+@@ -1845,6 +1851,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
+ 	struct bpf_tramp_links *fmod_ret = &tlinks[BPF_TRAMP_MODIFY_RETURN];
+ 	bool save_ret;
+ 	__le32 **branches = NULL;
++	bool is_struct_ops = is_struct_ops_tramp(fentry);
+ 
+ 	/* trampoline stack layout:
+ 	 *                  [ parent ip         ]
+@@ -1913,11 +1920,14 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
+ 	 */
+ 	emit_bti(A64_BTI_JC, ctx);
+ 
+-	/* frame for parent function */
+-	emit(A64_PUSH(A64_FP, A64_R(9), A64_SP), ctx);
+-	emit(A64_MOV(1, A64_FP, A64_SP), ctx);
++	/* x9 is not set for struct_ops */
++	if (!is_struct_ops) {
++		/* frame for parent function */
++		emit(A64_PUSH(A64_FP, A64_R(9), A64_SP), ctx);
++		emit(A64_MOV(1, A64_FP, A64_SP), ctx);
++	}
+ 
+-	/* frame for patched function */
++	/* frame for patched function for tracing, or caller for struct_ops */
+ 	emit(A64_PUSH(A64_FP, A64_LR, A64_SP), ctx);
+ 	emit(A64_MOV(1, A64_FP, A64_SP), ctx);
+ 
+@@ -2003,19 +2013,24 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im,
+ 	/* reset SP  */
+ 	emit(A64_MOV(1, A64_SP, A64_FP), ctx);
+ 
+-	/* pop frames  */
+-	emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
+-	emit(A64_POP(A64_FP, A64_R(9), A64_SP), ctx);
+-
+-	if (flags & BPF_TRAMP_F_SKIP_FRAME) {
+-		/* skip patched function, return to parent */
+-		emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
+-		emit(A64_RET(A64_R(9)), ctx);
++	if (is_struct_ops) {
++		emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
++		emit(A64_RET(A64_LR), ctx);
+ 	} else {
+-		/* return to patched function */
+-		emit(A64_MOV(1, A64_R(10), A64_LR), ctx);
+-		emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
+-		emit(A64_RET(A64_R(10)), ctx);
++		/* pop frames */
++		emit(A64_POP(A64_FP, A64_LR, A64_SP), ctx);
++		emit(A64_POP(A64_FP, A64_R(9), A64_SP), ctx);
++
++		if (flags & BPF_TRAMP_F_SKIP_FRAME) {
++			/* skip patched function, return to parent */
++			emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
++			emit(A64_RET(A64_R(9)), ctx);
++		} else {
++			/* return to patched function */
++			emit(A64_MOV(1, A64_R(10), A64_LR), ctx);
++			emit(A64_MOV(1, A64_LR, A64_R(9)), ctx);
++			emit(A64_RET(A64_R(10)), ctx);
++		}
+ 	}
+ 
+ 	if (ctx->image)
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-bpftool-fix-incorrect-disasm-pc.patch b/queue-6.6/bpf-bpftool-fix-incorrect-disasm-pc.patch
new file mode 100644
index 00000000000..536d1c3bbbf
--- /dev/null
+++ b/queue-6.6/bpf-bpftool-fix-incorrect-disasm-pc.patch
@@ -0,0 +1,163 @@
+From e8eefd1a9ba55f6d4800f5ac4a035d321d1d8a6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 23:28:44 +0800
+Subject: bpf, bpftool: Fix incorrect disasm pc
+
+From: Leon Hwang <leon.hwang@linux.dev>
+
+[ Upstream commit 4d99e509c161f8610de125202c648fa4acd00541 ]
+
+This patch addresses the bpftool issue "Wrong callq address displayed"[0].
+
+The issue stemmed from an incorrect program counter (PC) value used during
+disassembly with LLVM or libbfd.
+
+For LLVM: The PC argument must represent the actual address in the kernel
+to compute the correct relative address.
+
+For libbfd: The relative address can be adjusted by adding func_ksym within
+the custom info->print_address_func to yield the correct address.
+
+Links:
+[0] https://github.com/libbpf/bpftool/issues/109
+
+Changes:
+v2 -> v3:
+  * Address comment from Quentin:
+    * Remove the typedef.
+
+v1 -> v2:
+  * Fix the broken libbfd disassembler.
+
+Fixes: e1947c750ffe ("bpftool: Refactor disassembler for JIT-ed programs")
+Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Quentin Monnet <qmo@kernel.org>
+Reviewed-by: Quentin Monnet <qmo@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/bpf/20241031152844.68817-1-leon.hwang@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/jit_disasm.c | 40 ++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/tools/bpf/bpftool/jit_disasm.c b/tools/bpf/bpftool/jit_disasm.c
+index 7b8d9ec89ebd3..c032d2c6ab6d5 100644
+--- a/tools/bpf/bpftool/jit_disasm.c
++++ b/tools/bpf/bpftool/jit_disasm.c
+@@ -80,7 +80,8 @@ symbol_lookup_callback(__maybe_unused void *disasm_info,
+ static int
+ init_context(disasm_ctx_t *ctx, const char *arch,
+ 	     __maybe_unused const char *disassembler_options,
+-	     __maybe_unused unsigned char *image, __maybe_unused ssize_t len)
++	     __maybe_unused unsigned char *image, __maybe_unused ssize_t len,
++	     __maybe_unused __u64 func_ksym)
+ {
+ 	char *triple;
+ 
+@@ -109,12 +110,13 @@ static void destroy_context(disasm_ctx_t *ctx)
+ }
+ 
+ static int
+-disassemble_insn(disasm_ctx_t *ctx, unsigned char *image, ssize_t len, int pc)
++disassemble_insn(disasm_ctx_t *ctx, unsigned char *image, ssize_t len, int pc,
++		 __u64 func_ksym)
+ {
+ 	char buf[256];
+ 	int count;
+ 
+-	count = LLVMDisasmInstruction(*ctx, image + pc, len - pc, pc,
++	count = LLVMDisasmInstruction(*ctx, image + pc, len - pc, func_ksym + pc,
+ 				      buf, sizeof(buf));
+ 	if (json_output)
+ 		printf_json(buf);
+@@ -136,8 +138,21 @@ int disasm_init(void)
+ #ifdef HAVE_LIBBFD_SUPPORT
+ #define DISASM_SPACER "\t"
+ 
++struct disasm_info {
++	struct disassemble_info info;
++	__u64 func_ksym;
++};
++
++static void disasm_print_addr(bfd_vma addr, struct disassemble_info *info)
++{
++	struct disasm_info *dinfo = container_of(info, struct disasm_info, info);
++
++	addr += dinfo->func_ksym;
++	generic_print_address(addr, info);
++}
++
+ typedef struct {
+-	struct disassemble_info *info;
++	struct disasm_info *info;
+ 	disassembler_ftype disassemble;
+ 	bfd *bfdf;
+ } disasm_ctx_t;
+@@ -215,7 +230,7 @@ static int fprintf_json_styled(void *out,
+ 
+ static int init_context(disasm_ctx_t *ctx, const char *arch,
+ 			const char *disassembler_options,
+-			unsigned char *image, ssize_t len)
++			unsigned char *image, ssize_t len, __u64 func_ksym)
+ {
+ 	struct disassemble_info *info;
+ 	char tpath[PATH_MAX];
+@@ -238,12 +253,13 @@ static int init_context(disasm_ctx_t *ctx, const char *arch,
+ 	}
+ 	bfdf = ctx->bfdf;
+ 
+-	ctx->info = malloc(sizeof(struct disassemble_info));
++	ctx->info = malloc(sizeof(struct disasm_info));
+ 	if (!ctx->info) {
+ 		p_err("mem alloc failed");
+ 		goto err_close;
+ 	}
+-	info = ctx->info;
++	ctx->info->func_ksym = func_ksym;
++	info = &ctx->info->info;
+ 
+ 	if (json_output)
+ 		init_disassemble_info_compat(info, stdout,
+@@ -272,6 +288,7 @@ static int init_context(disasm_ctx_t *ctx, const char *arch,
+ 		info->disassembler_options = disassembler_options;
+ 	info->buffer = image;
+ 	info->buffer_length = len;
++	info->print_address_func = disasm_print_addr;
+ 
+ 	disassemble_init_for_target(info);
+ 
+@@ -304,9 +321,10 @@ static void destroy_context(disasm_ctx_t *ctx)
+ 
+ static int
+ disassemble_insn(disasm_ctx_t *ctx, __maybe_unused unsigned char *image,
+-		 __maybe_unused ssize_t len, int pc)
++		 __maybe_unused ssize_t len, int pc,
++		 __maybe_unused __u64 func_ksym)
+ {
+-	return ctx->disassemble(pc, ctx->info);
++	return ctx->disassemble(pc, &ctx->info->info);
+ }
+ 
+ int disasm_init(void)
+@@ -331,7 +349,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
+ 	if (!len)
+ 		return -1;
+ 
+-	if (init_context(&ctx, arch, disassembler_options, image, len))
++	if (init_context(&ctx, arch, disassembler_options, image, len, func_ksym))
+ 		return -1;
+ 
+ 	if (json_output)
+@@ -360,7 +378,7 @@ int disasm_print_insn(unsigned char *image, ssize_t len, int opcodes,
+ 			printf("%4x:" DISASM_SPACER, pc);
+ 		}
+ 
+-		count = disassemble_insn(&ctx, image, len, pc);
++		count = disassemble_insn(&ctx, image, len, pc, func_ksym);
+ 
+ 		if (json_output) {
+ 			/* Operand array, was started in fprintf_json. Before
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-fix-recursive-lock-when-verdict-program-return-s.patch b/queue-6.6/bpf-fix-recursive-lock-when-verdict-program-return-s.patch
new file mode 100644
index 00000000000..18b359f6ee9
--- /dev/null
+++ b/queue-6.6/bpf-fix-recursive-lock-when-verdict-program-return-s.patch
@@ -0,0 +1,66 @@
+From 5368e6f4d00e8e00da293e1e5c2e95750110d899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 11:09:09 +0800
+Subject: bpf: fix recursive lock when verdict program return SK_PASS
+
+From: Jiayuan Chen <mrpre@163.com>
+
+[ Upstream commit 8ca2a1eeadf09862190b2810697702d803ceef2d ]
+
+When the stream_verdict program returns SK_PASS, it places the received skb
+into its own receive queue, but a recursive lock eventually occurs, leading
+to an operating system deadlock. This issue has been present since v6.9.
+
+'''
+sk_psock_strp_data_ready
+    write_lock_bh(&sk->sk_callback_lock)
+    strp_data_ready
+      strp_read_sock
+        read_sock -> tcp_read_sock
+          strp_recv
+            cb.rcv_msg -> sk_psock_strp_read
+              # now stream_verdict return SK_PASS without peer sock assign
+              __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
+              sk_psock_verdict_apply
+                sk_psock_skb_ingress_self
+                  sk_psock_skb_ingress_enqueue
+                    sk_psock_data_ready
+                      read_lock_bh(&sk->sk_callback_lock) <= dead lock
+
+'''
+
+This topic has been discussed before, but it has not been fixed.
+Previous discussion:
+https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch
+
+Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue")
+Reported-by: Vincent Whitchurch <vincent.whitchurch@datadoghq.com>
+Signed-off-by: Jiayuan Chen <mrpre@163.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20241118030910.36230-2-mrpre@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index bbf40b9997138..846fd672f0e52 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -1117,9 +1117,9 @@ static void sk_psock_strp_data_ready(struct sock *sk)
+ 		if (tls_sw_has_ctx_rx(sk)) {
+ 			psock->saved_data_ready(sk);
+ 		} else {
+-			write_lock_bh(&sk->sk_callback_lock);
++			read_lock_bh(&sk->sk_callback_lock);
+ 			strp_data_ready(&psock->strp);
+-			write_unlock_bh(&sk->sk_callback_lock);
++			read_unlock_bh(&sk->sk_callback_lock);
+ 		}
+ 	}
+ 	rcu_read_unlock();
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch b/queue-6.6/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch
new file mode 100644
index 00000000000..d4d7b16af13
--- /dev/null
+++ b/queue-6.6/bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch
@@ -0,0 +1,41 @@
+From f22cd8e2d9e4675634e825f30b321b6225bc81ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 10:41:15 +0800
+Subject: bpf: Fix the xdp_adjust_tail sample prog issue
+
+From: Yuan Chen <chenyuan@kylinos.cn>
+
+[ Upstream commit 4236f114a3ffbbfd217436c08852e94cae372f57 ]
+
+During the xdp_adjust_tail test, probabilistic failure occurs and SKB package
+is discarded by the kernel. After checking the issues by tracking SKB package,
+it is identified that they were caused by checksum errors. Refer to checksum
+of the arch/arm64/include/asm/checksum.h for fixing.
+
+v2: Based on Alexei Starovoitov's suggestions, it is necessary to keep the code
+ implementation consistent.
+
+Fixes: c6ffd1ff7856 (bpf: add bpf_xdp_adjust_tail sample prog)
+Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240930024115.52841-1-chenyuan_fl@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdp_adjust_tail_kern.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/xdp_adjust_tail_kern.c b/samples/bpf/xdp_adjust_tail_kern.c
+index ffdd548627f0a..da67bcad1c638 100644
+--- a/samples/bpf/xdp_adjust_tail_kern.c
++++ b/samples/bpf/xdp_adjust_tail_kern.c
+@@ -57,6 +57,7 @@ static __always_inline void swap_mac(void *data, struct ethhdr *orig_eth)
+ 
+ static __always_inline __u16 csum_fold_helper(__u32 csum)
+ {
++	csum = (csum & 0xffff) + (csum >> 16);
+ 	return ~((csum & 0xffff) + (csum >> 16));
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-force-uprobe-bpf-program-to-always-return-0.patch b/queue-6.6/bpf-force-uprobe-bpf-program-to-always-return-0.patch
new file mode 100644
index 00000000000..5a7e0b03fb8
--- /dev/null
+++ b/queue-6.6/bpf-force-uprobe-bpf-program-to-always-return-0.patch
@@ -0,0 +1,59 @@
+From 9786ece3ed94b57f3e7c7c3ee8687d8504a93238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 14:45:33 +0100
+Subject: bpf: Force uprobe bpf program to always return 0
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit f505005bc7426f4309880da94cfbfc37efa225bd ]
+
+As suggested by Andrii make uprobe multi bpf programs to always return 0,
+so they can't force uprobe removal.
+
+Keeping the int return type for uprobe_prog_run, because it will be used
+in following session changes.
+
+Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
+Suggested-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20241108134544.480660-3-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 9064f75de7e46..e8fb6ada323c1 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -3098,7 +3098,6 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,
+ 	struct bpf_prog *prog = link->link.prog;
+ 	bool sleepable = prog->aux->sleepable;
+ 	struct bpf_run_ctx *old_run_ctx;
+-	int err = 0;
+ 
+ 	if (link->task && current->mm != link->task->mm)
+ 		return 0;
+@@ -3111,7 +3110,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,
+ 	migrate_disable();
+ 
+ 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
+-	err = bpf_prog_run(link->link.prog, regs);
++	bpf_prog_run(link->link.prog, regs);
+ 	bpf_reset_run_ctx(old_run_ctx);
+ 
+ 	migrate_enable();
+@@ -3120,7 +3119,7 @@ static int uprobe_prog_run(struct bpf_uprobe *uprobe,
+ 		rcu_read_unlock_trace();
+ 	else
+ 		rcu_read_unlock();
+-	return err;
++	return 0;
+ }
+ 
+ static bool
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-sockmap-fix-sk_msg_reset_curr.patch b/queue-6.6/bpf-sockmap-fix-sk_msg_reset_curr.patch
new file mode 100644
index 00000000000..b2785bd8488
--- /dev/null
+++ b/queue-6.6/bpf-sockmap-fix-sk_msg_reset_curr.patch
@@ -0,0 +1,70 @@
+From 26a1024d112453dcfabe26cd1511e52ad960b818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:20 +0000
+Subject: bpf, sockmap: Fix sk_msg_reset_curr
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 955afd57dc4bf7e8c620a0a9e3af3c881c2c6dff ]
+
+Found in the test_txmsg_pull in test_sockmap,
+```
+txmsg_cork = 512; // corking is importrant here
+opt->iov_length = 3;
+opt->iov_count = 1;
+opt->rate = 512; // sendmsg will be invoked 512 times
+```
+The first sendmsg will send an sk_msg with size 3, and bpf_msg_pull_data
+will be invoked the first time. sk_msg_reset_curr will reset the copybreak
+from 3 to 0. In the second sendmsg, since we are in the stage of corking,
+psock->cork will be reused in func sk_msg_alloc. msg->sg.copybreak is 0
+now, the second msg will overwrite the first msg. As a result, we could
+not pass the data integrity test.
+
+The same problem happens in push and pop test. Thus, fix sk_msg_reset_curr
+to restore the correct copybreak.
+
+Fixes: bb9aefde5bba ("bpf: sockmap, updating the sg structure should also update curr")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-9-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index c223e072b35e9..b64e7139eae19 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2602,18 +2602,16 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)
+ 
+ static void sk_msg_reset_curr(struct sk_msg *msg)
+ {
+-	u32 i = msg->sg.start;
+-	u32 len = 0;
+-
+-	do {
+-		len += sk_msg_elem(msg, i)->length;
+-		sk_msg_iter_var_next(i);
+-		if (len >= msg->sg.size)
+-			break;
+-	} while (i != msg->sg.end);
++	if (!msg->sg.size) {
++		msg->sg.curr = msg->sg.start;
++		msg->sg.copybreak = 0;
++	} else {
++		u32 i = msg->sg.end;
+ 
+-	msg->sg.curr = i;
+-	msg->sg.copybreak = 0;
++		sk_msg_iter_var_prev(i);
++		msg->sg.curr = i;
++		msg->sg.copybreak = msg->sg.data[i].length;
++	}
+ }
+ 
+ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch b/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch
new file mode 100644
index 00000000000..40acfca68d1
--- /dev/null
+++ b/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch
@@ -0,0 +1,104 @@
+From 291771cf48ec6a43d84eb13b88f57436675374cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:19 +0000
+Subject: bpf, sockmap: Several fixes to bpf_msg_pop_data
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 5d609ba262475db450ba69b8e8a557bd768ac07a ]
+
+Several fixes to bpf_msg_pop_data,
+1. In sk_msg_shift_left, we should put_page
+2. if (len == 0), return early is better
+3. pop the entire sk_msg (last == msg->sg.size) should be supported
+4. Fix for the value of variable "a"
+5. In sk_msg_shift_left, after shifting, i has already pointed to the next
+element. Addtional sk_msg_iter_var_next may result in BUG.
+
+Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-8-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 62092948b390f..c223e072b35e9 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2902,8 +2902,10 @@ static const struct bpf_func_proto bpf_msg_push_data_proto = {
+ 
+ static void sk_msg_shift_left(struct sk_msg *msg, int i)
+ {
++	struct scatterlist *sge = sk_msg_elem(msg, i);
+ 	int prev;
+ 
++	put_page(sg_page(sge));
+ 	do {
+ 		prev = i;
+ 		sk_msg_iter_var_next(i);
+@@ -2940,6 +2942,9 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 	if (unlikely(flags))
+ 		return -EINVAL;
+ 
++	if (unlikely(len == 0))
++		return 0;
++
+ 	/* First find the starting scatterlist element */
+ 	i = msg->sg.start;
+ 	do {
+@@ -2952,7 +2957,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 	} while (i != msg->sg.end);
+ 
+ 	/* Bounds checks: start and pop must be inside message */
+-	if (start >= offset + l || last >= msg->sg.size)
++	if (start >= offset + l || last > msg->sg.size)
+ 		return -EINVAL;
+ 
+ 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);
+@@ -2981,12 +2986,12 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 	 */
+ 	if (start != offset) {
+ 		struct scatterlist *nsge, *sge = sk_msg_elem(msg, i);
+-		int a = start;
++		int a = start - offset;
+ 		int b = sge->length - pop - a;
+ 
+ 		sk_msg_iter_var_next(i);
+ 
+-		if (pop < sge->length - a) {
++		if (b > 0) {
+ 			if (space) {
+ 				sge->length = a;
+ 				sk_msg_shift_right(msg, i);
+@@ -3005,7 +3010,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 				if (unlikely(!page))
+ 					return -ENOMEM;
+ 
+-				sge->length = a;
+ 				orig = sg_page(sge);
+ 				from = sg_virt(sge);
+ 				to = page_address(page);
+@@ -3015,7 +3019,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 				put_page(orig);
+ 			}
+ 			pop = 0;
+-		} else if (pop >= sge->length - a) {
++		} else {
+ 			pop -= (sge->length - a);
+ 			sge->length = a;
+ 		}
+@@ -3049,7 +3053,6 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
+ 			pop -= sge->length;
+ 			sk_msg_shift_left(msg, i);
+ 		}
+-		sk_msg_iter_var_next(i);
+ 	}
+ 
+ 	sk_mem_uncharge(msg->sk, len - pop);
+-- 
+2.43.0
+
diff --git a/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch b/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch
new file mode 100644
index 00000000000..ca6588e6ae9
--- /dev/null
+++ b/queue-6.6/bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch
@@ -0,0 +1,132 @@
+From f804da63eb688fd4c3e2351d497fe1c8b017ec09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:18 +0000
+Subject: bpf, sockmap: Several fixes to bpf_msg_push_data
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 15ab0548e3107665c34579ae523b2b6e7c22082a ]
+
+Several fixes to bpf_msg_push_data,
+1. test_sockmap has tests where bpf_msg_push_data is invoked to push some
+data at the end of a message, but -EINVAL is returned. In this case, in
+bpf_msg_push_data, after the first loop, i will be set to msg->sg.end, add
+the logic to handle it.
+2. In the code block of "if (start - offset)", it's possible that "i"
+points to the last of sk_msg_elem. In this case, "sk_msg_iter_next(msg,
+end)" might still be called twice, another invoking is in "if (!copy)"
+code block, but actually only one is needed. Add the logic to handle it,
+and reconstruct the code to make the logic more clear.
+
+Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-7-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 53 +++++++++++++++++++++++++++++------------------
+ 1 file changed, 33 insertions(+), 20 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index f9d05eff80b17..62092948b390f 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2776,7 +2776,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
+ 		sk_msg_iter_var_next(i);
+ 	} while (i != msg->sg.end);
+ 
+-	if (start >= offset + l)
++	if (start > offset + l)
+ 		return -EINVAL;
+ 
+ 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);
+@@ -2801,6 +2801,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
+ 
+ 		raw = page_address(page);
+ 
++		if (i == msg->sg.end)
++			sk_msg_iter_var_prev(i);
+ 		psge = sk_msg_elem(msg, i);
+ 		front = start - offset;
+ 		back = psge->length - front;
+@@ -2817,7 +2819,13 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
+ 		}
+ 
+ 		put_page(sg_page(psge));
+-	} else if (start - offset) {
++		new = i;
++		goto place_new;
++	}
++
++	if (start - offset) {
++		if (i == msg->sg.end)
++			sk_msg_iter_var_prev(i);
+ 		psge = sk_msg_elem(msg, i);
+ 		rsge = sk_msg_elem_cpy(msg, i);
+ 
+@@ -2828,39 +2836,44 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
+ 		sk_msg_iter_var_next(i);
+ 		sg_unmark_end(psge);
+ 		sg_unmark_end(&rsge);
+-		sk_msg_iter_next(msg, end);
+ 	}
+ 
+ 	/* Slot(s) to place newly allocated data */
++	sk_msg_iter_next(msg, end);
+ 	new = i;
++	sk_msg_iter_var_next(i);
++
++	if (i == msg->sg.end) {
++		if (!rsge.length)
++			goto place_new;
++		sk_msg_iter_next(msg, end);
++		goto place_new;
++	}
+ 
+ 	/* Shift one or two slots as needed */
+-	if (!copy) {
+-		sge = sk_msg_elem_cpy(msg, i);
++	sge = sk_msg_elem_cpy(msg, new);
++	sg_unmark_end(&sge);
+ 
++	nsge = sk_msg_elem_cpy(msg, i);
++	if (rsge.length) {
+ 		sk_msg_iter_var_next(i);
+-		sg_unmark_end(&sge);
++		nnsge = sk_msg_elem_cpy(msg, i);
+ 		sk_msg_iter_next(msg, end);
++	}
+ 
+-		nsge = sk_msg_elem_cpy(msg, i);
++	while (i != msg->sg.end) {
++		msg->sg.data[i] = sge;
++		sge = nsge;
++		sk_msg_iter_var_next(i);
+ 		if (rsge.length) {
+-			sk_msg_iter_var_next(i);
++			nsge = nnsge;
+ 			nnsge = sk_msg_elem_cpy(msg, i);
+-		}
+-
+-		while (i != msg->sg.end) {
+-			msg->sg.data[i] = sge;
+-			sge = nsge;
+-			sk_msg_iter_var_next(i);
+-			if (rsge.length) {
+-				nsge = nnsge;
+-				nnsge = sk_msg_elem_cpy(msg, i);
+-			} else {
+-				nsge = sk_msg_elem_cpy(msg, i);
+-			}
++		} else {
++			nsge = sk_msg_elem_cpy(msg, i);
+ 		}
+ 	}
+ 
++place_new:
+ 	/* Place newly allocated data buffer */
+ 	sk_mem_charge(msg->sk, len);
+ 	msg->sg.size += len;
+-- 
+2.43.0
+
diff --git a/queue-6.6/brd-defer-automatic-disk-creation-until-module-initi.patch b/queue-6.6/brd-defer-automatic-disk-creation-until-module-initi.patch
new file mode 100644
index 00000000000..c399ea290e3
--- /dev/null
+++ b/queue-6.6/brd-defer-automatic-disk-creation-until-module-initi.patch
@@ -0,0 +1,209 @@
+From 33706ca4be3d7e980352ddd8d859ed00c5bd7f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 11:49:14 +0800
+Subject: brd: defer automatic disk creation until module initialization
+ succeeds
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+[ Upstream commit 826cc42adf44930a633d11a5993676d85ddb0842 ]
+
+My colleague Wupeng found the following problems during fault injection:
+
+BUG: unable to handle page fault for address: fffffbfff809d073
+PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0
+Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
+CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+1.16.1-2.fc37 04/01/2014
+RIP: 0010:__asan_load8+0x4c/0xa0
+...
+Call Trace:
+ <TASK>
+ blkdev_put_whole+0x41/0x70
+ bdev_release+0x1a3/0x250
+ blkdev_release+0x11/0x20
+ __fput+0x1d7/0x4a0
+ task_work_run+0xfc/0x180
+ syscall_exit_to_user_mode+0x1de/0x1f0
+ do_syscall_64+0x6b/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+loop_init() is calling loop_add() after __register_blkdev() succeeds and
+is ignoring disk_add() failure from loop_add(), for loop_add() failure
+is not fatal and successfully created disks are already visible to
+bdev_open().
+
+brd_init() is currently calling brd_alloc() before __register_blkdev()
+succeeds and is releasing successfully created disks when brd_init()
+returns an error. This can cause UAF for the latter two case:
+
+case 1:
+    T1:
+modprobe brd
+  brd_init
+    brd_alloc(0) // success
+      add_disk
+        disk_scan_partitions
+          bdev_file_open_by_dev // alloc file
+          fput // won't free until back to userspace
+    brd_alloc(1) // failed since mem alloc error inject
+  // error path for modprobe will release code segment
+  // back to userspace
+  __fput
+    blkdev_release
+      bdev_release
+        blkdev_put_whole
+          bdev->bd_disk->fops->release // fops is freed now, UAF!
+
+case 2:
+    T1:                            T2:
+modprobe brd
+  brd_init
+    brd_alloc(0) // success
+                                   open(/dev/ram0)
+    brd_alloc(1) // fail
+  // error path for modprobe
+
+                                   close(/dev/ram0)
+                                   ...
+                                   /* UAF! */
+                                   bdev->bd_disk->fops->release
+
+Fix this problem by following what loop_init() does. Besides,
+reintroduce brd_devices_mutex to help serialize modifications to
+brd_list.
+
+Fixes: 7f9b348cb5e9 ("brd: convert to blk_alloc_disk/blk_cleanup_disk")
+Reported-by: Wupeng Ma <mawupeng1@huawei.com>
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241030034914.907829-1-yangerkun@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/brd.c | 66 ++++++++++++++++++++++++++++++---------------
+ 1 file changed, 44 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 970bd6ff38c49..d816d1512531e 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -310,8 +310,40 @@ __setup("ramdisk_size=", ramdisk_size);
+  * (should share code eventually).
+  */
+ static LIST_HEAD(brd_devices);
++static DEFINE_MUTEX(brd_devices_mutex);
+ static struct dentry *brd_debugfs_dir;
+ 
++static struct brd_device *brd_find_or_alloc_device(int i)
++{
++	struct brd_device *brd;
++
++	mutex_lock(&brd_devices_mutex);
++	list_for_each_entry(brd, &brd_devices, brd_list) {
++		if (brd->brd_number == i) {
++			mutex_unlock(&brd_devices_mutex);
++			return ERR_PTR(-EEXIST);
++		}
++	}
++
++	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
++	if (!brd) {
++		mutex_unlock(&brd_devices_mutex);
++		return ERR_PTR(-ENOMEM);
++	}
++	brd->brd_number	= i;
++	list_add_tail(&brd->brd_list, &brd_devices);
++	mutex_unlock(&brd_devices_mutex);
++	return brd;
++}
++
++static void brd_free_device(struct brd_device *brd)
++{
++	mutex_lock(&brd_devices_mutex);
++	list_del(&brd->brd_list);
++	mutex_unlock(&brd_devices_mutex);
++	kfree(brd);
++}
++
+ static int brd_alloc(int i)
+ {
+ 	struct brd_device *brd;
+@@ -319,14 +351,9 @@ static int brd_alloc(int i)
+ 	char buf[DISK_NAME_LEN];
+ 	int err = -ENOMEM;
+ 
+-	list_for_each_entry(brd, &brd_devices, brd_list)
+-		if (brd->brd_number == i)
+-			return -EEXIST;
+-	brd = kzalloc(sizeof(*brd), GFP_KERNEL);
+-	if (!brd)
+-		return -ENOMEM;
+-	brd->brd_number		= i;
+-	list_add_tail(&brd->brd_list, &brd_devices);
++	brd = brd_find_or_alloc_device(i);
++	if (IS_ERR(brd))
++		return PTR_ERR(brd);
+ 
+ 	xa_init(&brd->brd_pages);
+ 
+@@ -369,8 +396,7 @@ static int brd_alloc(int i)
+ out_cleanup_disk:
+ 	put_disk(disk);
+ out_free_dev:
+-	list_del(&brd->brd_list);
+-	kfree(brd);
++	brd_free_device(brd);
+ 	return err;
+ }
+ 
+@@ -389,8 +415,7 @@ static void brd_cleanup(void)
+ 		del_gendisk(brd->brd_disk);
+ 		put_disk(brd->brd_disk);
+ 		brd_free_pages(brd);
+-		list_del(&brd->brd_list);
+-		kfree(brd);
++		brd_free_device(brd);
+ 	}
+ }
+ 
+@@ -417,16 +442,6 @@ static int __init brd_init(void)
+ {
+ 	int err, i;
+ 
+-	brd_check_and_reset_par();
+-
+-	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
+-
+-	for (i = 0; i < rd_nr; i++) {
+-		err = brd_alloc(i);
+-		if (err)
+-			goto out_free;
+-	}
+-
+ 	/*
+ 	 * brd module now has a feature to instantiate underlying device
+ 	 * structure on-demand, provided that there is an access dev node.
+@@ -442,11 +457,18 @@ static int __init brd_init(void)
+ 	 *	dynamically.
+ 	 */
+ 
++	brd_check_and_reset_par();
++
++	brd_debugfs_dir = debugfs_create_dir("ramdisk_pages", NULL);
++
+ 	if (__register_blkdev(RAMDISK_MAJOR, "ramdisk", brd_probe)) {
+ 		err = -EIO;
+ 		goto out_free;
+ 	}
+ 
++	for (i = 0; i < rd_nr; i++)
++		brd_alloc(i);
++
+ 	pr_info("brd: module loaded\n");
+ 	return 0;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch b/queue-6.6/cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch
new file mode 100644
index 00000000000..6a17d687815
--- /dev/null
+++ b/queue-6.6/cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch
@@ -0,0 +1,51 @@
+From 82d6767a8c681d1dff5e8e75a15138df289f8846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 19:06:46 +0800
+Subject: cachefiles: Fix missing pos updates in
+ cachefiles_ondemand_fd_write_iter()
+
+From: Zizhi Wo <wozizhi@huawei.com>
+
+[ Upstream commit 56f4856b425a30e1d8b3e41e6cde8bfba90ba5f8 ]
+
+In the erofs on-demand loading scenario, read and write operations are
+usually delivered through "off" and "len" contained in read req in user
+mode. Naturally, pwrite is used to specify a specific offset to complete
+write operations.
+
+However, if the write(not pwrite) syscall is called multiple times in the
+read-ahead scenario, we need to manually update ki_pos after each write
+operation to update file->f_pos.
+
+This step is currently missing from the cachefiles_ondemand_fd_write_iter
+function, added to address this issue.
+
+Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up cookie")
+Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
+Link: https://lore.kernel.org/r/20241107110649.3980193-3-wozizhi@huawei.com
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cachefiles/ondemand.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c
+index 2185e2908dba8..d1a0264b08a6c 100644
+--- a/fs/cachefiles/ondemand.c
++++ b/fs/cachefiles/ondemand.c
+@@ -78,8 +78,10 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb,
+ 
+ 	trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len);
+ 	ret = __cachefiles_write(object, file, pos, iter, NULL, NULL);
+-	if (!ret)
++	if (!ret) {
+ 		ret = len;
++		kiocb->ki_pos += ret;
++	}
+ 
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/cgroup-bpf-only-cgroup-v2-can-be-attached-by-bpf-pro.patch b/queue-6.6/cgroup-bpf-only-cgroup-v2-can-be-attached-by-bpf-pro.patch
new file mode 100644
index 00000000000..6632981124e
--- /dev/null
+++ b/queue-6.6/cgroup-bpf-only-cgroup-v2-can-be-attached-by-bpf-pro.patch
@@ -0,0 +1,70 @@
+From 3b750ec28d1bb27297d63ab741912c50c20af30e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 08:15:20 +0000
+Subject: cgroup/bpf: only cgroup v2 can be attached by bpf programs
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 2190df6c91373fdec6db9fc07e427084f232f57e ]
+
+Only cgroup v2 can be attached by bpf programs, so this patch introduces
+that cgroup_bpf_inherit and cgroup_bpf_offline can only be called in
+cgroup v2, and this can fix the memleak mentioned by commit 04f8ef5643bc
+("cgroup: Fix memory leak caused by missing cgroup_bpf_offline"), which
+has been reverted.
+
+Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
+Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself")
+Link: https://lore.kernel.org/cgroups/aka2hk5jsel5zomucpwlxsej6iwnfw4qu5jkrmjhyfhesjlfdw@46zxhg5bdnr7/
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cgroup.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index d31cc406fb58e..36097e8c904fe 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -2096,8 +2096,10 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
+ 	if (ret)
+ 		goto exit_stats;
+ 
+-	ret = cgroup_bpf_inherit(root_cgrp);
+-	WARN_ON_ONCE(ret);
++	if (root == &cgrp_dfl_root) {
++		ret = cgroup_bpf_inherit(root_cgrp);
++		WARN_ON_ONCE(ret);
++	}
+ 
+ 	trace_cgroup_setup_root(root);
+ 
+@@ -5616,9 +5618,11 @@ static struct cgroup *cgroup_create(struct cgroup *parent, const char *name,
+ 	if (ret)
+ 		goto out_kernfs_remove;
+ 
+-	ret = cgroup_bpf_inherit(cgrp);
+-	if (ret)
+-		goto out_psi_free;
++	if (cgrp->root == &cgrp_dfl_root) {
++		ret = cgroup_bpf_inherit(cgrp);
++		if (ret)
++			goto out_psi_free;
++	}
+ 
+ 	/*
+ 	 * New cgroup inherits effective freeze counter, and
+@@ -5936,7 +5940,8 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
+ 
+ 	cgroup1_check_for_release(parent);
+ 
+-	cgroup_bpf_offline(cgrp);
++	if (cgrp->root == &cgrp_dfl_root)
++		cgroup_bpf_offline(cgrp);
+ 
+ 	/* put the base reference */
+ 	percpu_ref_kill(&cgrp->self.refcnt);
+-- 
+2.43.0
+
diff --git a/queue-6.6/checkpatch-always-parse-orig_commit-in-fixes-tag.patch b/queue-6.6/checkpatch-always-parse-orig_commit-in-fixes-tag.patch
new file mode 100644
index 00000000000..e2be03ddd51
--- /dev/null
+++ b/queue-6.6/checkpatch-always-parse-orig_commit-in-fixes-tag.patch
@@ -0,0 +1,120 @@
+From 7961cfe298a97344862638bc51501068aa28fca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 19:43:19 -0400
+Subject: checkpatch: always parse orig_commit in fixes tag
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tamir Duberstein <tamird@gmail.com>
+
+[ Upstream commit 2f07b652384969f5d0b317e1daa5f2eb967bc73d ]
+
+Do not require the presence of `$balanced_parens` to get the commit SHA;
+this allows a `Fixes: deadbeef` tag to get a correct suggestion rather
+than a suggestion containing a reference to HEAD.
+
+Given this patch:
+
+: From: Tamir Duberstein <tamird@gmail.com>
+: Subject: Test patch
+: Date: Fri, 25 Oct 2024 19:30:51 -0400
+:
+: This is a test patch.
+:
+: Fixes: bd17e036b495
+: Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+: --- /dev/null
+: +++ b/new-file
+: @@ -0,0 +1 @@
+: +Test.
+
+Before:
+
+WARNING: Please use correct Fixes: style 'Fixes: <12 chars of sha1> ("<title line>")' - ie: 'Fixes: c10a7d25e68f ("Test patch")'
+
+After:
+
+WARNING: Please use correct Fixes: style 'Fixes: <12 chars of sha1> ("<title line>")' - ie: 'Fixes: bd17e036b495 ("checkpatch: warn for non-standard fixes tag style")'
+
+The prior behavior incorrectly suggested the patch's own SHA and title
+line rather than the referenced commit's.  This fixes that.
+
+Ironically this:
+
+Fixes: bd17e036b495 ("checkpatch: warn for non-standard fixes tag style")
+Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Dwaipayan Ray <dwaipayanray1@gmail.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Louis Peens <louis.peens@corigine.com>
+Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Cc: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Cc: Philippe Schenker <philippe.schenker@toradex.com>
+Cc: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkpatch.pl | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 6b598f0858392..6744b58c35083 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -3208,36 +3208,31 @@ sub process {
+ 
+ # Check Fixes: styles is correct
+ 		if (!$in_header_lines &&
+-		    $line =~ /^\s*fixes:?\s*(?:commit\s*)?[0-9a-f]{5,}\b/i) {
+-			my $orig_commit = "";
+-			my $id = "0123456789ab";
+-			my $title = "commit title";
+-			my $tag_case = 1;
+-			my $tag_space = 1;
+-			my $id_length = 1;
+-			my $id_case = 1;
++		    $line =~ /^\s*(fixes:?)\s*(?:commit\s*)?([0-9a-f]{5,40})(?:\s*($balanced_parens))?/i) {
++			my $tag = $1;
++			my $orig_commit = $2;
++			my $title;
+ 			my $title_has_quotes = 0;
+ 			$fixes_tag = 1;
+-
+-			if ($line =~ /(\s*fixes:?)\s+([0-9a-f]{5,})\s+($balanced_parens)/i) {
+-				my $tag = $1;
+-				$orig_commit = $2;
+-				$title = $3;
+-
+-				$tag_case = 0 if $tag eq "Fixes:";
+-				$tag_space = 0 if ($line =~ /^fixes:? [0-9a-f]{5,} ($balanced_parens)/i);
+-
+-				$id_length = 0 if ($orig_commit =~ /^[0-9a-f]{12}$/i);
+-				$id_case = 0 if ($orig_commit !~ /[A-F]/);
+-
++			if (defined $3) {
+ 				# Always strip leading/trailing parens then double quotes if existing
+-				$title = substr($title, 1, -1);
++				$title = substr($3, 1, -1);
+ 				if ($title =~ /^".*"$/) {
+ 					$title = substr($title, 1, -1);
+ 					$title_has_quotes = 1;
+ 				}
++			} else {
++				$title = "commit title"
+ 			}
+ 
++
++			my $tag_case = not ($tag eq "Fixes:");
++			my $tag_space = not ($line =~ /^fixes:? [0-9a-f]{5,40} ($balanced_parens)/i);
++
++			my $id_length = not ($orig_commit =~ /^[0-9a-f]{12}$/i);
++			my $id_case = not ($orig_commit !~ /[A-F]/);
++
++			my $id = "0123456789ab";
+ 			my ($cid, $ctitle) = git_commit_info($orig_commit, $id,
+ 							     $title);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/checkpatch-check-for-missing-fixes-tags.patch b/queue-6.6/checkpatch-check-for-missing-fixes-tags.patch
new file mode 100644
index 00000000000..13c90f3eee6
--- /dev/null
+++ b/queue-6.6/checkpatch-check-for-missing-fixes-tags.patch
@@ -0,0 +1,147 @@
+From 107b0308a362ff2e2e0328cefdc46823db747039 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2024 16:43:29 +0300
+Subject: checkpatch: check for missing Fixes tags
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit d5d6281ae8e0c929c3ff188652f5b12c680fe8bf ]
+
+This check looks for common words that probably indicate a patch
+is a fix.  For now the regex is:
+
+	(?:(?:BUG: K.|UB)SAN: |Call Trace:|stable\@|syzkaller)/)
+
+Why are stable patches encouraged to have a fixes tag?  Some people mark
+their stable patches as "# 5.10" etc.  This is useful but a Fixes tag is
+still a good idea.  For example, the Fixes tag helps in review.  It
+helps people to not cherry-pick buggy patches without also
+cherry-picking the fix.
+
+Also if a bug affects the 5.7 kernel some people will round it up to
+5.10+ because 5.7 is not supported on kernel.org.  It's possible the Bad
+Binder bug was caused by this sort of gap where companies outside of
+kernel.org are supporting different kernels from kernel.org.
+
+Should it be counted as a Fix when a patch just silences harmless
+WARN_ON() stack trace.  Yes.  Definitely.
+
+Is silencing compiler warnings a fix?  It seems unfair to the original
+authors, but we use -Werror now, and warnings break the build so let's
+just add Fixes tags.  I tell people that silencing static checker
+warnings is not a fix but the rules on this vary by subsystem.
+
+Is fixing a minor LTP issue (Linux Test Project) a fix?  Probably?  It's
+hard to know what to do if the LTP test has technically always been
+broken.
+
+One clear false positive from this check is when someone updated their
+debug output and included before and after Call Traces.  Or when crashes
+are introduced deliberately for testing.  In those cases, you should
+just ignore checkpatch.
+
+Link: https://lkml.kernel.org/r/ZmhUgZBKeF_8ixA6@moroto
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Dwaipayan Ray <dwaipayanray1@gmail.com>
+Cc: Joe Perches <joe@perches.com>
+Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Thorsten Leemhuis <linux@leemhuis.info>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: 2f07b6523849 ("checkpatch: always parse orig_commit in fixes tag")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkpatch.pl | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 7d16f863edf1c..6b598f0858392 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -28,6 +28,7 @@ my %verbose_messages = ();
+ my %verbose_emitted = ();
+ my $tree = 1;
+ my $chk_signoff = 1;
++my $chk_fixes_tag = 1;
+ my $chk_patch = 1;
+ my $tst_only;
+ my $emacs = 0;
+@@ -88,6 +89,7 @@ Options:
+   -v, --verbose              verbose mode
+   --no-tree                  run without a kernel tree
+   --no-signoff               do not check for 'Signed-off-by' line
++  --no-fixes-tag             do not check for 'Fixes:' tag
+   --patch                    treat FILE as patchfile (default)
+   --emacs                    emacs compile window format
+   --terse                    one line per report
+@@ -295,6 +297,7 @@ GetOptions(
+ 	'v|verbose!'	=> \$verbose,
+ 	'tree!'		=> \$tree,
+ 	'signoff!'	=> \$chk_signoff,
++	'fixes-tag!'	=> \$chk_fixes_tag,
+ 	'patch!'	=> \$chk_patch,
+ 	'emacs!'	=> \$emacs,
+ 	'terse!'	=> \$terse,
+@@ -1256,6 +1259,7 @@ sub git_commit_info {
+ }
+ 
+ $chk_signoff = 0 if ($file);
++$chk_fixes_tag = 0 if ($file);
+ 
+ my @rawlines = ();
+ my @lines = ();
+@@ -2635,6 +2639,9 @@ sub process {
+ 
+ 	our $clean = 1;
+ 	my $signoff = 0;
++	my $fixes_tag = 0;
++	my $is_revert = 0;
++	my $needs_fixes_tag = "";
+ 	my $author = '';
+ 	my $authorsignoff = 0;
+ 	my $author_sob = '';
+@@ -3188,6 +3195,16 @@ sub process {
+ 			}
+ 		}
+ 
++# These indicate a bug fix
++		if (!$in_header_lines && !$is_patch &&
++			$line =~ /^This reverts commit/) {
++			$is_revert = 1;
++		}
++
++		if (!$in_header_lines && !$is_patch &&
++		    $line =~ /((?:(?:BUG: K.|UB)SAN: |Call Trace:|stable\@|syzkaller))/) {
++			$needs_fixes_tag = $1;
++		}
+ 
+ # Check Fixes: styles is correct
+ 		if (!$in_header_lines &&
+@@ -3200,6 +3217,7 @@ sub process {
+ 			my $id_length = 1;
+ 			my $id_case = 1;
+ 			my $title_has_quotes = 0;
++			$fixes_tag = 1;
+ 
+ 			if ($line =~ /(\s*fixes:?)\s+([0-9a-f]{5,})\s+($balanced_parens)/i) {
+ 				my $tag = $1;
+@@ -7680,6 +7698,12 @@ sub process {
+ 		ERROR("NOT_UNIFIED_DIFF",
+ 		      "Does not appear to be a unified-diff format patch\n");
+ 	}
++	if ($is_patch && $has_commit_log && $chk_fixes_tag) {
++		if ($needs_fixes_tag ne "" && !$is_revert && !$fixes_tag) {
++			WARN("MISSING_FIXES_TAG",
++				 "The commit message has '$needs_fixes_tag', perhaps it also needs a 'Fixes:' tag?\n");
++		}
++	}
+ 	if ($is_patch && $has_commit_log && $chk_signoff) {
+ 		if ($signoff == 0) {
+ 			ERROR("MISSING_SIGN_OFF",
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-clk-apple-nco-add-null-check-in-applnco_probe.patch b/queue-6.6/clk-clk-apple-nco-add-null-check-in-applnco_probe.patch
new file mode 100644
index 00000000000..58a782488d9
--- /dev/null
+++ b/queue-6.6/clk-clk-apple-nco-add-null-check-in-applnco_probe.patch
@@ -0,0 +1,42 @@
+From 369047b0c10638b1345fe8588bc9831e401a4fb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 15:28:20 +0800
+Subject: clk: clk-apple-nco: Add NULL check in applnco_probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Charles Han <hanchunchao@inspur.com>
+
+[ Upstream commit 969c765e2b508cca9099d246c010a1e48dcfd089 ]
+
+Add NULL check in applnco_probe, to handle kernel NULL pointer
+dereference error.
+
+Fixes: 6641057d5dba ("clk: clk-apple-nco: Add driver for Apple NCO")
+Signed-off-by: Charles Han <hanchunchao@inspur.com>
+Link: https://lore.kernel.org/r/20241114072820.3071-1-hanchunchao@inspur.com
+Reviewed-by: Martin Povišer <povik+lin@cutebit.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-apple-nco.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/clk-apple-nco.c b/drivers/clk/clk-apple-nco.c
+index 39472a51530a3..457a48d489412 100644
+--- a/drivers/clk/clk-apple-nco.c
++++ b/drivers/clk/clk-apple-nco.c
+@@ -297,6 +297,9 @@ static int applnco_probe(struct platform_device *pdev)
+ 		memset(&init, 0, sizeof(init));
+ 		init.name = devm_kasprintf(&pdev->dev, GFP_KERNEL,
+ 						"%s-%d", np->name, i);
++		if (!init.name)
++			return -ENOMEM;
++
+ 		init.ops = &applnco_ops;
+ 		init.parent_data = &pdata;
+ 		init.num_parents = 1;
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch b/queue-6.6/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch
new file mode 100644
index 00000000000..ece87118800
--- /dev/null
+++ b/queue-6.6/clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch
@@ -0,0 +1,82 @@
+From 67b6ee2da26d3536f368328768eafb230fdde5fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 14:59:42 +0100
+Subject: clk: clk-axi-clkgen: make sure to enable the AXI bus clock
+
+From: Nuno Sa <nuno.sa@analog.com>
+
+[ Upstream commit c64ef7e4851d1a9abbb7f7833e4936973ac5ba79 ]
+
+In order to access the registers of the HW, we need to make sure that
+the AXI bus clock is enabled. Hence let's increase the number of clocks
+by one.
+
+In order to keep backward compatibility and make sure old DTs still work
+we check if clock-names is available or not. If it is, then we can
+disambiguate between really having the AXI clock or a parent clock and
+so we can enable the bus clock. If not, we fallback to what was done
+before and don't explicitly enable the AXI bus clock.
+
+Note that if clock-names is given, the axi clock must be the last one in
+the phandle array (also enforced in the DT bindings) so that we can reuse
+as much code as possible.
+
+Fixes: 0e646c52cf0e ("clk: Add axi-clkgen driver")
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20241029-axi-clkgen-fix-axiclk-v2-2-bc5e0733ad76@analog.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-axi-clkgen.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-axi-clkgen.c b/drivers/clk/clk-axi-clkgen.c
+index bf4d8ddc93aea..934e53a96ddda 100644
+--- a/drivers/clk/clk-axi-clkgen.c
++++ b/drivers/clk/clk-axi-clkgen.c
+@@ -7,6 +7,7 @@
+  */
+ 
+ #include <linux/platform_device.h>
++#include <linux/clk.h>
+ #include <linux/clk-provider.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
+@@ -512,6 +513,7 @@ static int axi_clkgen_probe(struct platform_device *pdev)
+ 	struct clk_init_data init;
+ 	const char *parent_names[2];
+ 	const char *clk_name;
++	struct clk *axi_clk;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -528,8 +530,24 @@ static int axi_clkgen_probe(struct platform_device *pdev)
+ 		return PTR_ERR(axi_clkgen->base);
+ 
+ 	init.num_parents = of_clk_get_parent_count(pdev->dev.of_node);
+-	if (init.num_parents < 1 || init.num_parents > 2)
+-		return -EINVAL;
++
++	axi_clk = devm_clk_get_enabled(&pdev->dev, "s_axi_aclk");
++	if (!IS_ERR(axi_clk)) {
++		if (init.num_parents < 2 || init.num_parents > 3)
++			return -EINVAL;
++
++		init.num_parents -= 1;
++	} else {
++		/*
++		 * Legacy... So that old DTs which do not have clock-names still
++		 * work. In this case we don't explicitly enable the AXI bus
++		 * clock.
++		 */
++		if (PTR_ERR(axi_clk) != -ENOENT)
++			return PTR_ERR(axi_clk);
++		if (init.num_parents < 1 || init.num_parents > 2)
++			return -EINVAL;
++	}
+ 
+ 	for (i = 0; i < init.num_parents; i++) {
+ 		parent_names[i] = of_clk_get_parent_name(pdev->dev.of_node, i);
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-imx-clk-scu-fix-clk-enable-state-save-and-restor.patch b/queue-6.6/clk-imx-clk-scu-fix-clk-enable-state-save-and-restor.patch
new file mode 100644
index 00000000000..0a963e35abb
--- /dev/null
+++ b/queue-6.6/clk-imx-clk-scu-fix-clk-enable-state-save-and-restor.patch
@@ -0,0 +1,45 @@
+From 61b4b0c886a6ec0b1693352d3474cddadf290e0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 20:00:10 +0800
+Subject: clk: imx: clk-scu: fix clk enable state save and restore
+
+From: Dong Aisheng <aisheng.dong@nxp.com>
+
+[ Upstream commit e81361f6cf9bf4a1848b0813bc4becb2250870b8 ]
+
+The scu clk_ops only inplements prepare() and unprepare() callback.
+Saving the clock state during suspend by checking clk_hw_is_enabled()
+is not safe as it's possible that some device drivers may only
+disable the clocks without unprepare. Then the state retention will not
+work for such clocks.
+
+Fixing it by checking clk_hw_is_prepared() which is more reasonable
+and safe.
+
+Fixes: d0409631f466 ("clk: imx: scu: add suspend/resume support")
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Tested-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
+Link: https://lore.kernel.org/r/20241027-imx-clk-v1-v3-4-89152574d1d7@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-scu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
+index cd83c52e9952a..564f549ec204f 100644
+--- a/drivers/clk/imx/clk-scu.c
++++ b/drivers/clk/imx/clk-scu.c
+@@ -594,7 +594,7 @@ static int __maybe_unused imx_clk_scu_suspend(struct device *dev)
+ 		clk->rate = clk_scu_recalc_rate(&clk->hw, 0);
+ 	else
+ 		clk->rate = clk_hw_get_rate(&clk->hw);
+-	clk->is_enabled = clk_hw_is_enabled(&clk->hw);
++	clk->is_enabled = clk_hw_is_prepared(&clk->hw);
+ 
+ 	if (clk->parent)
+ 		dev_dbg(dev, "save parent %s idx %u\n", clk_hw_get_name(clk->parent),
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-imx-fracn-gppll-correct-pll-initialization-flow.patch b/queue-6.6/clk-imx-fracn-gppll-correct-pll-initialization-flow.patch
new file mode 100644
index 00000000000..70da920ca0d
--- /dev/null
+++ b/queue-6.6/clk-imx-fracn-gppll-correct-pll-initialization-flow.patch
@@ -0,0 +1,60 @@
+From 33b38d05bc4e528db94dc8f92f26c10b6c1e9621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 20:00:08 +0800
+Subject: clk: imx: fracn-gppll: correct PLL initialization flow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 557be501c38e1864b948fc6ccdf4b035d610a2ea ]
+
+Per i.MX93 Reference Mannual 22.4 Initialization information
+1. Program appropriate value of DIV[ODIV], DIV[RDIV] and DIV[MFI]
+   as per Integer mode.
+2. Wait for 5 μs.
+3. Program the following field in CTRL register.
+   Set CTRL[POWERUP] to 1'b1 to enable PLL block.
+4. Poll PLL_STATUS[PLL_LOCK] register, and wait till PLL_STATUS[PLL_LOCK]
+   is 1'b1 and pll_lock output signal is 1'b1.
+5. Set CTRL[CLKMUX_EN] to 1'b1 to enable PLL output clock.
+
+So move the CLKMUX_EN operation after PLL locked.
+
+Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll")
+Co-developed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20241027-imx-clk-v1-v3-2-89152574d1d7@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index 1becba2b62d0b..f85dd8798f15c 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -301,13 +301,13 @@ static int clk_fracn_gppll_prepare(struct clk_hw *hw)
+ 	val |= POWERUP_MASK;
+ 	writel_relaxed(val, pll->base + PLL_CTRL);
+ 
+-	val |= CLKMUX_EN;
+-	writel_relaxed(val, pll->base + PLL_CTRL);
+-
+ 	ret = clk_fracn_gppll_wait_lock(pll);
+ 	if (ret)
+ 		return ret;
+ 
++	val |= CLKMUX_EN;
++	writel_relaxed(val, pll->base + PLL_CTRL);
++
+ 	val &= ~CLKMUX_BYPASS;
+ 	writel_relaxed(val, pll->base + PLL_CTRL);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-imx-fracn-gppll-fix-pll-power-up.patch b/queue-6.6/clk-imx-fracn-gppll-fix-pll-power-up.patch
new file mode 100644
index 00000000000..9ba8f9ddbb1
--- /dev/null
+++ b/queue-6.6/clk-imx-fracn-gppll-fix-pll-power-up.patch
@@ -0,0 +1,87 @@
+From e42ffeaa81b277db6391f9578eed7063a8ae1a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 20:00:09 +0800
+Subject: clk: imx: fracn-gppll: fix pll power up
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit ff4279618f0aec350b0fb41b2b35841324fbd96e ]
+
+To i.MX93 which features dual Cortex-A55 cores and DSU, when using
+writel_relaxed to write value to PLL registers, the value might be
+buffered. To make sure the value has been written into the hardware,
+using readl to read back the register could achieve the goal.
+
+current PLL power up flow can be simplified as below:
+  1. writel_relaxed to set the PLL POWERUP bit;
+  2. readl_poll_timeout to check the PLL lock bit:
+     a). timeout = ktime_add_us(ktime_get(), timeout_us);
+     b). readl the pll the lock reg;
+     c). check if the pll lock bit ready
+     d). check if timeout
+
+But in some corner cases, both the write in step 1 and read in
+step 2 will be blocked by other bus transaction in the SoC for a
+long time, saying the value into real hardware is just before step b).
+That means the timeout counting has begins for quite sometime since
+step a), but value still not written into real hardware until bus
+released just at a point before step b).
+
+Then there maybe chances that the pll lock bit is not ready
+when readl done but the timeout happens. readl_poll_timeout will
+err return due to timeout. To avoid such unexpected failure,
+read back the reg to make sure the write has been done in HW
+reg.
+
+So use readl after writel_relaxed to fix the issue.
+
+Since we are here, to avoid udelay to run before writel_relaxed, use
+readl before udelay.
+
+Fixes: 1b26cb8a77a4 ("clk: imx: support fracn gppll")
+Co-developed-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20241027-imx-clk-v1-v3-3-89152574d1d7@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-fracn-gppll.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-fracn-gppll.c b/drivers/clk/imx/clk-fracn-gppll.c
+index f85dd8798f15c..b12b00a2f07fa 100644
+--- a/drivers/clk/imx/clk-fracn-gppll.c
++++ b/drivers/clk/imx/clk-fracn-gppll.c
+@@ -252,9 +252,11 @@ static int clk_fracn_gppll_set_rate(struct clk_hw *hw, unsigned long drate,
+ 	pll_div = FIELD_PREP(PLL_RDIV_MASK, rate->rdiv) | rate->odiv |
+ 		FIELD_PREP(PLL_MFI_MASK, rate->mfi);
+ 	writel_relaxed(pll_div, pll->base + PLL_DIV);
++	readl(pll->base + PLL_DIV);
+ 	if (pll->flags & CLK_FRACN_GPPLL_FRACN) {
+ 		writel_relaxed(rate->mfd, pll->base + PLL_DENOMINATOR);
+ 		writel_relaxed(FIELD_PREP(PLL_MFN_MASK, rate->mfn), pll->base + PLL_NUMERATOR);
++		readl(pll->base + PLL_NUMERATOR);
+ 	}
+ 
+ 	/* Wait for 5us according to fracn mode pll doc */
+@@ -263,6 +265,7 @@ static int clk_fracn_gppll_set_rate(struct clk_hw *hw, unsigned long drate,
+ 	/* Enable Powerup */
+ 	tmp |= POWERUP_MASK;
+ 	writel_relaxed(tmp, pll->base + PLL_CTRL);
++	readl(pll->base + PLL_CTRL);
+ 
+ 	/* Wait Lock */
+ 	ret = clk_fracn_gppll_wait_lock(pll);
+@@ -300,6 +303,7 @@ static int clk_fracn_gppll_prepare(struct clk_hw *hw)
+ 
+ 	val |= POWERUP_MASK;
+ 	writel_relaxed(val, pll->base + PLL_CTRL);
++	readl(pll->base + PLL_CTRL);
+ 
+ 	ret = clk_fracn_gppll_wait_lock(pll);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-imx-imx8-acm-fix-return-value-check-in-clk_imx_a.patch b/queue-6.6/clk-imx-imx8-acm-fix-return-value-check-in-clk_imx_a.patch
new file mode 100644
index 00000000000..2dbfb7549cb
--- /dev/null
+++ b/queue-6.6/clk-imx-imx8-acm-fix-return-value-check-in-clk_imx_a.patch
@@ -0,0 +1,43 @@
+From aea9c622c68c18c9367094a960010a325d271be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 19:24:52 +0800
+Subject: clk: imx: imx8-acm: Fix return value check in
+ clk_imx_acm_attach_pm_domains()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 81a206d736c19139d3863b79e7174f9e98b45499 ]
+
+If device_link_add() fails, it returns NULL pointer not ERR_PTR(),
+replace IS_ERR() with NULL pointer check, and return -EINVAL.
+
+Fixes: d3a0946d7ac9 ("clk: imx: imx8: add audio clock mux driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20241026112452.1523-1-yangyingliang@huaweicloud.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8-acm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8-acm.c b/drivers/clk/imx/clk-imx8-acm.c
+index 1c95ae905eec8..b9ddb74b86f7a 100644
+--- a/drivers/clk/imx/clk-imx8-acm.c
++++ b/drivers/clk/imx/clk-imx8-acm.c
+@@ -289,9 +289,9 @@ static int clk_imx_acm_attach_pm_domains(struct device *dev,
+ 							 DL_FLAG_STATELESS |
+ 							 DL_FLAG_PM_RUNTIME |
+ 							 DL_FLAG_RPM_ACTIVE);
+-		if (IS_ERR(dev_pm->pd_dev_link[i])) {
++		if (!dev_pm->pd_dev_link[i]) {
+ 			dev_pm_domain_detach(dev_pm->pd_dev[i], false);
+-			ret = PTR_ERR(dev_pm->pd_dev_link[i]);
++			ret = -EINVAL;
+ 			goto detach_pm;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-imx-lpcg-scu-sw-workaround-for-errata-e10858.patch b/queue-6.6/clk-imx-lpcg-scu-sw-workaround-for-errata-e10858.patch
new file mode 100644
index 00000000000..7c2e9508b54
--- /dev/null
+++ b/queue-6.6/clk-imx-lpcg-scu-sw-workaround-for-errata-e10858.patch
@@ -0,0 +1,113 @@
+From 911ee0123232838beacb631d8949d4dbbc5037f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 20:00:07 +0800
+Subject: clk: imx: lpcg-scu: SW workaround for errata (e10858)
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 5ee063fac85656bea9cfe3570af147ba1701ba18 ]
+
+Back-to-back LPCG writes can be ignored by the LPCG register due to
+a HW bug. The writes need to be separated by at least 4 cycles of
+the gated clock. See https://www.nxp.com.cn/docs/en/errata/IMX8_1N94W.pdf
+
+The workaround is implemented as follows:
+1. For clocks running greater than or equal to 24MHz, a read
+followed by the write will provide sufficient delay.
+2. For clocks running below 24MHz, add a delay of 4 clock cylces
+after the write to the LPCG register.
+
+Fixes: 2f77296d3df9 ("clk: imx: add lpcg clock support")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20241027-imx-clk-v1-v3-1-89152574d1d7@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-lpcg-scu.c | 37 ++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-lpcg-scu.c b/drivers/clk/imx/clk-lpcg-scu.c
+index dd5abd09f3e20..620afdf8dc03e 100644
+--- a/drivers/clk/imx/clk-lpcg-scu.c
++++ b/drivers/clk/imx/clk-lpcg-scu.c
+@@ -6,10 +6,12 @@
+ 
+ #include <linux/bits.h>
+ #include <linux/clk-provider.h>
++#include <linux/delay.h>
+ #include <linux/err.h>
+ #include <linux/io.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
++#include <linux/units.h>
+ 
+ #include "clk-scu.h"
+ 
+@@ -41,6 +43,29 @@ struct clk_lpcg_scu {
+ 
+ #define to_clk_lpcg_scu(_hw) container_of(_hw, struct clk_lpcg_scu, hw)
+ 
++/* e10858 -LPCG clock gating register synchronization errata */
++static void lpcg_e10858_writel(unsigned long rate, void __iomem *reg, u32 val)
++{
++	writel(val, reg);
++
++	if (rate >= 24 * HZ_PER_MHZ || rate == 0) {
++		/*
++		 * The time taken to access the LPCG registers from the AP core
++		 * through the interconnect is longer than the minimum delay
++		 * of 4 clock cycles required by the errata.
++		 * Adding a readl will provide sufficient delay to prevent
++		 * back-to-back writes.
++		 */
++		readl(reg);
++	} else {
++		/*
++		 * For clocks running below 24MHz, wait a minimum of
++		 * 4 clock cycles.
++		 */
++		ndelay(4 * (DIV_ROUND_UP(1000 * HZ_PER_MHZ, rate)));
++	}
++}
++
+ static int clk_lpcg_scu_enable(struct clk_hw *hw)
+ {
+ 	struct clk_lpcg_scu *clk = to_clk_lpcg_scu(hw);
+@@ -57,7 +82,8 @@ static int clk_lpcg_scu_enable(struct clk_hw *hw)
+ 		val |= CLK_GATE_SCU_LPCG_HW_SEL;
+ 
+ 	reg |= val << clk->bit_idx;
+-	writel(reg, clk->reg);
++
++	lpcg_e10858_writel(clk_hw_get_rate(hw), clk->reg, reg);
+ 
+ 	spin_unlock_irqrestore(&imx_lpcg_scu_lock, flags);
+ 
+@@ -74,7 +100,7 @@ static void clk_lpcg_scu_disable(struct clk_hw *hw)
+ 
+ 	reg = readl_relaxed(clk->reg);
+ 	reg &= ~(CLK_GATE_SCU_LPCG_MASK << clk->bit_idx);
+-	writel(reg, clk->reg);
++	lpcg_e10858_writel(clk_hw_get_rate(hw), clk->reg, reg);
+ 
+ 	spin_unlock_irqrestore(&imx_lpcg_scu_lock, flags);
+ }
+@@ -145,13 +171,8 @@ static int __maybe_unused imx_clk_lpcg_scu_resume(struct device *dev)
+ {
+ 	struct clk_lpcg_scu *clk = dev_get_drvdata(dev);
+ 
+-	/*
+-	 * FIXME: Sometimes writes don't work unless the CPU issues
+-	 * them twice
+-	 */
+-
+-	writel(clk->state, clk->reg);
+ 	writel(clk->state, clk->reg);
++	lpcg_e10858_writel(0, clk->reg, clk->state);
+ 	dev_dbg(dev, "restore lpcg state 0x%x\n", clk->state);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-mediatek-drop-two-dead-config-options.patch b/queue-6.6/clk-mediatek-drop-two-dead-config-options.patch
new file mode 100644
index 00000000000..aea502b9ac4
--- /dev/null
+++ b/queue-6.6/clk-mediatek-drop-two-dead-config-options.patch
@@ -0,0 +1,64 @@
+From 8a9dadb207799b6a979742b64332c0ea3bc78b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 11:22:32 +0200
+Subject: clk: mediatek: drop two dead config options
+
+From: Lukas Bulwahn <lukas.bulwahn@redhat.com>
+
+[ Upstream commit 98619dc3cecc2b3943d6abe1db235c868dc72f8d ]
+
+Commit 0f471d31e5e8 ("clk: mediatek: Split MT8195 clock drivers and allow
+module build") adds a number of new COMMON_CLK_MT8195_* config options.
+Among those, the config options COMMON_CLK_MT8195_AUDSYS and
+COMMON_CLK_MT8195_MSDC have no reference in the source tree and are not
+used in the Makefile to include a specific file.
+
+Drop the dead config options COMMON_CLK_MT8195_AUDSYS and
+COMMON_CLK_MT8195_MSDC.
+
+Fixes: 0f471d31e5e8 ("clk: mediatek: Split MT8195 clock drivers and allow module build")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
+Link: https://lore.kernel.org/r/20240927092232.386511-1-lukas.bulwahn@redhat.com
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/Kconfig | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+diff --git a/drivers/clk/mediatek/Kconfig b/drivers/clk/mediatek/Kconfig
+index 48b42d11111cd..8ad02c1f035b3 100644
+--- a/drivers/clk/mediatek/Kconfig
++++ b/drivers/clk/mediatek/Kconfig
+@@ -878,13 +878,6 @@ config COMMON_CLK_MT8195_APUSYS
+ 	help
+ 	  This driver supports MediaTek MT8195 AI Processor Unit System clocks.
+ 
+-config COMMON_CLK_MT8195_AUDSYS
+-	tristate "Clock driver for MediaTek MT8195 audsys"
+-	depends on COMMON_CLK_MT8195
+-	default COMMON_CLK_MT8195
+-	help
+-	  This driver supports MediaTek MT8195 audsys clocks.
+-
+ config COMMON_CLK_MT8195_IMP_IIC_WRAP
+ 	tristate "Clock driver for MediaTek MT8195 imp_iic_wrap"
+ 	depends on COMMON_CLK_MT8195
+@@ -899,14 +892,6 @@ config COMMON_CLK_MT8195_MFGCFG
+ 	help
+ 	  This driver supports MediaTek MT8195 mfgcfg clocks.
+ 
+-config COMMON_CLK_MT8195_MSDC
+-	tristate "Clock driver for MediaTek MT8195 msdc"
+-	depends on COMMON_CLK_MT8195
+-	default COMMON_CLK_MT8195
+-	help
+-	  This driver supports MediaTek MT8195 MMC and SD Controller's
+-	  msdc and msdc_top clocks.
+-
+ config COMMON_CLK_MT8195_SCP_ADSP
+ 	tristate "Clock driver for MediaTek MT8195 scp_adsp"
+ 	depends on COMMON_CLK_MT8195
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-ralink-mtmips-fix-clock-plan-for-ralink-soc-rt38.patch b/queue-6.6/clk-ralink-mtmips-fix-clock-plan-for-ralink-soc-rt38.patch
new file mode 100644
index 00000000000..d21c4a8daea
--- /dev/null
+++ b/queue-6.6/clk-ralink-mtmips-fix-clock-plan-for-ralink-soc-rt38.patch
@@ -0,0 +1,58 @@
+From 3a9fe71b81d863b2470f296bf4b53af6ff4f4608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 06:40:22 +0200
+Subject: clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit 33239152305567b3e9bf052f71fd4baecd626341 ]
+
+Clock plan for Ralink SoC RT3883 needs an extra 'periph' clock to properly
+set some peripherals that has this clock as their parent. When this driver
+was mainlined we could not find any active users of this SoC so we cannot
+perform any real tests for it. Now, one user of a Belkin f9k1109 version 1
+device which uses this SoC appear and reported some issues in openWRT:
+- https://github.com/openwrt/openwrt/issues/16054
+The peripherals that are wrong are 'uart', 'i2c', 'i2s' and 'uartlite' which
+has a not defined 'periph' clock as parent. Hence, introduce it to have a
+properly working clock plan for this SoC.
+
+Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-2-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ralink/clk-mtmips.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c
+index 50a443bf79ecd..62f9801ecd3a4 100644
+--- a/drivers/clk/ralink/clk-mtmips.c
++++ b/drivers/clk/ralink/clk-mtmips.c
+@@ -267,6 +267,11 @@ static struct mtmips_clk_fixed rt305x_fixed_clocks[] = {
+ 	CLK_FIXED("xtal", NULL, 40000000)
+ };
+ 
++static struct mtmips_clk_fixed rt3883_fixed_clocks[] = {
++	CLK_FIXED("xtal", NULL, 40000000),
++	CLK_FIXED("periph", "xtal", 40000000)
++};
++
+ static struct mtmips_clk_fixed rt3352_fixed_clocks[] = {
+ 	CLK_FIXED("periph", "xtal", 40000000)
+ };
+@@ -779,8 +784,8 @@ static const struct mtmips_clk_data rt3352_clk_data = {
+ static const struct mtmips_clk_data rt3883_clk_data = {
+ 	.clk_base = rt3883_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(rt3883_clks_base),
+-	.clk_fixed = rt305x_fixed_clocks,
+-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
++	.clk_fixed = rt3883_fixed_clocks,
++	.num_clk_fixed = ARRAY_SIZE(rt3883_fixed_clocks),
+ 	.clk_factor = NULL,
+ 	.num_clk_factor = 0,
+ 	.clk_periph = rt5350_pherip_clks,
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch b/queue-6.6/clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
new file mode 100644
index 00000000000..20dbec43fc1
--- /dev/null
+++ b/queue-6.6/clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
@@ -0,0 +1,133 @@
+From a4a7382309f0660f6b0f726f1e9418b27fb8ca8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 06:40:23 +0200
+Subject: clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit d34db686a3d74bd564bfce2ada15011c556269fc ]
+
+Base clocks are the first in being probed and are real dependencies of the
+rest of fixed, factor and peripheral clocks. For old ralink SoCs RT2880,
+RT305x and RT3883 'xtal' must be defined first since in any other case,
+when fixed clocks are probed they are delayed until 'xtal' is probed so the
+following warning appears:
+
+ WARNING: CPU: 0 PID: 0 at drivers/clk/ralink/clk-mtmips.c:499 rt3883_bus_recalc_rate+0x98/0x138
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.43 #0
+ Stack : 805e58d0 00000000 00000004 8004f950 00000000 00000004 00000000 00000000
+ 80669c54 80830000 80700000 805ae570 80670068 00000001 80669bf8 00000000
+ 00000000 00000000 805ae570 80669b38 00000020 804db7dc 00000000 00000000
+ 203a6d6d 80669b78 80669e48 70617773 00000000 805ae570 00000000 00000009
+ 00000000 00000001 00000004 00000001 00000000 00000000 83fe43b0 00000000
+ ...
+ Call Trace:
+ [<800065d0>] show_stack+0x64/0xf4
+ [<804bca14>] dump_stack_lvl+0x38/0x60
+ [<800218ac>] __warn+0x94/0xe4
+ [<8002195c>] warn_slowpath_fmt+0x60/0x94
+ [<80259ff8>] rt3883_bus_recalc_rate+0x98/0x138
+ [<80254530>] __clk_register+0x568/0x688
+ [<80254838>] of_clk_hw_register+0x18/0x2c
+ [<8070b910>] rt2880_clk_of_clk_init_driver+0x18c/0x594
+ [<8070b628>] of_clk_init+0x1c0/0x23c
+ [<806fc448>] plat_time_init+0x58/0x18c
+ [<806fdaf0>] time_init+0x10/0x6c
+ [<806f9bc4>] start_kernel+0x458/0x67c
+
+ ---[ end trace 0000000000000000 ]---
+
+When this driver was mainlined we could not find any active users of old
+ralink SoCs so we cannot perform any real tests for them. Now, one user
+of a Belkin f9k1109 version 1 device which uses RT3883 SoC appeared and
+reported some issues in openWRT:
+- https://github.com/openwrt/openwrt/issues/16054
+
+Thus, define a 'rt2880_xtal_recalc_rate()' just returning the expected
+frequency 40Mhz and use it along the old ralink SoCs to have a correct
+boot trace with no warnings and a working clock plan from the beggining.
+
+Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs")
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-3-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ralink/clk-mtmips.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c
+index 62f9801ecd3a4..76285fbbdeaa2 100644
+--- a/drivers/clk/ralink/clk-mtmips.c
++++ b/drivers/clk/ralink/clk-mtmips.c
+@@ -263,10 +263,6 @@ static int mtmips_register_pherip_clocks(struct device_node *np,
+ 		.rate = _rate		 \
+ 	}
+ 
+-static struct mtmips_clk_fixed rt305x_fixed_clocks[] = {
+-	CLK_FIXED("xtal", NULL, 40000000)
+-};
+-
+ static struct mtmips_clk_fixed rt3883_fixed_clocks[] = {
+ 	CLK_FIXED("xtal", NULL, 40000000),
+ 	CLK_FIXED("periph", "xtal", 40000000)
+@@ -371,6 +367,12 @@ static inline struct mtmips_clk *to_mtmips_clk(struct clk_hw *hw)
+ 	return container_of(hw, struct mtmips_clk, hw);
+ }
+ 
++static unsigned long rt2880_xtal_recalc_rate(struct clk_hw *hw,
++					     unsigned long parent_rate)
++{
++	return 40000000;
++}
++
+ static unsigned long rt5350_xtal_recalc_rate(struct clk_hw *hw,
+ 					     unsigned long parent_rate)
+ {
+@@ -682,10 +684,12 @@ static unsigned long mt76x8_cpu_recalc_rate(struct clk_hw *hw,
+ }
+ 
+ static struct mtmips_clk rt2880_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt2880_cpu_recalc_rate) }
+ };
+ 
+ static struct mtmips_clk rt305x_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt305x_cpu_recalc_rate) }
+ };
+ 
+@@ -695,6 +699,7 @@ static struct mtmips_clk rt3352_clks_base[] = {
+ };
+ 
+ static struct mtmips_clk rt3883_clks_base[] = {
++	{ CLK_BASE("xtal", NULL, rt2880_xtal_recalc_rate) },
+ 	{ CLK_BASE("cpu", "xtal", rt3883_cpu_recalc_rate) },
+ 	{ CLK_BASE("bus", "cpu", rt3883_bus_recalc_rate) }
+ };
+@@ -751,8 +756,8 @@ static int mtmips_register_clocks(struct device_node *np,
+ static const struct mtmips_clk_data rt2880_clk_data = {
+ 	.clk_base = rt2880_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(rt2880_clks_base),
+-	.clk_fixed = rt305x_fixed_clocks,
+-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
++	.clk_fixed = NULL,
++	.num_clk_fixed = 0,
+ 	.clk_factor = rt2880_factor_clocks,
+ 	.num_clk_factor = ARRAY_SIZE(rt2880_factor_clocks),
+ 	.clk_periph = rt2880_pherip_clks,
+@@ -762,8 +767,8 @@ static const struct mtmips_clk_data rt2880_clk_data = {
+ static const struct mtmips_clk_data rt305x_clk_data = {
+ 	.clk_base = rt305x_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(rt305x_clks_base),
+-	.clk_fixed = rt305x_fixed_clocks,
+-	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
++	.clk_fixed = NULL,
++	.num_clk_fixed = 0,
+ 	.clk_factor = rt305x_factor_clocks,
+ 	.num_clk_factor = ARRAY_SIZE(rt305x_factor_clocks),
+ 	.clk_periph = rt305x_pherip_clks,
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-renesas-rzg2l-fix-foutpostdiv-clk.patch b/queue-6.6/clk-renesas-rzg2l-fix-foutpostdiv-clk.patch
new file mode 100644
index 00000000000..764d2208f26
--- /dev/null
+++ b/queue-6.6/clk-renesas-rzg2l-fix-foutpostdiv-clk.patch
@@ -0,0 +1,56 @@
+From 0b655da1367d225e7cbad9689de0756f29c5e36f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:42:11 +0100
+Subject: clk: renesas: rzg2l: Fix FOUTPOSTDIV clk
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit dabf72b85f298970e86891b5218459c17b57b26a ]
+
+While computing foutpostdiv_rate, the value of params->pl5_fracin
+is discarded, which results in the wrong refresh rate. Fix the formula
+for computing foutpostdiv_rate.
+
+Fixes: 1561380ee72f ("clk: renesas: rzg2l: Add FOUTPOSTDIV clk support")
+Signed-off-by: Hien Huynh <hien.huynh.px@renesas.com>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/20241024134236.315289-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 75f9eca020ce5..f8dbb092b9f1b 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -285,7 +285,7 @@ static unsigned long
+ rzg2l_cpg_get_foutpostdiv_rate(struct rzg2l_pll5_param *params,
+ 			       unsigned long rate)
+ {
+-	unsigned long foutpostdiv_rate;
++	unsigned long foutpostdiv_rate, foutvco_rate;
+ 
+ 	params->pl5_intin = rate / MEGA;
+ 	params->pl5_fracin = div_u64(((u64)rate % MEGA) << 24, MEGA);
+@@ -294,10 +294,11 @@ rzg2l_cpg_get_foutpostdiv_rate(struct rzg2l_pll5_param *params,
+ 	params->pl5_postdiv2 = 1;
+ 	params->pl5_spread = 0x16;
+ 
+-	foutpostdiv_rate =
+-		EXTAL_FREQ_IN_MEGA_HZ * MEGA / params->pl5_refdiv *
+-		((((params->pl5_intin << 24) + params->pl5_fracin)) >> 24) /
+-		(params->pl5_postdiv1 * params->pl5_postdiv2);
++	foutvco_rate = div_u64(mul_u32_u32(EXTAL_FREQ_IN_MEGA_HZ * MEGA,
++					   (params->pl5_intin << 24) + params->pl5_fracin),
++			       params->pl5_refdiv) >> 24;
++	foutpostdiv_rate = DIV_ROUND_CLOSEST_ULL(foutvco_rate,
++						 params->pl5_postdiv1 * params->pl5_postdiv2);
+ 
+ 	return foutpostdiv_rate;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/clk-sunxi-ng-d1-fix-pll_audio0-preset.patch b/queue-6.6/clk-sunxi-ng-d1-fix-pll_audio0-preset.patch
new file mode 100644
index 00000000000..49ba3773c46
--- /dev/null
+++ b/queue-6.6/clk-sunxi-ng-d1-fix-pll_audio0-preset.patch
@@ -0,0 +1,42 @@
+From 4ae8d3573690771002835576937bf96f0ce37025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 11:50:16 +0100
+Subject: clk: sunxi-ng: d1: Fix PLL_AUDIO0 preset
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit e0f253a52ccee3cf3eb987e99756e20c68a1aac9 ]
+
+To work around a limitation in our clock modelling, we try to force two
+bits in the AUDIO0 PLL to 0, in the CCU probe routine.
+However the ~ operator only applies to the first expression, and does
+not cover the second bit, so we end up clearing only bit 1.
+
+Group the bit-ORing with parentheses, to make it both clearer to read
+and actually correct.
+
+Fixes: 35b97bb94111 ("clk: sunxi-ng: Add support for the D1 SoC clocks")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Link: https://patch.msgid.link/20241001105016.1068558-1-andre.przywara@arm.com
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun20i-d1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun20i-d1.c b/drivers/clk/sunxi-ng/ccu-sun20i-d1.c
+index 48a8fb2c43b74..f95c3615ca772 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun20i-d1.c
++++ b/drivers/clk/sunxi-ng/ccu-sun20i-d1.c
+@@ -1371,7 +1371,7 @@ static int sun20i_d1_ccu_probe(struct platform_device *pdev)
+ 
+ 	/* Enforce m1 = 0, m0 = 0 for PLL_AUDIO0 */
+ 	val = readl(reg + SUN20I_D1_PLL_AUDIO0_REG);
+-	val &= ~BIT(1) | BIT(0);
++	val &= ~(BIT(1) | BIT(0));
+ 	writel(val, reg + SUN20I_D1_PLL_AUDIO0_REG);
+ 
+ 	/* Force fanout-27M factor N to 0. */
+-- 
+2.43.0
+
diff --git a/queue-6.6/clocksource-drivers-sp804-make-user-selectable.patch b/queue-6.6/clocksource-drivers-sp804-make-user-selectable.patch
new file mode 100644
index 00000000000..aca1e18e0c3
--- /dev/null
+++ b/queue-6.6/clocksource-drivers-sp804-make-user-selectable.patch
@@ -0,0 +1,49 @@
+From 4bedc42c0e796862a1e135db4a74d0c233ccd66e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 12:23:56 +0100
+Subject: clocksource/drivers:sp804: Make user selectable
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 0309f714a0908e947af1c902cf6a330cb593e75e ]
+
+The sp804 is currently only user selectable if COMPILE_TEST, this was
+done by commit dfc82faad725 ("clocksource/drivers/sp804: Add
+COMPILE_TEST to CONFIG_ARM_TIMER_SP804") in order to avoid it being
+spuriously offered on platforms that won't have the hardware since it's
+generally only seen on Arm based platforms.  This config is overly
+restrictive, while platforms that rely on the SP804 do select it in
+their Kconfig there are others such as the Arm fast models which have a
+SP804 available but currently unused by Linux.  Relax the dependency to
+allow it to be user selectable on arm and arm64 to avoid surprises and
+in case someone comes up with a use for extra timer hardware.
+
+Fixes: dfc82faad725 ("clocksource/drivers/sp804: Add COMPILE_TEST to CONFIG_ARM_TIMER_SP804")
+Reported-by: Ross Burton <ross.burton@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20241001-arm64-vexpress-sp804-v3-1-0a2d3f7883e4@kernel.org
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 0ba0dc4ecf062..8208a3d895634 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -390,7 +390,8 @@ config ARM_GT_INITIAL_PRESCALER_VAL
+ 	  This affects CPU_FREQ max delta from the initial frequency.
+ 
+ config ARM_TIMER_SP804
+-	bool "Support for Dual Timer SP804 module" if COMPILE_TEST
++	bool "Support for Dual Timer SP804 module"
++	depends on ARM || ARM64 || COMPILE_TEST
+ 	depends on GENERIC_SCHED_CLOCK && HAVE_CLK
+ 	select CLKSRC_MMIO
+ 	select TIMER_OF if OF
+-- 
+2.43.0
+
diff --git a/queue-6.6/clocksource-drivers-timer-ti-dm-fix-child-node-refco.patch b/queue-6.6/clocksource-drivers-timer-ti-dm-fix-child-node-refco.patch
new file mode 100644
index 00000000000..d0728289a4c
--- /dev/null
+++ b/queue-6.6/clocksource-drivers-timer-ti-dm-fix-child-node-refco.patch
@@ -0,0 +1,46 @@
+From e346500240a10bb7f083f36b1cea991be2c1bfa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 13:54:23 +0100
+Subject: clocksource/drivers/timer-ti-dm: Fix child node refcount handling
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit e5cfc0989d9a2849c51c720a16b90b2c061a1aeb ]
+
+of_find_compatible_node() increments the node's refcount, and it must be
+decremented again with a call to of_node_put() when the pointer is no
+longer required to avoid leaking the resource.
+
+Instead of adding the missing calls to of_node_put() in all execution
+paths, use the cleanup attribute for 'arm_timer' by means of the
+__free() macro, which automatically calls of_node_put() when the
+variable goes out of scope.
+
+Fixes: 25de4ce5ed02 ("clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://lore.kernel.org/r/20241031-timer-ti-dm-systimer-of_node_put-v3-1-063ee822b73a@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-ti-dm-systimer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c
+index c2dcd8d68e458..d1c144d6f328c 100644
+--- a/drivers/clocksource/timer-ti-dm-systimer.c
++++ b/drivers/clocksource/timer-ti-dm-systimer.c
+@@ -686,9 +686,9 @@ subsys_initcall(dmtimer_percpu_timer_startup);
+ 
+ static int __init dmtimer_percpu_quirk_init(struct device_node *np, u32 pa)
+ {
+-	struct device_node *arm_timer;
++	struct device_node *arm_timer __free(device_node) =
++		of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
+ 
+-	arm_timer = of_find_compatible_node(NULL, NULL, "arm,armv7-timer");
+ 	if (of_device_is_available(arm_timer)) {
+ 		pr_warn_once("ARM architected timer wrap issue i940 detected\n");
+ 		return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/counter-stm32-timer-cnt-add-check-for-clk_enable.patch b/queue-6.6/counter-stm32-timer-cnt-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..60ea0b575ad
--- /dev/null
+++ b/queue-6.6/counter-stm32-timer-cnt-add-check-for-clk_enable.patch
@@ -0,0 +1,62 @@
+From 908d12ce1ba31fcbd34336120344082554dd9c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 19:18:25 +0000
+Subject: counter: stm32-timer-cnt: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 842c3755a6bfbfcafa4a1438078d2485a9eb1d87 ]
+
+Add check for the return value of clk_enable() in order to catch the
+potential exception.
+
+Fixes: c5b8425514da ("counter: stm32-timer-cnt: add power management support")
+Fixes: ad29937e206f ("counter: Add STM32 Timer quadrature encoder")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20241104191825.40155-1-jiashengjiangcool@gmail.com
+Signed-off-by: William Breathitt Gray <wbg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/counter/stm32-timer-cnt.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/counter/stm32-timer-cnt.c b/drivers/counter/stm32-timer-cnt.c
+index 6206d2dc3d470..36d7f0d05b5f2 100644
+--- a/drivers/counter/stm32-timer-cnt.c
++++ b/drivers/counter/stm32-timer-cnt.c
+@@ -195,11 +195,17 @@ static int stm32_count_enable_write(struct counter_device *counter,
+ {
+ 	struct stm32_timer_cnt *const priv = counter_priv(counter);
+ 	u32 cr1;
++	int ret;
+ 
+ 	if (enable) {
+ 		regmap_read(priv->regmap, TIM_CR1, &cr1);
+-		if (!(cr1 & TIM_CR1_CEN))
+-			clk_enable(priv->clk);
++		if (!(cr1 & TIM_CR1_CEN)) {
++			ret = clk_enable(priv->clk);
++			if (ret) {
++				dev_err(counter->parent, "Cannot enable clock %d\n", ret);
++				return ret;
++			}
++		}
+ 
+ 		regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
+ 				   TIM_CR1_CEN);
+@@ -383,7 +389,11 @@ static int __maybe_unused stm32_timer_cnt_resume(struct device *dev)
+ 		return ret;
+ 
+ 	if (priv->enabled) {
+-		clk_enable(priv->clk);
++		ret = clk_enable(priv->clk);
++		if (ret) {
++			dev_err(dev, "Cannot enable clock %d\n", ret);
++			return ret;
++		}
+ 
+ 		/* Restore registers that may have been lost */
+ 		regmap_write(priv->regmap, TIM_SMCR, priv->bak.smcr);
+-- 
+2.43.0
+
diff --git a/queue-6.6/counter-ti-ecap-capture-add-check-for-clk_enable.patch b/queue-6.6/counter-ti-ecap-capture-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..ce271c74cb7
--- /dev/null
+++ b/queue-6.6/counter-ti-ecap-capture-add-check-for-clk_enable.patch
@@ -0,0 +1,44 @@
+From b36c4b26099a379acf5990522354cd7d3171371b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 19:40:59 +0000
+Subject: counter: ti-ecap-capture: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 1437d9f1c56fce9c24e566508bce1d218dd5497a ]
+
+Add check for the return value of clk_enable() in order to catch the
+potential exception.
+
+Fixes: 4e2f42aa00b6 ("counter: ti-ecap-capture: capture driver support for ECAP")
+Reviewed-by: Julien Panis <jpanis@baylibre.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20241104194059.47924-1-jiashengjiangcool@gmail.com
+Signed-off-by: William Breathitt Gray <wbg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/counter/ti-ecap-capture.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/counter/ti-ecap-capture.c b/drivers/counter/ti-ecap-capture.c
+index fb1cb1774674a..b84e368a413f5 100644
+--- a/drivers/counter/ti-ecap-capture.c
++++ b/drivers/counter/ti-ecap-capture.c
+@@ -576,8 +576,13 @@ static int ecap_cnt_resume(struct device *dev)
+ {
+ 	struct counter_device *counter_dev = dev_get_drvdata(dev);
+ 	struct ecap_cnt_dev *ecap_dev = counter_priv(counter_dev);
++	int ret;
+ 
+-	clk_enable(ecap_dev->clk);
++	ret = clk_enable(ecap_dev->clk);
++	if (ret) {
++		dev_err(dev, "Cannot enable clock %d\n", ret);
++		return ret;
++	}
+ 
+ 	ecap_cnt_capture_set_evmode(counter_dev, ecap_dev->pm_ctx.ev_mode);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/cppc_cpufreq-use-desired-perf-if-feedback-ctrs-are-0.patch b/queue-6.6/cppc_cpufreq-use-desired-perf-if-feedback-ctrs-are-0.patch
new file mode 100644
index 00000000000..acbf23fc2d0
--- /dev/null
+++ b/queue-6.6/cppc_cpufreq-use-desired-perf-if-feedback-ctrs-are-0.patch
@@ -0,0 +1,128 @@
+From 85a877c29f8c833ae4e8844f5c84c010bddd8faf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 11:32:13 +0800
+Subject: cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged
+
+From: Jie Zhan <zhanjie9@hisilicon.com>
+
+[ Upstream commit c47195631960b626058c335aec31f186fa854f97 ]
+
+The CPPC performance feedback counters could be 0 or unchanged when the
+target cpu is in a low-power idle state, e.g. power-gated or clock-gated.
+
+When the counters are 0, cppc_cpufreq_get_rate() returns 0 KHz, which makes
+cpufreq_online() get a false error and fail to generate a cpufreq policy.
+
+When the counters are unchanged, the existing cppc_perf_from_fbctrs()
+returns a cached desired perf, but some platforms may update the real
+frequency back to the desired perf reg.
+
+For the above cases in cppc_cpufreq_get_rate(), get the latest desired perf
+from the CPPC reg to reflect the frequency because some platforms may
+update the actual frequency back there; if failed, use the cached desired
+perf.
+
+Fixes: 6a4fec4f6d30 ("cpufreq: cppc: cppc_cpufreq_get_rate() returns zero in all error cases.")
+Signed-off-by: Jie Zhan <zhanjie9@hisilicon.com>
+Reviewed-by: Zeng Heng <zengheng4@huawei.com>
+Reviewed-by: Ionela Voinescu <ionela.voinescu@arm.com>
+Reviewed-by: Huisong Li <lihuisong@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 57 +++++++++++++++++++++++++++-------
+ 1 file changed, 46 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index 15f1d41920a33..9d476264075d8 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -118,6 +118,9 @@ static void cppc_scale_freq_workfn(struct kthread_work *work)
+ 
+ 	perf = cppc_perf_from_fbctrs(cpu_data, &cppc_fi->prev_perf_fb_ctrs,
+ 				     &fb_ctrs);
++	if (!perf)
++		return;
++
+ 	cppc_fi->prev_perf_fb_ctrs = fb_ctrs;
+ 
+ 	perf <<= SCHED_CAPACITY_SHIFT;
+@@ -730,13 +733,31 @@ static int cppc_perf_from_fbctrs(struct cppc_cpudata *cpu_data,
+ 	delta_delivered = get_delta(fb_ctrs_t1->delivered,
+ 				    fb_ctrs_t0->delivered);
+ 
+-	/* Check to avoid divide-by zero and invalid delivered_perf */
++	/*
++	 * Avoid divide-by zero and unchanged feedback counters.
++	 * Leave it for callers to handle.
++	 */
+ 	if (!delta_reference || !delta_delivered)
+-		return cpu_data->perf_ctrls.desired_perf;
++		return 0;
+ 
+ 	return (reference_perf * delta_delivered) / delta_reference;
+ }
+ 
++static int cppc_get_perf_ctrs_sample(int cpu,
++				     struct cppc_perf_fb_ctrs *fb_ctrs_t0,
++				     struct cppc_perf_fb_ctrs *fb_ctrs_t1)
++{
++	int ret;
++
++	ret = cppc_get_perf_ctrs(cpu, fb_ctrs_t0);
++	if (ret)
++		return ret;
++
++	udelay(2); /* 2usec delay between sampling */
++
++	return cppc_get_perf_ctrs(cpu, fb_ctrs_t1);
++}
++
+ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu)
+ {
+ 	struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0}, fb_ctrs_t1 = {0};
+@@ -752,18 +773,32 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu)
+ 
+ 	cpufreq_cpu_put(policy);
+ 
+-	ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t0);
+-	if (ret)
+-		return 0;
+-
+-	udelay(2); /* 2usec delay between sampling */
+-
+-	ret = cppc_get_perf_ctrs(cpu, &fb_ctrs_t1);
+-	if (ret)
+-		return 0;
++	ret = cppc_get_perf_ctrs_sample(cpu, &fb_ctrs_t0, &fb_ctrs_t1);
++	if (ret) {
++		if (ret == -EFAULT)
++			/* Any of the associated CPPC regs is 0. */
++			goto out_invalid_counters;
++		else
++			return 0;
++	}
+ 
+ 	delivered_perf = cppc_perf_from_fbctrs(cpu_data, &fb_ctrs_t0,
+ 					       &fb_ctrs_t1);
++	if (!delivered_perf)
++		goto out_invalid_counters;
++
++	return cppc_perf_to_khz(&cpu_data->perf_caps, delivered_perf);
++
++out_invalid_counters:
++	/*
++	 * Feedback counters could be unchanged or 0 when a cpu enters a
++	 * low-power idle state, e.g. clock-gated or power-gated.
++	 * Use desired perf for reflecting frequency.  Get the latest register
++	 * value first as some platforms may update the actual delivered perf
++	 * there; if failed, resort to the cached desired perf.
++	 */
++	if (cppc_get_desired_perf(cpu, &delivered_perf))
++		delivered_perf = cpu_data->perf_ctrls.desired_perf;
+ 
+ 	return cppc_perf_to_khz(&cpu_data->perf_caps, delivered_perf);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cppc_ge.patch b/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cppc_ge.patch
new file mode 100644
index 00000000000..2daf6a7cdd9
--- /dev/null
+++ b/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cppc_ge.patch
@@ -0,0 +1,38 @@
+From 9cee8fb4b6628a7865b9c8569f5885ba5fdaa1db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 16:24:49 +0800
+Subject: cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 1a1374bb8c5926674973d849feed500bc61ad535 ]
+
+cpufreq_cpu_get_raw() may return NULL if the cpu is not in
+policy->cpus cpu mask and it will cause null pointer dereference,
+so check NULL for cppc_get_cpu_cost().
+
+Fixes: 740fcdc2c20e ("cpufreq: CPPC: Register EM based on efficiency class information")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index 284c328a1d3d1..866a0538ca896 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -498,6 +498,9 @@ static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz,
+ 	int step;
+ 
+ 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
++	if (!policy)
++		return 0;
++
+ 	cpu_data = policy->driver_data;
+ 	perf_caps = &cpu_data->perf_caps;
+ 	max_cap = arch_scale_cpu_capacity(cpu_dev->id);
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cpufreq.patch b/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cpufreq.patch
new file mode 100644
index 00000000000..50654080093
--- /dev/null
+++ b/queue-6.6/cpufreq-cppc-fix-possible-null-ptr-deref-for-cpufreq.patch
@@ -0,0 +1,37 @@
+From 2ac594a1e31e70cfe3aeb09061450053c06b3c0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 09:20:19 +0800
+Subject: cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit a78e7207564258db6e373e86294a85f9d646d35a ]
+
+cpufreq_cpu_get_raw() may return NULL if the cpu is not in
+policy->cpus cpu mask and it will cause null pointer dereference.
+
+Fixes: 740fcdc2c20e ("cpufreq: CPPC: Register EM based on efficiency class information")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index 9d476264075d8..284c328a1d3d1 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -428,6 +428,9 @@ static int cppc_get_cpu_power(struct device *cpu_dev,
+ 	struct cppc_cpudata *cpu_data;
+ 
+ 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
++	if (!policy)
++		return 0;
++
+ 	cpu_data = policy->driver_data;
+ 	perf_caps = &cpu_data->perf_caps;
+ 	max_cap = arch_scale_cpu_capacity(cpu_dev->id);
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch b/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch
new file mode 100644
index 00000000000..3db485c458b
--- /dev/null
+++ b/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch
@@ -0,0 +1,42 @@
+From e9c2d9054801981856aa74029ad33ffc71a1f6e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 09:12:38 +0800
+Subject: cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit be392aa80f1e5b0b65ccc2a540b9304fefcfe3d8 ]
+
+cppc_get_cpu_cost() return 0 if the policy is NULL. Then in
+em_compute_costs(), the later zero check for cost is not valid
+as cost is uninitialized. As Quentin pointed out, kernel energy model
+core check the return value of get_cost() first, so if the callback
+failed it should tell the core. Return -EINVAL to fix it.
+
+Fixes: 1a1374bb8c59 ("cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost()")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/c4765377-7830-44c2-84fa-706b6e304e10@stanley.mountain/
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index 866a0538ca896..05a8418485079 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -499,7 +499,7 @@ static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz,
+ 
+ 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
+ 	if (!policy)
+-		return 0;
++		return -EINVAL;
+ 
+ 	cpu_data = policy->driver_data;
+ 	perf_caps = &cpu_data->perf_caps;
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch-19495 b/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch-19495
new file mode 100644
index 00000000000..12cdeb5b7a4
--- /dev/null
+++ b/queue-6.6/cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch-19495
@@ -0,0 +1,40 @@
+From ec6bee70cfdd94689a186b00ce4ea4ebbb03e411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 09:01:11 +0800
+Subject: cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_power()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit b51eb0874d8170028434fbd259e80b78ed9b8eca ]
+
+cppc_get_cpu_power() return 0 if the policy is NULL. Then in
+em_create_perf_table(), the later zero check for power is not valid
+as power is uninitialized. As Quentin pointed out, kernel energy model
+core check the return value of active_power() first, so if the callback
+failed it should tell the core. So return -EINVAL to fix it.
+
+Fixes: a78e72075642 ("cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw()")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index 05a8418485079..c8447ecad797e 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -429,7 +429,7 @@ static int cppc_get_cpu_power(struct device *cpu_dev,
+ 
+ 	policy = cpufreq_cpu_get_raw(cpu_dev->id);
+ 	if (!policy)
+-		return 0;
++		return -EINVAL;
+ 
+ 	cpu_data = policy->driver_data;
+ 	perf_caps = &cpu_data->perf_caps;
+-- 
+2.43.0
+
diff --git a/queue-6.6/cpufreq-loongson2-unregister-platform_driver-on-fail.patch b/queue-6.6/cpufreq-loongson2-unregister-platform_driver-on-fail.patch
new file mode 100644
index 00000000000..00be48ebf97
--- /dev/null
+++ b/queue-6.6/cpufreq-loongson2-unregister-platform_driver-on-fail.patch
@@ -0,0 +1,39 @@
+From f865997ec8707b1949c223f56a633df3a588f0c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:06:15 +0800
+Subject: cpufreq: loongson2: Unregister platform_driver on failure
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 5f856d71ccdf89b4bac0ff70ebb0bb582e7f7f18 ]
+
+When cpufreq_register_driver() returns error, the cpufreq_init() returns
+without unregister platform_driver, fix by add missing
+platform_driver_unregister() when cpufreq_register_driver() failed.
+
+Fixes: f8ede0f700f5 ("MIPS: Loongson 2F: Add CPU frequency scaling support")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/loongson2_cpufreq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
+index afc59b292153d..63cae4037deb1 100644
+--- a/drivers/cpufreq/loongson2_cpufreq.c
++++ b/drivers/cpufreq/loongson2_cpufreq.c
+@@ -154,7 +154,9 @@ static int __init cpufreq_init(void)
+ 
+ 	ret = cpufreq_register_driver(&loongson2_cpufreq_driver);
+ 
+-	if (!ret && !nowait) {
++	if (ret) {
++		platform_driver_unregister(&platform_driver);
++	} else if (!nowait) {
+ 		saved_cpu_wait = cpu_wait;
+ 		cpu_wait = loongson2_cpu_wait;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-aes-gcm-p10-use-the-correct-bit-to-test-for-p.patch b/queue-6.6/crypto-aes-gcm-p10-use-the-correct-bit-to-test-for-p.patch
new file mode 100644
index 00000000000..069dd5f549e
--- /dev/null
+++ b/queue-6.6/crypto-aes-gcm-p10-use-the-correct-bit-to-test-for-p.patch
@@ -0,0 +1,38 @@
+From edb5869b99ea5b2b0f7a5b2d3e1978d8c51605fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 13:09:33 +0100
+Subject: crypto: aes-gcm-p10 - Use the correct bit to test for P10
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit 3574a5168ff3b6bddc4cd235878491f75967c8d4 ]
+
+A hwcap feature bit is passed to cpu_has_feature, resulting in testing
+for CPU_FTR_MMCRA instead of the 3.1 platform revision.
+
+Fixes: c954b252dee9 ("crypto: powerpc/p10-aes-gcm - Register modules as SIMD")
+Reported-by: Nicolai Stange <nstange@suse.com>
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/crypto/aes-gcm-p10-glue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/crypto/aes-gcm-p10-glue.c b/arch/powerpc/crypto/aes-gcm-p10-glue.c
+index e52629334cf80..1f8b677756582 100644
+--- a/arch/powerpc/crypto/aes-gcm-p10-glue.c
++++ b/arch/powerpc/crypto/aes-gcm-p10-glue.c
+@@ -414,7 +414,7 @@ static int __init p10_init(void)
+ {
+ 	int ret;
+ 
+-	if (!cpu_has_feature(PPC_FEATURE2_ARCH_3_1))
++	if (!cpu_has_feature(CPU_FTR_ARCH_31))
+ 		return 0;
+ 
+ 	ret = simd_register_aeads_compat(gcm_aes_algs,
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch b/queue-6.6/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch
new file mode 100644
index 00000000000..af1d6c8ec02
--- /dev/null
+++ b/queue-6.6/crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch
@@ -0,0 +1,47 @@
+From 3ae78cf58e7a33523641fe3cbcf9d9231aca8188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:17:45 +0000
+Subject: crypto: bcm - add error check in the ahash_hmac_init function
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit 19630cf57233e845b6ac57c9c969a4888925467b ]
+
+The ahash_init functions may return fails. The ahash_hmac_init should
+not return ok when ahash_init returns error. For an example, ahash_init
+will return -ENOMEM when allocation memory is error.
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 689be70d69c18..1d1ff3b1b0d5a 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -2415,6 +2415,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,
+ 
+ static int ahash_hmac_init(struct ahash_request *req)
+ {
++	int ret;
+ 	struct iproc_reqctx_s *rctx = ahash_request_ctx(req);
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+ 	struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm);
+@@ -2424,7 +2425,9 @@ static int ahash_hmac_init(struct ahash_request *req)
+ 	flow_log("ahash_hmac_init()\n");
+ 
+ 	/* init the context as a hash */
+-	ahash_init(req);
++	ret = ahash_init(req);
++	if (ret)
++		return ret;
+ 
+ 	if (!spu_no_incr_hash(ctx)) {
+ 		/* SPU-M can do incr hashing but needs sw for outer HMAC */
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-caam-add-error-check-to-caam_rsa_set_priv_key.patch b/queue-6.6/crypto-caam-add-error-check-to-caam_rsa_set_priv_key.patch
new file mode 100644
index 00000000000..a667e320368
--- /dev/null
+++ b/queue-6.6/crypto-caam-add-error-check-to-caam_rsa_set_priv_key.patch
@@ -0,0 +1,78 @@
+From c4278744ecd27527c8e237c9fd5d3d608b1d8b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:15:11 +0000
+Subject: crypto: caam - add error check to caam_rsa_set_priv_key_form
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit b64140c74e954f1db6eae5548ca3a1f41b6fad79 ]
+
+The caam_rsa_set_priv_key_form did not check for memory allocation errors.
+Add the checks to the caam_rsa_set_priv_key_form functions.
+
+Fixes: 52e26d77b8b3 ("crypto: caam - add support for RSA key form 2")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Reviewed-by: Gaurav Jain <gaurav.jain@nxp.com>
+Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caampkc.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
+index 887a5f2fb9279..cb001aa1de661 100644
+--- a/drivers/crypto/caam/caampkc.c
++++ b/drivers/crypto/caam/caampkc.c
+@@ -984,7 +984,7 @@ static int caam_rsa_set_pub_key(struct crypto_akcipher *tfm, const void *key,
+ 	return -ENOMEM;
+ }
+ 
+-static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
++static int caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
+ 				       struct rsa_key *raw_key)
+ {
+ 	struct caam_rsa_key *rsa_key = &ctx->key;
+@@ -994,7 +994,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
+ 
+ 	rsa_key->p = caam_read_raw_data(raw_key->p, &p_sz);
+ 	if (!rsa_key->p)
+-		return;
++		return -ENOMEM;
+ 	rsa_key->p_sz = p_sz;
+ 
+ 	rsa_key->q = caam_read_raw_data(raw_key->q, &q_sz);
+@@ -1029,7 +1029,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
+ 
+ 	rsa_key->priv_form = FORM3;
+ 
+-	return;
++	return 0;
+ 
+ free_dq:
+ 	kfree_sensitive(rsa_key->dq);
+@@ -1043,6 +1043,7 @@ static void caam_rsa_set_priv_key_form(struct caam_rsa_ctx *ctx,
+ 	kfree_sensitive(rsa_key->q);
+ free_p:
+ 	kfree_sensitive(rsa_key->p);
++	return -ENOMEM;
+ }
+ 
+ static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
+@@ -1088,7 +1089,9 @@ static int caam_rsa_set_priv_key(struct crypto_akcipher *tfm, const void *key,
+ 	rsa_key->e_sz = raw_key.e_sz;
+ 	rsa_key->n_sz = raw_key.n_sz;
+ 
+-	caam_rsa_set_priv_key_form(ctx, &raw_key);
++	ret = caam_rsa_set_priv_key_form(ctx, &raw_key);
++	if (ret)
++		goto err;
+ 
+ 	return 0;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-caam-fix-the-pointer-passed-to-caam_qi_shutdo.patch b/queue-6.6/crypto-caam-fix-the-pointer-passed-to-caam_qi_shutdo.patch
new file mode 100644
index 00000000000..2509183071b
--- /dev/null
+++ b/queue-6.6/crypto-caam-fix-the-pointer-passed-to-caam_qi_shutdo.patch
@@ -0,0 +1,40 @@
+From 81238a22ec46828299b86e7a069cdd79ed1c565b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2024 12:22:12 +0200
+Subject: crypto: caam - Fix the pointer passed to caam_qi_shutdown()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ad980b04f51f7fb503530bd1cb328ba5e75a250e ]
+
+The type of the last parameter given to devm_add_action_or_reset() is
+"struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to
+"struct device *".
+
+Pass the correct parameter to devm_add_action_or_reset() so that the
+resources are released as expected.
+
+Fixes: f414de2e2fff ("crypto: caam - use devres to de-initialize QI")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/qi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c
+index 46a083849a8ee..7a3a104557f03 100644
+--- a/drivers/crypto/caam/qi.c
++++ b/drivers/crypto/caam/qi.c
+@@ -772,7 +772,7 @@ int caam_qi_init(struct platform_device *caam_pdev)
+ 
+ 	caam_debugfs_qi_init(ctrlpriv);
+ 
+-	err = devm_add_action_or_reset(qidev, caam_qi_shutdown, ctrlpriv);
++	err = devm_add_action_or_reset(qidev, caam_qi_shutdown, qidev);
+ 	if (err)
+ 		return err;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch b/queue-6.6/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch
new file mode 100644
index 00000000000..98ba2e465de
--- /dev/null
+++ b/queue-6.6/crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch
@@ -0,0 +1,38 @@
+From b6bdd45f6a3e9fa1666007e16fa52d28c3712b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 18:22:27 +0100
+Subject: crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 572b7cf08403b6c67dfe0dc3e0f2efb42443254f ]
+
+If do_cpt_init() fails, a previous dma_alloc_coherent() call needs to be
+undone.
+
+Add the needed dma_free_coherent() before returning.
+
+Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/cavium/cpt/cptpf_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c
+index ec17beee24c07..54de869e5374c 100644
+--- a/drivers/crypto/cavium/cpt/cptpf_main.c
++++ b/drivers/crypto/cavium/cpt/cptpf_main.c
+@@ -302,6 +302,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
+ 
+ 	ret = do_cpt_init(cpt, mcode);
+ 	if (ret) {
++		dma_free_coherent(&cpt->pdev->dev, mcode->code_size,
++				  mcode->code, mcode->phys_base);
+ 		dev_err(dev, "do_cpt_init failed with ret: %d\n", ret);
+ 		goto fw_release;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch b/queue-6.6/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch
new file mode 100644
index 00000000000..cb3ed5b986a
--- /dev/null
+++ b/queue-6.6/crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch
@@ -0,0 +1,53 @@
+From 3634465b56643b13a26fb3097c3dd45d7d6273e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 10:23:10 -0600
+Subject: crypto: cavium - Fix the if condition to exit loop after timeout
+
+From: Everest K.C <everestkc@everestkc.com.np>
+
+[ Upstream commit 53d91ca76b6c426c546542a44c78507b42008c9e ]
+
+The while loop breaks in the first run because of incorrect
+if condition. It also causes the statements after the if to
+appear dead.
+Fix this by changing the condition from if(timeout--) to
+if(!timeout--).
+
+This bug was reported by Coverity Scan.
+Report:
+CID 1600859: (#1 of 1): Logically dead code (DEADCODE)
+dead_error_line: Execution cannot reach this statement: udelay(30UL);
+
+Fixes: 9e2c7d99941d ("crypto: cavium - Add Support for Octeon-tx CPT Engine")
+Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/cavium/cpt/cptpf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/cavium/cpt/cptpf_main.c b/drivers/crypto/cavium/cpt/cptpf_main.c
+index 6872ac3440010..ec17beee24c07 100644
+--- a/drivers/crypto/cavium/cpt/cptpf_main.c
++++ b/drivers/crypto/cavium/cpt/cptpf_main.c
+@@ -44,7 +44,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,
+ 		dev_err(dev, "Cores still busy %llx", coremask);
+ 		grp = cpt_read_csr64(cpt->reg_base,
+ 				     CPTX_PF_EXEC_BUSY(0));
+-		if (timeout--)
++		if (!timeout--)
+ 			break;
+ 
+ 		udelay(CSR_DELAY);
+@@ -394,7 +394,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)
+ 		dev_err(dev, "Cores still busy");
+ 		grp = cpt_read_csr64(cpt->reg_base,
+ 				     CPTX_PF_EXEC_BUSY(0));
+-		if (timeout--)
++		if (!timeout--)
+ 			break;
+ 
+ 		udelay(CSR_DELAY);
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-hisilicon-qm-disable-same-error-report-before.patch b/queue-6.6/crypto-hisilicon-qm-disable-same-error-report-before.patch
new file mode 100644
index 00000000000..ab131a7e33d
--- /dev/null
+++ b/queue-6.6/crypto-hisilicon-qm-disable-same-error-report-before.patch
@@ -0,0 +1,340 @@
+From 06cd6fa19d6ef24e055df417acfdbf7406146f37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 19:44:29 +0800
+Subject: crypto: hisilicon/qm - disable same error report before resetting
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit c418ba6baca3ae10ffaf47b0803d2a9e6bf1af96 ]
+
+If an error indicating that the device needs to be reset is reported,
+disable the error reporting before device reset is complete,
+enable the error reporting after the reset is complete to prevent
+the same error from being reported repeatedly.
+
+Fixes: eaebf4c3b103 ("crypto: hisilicon - Unify hardware error init/uninit into QM")
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 35 ++++++++++++++---
+ drivers/crypto/hisilicon/qm.c             | 47 +++++++----------------
+ drivers/crypto/hisilicon/sec2/sec_main.c  | 35 ++++++++++++++---
+ drivers/crypto/hisilicon/zip/zip_main.c   | 35 ++++++++++++++---
+ include/linux/hisi_acc_qm.h               |  8 +++-
+ 5 files changed, 110 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 3463f5ee83c0d..762a2a54ca821 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -1280,11 +1280,15 @@ static u32 hpre_get_hw_err_status(struct hisi_qm *qm)
+ 
+ static void hpre_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
+ {
+-	u32 nfe;
+-
+ 	writel(err_sts, qm->io_base + HPRE_HAC_SOURCE_INT);
+-	nfe = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
+-	writel(nfe, qm->io_base + HPRE_RAS_NFE_ENB);
++}
++
++static void hpre_disable_error_report(struct hisi_qm *qm, u32 err_type)
++{
++	u32 nfe_mask;
++
++	nfe_mask = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_NFE_MASK_CAP, qm->cap_ver);
++	writel(nfe_mask & (~err_type), qm->io_base + HPRE_RAS_NFE_ENB);
+ }
+ 
+ static void hpre_open_axi_master_ooo(struct hisi_qm *qm)
+@@ -1298,6 +1302,27 @@ static void hpre_open_axi_master_ooo(struct hisi_qm *qm)
+ 	       qm->io_base + HPRE_AM_OOO_SHUTDOWN_ENB);
+ }
+ 
++static enum acc_err_result hpre_get_err_result(struct hisi_qm *qm)
++{
++	u32 err_status;
++
++	err_status = hpre_get_hw_err_status(qm);
++	if (err_status) {
++		if (err_status & qm->err_info.ecc_2bits_mask)
++			qm->err_status.is_dev_ecc_mbit = true;
++		hpre_log_hw_error(qm, err_status);
++
++		if (err_status & qm->err_info.dev_reset_mask) {
++			/* Disable the same error reporting until device is recovered. */
++			hpre_disable_error_report(qm, err_status);
++			return ACC_ERR_NEED_RESET;
++		}
++		hpre_clear_hw_err_status(qm, err_status);
++	}
++
++	return ACC_ERR_RECOVERED;
++}
++
+ static void hpre_err_info_init(struct hisi_qm *qm)
+ {
+ 	struct hisi_qm_err_info *err_info = &qm->err_info;
+@@ -1324,12 +1349,12 @@ static const struct hisi_qm_err_ini hpre_err_ini = {
+ 	.hw_err_disable		= hpre_hw_error_disable,
+ 	.get_dev_hw_err_status	= hpre_get_hw_err_status,
+ 	.clear_dev_hw_err_status = hpre_clear_hw_err_status,
+-	.log_dev_hw_err		= hpre_log_hw_error,
+ 	.open_axi_master_ooo	= hpre_open_axi_master_ooo,
+ 	.open_sva_prefetch	= hpre_open_sva_prefetch,
+ 	.close_sva_prefetch	= hpre_close_sva_prefetch,
+ 	.show_last_dfx_regs	= hpre_show_last_dfx_regs,
+ 	.err_info_init		= hpre_err_info_init,
++	.get_err_result		= hpre_get_err_result,
+ };
+ 
+ static int hpre_pf_probe_init(struct hpre *hpre)
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 1b00edbbfe26a..7921409791fb0 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -272,12 +272,6 @@ enum vft_type {
+ 	SHAPER_VFT,
+ };
+ 
+-enum acc_err_result {
+-	ACC_ERR_NONE,
+-	ACC_ERR_NEED_RESET,
+-	ACC_ERR_RECOVERED,
+-};
+-
+ enum qm_alg_type {
+ 	ALG_TYPE_0,
+ 	ALG_TYPE_1,
+@@ -1489,22 +1483,25 @@ static void qm_log_hw_error(struct hisi_qm *qm, u32 error_status)
+ 
+ static enum acc_err_result qm_hw_error_handle_v2(struct hisi_qm *qm)
+ {
+-	u32 error_status, tmp;
+-
+-	/* read err sts */
+-	tmp = readl(qm->io_base + QM_ABNORMAL_INT_STATUS);
+-	error_status = qm->error_mask & tmp;
++	u32 error_status;
+ 
+-	if (error_status) {
++	error_status = qm_get_hw_error_status(qm);
++	if (error_status & qm->error_mask) {
+ 		if (error_status & QM_ECC_MBIT)
+ 			qm->err_status.is_qm_ecc_mbit = true;
+ 
+ 		qm_log_hw_error(qm, error_status);
+-		if (error_status & qm->err_info.qm_reset_mask)
++		if (error_status & qm->err_info.qm_reset_mask) {
++			/* Disable the same error reporting until device is recovered. */
++			writel(qm->err_info.nfe & (~error_status),
++			       qm->io_base + QM_RAS_NFE_ENABLE);
+ 			return ACC_ERR_NEED_RESET;
++		}
+ 
++		/* Clear error source if not need reset. */
+ 		writel(error_status, qm->io_base + QM_ABNORMAL_INT_SOURCE);
+ 		writel(qm->err_info.nfe, qm->io_base + QM_RAS_NFE_ENABLE);
++		writel(qm->err_info.ce, qm->io_base + QM_RAS_CE_ENABLE);
+ 	}
+ 
+ 	return ACC_ERR_RECOVERED;
+@@ -3957,30 +3954,12 @@ EXPORT_SYMBOL_GPL(hisi_qm_sriov_configure);
+ 
+ static enum acc_err_result qm_dev_err_handle(struct hisi_qm *qm)
+ {
+-	u32 err_sts;
+-
+-	if (!qm->err_ini->get_dev_hw_err_status) {
+-		dev_err(&qm->pdev->dev, "Device doesn't support get hw error status!\n");
++	if (!qm->err_ini->get_err_result) {
++		dev_err(&qm->pdev->dev, "Device doesn't support reset!\n");
+ 		return ACC_ERR_NONE;
+ 	}
+ 
+-	/* get device hardware error status */
+-	err_sts = qm->err_ini->get_dev_hw_err_status(qm);
+-	if (err_sts) {
+-		if (err_sts & qm->err_info.ecc_2bits_mask)
+-			qm->err_status.is_dev_ecc_mbit = true;
+-
+-		if (qm->err_ini->log_dev_hw_err)
+-			qm->err_ini->log_dev_hw_err(qm, err_sts);
+-
+-		if (err_sts & qm->err_info.dev_reset_mask)
+-			return ACC_ERR_NEED_RESET;
+-
+-		if (qm->err_ini->clear_dev_hw_err_status)
+-			qm->err_ini->clear_dev_hw_err_status(qm, err_sts);
+-	}
+-
+-	return ACC_ERR_RECOVERED;
++	return qm->err_ini->get_err_result(qm);
+ }
+ 
+ static enum acc_err_result qm_process_dev_error(struct hisi_qm *qm)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index cf7b6a37e7df7..6aaaaf784ddc0 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -1006,11 +1006,15 @@ static u32 sec_get_hw_err_status(struct hisi_qm *qm)
+ 
+ static void sec_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
+ {
+-	u32 nfe;
+-
+ 	writel(err_sts, qm->io_base + SEC_CORE_INT_SOURCE);
+-	nfe = hisi_qm_get_hw_info(qm, sec_basic_info, SEC_NFE_MASK_CAP, qm->cap_ver);
+-	writel(nfe, qm->io_base + SEC_RAS_NFE_REG);
++}
++
++static void sec_disable_error_report(struct hisi_qm *qm, u32 err_type)
++{
++	u32 nfe_mask;
++
++	nfe_mask = hisi_qm_get_hw_info(qm, sec_basic_info, SEC_NFE_MASK_CAP, qm->cap_ver);
++	writel(nfe_mask & (~err_type), qm->io_base + SEC_RAS_NFE_REG);
+ }
+ 
+ static void sec_open_axi_master_ooo(struct hisi_qm *qm)
+@@ -1022,6 +1026,27 @@ static void sec_open_axi_master_ooo(struct hisi_qm *qm)
+ 	writel(val | SEC_AXI_SHUTDOWN_ENABLE, qm->io_base + SEC_CONTROL_REG);
+ }
+ 
++static enum acc_err_result sec_get_err_result(struct hisi_qm *qm)
++{
++	u32 err_status;
++
++	err_status = sec_get_hw_err_status(qm);
++	if (err_status) {
++		if (err_status & qm->err_info.ecc_2bits_mask)
++			qm->err_status.is_dev_ecc_mbit = true;
++		sec_log_hw_error(qm, err_status);
++
++		if (err_status & qm->err_info.dev_reset_mask) {
++			/* Disable the same error reporting until device is recovered. */
++			sec_disable_error_report(qm, err_status);
++			return ACC_ERR_NEED_RESET;
++		}
++		sec_clear_hw_err_status(qm, err_status);
++	}
++
++	return ACC_ERR_RECOVERED;
++}
++
+ static void sec_err_info_init(struct hisi_qm *qm)
+ {
+ 	struct hisi_qm_err_info *err_info = &qm->err_info;
+@@ -1048,12 +1073,12 @@ static const struct hisi_qm_err_ini sec_err_ini = {
+ 	.hw_err_disable		= sec_hw_error_disable,
+ 	.get_dev_hw_err_status	= sec_get_hw_err_status,
+ 	.clear_dev_hw_err_status = sec_clear_hw_err_status,
+-	.log_dev_hw_err		= sec_log_hw_error,
+ 	.open_axi_master_ooo	= sec_open_axi_master_ooo,
+ 	.open_sva_prefetch	= sec_open_sva_prefetch,
+ 	.close_sva_prefetch	= sec_close_sva_prefetch,
+ 	.show_last_dfx_regs	= sec_show_last_dfx_regs,
+ 	.err_info_init		= sec_err_info_init,
++	.get_err_result		= sec_get_err_result,
+ };
+ 
+ static int sec_pf_probe_init(struct sec_dev *sec)
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 9d47b3675da7d..66e553115adfd 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -1068,11 +1068,15 @@ static u32 hisi_zip_get_hw_err_status(struct hisi_qm *qm)
+ 
+ static void hisi_zip_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts)
+ {
+-	u32 nfe;
+-
+ 	writel(err_sts, qm->io_base + HZIP_CORE_INT_SOURCE);
+-	nfe = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_NFE_MASK_CAP, qm->cap_ver);
+-	writel(nfe, qm->io_base + HZIP_CORE_INT_RAS_NFE_ENB);
++}
++
++static void hisi_zip_disable_error_report(struct hisi_qm *qm, u32 err_type)
++{
++	u32 nfe_mask;
++
++	nfe_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_NFE_MASK_CAP, qm->cap_ver);
++	writel(nfe_mask & (~err_type), qm->io_base + HZIP_CORE_INT_RAS_NFE_ENB);
+ }
+ 
+ static void hisi_zip_open_axi_master_ooo(struct hisi_qm *qm)
+@@ -1102,6 +1106,27 @@ static void hisi_zip_close_axi_master_ooo(struct hisi_qm *qm)
+ 	       qm->io_base + HZIP_CORE_INT_SET);
+ }
+ 
++static enum acc_err_result hisi_zip_get_err_result(struct hisi_qm *qm)
++{
++	u32 err_status;
++
++	err_status = hisi_zip_get_hw_err_status(qm);
++	if (err_status) {
++		if (err_status & qm->err_info.ecc_2bits_mask)
++			qm->err_status.is_dev_ecc_mbit = true;
++		hisi_zip_log_hw_error(qm, err_status);
++
++		if (err_status & qm->err_info.dev_reset_mask) {
++			/* Disable the same error reporting until device is recovered. */
++			hisi_zip_disable_error_report(qm, err_status);
++			return ACC_ERR_NEED_RESET;
++		}
++		hisi_zip_clear_hw_err_status(qm, err_status);
++	}
++
++	return ACC_ERR_RECOVERED;
++}
++
+ static void hisi_zip_err_info_init(struct hisi_qm *qm)
+ {
+ 	struct hisi_qm_err_info *err_info = &qm->err_info;
+@@ -1129,13 +1154,13 @@ static const struct hisi_qm_err_ini hisi_zip_err_ini = {
+ 	.hw_err_disable		= hisi_zip_hw_error_disable,
+ 	.get_dev_hw_err_status	= hisi_zip_get_hw_err_status,
+ 	.clear_dev_hw_err_status = hisi_zip_clear_hw_err_status,
+-	.log_dev_hw_err		= hisi_zip_log_hw_error,
+ 	.open_axi_master_ooo	= hisi_zip_open_axi_master_ooo,
+ 	.close_axi_master_ooo	= hisi_zip_close_axi_master_ooo,
+ 	.open_sva_prefetch	= hisi_zip_open_sva_prefetch,
+ 	.close_sva_prefetch	= hisi_zip_close_sva_prefetch,
+ 	.show_last_dfx_regs	= hisi_zip_show_last_dfx_regs,
+ 	.err_info_init		= hisi_zip_err_info_init,
++	.get_err_result		= hisi_zip_get_err_result,
+ };
+ 
+ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index 5c4b3a68053f5..8070bff54bfa2 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -225,6 +225,12 @@ struct hisi_qm_status {
+ 
+ struct hisi_qm;
+ 
++enum acc_err_result {
++	ACC_ERR_NONE,
++	ACC_ERR_NEED_RESET,
++	ACC_ERR_RECOVERED,
++};
++
+ struct hisi_qm_err_info {
+ 	char *acpi_rst;
+ 	u32 msi_wr_port;
+@@ -253,9 +259,9 @@ struct hisi_qm_err_ini {
+ 	void (*close_axi_master_ooo)(struct hisi_qm *qm);
+ 	void (*open_sva_prefetch)(struct hisi_qm *qm);
+ 	void (*close_sva_prefetch)(struct hisi_qm *qm);
+-	void (*log_dev_hw_err)(struct hisi_qm *qm, u32 err_sts);
+ 	void (*show_last_dfx_regs)(struct hisi_qm *qm);
+ 	void (*err_info_init)(struct hisi_qm *qm);
++	enum acc_err_result (*get_err_result)(struct hisi_qm *qm);
+ };
+ 
+ struct hisi_qm_cap_info {
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-inside-secure-fix-the-return-value-of-safexce.patch b/queue-6.6/crypto-inside-secure-fix-the-return-value-of-safexce.patch
new file mode 100644
index 00000000000..9804fe5b956
--- /dev/null
+++ b/queue-6.6/crypto-inside-secure-fix-the-return-value-of-safexce.patch
@@ -0,0 +1,41 @@
+From 3188101ace22a3e04f967fea3fb39e1967aae680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 19:27:55 +0800
+Subject: crypto: inside-secure - Fix the return value of
+ safexcel_xcbcmac_cra_init()
+
+From: Li Huafei <lihuafei1@huawei.com>
+
+[ Upstream commit a10549fcce2913be7dc581562ffd8ea35653853e ]
+
+The commit 320406cb60b6 ("crypto: inside-secure - Replace generic aes
+with libaes") replaced crypto_alloc_cipher() with kmalloc(), but did not
+modify the handling of the return value. When kmalloc() returns NULL,
+PTR_ERR_OR_ZERO(NULL) returns 0, but in fact, the memory allocation has
+failed, and -ENOMEM should be returned.
+
+Fixes: 320406cb60b6 ("crypto: inside-secure - Replace generic aes with libaes")
+Signed-off-by: Li Huafei <lihuafei1@huawei.com>
+Acked-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
+index e17577b785c33..f44c08f5f5ec4 100644
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -2093,7 +2093,7 @@ static int safexcel_xcbcmac_cra_init(struct crypto_tfm *tfm)
+ 
+ 	safexcel_ahash_cra_init(tfm);
+ 	ctx->aes = kmalloc(sizeof(*ctx->aes), GFP_KERNEL);
+-	return PTR_ERR_OR_ZERO(ctx->aes);
++	return ctx->aes == NULL ? -ENOMEM : 0;
+ }
+ 
+ static void safexcel_xcbcmac_cra_exit(struct crypto_tfm *tfm)
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch b/queue-6.6/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch
new file mode 100644
index 00000000000..5ee53b37f18
--- /dev/null
+++ b/queue-6.6/crypto-pcrypt-call-crypto-layer-directly-when-padata.patch
@@ -0,0 +1,59 @@
+From d7566aca0b07beec0766764f311feb320d5353ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 02:09:35 +0000
+Subject: crypto: pcrypt - Call crypto layer directly when padata_do_parallel()
+ return -EBUSY
+
+From: Yi Yang <yiyang13@huawei.com>
+
+[ Upstream commit 662f2f13e66d3883b9238b0b96b17886179e60e2 ]
+
+Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for
+PADATA_RESET"), the pcrypt encryption and decryption operations return
+-EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is
+generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns
+-EAGAIN, the unnecessary panic will occur when panic_on_warn set 1.
+Fix this issue by calling crypto layer directly without parallelization
+in that case.
+
+Fixes: 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET")
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index d0d954fe9d54f..7fc79e7dce44a 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -117,8 +117,10 @@ static int pcrypt_aead_encrypt(struct aead_request *req)
+ 	err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
+ 	if (!err)
+ 		return -EINPROGRESS;
+-	if (err == -EBUSY)
+-		return -EAGAIN;
++	if (err == -EBUSY) {
++		/* try non-parallel mode */
++		return crypto_aead_encrypt(creq);
++	}
+ 
+ 	return err;
+ }
+@@ -166,8 +168,10 @@ static int pcrypt_aead_decrypt(struct aead_request *req)
+ 	err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
+ 	if (!err)
+ 		return -EINPROGRESS;
+-	if (err == -EBUSY)
+-		return -EAGAIN;
++	if (err == -EBUSY) {
++		/* try non-parallel mode */
++		return crypto_aead_decrypt(creq);
++	}
+ 
+ 	return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-powerpc-p10-aes-gcm-add-dependency-on-crypto_.patch b/queue-6.6/crypto-powerpc-p10-aes-gcm-add-dependency-on-crypto_.patch
new file mode 100644
index 00000000000..8d908281d3d
--- /dev/null
+++ b/queue-6.6/crypto-powerpc-p10-aes-gcm-add-dependency-on-crypto_.patch
@@ -0,0 +1,42 @@
+From 63636ce1b8548293319657bb728d092dc6132f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 09:30:40 -0400
+Subject: crypto: powerpc/p10-aes-gcm - Add dependency on CRYPTO_SIMDand
+ re-enable CRYPTO_AES_GCM_P10
+
+From: Danny Tsen <dtsen@linux.ibm.com>
+
+[ Upstream commit 8b6c1e466eecab70c2ed686f636d56eda19f4cd6 ]
+
+Added CRYPTO_SIMD for CRYPTO_AES_GCM_P10.
+
+Fixes: 45a4672b9a6e ("crypto: p10-aes-gcm - Update Kconfig and Makefile")
+
+Signed-off-by: Danny Tsen <dtsen@linux.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/crypto/Kconfig b/arch/powerpc/crypto/Kconfig
+index fccf742c55c2c..46059bca8721c 100644
+--- a/arch/powerpc/crypto/Kconfig
++++ b/arch/powerpc/crypto/Kconfig
+@@ -96,12 +96,12 @@ config CRYPTO_AES_PPC_SPE
+ 
+ config CRYPTO_AES_GCM_P10
+ 	tristate "Stitched AES/GCM acceleration support on P10 or later CPU (PPC)"
+-	depends on BROKEN
+ 	depends on PPC64 && CPU_LITTLE_ENDIAN && VSX
+ 	select CRYPTO_LIB_AES
+ 	select CRYPTO_ALGAPI
+ 	select CRYPTO_AEAD
+ 	select CRYPTO_SKCIPHER
++	select CRYPTO_SIMD
+ 	help
+ 	  AEAD cipher: AES cipher algorithms (FIPS-197)
+ 	  GCM (Galois/Counter Mode) authenticated encryption mode (NIST SP800-38D)
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-powerpc-p10-aes-gcm-register-modules-as-simd.patch b/queue-6.6/crypto-powerpc-p10-aes-gcm-register-modules-as-simd.patch
new file mode 100644
index 00000000000..639335d88cd
--- /dev/null
+++ b/queue-6.6/crypto-powerpc-p10-aes-gcm-register-modules-as-simd.patch
@@ -0,0 +1,310 @@
+From 49d9d54fbed4b709dbf6cf556fe115c9f97c2e11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 09:30:39 -0400
+Subject: crypto: powerpc/p10-aes-gcm - Register modules as SIMD
+
+From: Danny Tsen <dtsen@linux.ibm.com>
+
+[ Upstream commit c954b252dee956d33ee59f594710af28fb3037d9 ]
+
+This patch is to fix an issue when simd is not usable that data mismatch
+may occur. The fix is to register algs as SIMD modules so that the
+algorithm is excecuted when SIMD instructions is usable.  Called
+gcm_update() to generate the final digest if needed.
+
+A new module rfc4106(gcm(aes)) is also added.
+
+Fixes: cdcecfd9991f ("crypto: p10-aes-gcm - Glue code for AES/GCM stitched implementation")
+
+Signed-off-by: Danny Tsen <dtsen@linux.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/crypto/aes-gcm-p10-glue.c | 141 +++++++++++++++++++++----
+ 1 file changed, 118 insertions(+), 23 deletions(-)
+
+diff --git a/arch/powerpc/crypto/aes-gcm-p10-glue.c b/arch/powerpc/crypto/aes-gcm-p10-glue.c
+index f62ee54076c06..e52629334cf80 100644
+--- a/arch/powerpc/crypto/aes-gcm-p10-glue.c
++++ b/arch/powerpc/crypto/aes-gcm-p10-glue.c
+@@ -8,6 +8,7 @@
+ #include <asm/unaligned.h>
+ #include <asm/simd.h>
+ #include <asm/switch_to.h>
++#include <crypto/gcm.h>
+ #include <crypto/aes.h>
+ #include <crypto/algapi.h>
+ #include <crypto/b128ops.h>
+@@ -24,6 +25,7 @@
+ 
+ #define	PPC_ALIGN		16
+ #define GCM_IV_SIZE		12
++#define RFC4106_NONCE_SIZE	4
+ 
+ MODULE_DESCRIPTION("PPC64le AES-GCM with Stitched implementation");
+ MODULE_AUTHOR("Danny Tsen <dtsen@linux.ibm.com");
+@@ -31,7 +33,7 @@ MODULE_LICENSE("GPL v2");
+ MODULE_ALIAS_CRYPTO("aes");
+ 
+ asmlinkage int aes_p10_set_encrypt_key(const u8 *userKey, const int bits,
+-				      void *key);
++				       void *key);
+ asmlinkage void aes_p10_encrypt(const u8 *in, u8 *out, const void *key);
+ asmlinkage void aes_p10_gcm_encrypt(u8 *in, u8 *out, size_t len,
+ 				    void *rkey, u8 *iv, void *Xi);
+@@ -39,7 +41,8 @@ asmlinkage void aes_p10_gcm_decrypt(u8 *in, u8 *out, size_t len,
+ 				    void *rkey, u8 *iv, void *Xi);
+ asmlinkage void gcm_init_htable(unsigned char htable[], unsigned char Xi[]);
+ asmlinkage void gcm_ghash_p10(unsigned char *Xi, unsigned char *Htable,
+-		unsigned char *aad, unsigned int alen);
++			      unsigned char *aad, unsigned int alen);
++asmlinkage void gcm_update(u8 *iv, void *Xi);
+ 
+ struct aes_key {
+ 	u8 key[AES_MAX_KEYLENGTH];
+@@ -52,6 +55,7 @@ struct gcm_ctx {
+ 	u8 aad_hash[16];
+ 	u64 aadLen;
+ 	u64 Plen;	/* offset 56 - used in aes_p10_gcm_{en/de}crypt */
++	u8 pblock[16];
+ };
+ struct Hash_ctx {
+ 	u8 H[16];	/* subkey */
+@@ -60,17 +64,20 @@ struct Hash_ctx {
+ 
+ struct p10_aes_gcm_ctx {
+ 	struct aes_key enc_key;
++	u8 nonce[RFC4106_NONCE_SIZE];
+ };
+ 
+ static void vsx_begin(void)
+ {
+ 	preempt_disable();
++	pagefault_disable();
+ 	enable_kernel_vsx();
+ }
+ 
+ static void vsx_end(void)
+ {
+ 	disable_kernel_vsx();
++	pagefault_enable();
+ 	preempt_enable();
+ }
+ 
+@@ -185,7 +192,7 @@ static int set_authsize(struct crypto_aead *tfm, unsigned int authsize)
+ }
+ 
+ static int p10_aes_gcm_setkey(struct crypto_aead *aead, const u8 *key,
+-			     unsigned int keylen)
++			      unsigned int keylen)
+ {
+ 	struct crypto_tfm *tfm = crypto_aead_tfm(aead);
+ 	struct p10_aes_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
+@@ -198,7 +205,8 @@ static int p10_aes_gcm_setkey(struct crypto_aead *aead, const u8 *key,
+ 	return ret ? -EINVAL : 0;
+ }
+ 
+-static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
++static int p10_aes_gcm_crypt(struct aead_request *req, u8 *riv,
++			     int assoclen, int enc)
+ {
+ 	struct crypto_tfm *tfm = req->base.tfm;
+ 	struct p10_aes_gcm_ctx *ctx = crypto_tfm_ctx(tfm);
+@@ -210,7 +218,6 @@ static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
+ 	struct skcipher_walk walk;
+ 	u8 *assocmem = NULL;
+ 	u8 *assoc;
+-	unsigned int assoclen = req->assoclen;
+ 	unsigned int cryptlen = req->cryptlen;
+ 	unsigned char ivbuf[AES_BLOCK_SIZE+PPC_ALIGN];
+ 	unsigned char *iv = PTR_ALIGN((void *)ivbuf, PPC_ALIGN);
+@@ -218,11 +225,12 @@ static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
+ 	unsigned long auth_tag_len = crypto_aead_authsize(__crypto_aead_cast(tfm));
+ 	u8 otag[16];
+ 	int total_processed = 0;
++	int nbytes;
+ 
+ 	memset(databuf, 0, sizeof(databuf));
+ 	memset(hashbuf, 0, sizeof(hashbuf));
+ 	memset(ivbuf, 0, sizeof(ivbuf));
+-	memcpy(iv, req->iv, GCM_IV_SIZE);
++	memcpy(iv, riv, GCM_IV_SIZE);
+ 
+ 	/* Linearize assoc, if not already linear */
+ 	if (req->src->length >= assoclen && req->src->length) {
+@@ -257,19 +265,25 @@ static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
+ 	if (ret)
+ 		return ret;
+ 
+-	while (walk.nbytes > 0 && ret == 0) {
++	while ((nbytes = walk.nbytes) > 0 && ret == 0) {
++		u8 *src = walk.src.virt.addr;
++		u8 *dst = walk.dst.virt.addr;
++		u8 buf[AES_BLOCK_SIZE];
++
++		if (unlikely(nbytes > 0 && nbytes < AES_BLOCK_SIZE))
++			src = dst = memcpy(buf, src, nbytes);
+ 
+ 		vsx_begin();
+ 		if (enc)
+-			aes_p10_gcm_encrypt(walk.src.virt.addr,
+-					    walk.dst.virt.addr,
+-					    walk.nbytes,
++			aes_p10_gcm_encrypt(src, dst, nbytes,
+ 					    &ctx->enc_key, gctx->iv, hash->Htable);
+ 		else
+-			aes_p10_gcm_decrypt(walk.src.virt.addr,
+-					    walk.dst.virt.addr,
+-					    walk.nbytes,
++			aes_p10_gcm_decrypt(src, dst, nbytes,
+ 					    &ctx->enc_key, gctx->iv, hash->Htable);
++
++		if (unlikely(nbytes > 0 && nbytes < AES_BLOCK_SIZE))
++			memcpy(walk.dst.virt.addr, buf, nbytes);
++
+ 		vsx_end();
+ 
+ 		total_processed += walk.nbytes;
+@@ -281,6 +295,7 @@ static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
+ 
+ 	/* Finalize hash */
+ 	vsx_begin();
++	gcm_update(gctx->iv, hash->Htable);
+ 	finish_tag(gctx, hash, total_processed);
+ 	vsx_end();
+ 
+@@ -302,17 +317,63 @@ static int p10_aes_gcm_crypt(struct aead_request *req, int enc)
+ 	return 0;
+ }
+ 
++static int rfc4106_setkey(struct crypto_aead *tfm, const u8 *inkey,
++			  unsigned int keylen)
++{
++	struct p10_aes_gcm_ctx *ctx = crypto_aead_ctx(tfm);
++	int err;
++
++	keylen -= RFC4106_NONCE_SIZE;
++	err = p10_aes_gcm_setkey(tfm, inkey, keylen);
++	if (err)
++		return err;
++
++	memcpy(ctx->nonce, inkey + keylen, RFC4106_NONCE_SIZE);
++	return 0;
++}
++
++static int rfc4106_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
++{
++	return crypto_rfc4106_check_authsize(authsize);
++}
++
++static int rfc4106_encrypt(struct aead_request *req)
++{
++	struct crypto_aead *aead = crypto_aead_reqtfm(req);
++	struct p10_aes_gcm_ctx *ctx = crypto_aead_ctx(aead);
++	u8 iv[AES_BLOCK_SIZE];
++
++	memcpy(iv, ctx->nonce, RFC4106_NONCE_SIZE);
++	memcpy(iv + RFC4106_NONCE_SIZE, req->iv, GCM_RFC4106_IV_SIZE);
++
++	return crypto_ipsec_check_assoclen(req->assoclen) ?:
++	       p10_aes_gcm_crypt(req, iv, req->assoclen - GCM_RFC4106_IV_SIZE, 1);
++}
++
++static int rfc4106_decrypt(struct aead_request *req)
++{
++	struct crypto_aead *aead = crypto_aead_reqtfm(req);
++	struct p10_aes_gcm_ctx *ctx = crypto_aead_ctx(aead);
++	u8 iv[AES_BLOCK_SIZE];
++
++	memcpy(iv, ctx->nonce, RFC4106_NONCE_SIZE);
++	memcpy(iv + RFC4106_NONCE_SIZE, req->iv, GCM_RFC4106_IV_SIZE);
++
++	return crypto_ipsec_check_assoclen(req->assoclen) ?:
++	       p10_aes_gcm_crypt(req, iv, req->assoclen - GCM_RFC4106_IV_SIZE, 0);
++}
++
+ static int p10_aes_gcm_encrypt(struct aead_request *req)
+ {
+-	return p10_aes_gcm_crypt(req, 1);
++	return p10_aes_gcm_crypt(req, req->iv, req->assoclen, 1);
+ }
+ 
+ static int p10_aes_gcm_decrypt(struct aead_request *req)
+ {
+-	return p10_aes_gcm_crypt(req, 0);
++	return p10_aes_gcm_crypt(req, req->iv, req->assoclen, 0);
+ }
+ 
+-static struct aead_alg gcm_aes_alg = {
++static struct aead_alg gcm_aes_algs[] = {{
+ 	.ivsize			= GCM_IV_SIZE,
+ 	.maxauthsize		= 16,
+ 
+@@ -321,23 +382,57 @@ static struct aead_alg gcm_aes_alg = {
+ 	.encrypt		= p10_aes_gcm_encrypt,
+ 	.decrypt		= p10_aes_gcm_decrypt,
+ 
+-	.base.cra_name		= "gcm(aes)",
+-	.base.cra_driver_name	= "aes_gcm_p10",
++	.base.cra_name		= "__gcm(aes)",
++	.base.cra_driver_name	= "__aes_gcm_p10",
+ 	.base.cra_priority	= 2100,
+ 	.base.cra_blocksize	= 1,
+-	.base.cra_ctxsize	= sizeof(struct p10_aes_gcm_ctx),
++	.base.cra_ctxsize	= sizeof(struct p10_aes_gcm_ctx)+
++				  4 * sizeof(u64[2]),
+ 	.base.cra_module	= THIS_MODULE,
+-};
++	.base.cra_flags		= CRYPTO_ALG_INTERNAL,
++}, {
++	.ivsize			= GCM_RFC4106_IV_SIZE,
++	.maxauthsize		= 16,
++	.setkey			= rfc4106_setkey,
++	.setauthsize		= rfc4106_setauthsize,
++	.encrypt		= rfc4106_encrypt,
++	.decrypt		= rfc4106_decrypt,
++
++	.base.cra_name		= "__rfc4106(gcm(aes))",
++	.base.cra_driver_name	= "__rfc4106_aes_gcm_p10",
++	.base.cra_priority	= 2100,
++	.base.cra_blocksize	= 1,
++	.base.cra_ctxsize	= sizeof(struct p10_aes_gcm_ctx) +
++				  4 * sizeof(u64[2]),
++	.base.cra_module	= THIS_MODULE,
++	.base.cra_flags		= CRYPTO_ALG_INTERNAL,
++}};
++
++static struct simd_aead_alg *p10_simd_aeads[ARRAY_SIZE(gcm_aes_algs)];
+ 
+ static int __init p10_init(void)
+ {
+-	return crypto_register_aead(&gcm_aes_alg);
++	int ret;
++
++	if (!cpu_has_feature(PPC_FEATURE2_ARCH_3_1))
++		return 0;
++
++	ret = simd_register_aeads_compat(gcm_aes_algs,
++					 ARRAY_SIZE(gcm_aes_algs),
++					 p10_simd_aeads);
++	if (ret) {
++		simd_unregister_aeads(gcm_aes_algs, ARRAY_SIZE(gcm_aes_algs),
++				      p10_simd_aeads);
++		return ret;
++	}
++	return 0;
+ }
+ 
+ static void __exit p10_exit(void)
+ {
+-	crypto_unregister_aead(&gcm_aes_alg);
++	simd_unregister_aeads(gcm_aes_algs, ARRAY_SIZE(gcm_aes_algs),
++			      p10_simd_aeads);
+ }
+ 
+-module_cpu_feature_match(PPC_MODULE_FEATURE_P10, p10_init);
++module_init(p10_init);
+ module_exit(p10_exit);
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-qat-qat_4xxx-fix-off-by-one-in-uof_get_name.patch b/queue-6.6/crypto-qat-qat_4xxx-fix-off-by-one-in-uof_get_name.patch
new file mode 100644
index 00000000000..d29c159515c
--- /dev/null
+++ b/queue-6.6/crypto-qat-qat_4xxx-fix-off-by-one-in-uof_get_name.patch
@@ -0,0 +1,37 @@
+From a3515d8a92efd2415f61537553346218c2527b36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Sep 2024 13:05:08 +0300
+Subject: crypto: qat/qat_4xxx - fix off by one in uof_get_name()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 475b5098043eef6e72751aadeab687992a5b63d1 ]
+
+The fw_objs[] array has "num_objs" elements so the > needs to be >= to
+prevent an out of bounds read.
+
+Fixes: 10484c647af6 ("crypto: qat - refactor fw config logic for 4xxx")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
+index 615af08832076..403f073714450 100644
+--- a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
++++ b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
+@@ -473,7 +473,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num,
+ 	else
+ 		id = -EINVAL;
+ 
+-	if (id < 0 || id > num_objs)
++	if (id < 0 || id >= num_objs)
+ 		return NULL;
+ 
+ 	return fw_objs[id];
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-qat-remove-check-after-debugfs_create_dir.patch b/queue-6.6/crypto-qat-remove-check-after-debugfs_create_dir.patch
new file mode 100644
index 00000000000..108f579547c
--- /dev/null
+++ b/queue-6.6/crypto-qat-remove-check-after-debugfs_create_dir.patch
@@ -0,0 +1,76 @@
+From ce966d261de7d9147f257d397eb4d5ec273d03c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 10:42:51 +0100
+Subject: crypto: qat - remove check after debugfs_create_dir()
+
+From: Cabiddu, Giovanni <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 23717055a79981daf7fafa09a4b0d7566f8384aa ]
+
+The debugfs functions are guaranteed to return a valid error code
+instead of NULL upon failure. Consequently, the driver can directly
+propagate any error returned without additional checks.
+
+Remove the unnecessary `if` statement after debugfs_create_dir(). If
+this function fails, the error code is stored in accel_dev->debugfs_dir
+and utilized in subsequent debugfs calls.
+
+Additionally, since accel_dev->debugfs_dir is assured to be non-NULL,
+remove the superfluous NULL pointer checks within the adf_dbgfs_add()
+and adf_dbgfs_rm().
+
+Fixes: 9260db6640a6 ("crypto: qat - move dbgfs init to separate file")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_dbgfs.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c b/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c
+index 04845f8d72be6..056fc59b5ae61 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_dbgfs.c
+@@ -19,18 +19,13 @@
+ void adf_dbgfs_init(struct adf_accel_dev *accel_dev)
+ {
+ 	char name[ADF_DEVICE_NAME_LENGTH];
+-	void *ret;
+ 
+ 	/* Create dev top level debugfs entry */
+ 	snprintf(name, sizeof(name), "%s%s_%s", ADF_DEVICE_NAME_PREFIX,
+ 		 accel_dev->hw_device->dev_class->name,
+ 		 pci_name(accel_dev->accel_pci_dev.pci_dev));
+ 
+-	ret = debugfs_create_dir(name, NULL);
+-	if (IS_ERR_OR_NULL(ret))
+-		return;
+-
+-	accel_dev->debugfs_dir = ret;
++	accel_dev->debugfs_dir = debugfs_create_dir(name, NULL);
+ 
+ 	adf_cfg_dev_dbgfs_add(accel_dev);
+ }
+@@ -56,9 +51,6 @@ EXPORT_SYMBOL_GPL(adf_dbgfs_exit);
+  */
+ void adf_dbgfs_add(struct adf_accel_dev *accel_dev)
+ {
+-	if (!accel_dev->debugfs_dir)
+-		return;
+-
+ 	if (!accel_dev->is_vf) {
+ 		adf_fw_counters_dbgfs_add(accel_dev);
+ 		adf_heartbeat_dbgfs_add(accel_dev);
+@@ -71,9 +63,6 @@ void adf_dbgfs_add(struct adf_accel_dev *accel_dev)
+  */
+ void adf_dbgfs_rm(struct adf_accel_dev *accel_dev)
+ {
+-	if (!accel_dev->debugfs_dir)
+-		return;
+-
+ 	if (!accel_dev->is_vf) {
+ 		adf_heartbeat_dbgfs_rm(accel_dev);
+ 		adf_fw_counters_dbgfs_rm(accel_dev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/crypto-qat-remove-faulty-arbiter-config-reset.patch b/queue-6.6/crypto-qat-remove-faulty-arbiter-config-reset.patch
new file mode 100644
index 00000000000..16b3e0d290f
--- /dev/null
+++ b/queue-6.6/crypto-qat-remove-faulty-arbiter-config-reset.patch
@@ -0,0 +1,45 @@
+From a59962a17449eeaeaeac3284fa1644376543f588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 14:42:40 +0100
+Subject: crypto: qat - remove faulty arbiter config reset
+
+From: Ahsan Atta <ahsan.atta@intel.com>
+
+[ Upstream commit 70199359902f1c7187dcb28a1be679a7081de7cc ]
+
+Resetting the service arbiter config can cause potential issues
+related to response ordering and ring flow control check in the
+event of AER or device hang. This is because it results in changing
+the default response ring size from 32 bytes to 16 bytes. The service
+arbiter config reset also disables response ring flow control check.
+Thus, by removing this reset we can prevent the service arbiter from
+being configured inappropriately, which leads to undesired device
+behaviour in the event of errors.
+
+Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator")
+Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c b/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c
+index da69566992467..dd9a31c20bc9c 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_hw_arbiter.c
+@@ -90,10 +90,6 @@ void adf_exit_arb(struct adf_accel_dev *accel_dev)
+ 
+ 	hw_data->get_arb_info(&info);
+ 
+-	/* Reset arbiter configuration */
+-	for (i = 0; i < ADF_ARB_NUM; i++)
+-		WRITE_CSR_ARB_SARCONFIG(csr, arb_off, i, 0);
+-
+ 	/* Unmap worker threads to service arbiters */
+ 	for (i = 0; i < hw_data->num_engines; i++)
+ 		WRITE_CSR_ARB_WT2SAM(csr, arb_off, wt_off, i, 0);
+-- 
+2.43.0
+
diff --git a/queue-6.6/dax-delete-a-stale-directory-pmem.patch b/queue-6.6/dax-delete-a-stale-directory-pmem.patch
new file mode 100644
index 00000000000..f50724c5cf7
--- /dev/null
+++ b/queue-6.6/dax-delete-a-stale-directory-pmem.patch
@@ -0,0 +1,61 @@
+From 4482a7a426c1edfbfa6307924954b17fbd79346d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 03:11:25 -0700
+Subject: dax: delete a stale directory pmem
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit b8e6d7ce50673c39514921ac61f7af00bbb58b87 ]
+
+After commit: 83762cb5c7c4 ("dax: Kill DEV_DAX_PMEM_COMPAT") the pmem/
+directory is not needed anymore and Makefile changes were made
+accordingly in this commit, but there is a Makefile and pmem.c in pmem/
+which are now stale and pmem.c is empty, remove them.
+
+Fixes: 83762cb5c7c4 ("dax: Kill DEV_DAX_PMEM_COMPAT")
+Suggested-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Link: https://patch.msgid.link/20241017101144.1654085-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Ira Weiny <ira.weiny@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/pmem/Makefile |  7 -------
+ drivers/dax/pmem/pmem.c   | 10 ----------
+ 2 files changed, 17 deletions(-)
+ delete mode 100644 drivers/dax/pmem/Makefile
+ delete mode 100644 drivers/dax/pmem/pmem.c
+
+diff --git a/drivers/dax/pmem/Makefile b/drivers/dax/pmem/Makefile
+deleted file mode 100644
+index 191c31f0d4f00..0000000000000
+--- a/drivers/dax/pmem/Makefile
++++ /dev/null
+@@ -1,7 +0,0 @@
+-# SPDX-License-Identifier: GPL-2.0-only
+-obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem.o
+-obj-$(CONFIG_DEV_DAX_PMEM) += dax_pmem_core.o
+-
+-dax_pmem-y := pmem.o
+-dax_pmem_core-y := core.o
+-dax_pmem_compat-y := compat.o
+diff --git a/drivers/dax/pmem/pmem.c b/drivers/dax/pmem/pmem.c
+deleted file mode 100644
+index dfe91a2990fec..0000000000000
+--- a/drivers/dax/pmem/pmem.c
++++ /dev/null
+@@ -1,10 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/* Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved. */
+-#include <linux/percpu-refcount.h>
+-#include <linux/memremap.h>
+-#include <linux/module.h>
+-#include <linux/pfn_t.h>
+-#include <linux/nd.h>
+-#include "../bus.h"
+-
+-
+-- 
+2.43.0
+
diff --git a/queue-6.6/doc-rcu-update-printed-dynticks-counter-bits.patch b/queue-6.6/doc-rcu-update-printed-dynticks-counter-bits.patch
new file mode 100644
index 00000000000..a53cc522ad2
--- /dev/null
+++ b/queue-6.6/doc-rcu-update-printed-dynticks-counter-bits.patch
@@ -0,0 +1,38 @@
+From fb41cf55fa629c326bcb9fa4782f672c4288a3c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Aug 2024 11:18:17 +0300
+Subject: doc: rcu: update printed dynticks counter bits
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 4a09e358922381f9b258e863bcd9c910584203b9 ]
+
+The stall warning prints 16 bits since commit 171476775d32
+("context_tracking: Convert state to atomic_t").
+
+Fixes: 171476775d32 ("context_tracking: Convert state to atomic_t")
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Reviewed-by: "Paul E. McKenney" <paulmck@kernel.org>
+Signed-off-by: Neeraj Upadhyay <neeraj.upadhyay@kernel.org>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/RCU/stallwarn.rst | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/RCU/stallwarn.rst b/Documentation/RCU/stallwarn.rst
+index ca7b7cd806a16..30080ff6f4062 100644
+--- a/Documentation/RCU/stallwarn.rst
++++ b/Documentation/RCU/stallwarn.rst
+@@ -249,7 +249,7 @@ ticks this GP)" indicates that this CPU has not taken any scheduling-clock
+ interrupts during the current stalled grace period.
+ 
+ The "idle=" portion of the message prints the dyntick-idle state.
+-The hex number before the first "/" is the low-order 12 bits of the
++The hex number before the first "/" is the low-order 16 bits of the
+ dynticks counter, which will have an even-numbered value if the CPU
+ is in dyntick-idle mode and an odd-numbered value otherwise.  The hex
+ number between the two "/"s is the value of the nesting, which will be
+-- 
+2.43.0
+
diff --git a/queue-6.6/drivers-soc-xilinx-add-the-missing-kfree-in-xlnx_add.patch b/queue-6.6/drivers-soc-xilinx-add-the-missing-kfree-in-xlnx_add.patch
new file mode 100644
index 00000000000..3332f47efbf
--- /dev/null
+++ b/queue-6.6/drivers-soc-xilinx-add-the-missing-kfree-in-xlnx_add.patch
@@ -0,0 +1,42 @@
+From c54d48995dcb4db59670253ee8c5badc0cab8ab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2024 14:51:55 +0800
+Subject: drivers: soc: xilinx: add the missing kfree in
+ xlnx_add_cb_for_suspend()
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit 44ed4f90a97ff6f339e50ac01db71544e0990efc ]
+
+If we fail to allocate memory for cb_data by kmalloc, the memory
+allocation for eve_data is never freed, add the missing kfree()
+in the error handling path.
+
+Fixes: 05e5ba40ea7a ("driver: soc: xilinx: Add support of multiple callbacks for same event in event management driver")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Link: https://lore.kernel.org/r/20240706065155.452764-1-cuigaosheng1@huawei.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/xilinx/xlnx_event_manager.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
+index 098a2ecfd5c68..8f6a2614d8eb4 100644
+--- a/drivers/soc/xilinx/xlnx_event_manager.c
++++ b/drivers/soc/xilinx/xlnx_event_manager.c
+@@ -174,8 +174,10 @@ static int xlnx_add_cb_for_suspend(event_cb_func_t cb_fun, void *data)
+ 	INIT_LIST_HEAD(&eve_data->cb_list_head);
+ 
+ 	cb_data = kmalloc(sizeof(*cb_data), GFP_KERNEL);
+-	if (!cb_data)
++	if (!cb_data) {
++		kfree(eve_data);
+ 		return -ENOMEM;
++	}
+ 	cb_data->eve_cb = cb_fun;
+ 	cb_data->agent_data = data;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch b/queue-6.6/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch
new file mode 100644
index 00000000000..881552b876d
--- /dev/null
+++ b/queue-6.6/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch
@@ -0,0 +1,41 @@
+From b22668c1c897b77681acbb3573dcc35adcb62d93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 14:01:37 +0000
+Subject: drm/amd/display: Fix null check for pipe_ctx->plane_state in
+ hwss_setup_dpp
+
+From: Zicheng Qu <quzicheng@huawei.com>
+
+[ Upstream commit 2bc96c95070571c6c824e0d4c7783bee25a37876 ]
+
+This commit addresses a null pointer dereference issue in
+hwss_setup_dpp(). The issue could occur when pipe_ctx->plane_state is
+null. The fix adds a check to ensure `pipe_ctx->plane_state` is not null
+before accessing. This prevents a null pointer dereference.
+
+Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence")
+Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+index f99ec1b0efaff..2eae1fd95fd06 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+@@ -727,6 +727,9 @@ void hwss_setup_dpp(union block_sequence_params *params)
+ 	struct dpp *dpp = pipe_ctx->plane_res.dpp;
+ 	struct dc_plane_state *plane_state = pipe_ctx->plane_state;
+ 
++	if (!plane_state)
++		return;
++
+ 	if (dpp && dpp->funcs->dpp_setup) {
+ 		// program the input csc
+ 		dpp->funcs->dpp_setup(dpp,
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-amdkfd-fix-wrong-usage-of-init_work.patch b/queue-6.6/drm-amdkfd-fix-wrong-usage-of-init_work.patch
new file mode 100644
index 00000000000..e2cae9e146f
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-fix-wrong-usage-of-init_work.patch
@@ -0,0 +1,49 @@
+From d11e0bc55c4c8d579832cec88d10ea57f0078803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 09:35:41 +0800
+Subject: drm/amdkfd: Fix wrong usage of INIT_WORK()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 21cae8debc6a1d243f64fa82cd1b41cb612b5c61 ]
+
+In kfd_procfs_show(), the sdma_activity_work_handler is a local variable
+and the sdma_activity_work_handler.sdma_activity_work should initialize
+with INIT_WORK_ONSTACK() instead of INIT_WORK().
+
+Fixes: 32cb59f31362 ("drm/amdkfd: Track SDMA utilization per process")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 6c90231e0aec2..fd640a061c96a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -312,8 +312,8 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr,
+ 							      attr_sdma);
+ 		struct kfd_sdma_activity_handler_workarea sdma_activity_work_handler;
+ 
+-		INIT_WORK(&sdma_activity_work_handler.sdma_activity_work,
+-					kfd_sdma_activity_worker);
++		INIT_WORK_ONSTACK(&sdma_activity_work_handler.sdma_activity_work,
++				  kfd_sdma_activity_worker);
+ 
+ 		sdma_activity_work_handler.pdd = pdd;
+ 		sdma_activity_work_handler.sdma_activity_counter = 0;
+@@ -321,6 +321,7 @@ static ssize_t kfd_procfs_show(struct kobject *kobj, struct attribute *attr,
+ 		schedule_work(&sdma_activity_work_handler.sdma_activity_work);
+ 
+ 		flush_work(&sdma_activity_work_handler.sdma_activity_work);
++		destroy_work_on_stack(&sdma_activity_work_handler.sdma_activity_work);
+ 
+ 		return snprintf(buffer, PAGE_SIZE, "%llu\n",
+ 				(sdma_activity_work_handler.sdma_activity_counter)/
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-bridge-anx7625-drop-edid-cache-on-bridge-power-o.patch b/queue-6.6/drm-bridge-anx7625-drop-edid-cache-on-bridge-power-o.patch
new file mode 100644
index 00000000000..21a89fe475c
--- /dev/null
+++ b/queue-6.6/drm-bridge-anx7625-drop-edid-cache-on-bridge-power-o.patch
@@ -0,0 +1,45 @@
+From 97fd41fe269025fa127e3ee92965eb29c2e067c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 17:29:08 +0800
+Subject: drm/bridge: anx7625: Drop EDID cache on bridge power off
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 00ae002116a14c2e6a342c4c9ae080cdbb9b4b21 ]
+
+The bridge might miss the display change events when it's powered off.
+This happens when a user changes the external monitor when the system
+is suspended and the embedded controller doesn't not wake AP up.
+
+It's also observed that one DP-to-HDMI bridge doesn't work correctly
+when there is no EDID read after it is powered on.
+
+Drop the cache to force an EDID read after system resume to fix this.
+
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240926092931.3870342-2-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index c1191ef5e8e67..412c6575e87b7 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2573,6 +2573,8 @@ static int __maybe_unused anx7625_runtime_pm_suspend(struct device *dev)
+ 	mutex_lock(&ctx->lock);
+ 
+ 	anx7625_stop_dp_work(ctx);
++	if (!ctx->pdata.panel_bridge)
++		anx7625_remove_edid(ctx);
+ 	anx7625_power_standby(ctx);
+ 
+ 	mutex_unlock(&ctx->lock);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-bridge-it6505-drop-edid-cache-on-bridge-power-of.patch b/queue-6.6/drm-bridge-it6505-drop-edid-cache-on-bridge-power-of.patch
new file mode 100644
index 00000000000..f5e9973319e
--- /dev/null
+++ b/queue-6.6/drm-bridge-it6505-drop-edid-cache-on-bridge-power-of.patch
@@ -0,0 +1,45 @@
+From 698d8b6081cdc6cdfe8aadfc9e2b5c813b7d4364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 17:29:09 +0800
+Subject: drm/bridge: it6505: Drop EDID cache on bridge power off
+
+From: Pin-yen Lin <treapking@chromium.org>
+
+[ Upstream commit 574c558ddb68591c9a4b7a95e45e935ab22c0fc6 ]
+
+The bridge might miss the display change events when it's powered off.
+This happens when a user changes the external monitor when the system
+is suspended and the embedded controller doesn't not wake AP up.
+
+It's also observed that one DP-to-HDMI bridge doesn't work correctly
+when there is no EDID read after it is powered on.
+
+Drop the cache to force an EDID read after system resume to fix this.
+
+Fixes: 11feaef69d0c ("drm/bridge: it6505: Add caching for EDID")
+Signed-off-by: Pin-yen Lin <treapking@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240926092931.3870342-3-treapking@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index 4ad527fe04f27..93eb8fba23d42 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -3104,6 +3104,8 @@ static __maybe_unused int it6505_bridge_suspend(struct device *dev)
+ {
+ 	struct it6505 *it6505 = dev_get_drvdata(dev);
+ 
++	it6505_remove_edid(it6505);
++
+ 	return it6505_poweroff(it6505);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-bridge-tc358767-fix-link-properties-discovery.patch b/queue-6.6/drm-bridge-tc358767-fix-link-properties-discovery.patch
new file mode 100644
index 00000000000..06404d645d8
--- /dev/null
+++ b/queue-6.6/drm-bridge-tc358767-fix-link-properties-discovery.patch
@@ -0,0 +1,60 @@
+From 7ad648198159b612a484f49782973a78dbb669ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 13:27:23 +0200
+Subject: drm/bridge: tc358767: Fix link properties discovery
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 2d343723c7e1f9f6d64f721f07cfdfc2993758d1 ]
+
+When a display controller driver uses DRM_BRIDGE_ATTACH_NO_CONNECTOR,
+tc358767 will behave properly and skip the creation of the connector.
+
+However, tc_get_display_props(), which is used to find out about the DP
+monitor and link, is only called from two places: .atomic_enable() and
+tc_connector_get_modes(). The latter is only used when tc358767 creates
+its own connector, i.e. when DRM_BRIDGE_ATTACH_NO_CONNECTOR is _not_
+set.
+
+Thus, the driver never finds out the link properties before get_edid()
+is called. With num_lanes of 0 and link_rate of 0 there are not many
+valid modes...
+
+Fix this by adding tc_get_display_props() call at the beginning of
+get_edid(), so that we have up to date information before looking at the
+modes.
+
+Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
+Closes: https://lore.kernel.org/all/24282420-b4dd-45b3-bb1c-fc37fe4a8205@siemens.com/
+Fixes: de5e6c027ae6 ("drm/bridge: tc358767: add drm_panel_bridge support")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Tested-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231108-tc358767-v2-2-25c5f70a2159@ideasonboard.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 7fd4a5fe03edf..6a3f29390313b 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1579,6 +1579,13 @@ static struct edid *tc_get_edid(struct drm_bridge *bridge,
+ 				struct drm_connector *connector)
+ {
+ 	struct tc_data *tc = bridge_to_tc(bridge);
++	int ret;
++
++	ret = tc_get_display_props(tc);
++	if (ret < 0) {
++		dev_err(tc->dev, "failed to read display props: %d\n", ret);
++		return 0;
++	}
+ 
+ 	return drm_get_edid(connector, &tc->aux.ddc);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch b/queue-6.6/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch
new file mode 100644
index 00000000000..7e726efaec5
--- /dev/null
+++ b/queue-6.6/drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch
@@ -0,0 +1,78 @@
+From ff5709ea9a5d12fadb1d08e39da5554505f69316 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2024 22:00:09 +0200
+Subject: drm/etnaviv: hold GPU lock across perfmon sampling
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ]
+
+The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL
+to select the pipe for the perf counter reads). To avoid clashing with
+other functions mutating the same state (e.g. etnaviv_gpu_update_clock)
+the perfmon sampling needs to hold the GPU lock.
+
+Fixes: 68dc0b295dcb ("drm/etnaviv: use 'sync points' for performance monitor requests")
+Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index 92d786f208979..ad543a7cbf073 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -1300,6 +1300,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,
+ {
+ 	u32 val;
+ 
++	mutex_lock(&gpu->lock);
++
+ 	/* disable clock gating */
+ 	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
+ 	val &= ~VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
+@@ -1311,6 +1313,8 @@ static void sync_point_perfmon_sample_pre(struct etnaviv_gpu *gpu,
+ 	gpu_write(gpu, VIVS_HI_CLOCK_CONTROL, val);
+ 
+ 	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_PRE);
++
++	mutex_unlock(&gpu->lock);
+ }
+ 
+ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
+@@ -1320,13 +1324,9 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
+ 	unsigned int i;
+ 	u32 val;
+ 
+-	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST);
+-
+-	for (i = 0; i < submit->nr_pmrs; i++) {
+-		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
++	mutex_lock(&gpu->lock);
+ 
+-		*pmr->bo_vma = pmr->sequence;
+-	}
++	sync_point_perfmon_sample(gpu, event, ETNA_PM_PROCESS_POST);
+ 
+ 	/* disable debug register */
+ 	val = gpu_read(gpu, VIVS_HI_CLOCK_CONTROL);
+@@ -1337,6 +1337,14 @@ static void sync_point_perfmon_sample_post(struct etnaviv_gpu *gpu,
+ 	val = gpu_read_power(gpu, VIVS_PM_POWER_CONTROLS);
+ 	val |= VIVS_PM_POWER_CONTROLS_ENABLE_MODULE_CLOCK_GATING;
+ 	gpu_write_power(gpu, VIVS_PM_POWER_CONTROLS, val);
++
++	mutex_unlock(&gpu->lock);
++
++	for (i = 0; i < submit->nr_pmrs; i++) {
++		const struct etnaviv_perfmon_request *pmr = submit->pmrs + i;
++
++		*pmr->bo_vma = pmr->sequence;
++	}
+ }
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-etnaviv-request-pages-from-dma32-zone-on-address.patch b/queue-6.6/drm-etnaviv-request-pages-from-dma32-zone-on-address.patch
new file mode 100644
index 00000000000..340fba31eb0
--- /dev/null
+++ b/queue-6.6/drm-etnaviv-request-pages-from-dma32-zone-on-address.patch
@@ -0,0 +1,68 @@
+From 57f29fd75f5bbc6078928f269522e4db70393bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 07:34:30 +0800
+Subject: drm/etnaviv: Request pages from DMA32 zone on addressing_limited
+
+From: Xiaolei Wang <xiaolei.wang@windriver.com>
+
+[ Upstream commit 13c96ac9a3f0f1c7ba1ff0656ea508e7fa065e7e ]
+
+Remove __GFP_HIGHMEM when requesting a page from DMA32 zone,
+and since all vivante GPUs in the system will share the same
+DMA constraints, move the check of whether to get a page from
+DMA32 to etnaviv_bind().
+
+Fixes: b72af445cd38 ("drm/etnaviv: request pages from DMA32 zone when needed")
+Suggested-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
+Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_drv.c | 10 ++++++++++
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c |  8 --------
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+index f9bc837e22bdd..85d0695e94a5f 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c
+@@ -527,6 +527,16 @@ static int etnaviv_bind(struct device *dev)
+ 	priv->num_gpus = 0;
+ 	priv->shm_gfp_mask = GFP_HIGHUSER | __GFP_RETRY_MAYFAIL | __GFP_NOWARN;
+ 
++	/*
++	 * If the GPU is part of a system with DMA addressing limitations,
++	 * request pages for our SHM backend buffers from the DMA32 zone to
++	 * hopefully avoid performance killing SWIOTLB bounce buffering.
++	 */
++	if (dma_addressing_limited(dev)) {
++		priv->shm_gfp_mask |= GFP_DMA32;
++		priv->shm_gfp_mask &= ~__GFP_HIGHMEM;
++	}
++
+ 	priv->cmdbuf_suballoc = etnaviv_cmdbuf_suballoc_new(drm->dev);
+ 	if (IS_ERR(priv->cmdbuf_suballoc)) {
+ 		dev_err(drm->dev, "Failed to create cmdbuf suballocator\n");
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index 371e1f2733f6f..92d786f208979 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -820,14 +820,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+ 	if (ret)
+ 		goto fail;
+ 
+-	/*
+-	 * If the GPU is part of a system with DMA addressing limitations,
+-	 * request pages for our SHM backend buffers from the DMA32 zone to
+-	 * hopefully avoid performance killing SWIOTLB bounce buffering.
+-	 */
+-	if (dma_addressing_limited(gpu->dev))
+-		priv->shm_gfp_mask |= GFP_DMA32;
+-
+ 	/* Create buffer: */
+ 	ret = etnaviv_cmdbuf_init(priv->cmdbuf_suballoc, &gpu->buffer,
+ 				  PAGE_SIZE);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch b/queue-6.6/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch
new file mode 100644
index 00000000000..c0cee6e4921
--- /dev/null
+++ b/queue-6.6/drm-fsl-dcu-enable-pixclk-on-ls1021a.patch
@@ -0,0 +1,88 @@
+From c5f09f3b3e988ed87e64b3a0ff2b369449cbc97f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 07:55:51 +0200
+Subject: drm: fsl-dcu: enable PIXCLK on LS1021A
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit ffcde9e44d3e18fde3d18bfff8d9318935413bfd ]
+
+The PIXCLK needs to be enabled in SCFG before accessing certain DCU
+registers, or the access will hang. For simplicity, the PIXCLK is enabled
+unconditionally, resulting in increased power consumption.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Fixes: 109eee2f2a18 ("drm/layerscape: Add Freescale DCU DRM driver")
+Acked-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240926055552.1632448-2-alexander.stein@ew.tq-group.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/fsl-dcu/Kconfig           |  1 +
+ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c | 15 +++++++++++++++
+ drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h |  3 +++
+ 3 files changed, 19 insertions(+)
+
+diff --git a/drivers/gpu/drm/fsl-dcu/Kconfig b/drivers/gpu/drm/fsl-dcu/Kconfig
+index 5ca71ef873259..c9ee98693b48a 100644
+--- a/drivers/gpu/drm/fsl-dcu/Kconfig
++++ b/drivers/gpu/drm/fsl-dcu/Kconfig
+@@ -8,6 +8,7 @@ config DRM_FSL_DCU
+ 	select DRM_PANEL
+ 	select REGMAP_MMIO
+ 	select VIDEOMODE_HELPERS
++	select MFD_SYSCON if SOC_LS1021A
+ 	help
+ 	  Choose this option if you have an Freescale DCU chipset.
+ 	  If M is selected the module will be called fsl-dcu-drm.
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+index a395f93449f36..a23f3f5c5530b 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+@@ -100,6 +100,7 @@ static void fsl_dcu_irq_uninstall(struct drm_device *dev)
+ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
+ {
+ 	struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
++	struct regmap *scfg;
+ 	int ret;
+ 
+ 	ret = fsl_dcu_drm_modeset_init(fsl_dev);
+@@ -108,6 +109,20 @@ static int fsl_dcu_load(struct drm_device *dev, unsigned long flags)
+ 		return ret;
+ 	}
+ 
++	scfg = syscon_regmap_lookup_by_compatible("fsl,ls1021a-scfg");
++	if (PTR_ERR(scfg) != -ENODEV) {
++		/*
++		 * For simplicity, enable the PIXCLK unconditionally,
++		 * resulting in increased power consumption. Disabling
++		 * the clock in PM or on unload could be implemented as
++		 * a future improvement.
++		 */
++		ret = regmap_update_bits(scfg, SCFG_PIXCLKCR, SCFG_PIXCLKCR_PXCEN,
++					 SCFG_PIXCLKCR_PXCEN);
++		if (ret < 0)
++			return dev_err_probe(dev->dev, ret, "failed to enable pixclk\n");
++	}
++
+ 	ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
+ 	if (ret < 0) {
+ 		dev_err(dev->dev, "failed to initialize vblank\n");
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
+index e2049a0e8a92a..566396013c04a 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.h
+@@ -160,6 +160,9 @@
+ #define FSL_DCU_ARGB4444		12
+ #define FSL_DCU_YUV422			14
+ 
++#define SCFG_PIXCLKCR			0x28
++#define SCFG_PIXCLKCR_PXCEN		BIT(31)
++
+ #define VF610_LAYER_REG_NUM		9
+ #define LS1021A_LAYER_REG_NUM		10
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-imx-dcss-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.6/drm-imx-dcss-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644
index 00000000000..b0667fe4cb5
--- /dev/null
+++ b/queue-6.6/drm-imx-dcss-use-irqf_no_autoen-flag-in-request_irq.patch
@@ -0,0 +1,49 @@
+From 25e064bb640a84d855885ee8fe7f7c83d6dc14af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 16:30:16 +0800
+Subject: drm/imx/dcss: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 1af01e14db7e0b45ae502d822776a58c86688763 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 9021c317b770 ("drm/imx: Add initial support for DCSS on iMX8MQ")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240912083020.3720233-2-ruanjinjie@huawei.com
+[DB: fixed the subject]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/dcss/dcss-crtc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/dcss/dcss-crtc.c b/drivers/gpu/drm/imx/dcss/dcss-crtc.c
+index 31267c00782fc..af91e45b5d13b 100644
+--- a/drivers/gpu/drm/imx/dcss/dcss-crtc.c
++++ b/drivers/gpu/drm/imx/dcss/dcss-crtc.c
+@@ -206,15 +206,13 @@ int dcss_crtc_init(struct dcss_crtc *crtc, struct drm_device *drm)
+ 	if (crtc->irq < 0)
+ 		return crtc->irq;
+ 
+-	ret = request_irq(crtc->irq, dcss_crtc_irq_handler,
+-			  0, "dcss_drm", crtc);
++	ret = request_irq(crtc->irq, dcss_crtc_irq_handler, IRQF_NO_AUTOEN,
++			  "dcss_drm", crtc);
+ 	if (ret) {
+ 		dev_err(dcss->dev, "irq request failed with %d.\n", ret);
+ 		return ret;
+ 	}
+ 
+-	disable_irq(crtc->irq);
+-
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.6/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644
index 00000000000..1f2e6ad7ae5
--- /dev/null
+++ b/queue-6.6/drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch
@@ -0,0 +1,48 @@
+From c75166411c734d2ff1a4a5436229284df169c62a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 16:30:18 +0800
+Subject: drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 40004709a3d3b07041a473a163ca911ef04ab8bd ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 47b1be5c0f4e ("staging: imx/drm: request irq only after adding the crtc")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240912083020.3720233-4-ruanjinjie@huawei.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+index 89585b31b985e..5f423a2e0ede3 100644
+--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+@@ -410,14 +410,12 @@ static int ipu_drm_bind(struct device *dev, struct device *master, void *data)
+ 	}
+ 
+ 	ipu_crtc->irq = ipu_plane_irq(ipu_crtc->plane[0]);
+-	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler, 0,
+-			"imx_drm", ipu_crtc);
++	ret = devm_request_irq(ipu_crtc->dev, ipu_crtc->irq, ipu_irq_handler,
++			       IRQF_NO_AUTOEN, "imx_drm", ipu_crtc);
+ 	if (ret < 0) {
+ 		dev_err(ipu_crtc->dev, "irq request failed with %d.\n", ret);
+ 		return ret;
+ 	}
+-	/* Only enable IRQ when we actually need it to trigger work. */
+-	disable_irq(ipu_crtc->irq);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch b/queue-6.6/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch
new file mode 100644
index 00000000000..70a559c8ea7
--- /dev/null
+++ b/queue-6.6/drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch
@@ -0,0 +1,52 @@
+From 428c58242c39e00e5a46466310e5971f3cb495f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 18:46:40 +0300
+Subject: drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 53bd7c1c0077db533472ae32799157758302ef48 ]
+
+The INTERVAL_TREE_DEFINE() uncoditionally provides a bunch of helper
+functions which in some cases may be not used. This, in particular,
+prevents kernel builds with clang, `make W=1` and CONFIG_WERROR=y:
+
+.../drm/drm_mm.c:152:1: error: unused function 'drm_mm_interval_tree_insert' [-Werror,-Wunused-function]
+  152 | INTERVAL_TREE_DEFINE(struct drm_mm_node, rb,
+      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  153 |                      u64, __subtree_last,
+      |                      ~~~~~~~~~~~~~~~~~~~~
+  154 |                      START, LAST, static inline, drm_mm_interval_tree)
+      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by marking drm_mm_interval_tree*() functions with __maybe_unused.
+
+See also commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
+inline functions for W=1 build").
+
+Fixes: 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240829154640.1120050-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
+index 8257f9d4f6190..22a373eaffefd 100644
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -151,7 +151,7 @@ static void show_leaks(struct drm_mm *mm) { }
+ 
+ INTERVAL_TREE_DEFINE(struct drm_mm_node, rb,
+ 		     u64, __subtree_last,
+-		     START, LAST, static inline, drm_mm_interval_tree)
++		     START, LAST, static inline __maybe_unused, drm_mm_interval_tree)
+ 
+ struct drm_mm_node *
+ __drm_mm_interval_first(const struct drm_mm *mm, u64 start, u64 last)
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch b/queue-6.6/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch
new file mode 100644
index 00000000000..5acb663c1b0
--- /dev/null
+++ b/queue-6.6/drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch
@@ -0,0 +1,47 @@
+From 2fbd317754833236708243e2f6888f0082daa70d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 16:30:20 +0800
+Subject: drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 394679f322649d06fea3c646ba65f5a0887f52c3 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Patchwork: https://patchwork.freedesktop.org/patch/614075/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index 7923129363b0a..c9edaa6d76369 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -1432,15 +1432,13 @@ static int a6xx_gmu_get_irq(struct a6xx_gmu *gmu, struct platform_device *pdev,
+ 
+ 	irq = platform_get_irq_byname(pdev, name);
+ 
+-	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH, name, gmu);
++	ret = request_irq(irq, handler, IRQF_TRIGGER_HIGH | IRQF_NO_AUTOEN, name, gmu);
+ 	if (ret) {
+ 		DRM_DEV_ERROR(&pdev->dev, "Unable to get interrupt %s %d\n",
+ 			      name, ret);
+ 		return ret;
+ 	}
+ 
+-	disable_irq(irq);
+-
+ 	return irq;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-dpu-cast-crtc_clk-calculation-to-u64-in-_dpu.patch b/queue-6.6/drm-msm-dpu-cast-crtc_clk-calculation-to-u64-in-_dpu.patch
new file mode 100644
index 00000000000..622b9185c10
--- /dev/null
+++ b/queue-6.6/drm-msm-dpu-cast-crtc_clk-calculation-to-u64-in-_dpu.patch
@@ -0,0 +1,46 @@
+From c2c2a39699e0bcddbdce2b29bcdfcd95e0799bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 14:42:10 -0500
+Subject: drm/msm/dpu: cast crtc_clk calculation to u64 in
+ _dpu_core_perf_calc_clk()
+
+From: Zichen Xie <zichenxie0106@gmail.com>
+
+[ Upstream commit 20c7b42d9dbd048019bfe0af39229e3014007a98 ]
+
+There may be a potential integer overflow issue in
+_dpu_core_perf_calc_clk(). crtc_clk is defined as u64, while
+mode->vtotal, mode->hdisplay, and drm_mode_vrefresh(mode) are defined as
+a smaller data type. The result of the calculation will be limited to
+"int" in this case without correct casting. In screen with high
+resolution and high refresh rate, integer overflow may happen.
+So, we recommend adding an extra cast to prevent potential
+integer overflow.
+
+Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display")
+Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/622206/
+Link: https://lore.kernel.org/r/20241029194209.23684-1-zichenxie0106@gmail.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+index 68fae048a9a83..260accc151d4b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+@@ -80,7 +80,7 @@ static u64 _dpu_core_perf_calc_clk(const struct dpu_perf_cfg *perf_cfg,
+ 
+ 	mode = &state->adjusted_mode;
+ 
+-	crtc_clk = mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
++	crtc_clk = (u64)mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
+ 
+ 	drm_atomic_crtc_for_each_plane(plane, crtc) {
+ 		pstate = to_dpu_plane_state(plane->state);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch b/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch
new file mode 100644
index 00000000000..2aeecc2bec6
--- /dev/null
+++ b/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch
@@ -0,0 +1,49 @@
+From b16c75cb36dfde81341f88db429a0de0e3c8a533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 06:26:15 +0300
+Subject: drm/msm/dpu: drop LM_3 / LM_4 on MSM8998
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c59afe50773d5c972f6684f9bbd9a2ddb2fb92fa ]
+
+On the MSM8998 platform ther are no LM_3 and LM_4 blocks. Drop them from
+the MSM8998 catalog.
+
+Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog")
+Reported-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612585/
+Link: https://lore.kernel.org/r/20240905-dpu-fix-sdm845-catalog-v1-3-3363d03998bd@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h  | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h
+index 43c47a19cd94f..a857ce8e385fc 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h
+@@ -157,18 +157,6 @@ static const struct dpu_lm_cfg msm8998_lm[] = {
+ 		.sblk = &msm8998_lm_sblk,
+ 		.lm_pair = LM_5,
+ 		.pingpong = PINGPONG_2,
+-	}, {
+-		.name = "lm_3", .id = LM_3,
+-		.base = 0x47000, .len = 0x320,
+-		.features = MIXER_MSM8998_MASK,
+-		.sblk = &msm8998_lm_sblk,
+-		.pingpong = PINGPONG_NONE,
+-	}, {
+-		.name = "lm_4", .id = LM_4,
+-		.base = 0x48000, .len = 0x320,
+-		.features = MIXER_MSM8998_MASK,
+-		.sblk = &msm8998_lm_sblk,
+-		.pingpong = PINGPONG_NONE,
+ 	}, {
+ 		.name = "lm_5", .id = LM_5,
+ 		.base = 0x49000, .len = 0x320,
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch b/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch
new file mode 100644
index 00000000000..3a6450c7c0b
--- /dev/null
+++ b/queue-6.6/drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch
@@ -0,0 +1,48 @@
+From 30bce4faee18206601c9e2bca3a3dc9a6a83c3db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 06:26:14 +0300
+Subject: drm/msm/dpu: drop LM_3 / LM_4 on SDM845
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit d39271061d67c6fcbe8f361c532b493069232cf8 ]
+
+On the SDM845 platform ther are no LM_3 and LM_4 blocks. Drop them from
+the SDM845 catalog.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612586/
+Link: https://lore.kernel.org/r/20240905-dpu-fix-sdm845-catalog-v1-2-3363d03998bd@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h   | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
+index da0719588069b..3749c014870d3 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
+@@ -156,18 +156,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = {
+ 		.lm_pair = LM_5,
+ 		.pingpong = PINGPONG_2,
+ 		.dspp = DSPP_2,
+-	}, {
+-		.name = "lm_3", .id = LM_3,
+-		.base = 0x0, .len = 0x320,
+-		.features = MIXER_SDM845_MASK,
+-		.sblk = &sdm845_lm_sblk,
+-		.pingpong = PINGPONG_NONE,
+-	}, {
+-		.name = "lm_4", .id = LM_4,
+-		.base = 0x0, .len = 0x320,
+-		.features = MIXER_SDM845_MASK,
+-		.sblk = &sdm845_lm_sblk,
+-		.pingpong = PINGPONG_NONE,
+ 	}, {
+ 		.name = "lm_5", .id = LM_5,
+ 		.base = 0x49000, .len = 0x320,
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-dpu-on-sdm845-move-dspp_3-to-lm_5-block.patch b/queue-6.6/drm-msm-dpu-on-sdm845-move-dspp_3-to-lm_5-block.patch
new file mode 100644
index 00000000000..1c12b8ea6d7
--- /dev/null
+++ b/queue-6.6/drm-msm-dpu-on-sdm845-move-dspp_3-to-lm_5-block.patch
@@ -0,0 +1,45 @@
+From 7167bc5f8d87c338575757bcf71023b9f88d99e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 06:26:13 +0300
+Subject: drm/msm/dpu: on SDM845 move DSPP_3 to LM_5 block
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 768a272d5357269b17b4b06dd8647e21bdc0ca3c ]
+
+On the SDM845 platform the DSPP_3 is used by the LM_5. Correct
+corresponding entries in the sdm845_lm array.
+
+Fixes: c72375172194 ("drm/msm/dpu/catalog: define DSPP blocks found on sdm845")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/612584/
+Link: https://lore.kernel.org/r/20240905-dpu-fix-sdm845-catalog-v1-1-3363d03998bd@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
+index 88a5177dfdb73..da0719588069b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_4_0_sdm845.h
+@@ -162,7 +162,6 @@ static const struct dpu_lm_cfg sdm845_lm[] = {
+ 		.features = MIXER_SDM845_MASK,
+ 		.sblk = &sdm845_lm_sblk,
+ 		.pingpong = PINGPONG_NONE,
+-		.dspp = DSPP_3,
+ 	}, {
+ 		.name = "lm_4", .id = LM_4,
+ 		.base = 0x0, .len = 0x320,
+@@ -176,6 +175,7 @@ static const struct dpu_lm_cfg sdm845_lm[] = {
+ 		.sblk = &sdm845_lm_sblk,
+ 		.lm_pair = LM_2,
+ 		.pingpong = PINGPONG_3,
++		.dspp = DSPP_3,
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-msm-gpu-check-the-status-of-registration-to-pm-q.patch b/queue-6.6/drm-msm-gpu-check-the-status-of-registration-to-pm-q.patch
new file mode 100644
index 00000000000..b3b87728c19
--- /dev/null
+++ b/queue-6.6/drm-msm-gpu-check-the-status-of-registration-to-pm-q.patch
@@ -0,0 +1,51 @@
+From cf0517a3070016bf42cc40ff4daf2666ed79e803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 12:18:11 +0100
+Subject: drm/msm/gpu: Check the status of registration to PM QoS
+
+From: Lukasz Luba <lukasz.luba@arm.com>
+
+[ Upstream commit 8f32ddd87e499ba6d2dc74ce30b6932baf1e1fc3 ]
+
+There is a need to check the returned value of the registration function.
+In case of returned error, print that and stop the init process.
+
+Fixes: 7c0ffcd40b16 ("drm/msm/gpu: Respect PM QoS constraints")
+Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/620336/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gpu_devfreq.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gpu_devfreq.c b/drivers/gpu/drm/msm/msm_gpu_devfreq.c
+index ea70c1c32d940..6970b0f7f457c 100644
+--- a/drivers/gpu/drm/msm/msm_gpu_devfreq.c
++++ b/drivers/gpu/drm/msm/msm_gpu_devfreq.c
+@@ -140,6 +140,7 @@ void msm_devfreq_init(struct msm_gpu *gpu)
+ {
+ 	struct msm_gpu_devfreq *df = &gpu->devfreq;
+ 	struct msm_drm_private *priv = gpu->dev->dev_private;
++	int ret;
+ 
+ 	/* We need target support to do devfreq */
+ 	if (!gpu->funcs->gpu_busy)
+@@ -156,8 +157,12 @@ void msm_devfreq_init(struct msm_gpu *gpu)
+ 
+ 	mutex_init(&df->lock);
+ 
+-	dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq,
+-			       DEV_PM_QOS_MIN_FREQUENCY, 0);
++	ret = dev_pm_qos_add_request(&gpu->pdev->dev, &df->boost_freq,
++				     DEV_PM_QOS_MIN_FREQUENCY, 0);
++	if (ret < 0) {
++		DRM_DEV_ERROR(&gpu->pdev->dev, "Couldn't initialize QoS\n");
++		return;
++	}
+ 
+ 	msm_devfreq_profile.initial_freq = gpu->fast_rate;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-nouveau-gr-gf100-fix-missing-unlock-in-gf100_gr_.patch b/queue-6.6/drm-nouveau-gr-gf100-fix-missing-unlock-in-gf100_gr_.patch
new file mode 100644
index 00000000000..312a6ea915d
--- /dev/null
+++ b/queue-6.6/drm-nouveau-gr-gf100-fix-missing-unlock-in-gf100_gr_.patch
@@ -0,0 +1,41 @@
+From f7efa48ad8be7f8107e59c901435b0d463062fce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 01:38:44 +0800
+Subject: drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
+
+From: Li Huafei <lihuafei1@huawei.com>
+
+[ Upstream commit a2f599046c671d6b46d93aed95b37241ce4504cf ]
+
+When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex
+before returning the error.
+
+Fixes smatch warning:
+
+drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'.
+
+Fixes: ca081fff6ecc ("drm/nouveau/gr/gf100-: generate golden context during first object alloc")
+Signed-off-by: Li Huafei <lihuafei1@huawei.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241026173844.2392679-1-lihuafei1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+index 3648868bb9fc5..cd533d16b9663 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -443,6 +443,7 @@ gf100_gr_chan_new(struct nvkm_gr *base, struct nvkm_chan *fifoch,
+ 		ret = gf100_grctx_generate(gr, chan, fifoch->inst);
+ 		if (ret) {
+ 			nvkm_error(&base->engine.subdev, "failed to construct context\n");
++			mutex_unlock(&gr->fecs.mutex);
+ 			return ret;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch b/queue-6.6/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch
new file mode 100644
index 00000000000..87c9ee2d397
--- /dev/null
+++ b/queue-6.6/drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch
@@ -0,0 +1,75 @@
+From 330047ce36067b351de405490a3f6dca7d5f6787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 16:50:29 +0300
+Subject: drm/omap: Fix locking in omap_gem_new_dmabuf()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit e6a1c4037227539373c8cf484ace83833e2ad6a2 ]
+
+omap_gem_new_dmabuf() creates the new gem object, and then takes and
+holds the omap_obj->lock for the rest of the function. This has two
+issues:
+
+- omap_gem_free_object(), which is called in the error paths, also takes
+  the same lock, leading to deadlock
+- Even if the above wouldn't happen, in the error cases
+  omap_gem_new_dmabuf() still unlocks omap_obj->lock, even after the
+  omap_obj has already been freed.
+
+Furthermore, I don't think there's any reason to take the lock at all,
+as the object was just created and not yet shared with anyone else.
+
+To fix all this, drop taking the lock.
+
+Fixes: 3cbd0c587b12 ("drm/omap: gem: Replace struct_mutex usage with omap_obj private lock")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/511b99d7-aade-4f92-bd3e-63163a13d617@stanley.mountain/
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240806-omapdrm-misc-fixes-v1-3-15d31aea0831@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_gem.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
+index c48fa531ca321..68117eed702be 100644
+--- a/drivers/gpu/drm/omapdrm/omap_gem.c
++++ b/drivers/gpu/drm/omapdrm/omap_gem.c
+@@ -1395,8 +1395,6 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,
+ 
+ 	omap_obj = to_omap_bo(obj);
+ 
+-	mutex_lock(&omap_obj->lock);
+-
+ 	omap_obj->sgt = sgt;
+ 
+ 	if (sgt->orig_nents == 1) {
+@@ -1411,21 +1409,17 @@ struct drm_gem_object *omap_gem_new_dmabuf(struct drm_device *dev, size_t size,
+ 		pages = kcalloc(npages, sizeof(*pages), GFP_KERNEL);
+ 		if (!pages) {
+ 			omap_gem_free_object(obj);
+-			obj = ERR_PTR(-ENOMEM);
+-			goto done;
++			return ERR_PTR(-ENOMEM);
+ 		}
+ 
+ 		omap_obj->pages = pages;
+ 		ret = drm_prime_sg_to_page_array(sgt, pages, npages);
+ 		if (ret) {
+ 			omap_gem_free_object(obj);
+-			obj = ERR_PTR(-ENOMEM);
+-			goto done;
++			return ERR_PTR(-ENOMEM);
+ 		}
+ 	}
+ 
+-done:
+-	mutex_unlock(&omap_obj->lock);
+ 	return obj;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-omap-fix-possible-null-dereference.patch b/queue-6.6/drm-omap-fix-possible-null-dereference.patch
new file mode 100644
index 00000000000..83892038e50
--- /dev/null
+++ b/queue-6.6/drm-omap-fix-possible-null-dereference.patch
@@ -0,0 +1,135 @@
+From 77e9bc4d4a5bb2f37f432e0384f47a90c5efce9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 16:50:27 +0300
+Subject: drm/omap: Fix possible NULL dereference
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit a88fee2d67d9b78c24630a987a88ccf886b2498b ]
+
+smatch reports:
+
+drivers/gpu/drm/omapdrm/dss/base.c:176 omapdss_device_disconnect() error: we previously assumed 'src' could be null (see line 169)
+
+This code is mostly from a time when omapdrm had its own display device
+model. I can't honestly remember the details, and I don't think it's
+worth digging in deeply into that for a legacy driver.
+
+However, it looks like we only call omapdss_device_disconnect() and
+omapdss_device_connect() with NULL as the src parameter. We can thus
+drop the src parameter from both functions, and fix the smatch warning.
+
+I don't think omapdss_device_disconnect() ever gets NULL for the dst
+parameter (if it did, we'd crash soon after returning from the
+function), but I have kept the !dst check, just in case, but I added a
+WARN_ON() there.
+
+Also, if the dst parameter can be NULL, we can't always get the struct
+dss_device pointer from dst->dss (which is only used for a debug print).
+To make sure we can't hit that issue, do it similarly to the
+omapdss_device_connect() function: add 'struct dss_device *dss' as the
+first parameter, so that we always have it regardless of the dst.
+
+Fixes: 79107f274b2f ("drm/omap: Add support for drm_bridge")
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240806-omapdrm-misc-fixes-v1-1-15d31aea0831@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/dss/base.c    | 25 ++++++-------------------
+ drivers/gpu/drm/omapdrm/dss/omapdss.h |  3 +--
+ drivers/gpu/drm/omapdrm/omap_drv.c    |  4 ++--
+ 3 files changed, 9 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/base.c b/drivers/gpu/drm/omapdrm/dss/base.c
+index 050ca7eafac58..556e0f9026bed 100644
+--- a/drivers/gpu/drm/omapdrm/dss/base.c
++++ b/drivers/gpu/drm/omapdrm/dss/base.c
+@@ -139,21 +139,13 @@ static bool omapdss_device_is_connected(struct omap_dss_device *dssdev)
+ }
+ 
+ int omapdss_device_connect(struct dss_device *dss,
+-			   struct omap_dss_device *src,
+ 			   struct omap_dss_device *dst)
+ {
+-	dev_dbg(&dss->pdev->dev, "connect(%s, %s)\n",
+-		src ? dev_name(src->dev) : "NULL",
++	dev_dbg(&dss->pdev->dev, "connect(%s)\n",
+ 		dst ? dev_name(dst->dev) : "NULL");
+ 
+-	if (!dst) {
+-		/*
+-		 * The destination is NULL when the source is connected to a
+-		 * bridge instead of a DSS device. Stop here, we will attach
+-		 * the bridge later when we will have a DRM encoder.
+-		 */
+-		return src && src->bridge ? 0 : -EINVAL;
+-	}
++	if (!dst)
++		return -EINVAL;
+ 
+ 	if (omapdss_device_is_connected(dst))
+ 		return -EBUSY;
+@@ -163,19 +155,14 @@ int omapdss_device_connect(struct dss_device *dss,
+ 	return 0;
+ }
+ 
+-void omapdss_device_disconnect(struct omap_dss_device *src,
++void omapdss_device_disconnect(struct dss_device *dss,
+ 			       struct omap_dss_device *dst)
+ {
+-	struct dss_device *dss = src ? src->dss : dst->dss;
+-
+-	dev_dbg(&dss->pdev->dev, "disconnect(%s, %s)\n",
+-		src ? dev_name(src->dev) : "NULL",
++	dev_dbg(&dss->pdev->dev, "disconnect(%s)\n",
+ 		dst ? dev_name(dst->dev) : "NULL");
+ 
+-	if (!dst) {
+-		WARN_ON(!src->bridge);
++	if (WARN_ON(!dst))
+ 		return;
+-	}
+ 
+ 	if (!dst->id && !omapdss_device_is_connected(dst)) {
+ 		WARN_ON(1);
+diff --git a/drivers/gpu/drm/omapdrm/dss/omapdss.h b/drivers/gpu/drm/omapdrm/dss/omapdss.h
+index 040d5a3e33d68..4c22c09c93d52 100644
+--- a/drivers/gpu/drm/omapdrm/dss/omapdss.h
++++ b/drivers/gpu/drm/omapdrm/dss/omapdss.h
+@@ -242,9 +242,8 @@ struct omap_dss_device *omapdss_device_get(struct omap_dss_device *dssdev);
+ void omapdss_device_put(struct omap_dss_device *dssdev);
+ struct omap_dss_device *omapdss_find_device_by_node(struct device_node *node);
+ int omapdss_device_connect(struct dss_device *dss,
+-			   struct omap_dss_device *src,
+ 			   struct omap_dss_device *dst);
+-void omapdss_device_disconnect(struct omap_dss_device *src,
++void omapdss_device_disconnect(struct dss_device *dss,
+ 			       struct omap_dss_device *dst);
+ 
+ int omap_dss_get_num_overlay_managers(void);
+diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
+index 21996b713d1c3..13790d3ac3b6a 100644
+--- a/drivers/gpu/drm/omapdrm/omap_drv.c
++++ b/drivers/gpu/drm/omapdrm/omap_drv.c
+@@ -307,7 +307,7 @@ static void omap_disconnect_pipelines(struct drm_device *ddev)
+ 	for (i = 0; i < priv->num_pipes; i++) {
+ 		struct omap_drm_pipeline *pipe = &priv->pipes[i];
+ 
+-		omapdss_device_disconnect(NULL, pipe->output);
++		omapdss_device_disconnect(priv->dss, pipe->output);
+ 
+ 		omapdss_device_put(pipe->output);
+ 		pipe->output = NULL;
+@@ -325,7 +325,7 @@ static int omap_connect_pipelines(struct drm_device *ddev)
+ 	int r;
+ 
+ 	for_each_dss_output(output) {
+-		r = omapdss_device_connect(priv->dss, NULL, output);
++		r = omapdss_device_connect(priv->dss, output);
+ 		if (r == -EPROBE_DEFER) {
+ 			omapdss_device_put(output);
+ 			return r;
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch b/queue-6.6/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch
new file mode 100644
index 00000000000..d0d3d451162
--- /dev/null
+++ b/queue-6.6/drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch
@@ -0,0 +1,35 @@
+From 054722b744834b3aa842cf9e2d699a9d0fa4bedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 15:00:07 +0100
+Subject: drm/panfrost: Remove unused id_mask from struct panfrost_model
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit 581d1f8248550f2b67847e6d84f29fbe3751ea0a ]
+
+The id_mask field of struct panfrost_model has never been used.
+
+Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241025140008.385081-1-steven.price@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index c067ff550692a..164c4690cacaf 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -157,7 +157,6 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev)
+ struct panfrost_model {
+ 	const char *name;
+ 	u32 id;
+-	u32 id_mask;
+ 	u64 features;
+ 	u64 issues;
+ 	struct {
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-radeon-add-helper-rdev_to_drm-rdev.patch b/queue-6.6/drm-radeon-add-helper-rdev_to_drm-rdev.patch
new file mode 100644
index 00000000000..69a2c0697d3
--- /dev/null
+++ b/queue-6.6/drm-radeon-add-helper-rdev_to_drm-rdev.patch
@@ -0,0 +1,43 @@
+From 0bfad3c5cf87d2aee3708f3ae1ada346fd53511a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jun 2024 12:59:20 -0400
+Subject: drm/radeon: add helper rdev_to_drm(rdev)
+
+From: Wu Hoi Pok <wuhoipok@gmail.com>
+
+[ Upstream commit a6e23bec8ed184ed2a11080b28cdbd7a3024f0c0 ]
+
+Add helper rdev_to_drm(rdev), similar to amdgpu, most function should
+access the "drm_device" with "rdev_to_drm(rdev)" instead, where amdgpu has
+"adev_to_drm(adev)". It also makes changing from "*drm_device" to "drm_device"
+in "radeon_devicce" later on easier.
+
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Wu Hoi Pok <wuhoipok@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 7037bb04265e ("drm/radeon: Fix spurious unplug event on radeon HDMI")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
+index 426a49851e349..e0a02b357ce72 100644
+--- a/drivers/gpu/drm/radeon/radeon.h
++++ b/drivers/gpu/drm/radeon/radeon.h
+@@ -2478,6 +2478,11 @@ void r100_io_wreg(struct radeon_device *rdev, u32 reg, u32 v);
+ u32 cik_mm_rdoorbell(struct radeon_device *rdev, u32 index);
+ void cik_mm_wdoorbell(struct radeon_device *rdev, u32 index, u32 v);
+ 
++static inline struct drm_device *rdev_to_drm(struct radeon_device *rdev)
++{
++	return rdev->ddev;
++}
++
+ /*
+  * Cast helper
+  */
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-radeon-change-rdev-ddev-to-rdev_to_drm-rdev.patch b/queue-6.6/drm-radeon-change-rdev-ddev-to-rdev_to_drm-rdev.patch
new file mode 100644
index 00000000000..8043cc780ba
--- /dev/null
+++ b/queue-6.6/drm-radeon-change-rdev-ddev-to-rdev_to_drm-rdev.patch
@@ -0,0 +1,1459 @@
+From 218179376ab65cdc28162f6e5388a8d6af0a71f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Jun 2024 12:59:21 -0400
+Subject: drm/radeon: change rdev->ddev to rdev_to_drm(rdev)
+
+From: Wu Hoi Pok <wuhoipok@gmail.com>
+
+[ Upstream commit fb1b5e1dd53fc834e12f69749cbc8484382599c4 ]
+
+This patch changes the way "drm_device" is accessed. It uses "rdev_to_drm(rdev)"
+instead of accessing the struct member directly.
+
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Wu Hoi Pok <wuhoipok@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 7037bb04265e ("drm/radeon: Fix spurious unplug event on radeon HDMI")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c |  2 +-
+ drivers/gpu/drm/radeon/cik.c               | 14 ++--
+ drivers/gpu/drm/radeon/dce6_afmt.c         |  2 +-
+ drivers/gpu/drm/radeon/evergreen.c         | 12 ++--
+ drivers/gpu/drm/radeon/ni.c                |  2 +-
+ drivers/gpu/drm/radeon/r100.c              | 24 +++----
+ drivers/gpu/drm/radeon/r300.c              |  6 +-
+ drivers/gpu/drm/radeon/r420.c              |  6 +-
+ drivers/gpu/drm/radeon/r520.c              |  2 +-
+ drivers/gpu/drm/radeon/r600.c              | 12 ++--
+ drivers/gpu/drm/radeon/r600_cs.c           |  2 +-
+ drivers/gpu/drm/radeon/r600_dpm.c          |  4 +-
+ drivers/gpu/drm/radeon/r600_hdmi.c         |  2 +-
+ drivers/gpu/drm/radeon/radeon_acpi.c       | 10 +--
+ drivers/gpu/drm/radeon/radeon_agp.c        |  2 +-
+ drivers/gpu/drm/radeon/radeon_atombios.c   |  2 +-
+ drivers/gpu/drm/radeon/radeon_audio.c      |  4 +-
+ drivers/gpu/drm/radeon/radeon_combios.c    | 12 ++--
+ drivers/gpu/drm/radeon/radeon_device.c     | 10 +--
+ drivers/gpu/drm/radeon/radeon_display.c    | 74 +++++++++++-----------
+ drivers/gpu/drm/radeon/radeon_fbdev.c      | 26 ++++----
+ drivers/gpu/drm/radeon/radeon_fence.c      |  8 +--
+ drivers/gpu/drm/radeon/radeon_gem.c        |  2 +-
+ drivers/gpu/drm/radeon/radeon_i2c.c        |  2 +-
+ drivers/gpu/drm/radeon/radeon_ib.c         |  2 +-
+ drivers/gpu/drm/radeon/radeon_irq_kms.c    | 12 ++--
+ drivers/gpu/drm/radeon/radeon_object.c     |  2 +-
+ drivers/gpu/drm/radeon/radeon_pm.c         | 20 +++---
+ drivers/gpu/drm/radeon/radeon_ring.c       |  2 +-
+ drivers/gpu/drm/radeon/radeon_ttm.c        |  6 +-
+ drivers/gpu/drm/radeon/rs400.c             |  6 +-
+ drivers/gpu/drm/radeon/rs600.c             | 14 ++--
+ drivers/gpu/drm/radeon/rs690.c             |  2 +-
+ drivers/gpu/drm/radeon/rv515.c             |  4 +-
+ drivers/gpu/drm/radeon/rv770.c             |  2 +-
+ drivers/gpu/drm/radeon/si.c                |  4 +-
+ 36 files changed, 159 insertions(+), 159 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 4aca09cab4b8c..7ea76fdd714a9 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -2178,7 +2178,7 @@ int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder, int fe_idx)
+ void
+ radeon_atom_encoder_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_encoder *encoder;
+ 
+ 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 10be30366c2bf..341441b241835 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7585,7 +7585,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[0]) {
+-					drm_handle_vblank(rdev->ddev, 0);
++					drm_handle_vblank(rdev_to_drm(rdev), 0);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -7615,7 +7615,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[1]) {
+-					drm_handle_vblank(rdev->ddev, 1);
++					drm_handle_vblank(rdev_to_drm(rdev), 1);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -7645,7 +7645,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[2]) {
+-					drm_handle_vblank(rdev->ddev, 2);
++					drm_handle_vblank(rdev_to_drm(rdev), 2);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -7675,7 +7675,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[3]) {
+-					drm_handle_vblank(rdev->ddev, 3);
++					drm_handle_vblank(rdev_to_drm(rdev), 3);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -7705,7 +7705,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[4]) {
+-					drm_handle_vblank(rdev->ddev, 4);
++					drm_handle_vblank(rdev_to_drm(rdev), 4);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -7735,7 +7735,7 @@ int cik_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[5]) {
+-					drm_handle_vblank(rdev->ddev, 5);
++					drm_handle_vblank(rdev_to_drm(rdev), 5);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -8581,7 +8581,7 @@ int cik_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
+index 4a1d5447eac17..4419a0e85f69b 100644
+--- a/drivers/gpu/drm/radeon/dce6_afmt.c
++++ b/drivers/gpu/drm/radeon/dce6_afmt.c
+@@ -90,7 +90,7 @@ struct r600_audio_pin *dce6_audio_get_pin(struct radeon_device *rdev)
+ 			pin = &rdev->audio.pin[i];
+ 			pin_count = 0;
+ 
+-			list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
++			list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
+ 				if (radeon_encoder_is_digital(encoder)) {
+ 					radeon_encoder = to_radeon_encoder(encoder);
+ 					dig = radeon_encoder->enc_priv;
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index f0ae087be914e..a7f9fc2b52399 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1672,7 +1672,7 @@ void evergreen_pm_misc(struct radeon_device *rdev)
+  */
+ void evergreen_pm_prepare(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -1697,7 +1697,7 @@ void evergreen_pm_prepare(struct radeon_device *rdev)
+  */
+ void evergreen_pm_finish(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -1762,7 +1762,7 @@ void evergreen_hpd_set_polarity(struct radeon_device *rdev,
+  */
+ void evergreen_hpd_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned enabled = 0;
+ 	u32 tmp = DC_HPDx_CONNECTION_TIMER(0x9c4) |
+@@ -1803,7 +1803,7 @@ void evergreen_hpd_init(struct radeon_device *rdev)
+  */
+ void evergreen_hpd_fini(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned disabled = 0;
+ 
+@@ -4756,7 +4756,7 @@ int evergreen_irq_process(struct radeon_device *rdev)
+ 				event_name = "vblank";
+ 
+ 				if (rdev->irq.crtc_vblank_int[crtc_idx]) {
+-					drm_handle_vblank(rdev->ddev, crtc_idx);
++					drm_handle_vblank(rdev_to_drm(rdev), crtc_idx);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -5214,7 +5214,7 @@ int evergreen_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+ 	/* initialize AGP */
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 3e48cbb522a1c..4cd89fd6e9a22 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -2373,7 +2373,7 @@ int cayman_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+ 	/* initialize memory controller */
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index b63b6b4e9b281..54cbfac3605fb 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -458,7 +458,7 @@ void r100_pm_misc(struct radeon_device *rdev)
+  */
+ void r100_pm_prepare(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -489,7 +489,7 @@ void r100_pm_prepare(struct radeon_device *rdev)
+  */
+ void r100_pm_finish(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -602,7 +602,7 @@ void r100_hpd_set_polarity(struct radeon_device *rdev,
+  */
+ void r100_hpd_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned enable = 0;
+ 
+@@ -625,7 +625,7 @@ void r100_hpd_init(struct radeon_device *rdev)
+  */
+ void r100_hpd_fini(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned disable = 0;
+ 
+@@ -797,7 +797,7 @@ int r100_irq_process(struct radeon_device *rdev)
+ 		/* Vertical blank interrupts */
+ 		if (status & RADEON_CRTC_VBLANK_STAT) {
+ 			if (rdev->irq.crtc_vblank_int[0]) {
+-				drm_handle_vblank(rdev->ddev, 0);
++				drm_handle_vblank(rdev_to_drm(rdev), 0);
+ 				rdev->pm.vblank_sync = true;
+ 				wake_up(&rdev->irq.vblank_queue);
+ 			}
+@@ -806,7 +806,7 @@ int r100_irq_process(struct radeon_device *rdev)
+ 		}
+ 		if (status & RADEON_CRTC2_VBLANK_STAT) {
+ 			if (rdev->irq.crtc_vblank_int[1]) {
+-				drm_handle_vblank(rdev->ddev, 1);
++				drm_handle_vblank(rdev_to_drm(rdev), 1);
+ 				rdev->pm.vblank_sync = true;
+ 				wake_up(&rdev->irq.vblank_queue);
+ 			}
+@@ -1490,7 +1490,7 @@ int r100_cs_packet_parse_vline(struct radeon_cs_parser *p)
+ 	header = radeon_get_ib_value(p, h_idx);
+ 	crtc_id = radeon_get_ib_value(p, h_idx + 5);
+ 	reg = R100_CP_PACKET0_GET_REG(header);
+-	crtc = drm_crtc_find(p->rdev->ddev, p->filp, crtc_id);
++	crtc = drm_crtc_find(rdev_to_drm(p->rdev), p->filp, crtc_id);
+ 	if (!crtc) {
+ 		DRM_ERROR("cannot find crtc %d\n", crtc_id);
+ 		return -ENOENT;
+@@ -3078,7 +3078,7 @@ DEFINE_SHOW_ATTRIBUTE(r100_debugfs_mc_info);
+ void  r100_debugfs_rbbm_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("r100_rbbm_info", 0444, root, rdev,
+ 			    &r100_debugfs_rbbm_info_fops);
+@@ -3088,7 +3088,7 @@ void  r100_debugfs_rbbm_init(struct radeon_device *rdev)
+ void r100_debugfs_cp_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("r100_cp_ring_info", 0444, root, rdev,
+ 			    &r100_debugfs_cp_ring_info_fops);
+@@ -3100,7 +3100,7 @@ void r100_debugfs_cp_init(struct radeon_device *rdev)
+ void  r100_debugfs_mc_info_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("r100_mc_info", 0444, root, rdev,
+ 			    &r100_debugfs_mc_info_fops);
+@@ -3966,7 +3966,7 @@ int r100_resume(struct radeon_device *rdev)
+ 			RREG32(R_0007C0_CP_STAT));
+ 	}
+ 	/* post */
+-	radeon_combios_asic_init(rdev->ddev);
++	radeon_combios_asic_init(rdev_to_drm(rdev));
+ 	/* Resume clock after posting */
+ 	r100_clock_startup(rdev);
+ 	/* Initialize surface registers */
+@@ -4075,7 +4075,7 @@ int r100_init(struct radeon_device *rdev)
+ 	/* Set asic errata */
+ 	r100_errata(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize AGP */
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r = radeon_agp_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
+index 25201b9a5aae7..430a4263ccf7a 100644
+--- a/drivers/gpu/drm/radeon/r300.c
++++ b/drivers/gpu/drm/radeon/r300.c
+@@ -615,7 +615,7 @@ DEFINE_SHOW_ATTRIBUTE(rv370_debugfs_pcie_gart_info);
+ static void rv370_debugfs_pcie_gart_info_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("rv370_pcie_gart_info", 0444, root, rdev,
+ 			    &rv370_debugfs_pcie_gart_info_fops);
+@@ -1451,7 +1451,7 @@ int r300_resume(struct radeon_device *rdev)
+ 			RREG32(R_0007C0_CP_STAT));
+ 	}
+ 	/* post */
+-	radeon_combios_asic_init(rdev->ddev);
++	radeon_combios_asic_init(rdev_to_drm(rdev));
+ 	/* Resume clock after posting */
+ 	r300_clock_startup(rdev);
+ 	/* Initialize surface registers */
+@@ -1537,7 +1537,7 @@ int r300_init(struct radeon_device *rdev)
+ 	/* Set asic errata */
+ 	r300_errata(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize AGP */
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r = radeon_agp_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
+index eae8a6389f5ea..b3a747a8f17d5 100644
+--- a/drivers/gpu/drm/radeon/r420.c
++++ b/drivers/gpu/drm/radeon/r420.c
+@@ -321,7 +321,7 @@ int r420_resume(struct radeon_device *rdev)
+ 	if (rdev->is_atom_bios) {
+ 		atom_asic_init(rdev->mode_info.atom_context);
+ 	} else {
+-		radeon_combios_asic_init(rdev->ddev);
++		radeon_combios_asic_init(rdev_to_drm(rdev));
+ 	}
+ 	/* Resume clock after posting */
+ 	r420_clock_resume(rdev);
+@@ -413,7 +413,7 @@ int r420_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize AGP */
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r = radeon_agp_init(rdev);
+@@ -492,7 +492,7 @@ DEFINE_SHOW_ATTRIBUTE(r420_debugfs_pipes_info);
+ void r420_debugfs_pipes_info_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("r420_pipes_info", 0444, root, rdev,
+ 			    &r420_debugfs_pipes_info_fops);
+diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
+index 6cbcaa8451924..08e127b3249a2 100644
+--- a/drivers/gpu/drm/radeon/r520.c
++++ b/drivers/gpu/drm/radeon/r520.c
+@@ -287,7 +287,7 @@ int r520_init(struct radeon_device *rdev)
+ 		atom_asic_init(rdev->mode_info.atom_context);
+ 	}
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize AGP */
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r = radeon_agp_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index a17b95eec65fb..98d075c540e5e 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -950,7 +950,7 @@ void r600_hpd_set_polarity(struct radeon_device *rdev,
+ 
+ void r600_hpd_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned enable = 0;
+ 
+@@ -1017,7 +1017,7 @@ void r600_hpd_init(struct radeon_device *rdev)
+ 
+ void r600_hpd_fini(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned disable = 0;
+ 
+@@ -3280,7 +3280,7 @@ int r600_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+ 	if (rdev->flags & RADEON_IS_AGP) {
+@@ -4136,7 +4136,7 @@ int r600_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[0]) {
+-					drm_handle_vblank(rdev->ddev, 0);
++					drm_handle_vblank(rdev_to_drm(rdev), 0);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -4166,7 +4166,7 @@ int r600_irq_process(struct radeon_device *rdev)
+ 					DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
+ 
+ 				if (rdev->irq.crtc_vblank_int[1]) {
+-					drm_handle_vblank(rdev->ddev, 1);
++					drm_handle_vblank(rdev_to_drm(rdev), 1);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -4358,7 +4358,7 @@ DEFINE_SHOW_ATTRIBUTE(r600_debugfs_mc_info);
+ static void r600_debugfs_mc_info_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("r600_mc_info", 0444, root, rdev,
+ 			    &r600_debugfs_mc_info_fops);
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 6cf54a747749d..1b2d31c4d77ca 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -884,7 +884,7 @@ int r600_cs_common_vline_parse(struct radeon_cs_parser *p,
+ 	crtc_id = radeon_get_ib_value(p, h_idx + 2 + 7 + 1);
+ 	reg = R600_CP_PACKET0_GET_REG(header);
+ 
+-	crtc = drm_crtc_find(p->rdev->ddev, p->filp, crtc_id);
++	crtc = drm_crtc_find(rdev_to_drm(p->rdev), p->filp, crtc_id);
+ 	if (!crtc) {
+ 		DRM_ERROR("cannot find crtc %d\n", crtc_id);
+ 		return -ENOENT;
+diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
+index 9d2bcb9551e61..157107cf1bfb0 100644
+--- a/drivers/gpu/drm/radeon/r600_dpm.c
++++ b/drivers/gpu/drm/radeon/r600_dpm.c
+@@ -155,7 +155,7 @@ void r600_dpm_print_ps_status(struct radeon_device *rdev,
+ 
+ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 vblank_in_pixels;
+@@ -182,7 +182,7 @@ u32 r600_dpm_get_vblank_time(struct radeon_device *rdev)
+ 
+ u32 r600_dpm_get_vrefresh(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 vrefresh = 0;
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index f3551ebaa2f08..661f374f5f27a 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -116,7 +116,7 @@ void r600_audio_update_hdmi(struct work_struct *work)
+ {
+ 	struct radeon_device *rdev = container_of(work, struct radeon_device,
+ 						  audio_work);
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct r600_audio_pin audio_status = r600_audio_status(rdev);
+ 	struct drm_encoder *encoder;
+ 	bool changed = false;
+diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
+index 603a78e41ba55..22ce61bdfc060 100644
+--- a/drivers/gpu/drm/radeon/radeon_acpi.c
++++ b/drivers/gpu/drm/radeon/radeon_acpi.c
+@@ -405,11 +405,11 @@ static int radeon_atif_handler(struct radeon_device *rdev,
+ 	if (req.pending & ATIF_DGPU_DISPLAY_EVENT) {
+ 		if ((rdev->flags & RADEON_IS_PX) &&
+ 		    radeon_atpx_dgpu_req_power_for_displays()) {
+-			pm_runtime_get_sync(rdev->ddev->dev);
++			pm_runtime_get_sync(rdev_to_drm(rdev)->dev);
+ 			/* Just fire off a uevent and let userspace tell us what to do */
+-			drm_helper_hpd_irq_event(rdev->ddev);
+-			pm_runtime_mark_last_busy(rdev->ddev->dev);
+-			pm_runtime_put_autosuspend(rdev->ddev->dev);
++			drm_helper_hpd_irq_event(rdev_to_drm(rdev));
++			pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
++			pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
+ 		}
+ 	}
+ 	/* TODO: check other events */
+@@ -736,7 +736,7 @@ int radeon_acpi_init(struct radeon_device *rdev)
+ 		struct radeon_encoder *target = NULL;
+ 
+ 		/* Find the encoder controlling the brightness */
+-		list_for_each_entry(tmp, &rdev->ddev->mode_config.encoder_list,
++		list_for_each_entry(tmp, &rdev_to_drm(rdev)->mode_config.encoder_list,
+ 				head) {
+ 			struct radeon_encoder *enc = to_radeon_encoder(tmp);
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
+index a3d749e350f9c..89d7b0e9e79f8 100644
+--- a/drivers/gpu/drm/radeon/radeon_agp.c
++++ b/drivers/gpu/drm/radeon/radeon_agp.c
+@@ -161,7 +161,7 @@ struct radeon_agp_head *radeon_agp_head_init(struct drm_device *dev)
+ 
+ static int radeon_agp_head_acquire(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct pci_dev *pdev = to_pci_dev(dev->dev);
+ 
+ 	if (!rdev->agp)
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 53c7273eb6a5c..c025ce6eb3167 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -186,7 +186,7 @@ void radeon_atombios_i2c_init(struct radeon_device *rdev)
+ 
+ 			if (i2c.valid) {
+ 				sprintf(stmp, "0x%x", i2c.i2c_id);
+-				rdev->i2c_bus[i] = radeon_i2c_create(rdev->ddev, &i2c, stmp);
++				rdev->i2c_bus[i] = radeon_i2c_create(rdev_to_drm(rdev), &i2c, stmp);
+ 			}
+ 			gpio = (ATOM_GPIO_I2C_ASSIGMENT *)
+ 				((u8 *)gpio + sizeof(ATOM_GPIO_I2C_ASSIGMENT));
+diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
+index d6ccaf24ee0c7..ff0ff2642a8d0 100644
+--- a/drivers/gpu/drm/radeon/radeon_audio.c
++++ b/drivers/gpu/drm/radeon/radeon_audio.c
+@@ -195,7 +195,7 @@ static void radeon_audio_enable(struct radeon_device *rdev,
+ 		return;
+ 
+ 	if (rdev->mode_info.mode_config_initialized) {
+-		list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
++		list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
+ 			if (radeon_encoder_is_digital(encoder)) {
+ 				radeon_encoder = to_radeon_encoder(encoder);
+ 				dig = radeon_encoder->enc_priv;
+@@ -758,7 +758,7 @@ static int radeon_audio_component_get_eld(struct device *kdev, int port,
+ 	if (!rdev->audio.enabled || !rdev->mode_info.mode_config_initialized)
+ 		return 0;
+ 
+-	list_for_each_entry(encoder, &rdev->ddev->mode_config.encoder_list, head) {
++	list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
+ 		if (!radeon_encoder_is_digital(encoder))
+ 			continue;
+ 		radeon_encoder = to_radeon_encoder(encoder);
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 2620efc7c675b..a30f36d098a8d 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -371,7 +371,7 @@ bool radeon_combios_check_hardcoded_edid(struct radeon_device *rdev)
+ 	int edid_info, size;
+ 	struct edid *edid;
+ 	unsigned char *raw;
+-	edid_info = combios_get_table_offset(rdev->ddev, COMBIOS_HARDCODED_EDID_TABLE);
++	edid_info = combios_get_table_offset(rdev_to_drm(rdev), COMBIOS_HARDCODED_EDID_TABLE);
+ 	if (!edid_info)
+ 		return false;
+ 
+@@ -641,7 +641,7 @@ static struct radeon_i2c_bus_rec combios_setup_i2c_bus(struct radeon_device *rde
+ 
+ static struct radeon_i2c_bus_rec radeon_combios_get_i2c_info_from_table(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct radeon_i2c_bus_rec i2c;
+ 	u16 offset;
+ 	u8 id, blocks, clk, data;
+@@ -669,7 +669,7 @@ static struct radeon_i2c_bus_rec radeon_combios_get_i2c_info_from_table(struct r
+ 
+ void radeon_combios_i2c_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct radeon_i2c_bus_rec i2c;
+ 
+ 	/* actual hw pads
+@@ -811,7 +811,7 @@ bool radeon_combios_get_clock_info(struct drm_device *dev)
+ 
+ bool radeon_combios_sideport_present(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	u16 igp_info;
+ 
+ 	/* sideport is AMD only */
+@@ -914,7 +914,7 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
+ enum radeon_tv_std
+ radeon_combios_get_tv_info(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	uint16_t tv_info;
+ 	enum radeon_tv_std tv_std = TV_STD_NTSC;
+ 
+@@ -2636,7 +2636,7 @@ static const char *thermal_controller_names[] = {
+ 
+ void radeon_combios_get_power_modes(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	u16 offset, misc, misc2 = 0;
+ 	u8 rev, tmp;
+ 	int state_index = 0;
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index afbb3a80c0c6b..32851632643db 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -760,7 +760,7 @@ bool radeon_boot_test_post_card(struct radeon_device *rdev)
+ 		if (rdev->is_atom_bios)
+ 			atom_asic_init(rdev->mode_info.atom_context);
+ 		else
+-			radeon_combios_asic_init(rdev->ddev);
++			radeon_combios_asic_init(rdev_to_drm(rdev));
+ 		return true;
+ 	} else {
+ 		dev_err(rdev->dev, "Card not posted and no BIOS - ignoring\n");
+@@ -980,7 +980,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
+ 		return -ENOMEM;
+ 
+ 	rdev->mode_info.atom_card_info = atom_card_info;
+-	atom_card_info->dev = rdev->ddev;
++	atom_card_info->dev = rdev_to_drm(rdev);
+ 	atom_card_info->reg_read = cail_reg_read;
+ 	atom_card_info->reg_write = cail_reg_write;
+ 	/* needed for iio ops */
+@@ -1005,7 +1005,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
+ 
+ 	mutex_init(&rdev->mode_info.atom_context->mutex);
+ 	mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
+-	radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
++	radeon_atom_initialize_bios_scratch_regs(rdev_to_drm(rdev));
+ 	atom_allocate_fb_scratch(rdev->mode_info.atom_context);
+ 	return 0;
+ }
+@@ -1049,7 +1049,7 @@ void radeon_atombios_fini(struct radeon_device *rdev)
+  */
+ int radeon_combios_init(struct radeon_device *rdev)
+ {
+-	radeon_combios_initialize_bios_scratch_regs(rdev->ddev);
++	radeon_combios_initialize_bios_scratch_regs(rdev_to_drm(rdev));
+ 	return 0;
+ }
+ 
+@@ -1847,7 +1847,7 @@ int radeon_gpu_reset(struct radeon_device *rdev)
+ 
+ 	downgrade_write(&rdev->exclusive_lock);
+ 
+-	drm_helper_resume_force_mode(rdev->ddev);
++	drm_helper_resume_force_mode(rdev_to_drm(rdev));
+ 
+ 	/* set the power state here in case we are a PX system or headless */
+ 	if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 5f1d24d3120c4..8a8ffc5fc8040 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -302,13 +302,13 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
+ 	if ((radeon_use_pflipirq == 2) && ASIC_IS_DCE4(rdev))
+ 		return;
+ 
+-	spin_lock_irqsave(&rdev->ddev->event_lock, flags);
++	spin_lock_irqsave(&rdev_to_drm(rdev)->event_lock, flags);
+ 	if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
+ 		DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+ 				 "RADEON_FLIP_SUBMITTED(%d)\n",
+ 				 radeon_crtc->flip_status,
+ 				 RADEON_FLIP_SUBMITTED);
+-		spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
++		spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
+ 		return;
+ 	}
+ 
+@@ -334,7 +334,7 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
+ 	 */
+ 	if (update_pending &&
+ 	    (DRM_SCANOUTPOS_VALID &
+-	     radeon_get_crtc_scanoutpos(rdev->ddev, crtc_id,
++	     radeon_get_crtc_scanoutpos(rdev_to_drm(rdev), crtc_id,
+ 					GET_DISTANCE_TO_VBLANKSTART,
+ 					&vpos, &hpos, NULL, NULL,
+ 					&rdev->mode_info.crtcs[crtc_id]->base.hwmode)) &&
+@@ -347,7 +347,7 @@ void radeon_crtc_handle_vblank(struct radeon_device *rdev, int crtc_id)
+ 		 */
+ 		update_pending = 0;
+ 	}
+-	spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
++	spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
+ 	if (!update_pending)
+ 		radeon_crtc_handle_flip(rdev, crtc_id);
+ }
+@@ -370,14 +370,14 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
+ 	if (radeon_crtc == NULL)
+ 		return;
+ 
+-	spin_lock_irqsave(&rdev->ddev->event_lock, flags);
++	spin_lock_irqsave(&rdev_to_drm(rdev)->event_lock, flags);
+ 	work = radeon_crtc->flip_work;
+ 	if (radeon_crtc->flip_status != RADEON_FLIP_SUBMITTED) {
+ 		DRM_DEBUG_DRIVER("radeon_crtc->flip_status = %d != "
+ 				 "RADEON_FLIP_SUBMITTED(%d)\n",
+ 				 radeon_crtc->flip_status,
+ 				 RADEON_FLIP_SUBMITTED);
+-		spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
++		spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
+ 		return;
+ 	}
+ 
+@@ -389,7 +389,7 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
+ 	if (work->event)
+ 		drm_crtc_send_vblank_event(&radeon_crtc->base, work->event);
+ 
+-	spin_unlock_irqrestore(&rdev->ddev->event_lock, flags);
++	spin_unlock_irqrestore(&rdev_to_drm(rdev)->event_lock, flags);
+ 
+ 	drm_crtc_vblank_put(&radeon_crtc->base);
+ 	radeon_irq_kms_pflip_irq_put(rdev, work->crtc_id);
+@@ -408,7 +408,7 @@ static void radeon_flip_work_func(struct work_struct *__work)
+ 	struct radeon_flip_work *work =
+ 		container_of(__work, struct radeon_flip_work, flip_work);
+ 	struct radeon_device *rdev = work->rdev;
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[work->crtc_id];
+ 
+ 	struct drm_crtc *crtc = &radeon_crtc->base;
+@@ -1401,7 +1401,7 @@ static int radeon_modeset_create_props(struct radeon_device *rdev)
+ 
+ 	if (rdev->is_atom_bios) {
+ 		rdev->mode_info.coherent_mode_property =
+-			drm_property_create_range(rdev->ddev, 0 , "coherent", 0, 1);
++			drm_property_create_range(rdev_to_drm(rdev), 0, "coherent", 0, 1);
+ 		if (!rdev->mode_info.coherent_mode_property)
+ 			return -ENOMEM;
+ 	}
+@@ -1409,57 +1409,57 @@ static int radeon_modeset_create_props(struct radeon_device *rdev)
+ 	if (!ASIC_IS_AVIVO(rdev)) {
+ 		sz = ARRAY_SIZE(radeon_tmds_pll_enum_list);
+ 		rdev->mode_info.tmds_pll_property =
+-			drm_property_create_enum(rdev->ddev, 0,
++			drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 					    "tmds_pll",
+ 					    radeon_tmds_pll_enum_list, sz);
+ 	}
+ 
+ 	rdev->mode_info.load_detect_property =
+-		drm_property_create_range(rdev->ddev, 0, "load detection", 0, 1);
++		drm_property_create_range(rdev_to_drm(rdev), 0, "load detection", 0, 1);
+ 	if (!rdev->mode_info.load_detect_property)
+ 		return -ENOMEM;
+ 
+-	drm_mode_create_scaling_mode_property(rdev->ddev);
++	drm_mode_create_scaling_mode_property(rdev_to_drm(rdev));
+ 
+ 	sz = ARRAY_SIZE(radeon_tv_std_enum_list);
+ 	rdev->mode_info.tv_std_property =
+-		drm_property_create_enum(rdev->ddev, 0,
++		drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 				    "tv standard",
+ 				    radeon_tv_std_enum_list, sz);
+ 
+ 	sz = ARRAY_SIZE(radeon_underscan_enum_list);
+ 	rdev->mode_info.underscan_property =
+-		drm_property_create_enum(rdev->ddev, 0,
++		drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 				    "underscan",
+ 				    radeon_underscan_enum_list, sz);
+ 
+ 	rdev->mode_info.underscan_hborder_property =
+-		drm_property_create_range(rdev->ddev, 0,
++		drm_property_create_range(rdev_to_drm(rdev), 0,
+ 					"underscan hborder", 0, 128);
+ 	if (!rdev->mode_info.underscan_hborder_property)
+ 		return -ENOMEM;
+ 
+ 	rdev->mode_info.underscan_vborder_property =
+-		drm_property_create_range(rdev->ddev, 0,
++		drm_property_create_range(rdev_to_drm(rdev), 0,
+ 					"underscan vborder", 0, 128);
+ 	if (!rdev->mode_info.underscan_vborder_property)
+ 		return -ENOMEM;
+ 
+ 	sz = ARRAY_SIZE(radeon_audio_enum_list);
+ 	rdev->mode_info.audio_property =
+-		drm_property_create_enum(rdev->ddev, 0,
++		drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 					 "audio",
+ 					 radeon_audio_enum_list, sz);
+ 
+ 	sz = ARRAY_SIZE(radeon_dither_enum_list);
+ 	rdev->mode_info.dither_property =
+-		drm_property_create_enum(rdev->ddev, 0,
++		drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 					 "dither",
+ 					 radeon_dither_enum_list, sz);
+ 
+ 	sz = ARRAY_SIZE(radeon_output_csc_enum_list);
+ 	rdev->mode_info.output_csc_property =
+-		drm_property_create_enum(rdev->ddev, 0,
++		drm_property_create_enum(rdev_to_drm(rdev), 0,
+ 					 "output_csc",
+ 					 radeon_output_csc_enum_list, sz);
+ 
+@@ -1578,29 +1578,29 @@ int radeon_modeset_init(struct radeon_device *rdev)
+ 	int i;
+ 	int ret;
+ 
+-	drm_mode_config_init(rdev->ddev);
++	drm_mode_config_init(rdev_to_drm(rdev));
+ 	rdev->mode_info.mode_config_initialized = true;
+ 
+-	rdev->ddev->mode_config.funcs = &radeon_mode_funcs;
++	rdev_to_drm(rdev)->mode_config.funcs = &radeon_mode_funcs;
+ 
+ 	if (radeon_use_pflipirq == 2 && rdev->family >= CHIP_R600)
+-		rdev->ddev->mode_config.async_page_flip = true;
++		rdev_to_drm(rdev)->mode_config.async_page_flip = true;
+ 
+ 	if (ASIC_IS_DCE5(rdev)) {
+-		rdev->ddev->mode_config.max_width = 16384;
+-		rdev->ddev->mode_config.max_height = 16384;
++		rdev_to_drm(rdev)->mode_config.max_width = 16384;
++		rdev_to_drm(rdev)->mode_config.max_height = 16384;
+ 	} else if (ASIC_IS_AVIVO(rdev)) {
+-		rdev->ddev->mode_config.max_width = 8192;
+-		rdev->ddev->mode_config.max_height = 8192;
++		rdev_to_drm(rdev)->mode_config.max_width = 8192;
++		rdev_to_drm(rdev)->mode_config.max_height = 8192;
+ 	} else {
+-		rdev->ddev->mode_config.max_width = 4096;
+-		rdev->ddev->mode_config.max_height = 4096;
++		rdev_to_drm(rdev)->mode_config.max_width = 4096;
++		rdev_to_drm(rdev)->mode_config.max_height = 4096;
+ 	}
+ 
+-	rdev->ddev->mode_config.preferred_depth = 24;
+-	rdev->ddev->mode_config.prefer_shadow = 1;
++	rdev_to_drm(rdev)->mode_config.preferred_depth = 24;
++	rdev_to_drm(rdev)->mode_config.prefer_shadow = 1;
+ 
+-	rdev->ddev->mode_config.fb_modifiers_not_supported = true;
++	rdev_to_drm(rdev)->mode_config.fb_modifiers_not_supported = true;
+ 
+ 	ret = radeon_modeset_create_props(rdev);
+ 	if (ret) {
+@@ -1618,11 +1618,11 @@ int radeon_modeset_init(struct radeon_device *rdev)
+ 
+ 	/* allocate crtcs */
+ 	for (i = 0; i < rdev->num_crtc; i++) {
+-		radeon_crtc_init(rdev->ddev, i);
++		radeon_crtc_init(rdev_to_drm(rdev), i);
+ 	}
+ 
+ 	/* okay we should have all the bios connectors */
+-	ret = radeon_setup_enc_conn(rdev->ddev);
++	ret = radeon_setup_enc_conn(rdev_to_drm(rdev));
+ 	if (!ret) {
+ 		return ret;
+ 	}
+@@ -1639,7 +1639,7 @@ int radeon_modeset_init(struct radeon_device *rdev)
+ 	/* setup afmt */
+ 	radeon_afmt_init(rdev);
+ 
+-	drm_kms_helper_poll_init(rdev->ddev);
++	drm_kms_helper_poll_init(rdev_to_drm(rdev));
+ 
+ 	/* do pm late init */
+ 	ret = radeon_pm_late_init(rdev);
+@@ -1650,11 +1650,11 @@ int radeon_modeset_init(struct radeon_device *rdev)
+ void radeon_modeset_fini(struct radeon_device *rdev)
+ {
+ 	if (rdev->mode_info.mode_config_initialized) {
+-		drm_kms_helper_poll_fini(rdev->ddev);
++		drm_kms_helper_poll_fini(rdev_to_drm(rdev));
+ 		radeon_hpd_fini(rdev);
+-		drm_helper_force_disable_all(rdev->ddev);
++		drm_helper_force_disable_all(rdev_to_drm(rdev));
+ 		radeon_afmt_fini(rdev);
+-		drm_mode_config_cleanup(rdev->ddev);
++		drm_mode_config_cleanup(rdev_to_drm(rdev));
+ 		rdev->mode_info.mode_config_initialized = false;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_fbdev.c b/drivers/gpu/drm/radeon/radeon_fbdev.c
+index 02bf25759059a..fb70de29545c6 100644
+--- a/drivers/gpu/drm/radeon/radeon_fbdev.c
++++ b/drivers/gpu/drm/radeon/radeon_fbdev.c
+@@ -67,7 +67,7 @@ static int radeon_fbdev_create_pinned_object(struct drm_fb_helper *fb_helper,
+ 	int height = mode_cmd->height;
+ 	u32 cpp;
+ 
+-	info = drm_get_format_info(rdev->ddev, mode_cmd);
++	info = drm_get_format_info(rdev_to_drm(rdev), mode_cmd);
+ 	cpp = info->cpp[0];
+ 
+ 	/* need to align pitch with crtc limits */
+@@ -148,15 +148,15 @@ static int radeon_fbdev_fb_open(struct fb_info *info, int user)
+ 	struct radeon_device *rdev = fb_helper->dev->dev_private;
+ 	int ret;
+ 
+-	ret = pm_runtime_get_sync(rdev->ddev->dev);
++	ret = pm_runtime_get_sync(rdev_to_drm(rdev)->dev);
+ 	if (ret < 0 && ret != -EACCES)
+ 		goto err_pm_runtime_mark_last_busy;
+ 
+ 	return 0;
+ 
+ err_pm_runtime_mark_last_busy:
+-	pm_runtime_mark_last_busy(rdev->ddev->dev);
+-	pm_runtime_put_autosuspend(rdev->ddev->dev);
++	pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
++	pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
+ 	return ret;
+ }
+ 
+@@ -165,8 +165,8 @@ static int radeon_fbdev_fb_release(struct fb_info *info, int user)
+ 	struct drm_fb_helper *fb_helper = info->par;
+ 	struct radeon_device *rdev = fb_helper->dev->dev_private;
+ 
+-	pm_runtime_mark_last_busy(rdev->ddev->dev);
+-	pm_runtime_put_autosuspend(rdev->ddev->dev);
++	pm_runtime_mark_last_busy(rdev_to_drm(rdev)->dev);
++	pm_runtime_put_autosuspend(rdev_to_drm(rdev)->dev);
+ 
+ 	return 0;
+ }
+@@ -236,7 +236,7 @@ static int radeon_fbdev_fb_helper_fb_probe(struct drm_fb_helper *fb_helper,
+ 		ret = -ENOMEM;
+ 		goto err_radeon_fbdev_destroy_pinned_object;
+ 	}
+-	ret = radeon_framebuffer_init(rdev->ddev, fb, &mode_cmd, gobj);
++	ret = radeon_framebuffer_init(rdev_to_drm(rdev), fb, &mode_cmd, gobj);
+ 	if (ret) {
+ 		DRM_ERROR("failed to initialize framebuffer %d\n", ret);
+ 		goto err_kfree;
+@@ -374,12 +374,12 @@ void radeon_fbdev_setup(struct radeon_device *rdev)
+ 	fb_helper = kzalloc(sizeof(*fb_helper), GFP_KERNEL);
+ 	if (!fb_helper)
+ 		return;
+-	drm_fb_helper_prepare(rdev->ddev, fb_helper, bpp_sel, &radeon_fbdev_fb_helper_funcs);
++	drm_fb_helper_prepare(rdev_to_drm(rdev), fb_helper, bpp_sel, &radeon_fbdev_fb_helper_funcs);
+ 
+-	ret = drm_client_init(rdev->ddev, &fb_helper->client, "radeon-fbdev",
++	ret = drm_client_init(rdev_to_drm(rdev), &fb_helper->client, "radeon-fbdev",
+ 			      &radeon_fbdev_client_funcs);
+ 	if (ret) {
+-		drm_err(rdev->ddev, "Failed to register client: %d\n", ret);
++		drm_err(rdev_to_drm(rdev), "Failed to register client: %d\n", ret);
+ 		goto err_drm_client_init;
+ 	}
+ 
+@@ -394,13 +394,13 @@ void radeon_fbdev_setup(struct radeon_device *rdev)
+ 
+ void radeon_fbdev_set_suspend(struct radeon_device *rdev, int state)
+ {
+-	if (rdev->ddev->fb_helper)
+-		drm_fb_helper_set_suspend(rdev->ddev->fb_helper, state);
++	if (rdev_to_drm(rdev)->fb_helper)
++		drm_fb_helper_set_suspend(rdev_to_drm(rdev)->fb_helper, state);
+ }
+ 
+ bool radeon_fbdev_robj_is_fb(struct radeon_device *rdev, struct radeon_bo *robj)
+ {
+-	struct drm_fb_helper *fb_helper = rdev->ddev->fb_helper;
++	struct drm_fb_helper *fb_helper = rdev_to_drm(rdev)->fb_helper;
+ 	struct drm_gem_object *gobj;
+ 
+ 	if (!fb_helper)
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index 2749dde5838f1..6d5e828fa39e3 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -151,7 +151,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
+ 		       rdev->fence_context + ring,
+ 		       seq);
+ 	radeon_fence_ring_emit(rdev, ring, *fence);
+-	trace_radeon_fence_emit(rdev->ddev, ring, (*fence)->seq);
++	trace_radeon_fence_emit(rdev_to_drm(rdev), ring, (*fence)->seq);
+ 	radeon_fence_schedule_check(rdev, ring);
+ 	return 0;
+ }
+@@ -492,7 +492,7 @@ static long radeon_fence_wait_seq_timeout(struct radeon_device *rdev,
+ 		if (!target_seq[i])
+ 			continue;
+ 
+-		trace_radeon_fence_wait_begin(rdev->ddev, i, target_seq[i]);
++		trace_radeon_fence_wait_begin(rdev_to_drm(rdev), i, target_seq[i]);
+ 		radeon_irq_kms_sw_irq_get(rdev, i);
+ 	}
+ 
+@@ -514,7 +514,7 @@ static long radeon_fence_wait_seq_timeout(struct radeon_device *rdev,
+ 			continue;
+ 
+ 		radeon_irq_kms_sw_irq_put(rdev, i);
+-		trace_radeon_fence_wait_end(rdev->ddev, i, target_seq[i]);
++		trace_radeon_fence_wait_end(rdev_to_drm(rdev), i, target_seq[i]);
+ 	}
+ 
+ 	return r;
+@@ -1004,7 +1004,7 @@ DEFINE_DEBUGFS_ATTRIBUTE(radeon_debugfs_gpu_reset_fops,
+ void radeon_debugfs_fence_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("radeon_gpu_reset", 0444, root, rdev,
+ 			    &radeon_debugfs_gpu_reset_fops);
+diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
+index 27225d1fe8d2e..96934fee7e943 100644
+--- a/drivers/gpu/drm/radeon/radeon_gem.c
++++ b/drivers/gpu/drm/radeon/radeon_gem.c
+@@ -898,7 +898,7 @@ DEFINE_SHOW_ATTRIBUTE(radeon_debugfs_gem_info);
+ void radeon_gem_debugfs_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("radeon_gem_info", 0444, root, rdev,
+ 			    &radeon_debugfs_gem_info_fops);
+diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
+index 314d066e68e9d..e7b2e93707294 100644
+--- a/drivers/gpu/drm/radeon/radeon_i2c.c
++++ b/drivers/gpu/drm/radeon/radeon_i2c.c
+@@ -1012,7 +1012,7 @@ void radeon_i2c_add(struct radeon_device *rdev,
+ 		    struct radeon_i2c_bus_rec *rec,
+ 		    const char *name)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	int i;
+ 
+ 	for (i = 0; i < RADEON_MAX_I2C_BUS; i++) {
+diff --git a/drivers/gpu/drm/radeon/radeon_ib.c b/drivers/gpu/drm/radeon/radeon_ib.c
+index fb9ecf5dbe2b7..560ce90f4eb16 100644
+--- a/drivers/gpu/drm/radeon/radeon_ib.c
++++ b/drivers/gpu/drm/radeon/radeon_ib.c
+@@ -307,7 +307,7 @@ DEFINE_SHOW_ATTRIBUTE(radeon_debugfs_sa_info);
+ static void radeon_debugfs_sa_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("radeon_sa_info", 0444, root, rdev,
+ 			    &radeon_debugfs_sa_info_fops);
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index c4dda908666cf..9961251b44ba0 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -80,7 +80,7 @@ static void radeon_hotplug_work_func(struct work_struct *work)
+ {
+ 	struct radeon_device *rdev = container_of(work, struct radeon_device,
+ 						  hotplug_work.work);
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_mode_config *mode_config = &dev->mode_config;
+ 	struct drm_connector *connector;
+ 
+@@ -101,7 +101,7 @@ static void radeon_dp_work_func(struct work_struct *work)
+ {
+ 	struct radeon_device *rdev = container_of(work, struct radeon_device,
+ 						  dp_work);
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_mode_config *mode_config = &dev->mode_config;
+ 	struct drm_connector *connector;
+ 
+@@ -197,7 +197,7 @@ static void radeon_driver_irq_uninstall_kms(struct drm_device *dev)
+ 
+ static int radeon_irq_install(struct radeon_device *rdev, int irq)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	int ret;
+ 
+ 	if (irq == IRQ_NOTCONNECTED)
+@@ -218,7 +218,7 @@ static int radeon_irq_install(struct radeon_device *rdev, int irq)
+ 
+ static void radeon_irq_uninstall(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct pci_dev *pdev = to_pci_dev(dev->dev);
+ 
+ 	radeon_driver_irq_uninstall_kms(dev);
+@@ -322,9 +322,9 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
+ 	spin_lock_init(&rdev->irq.lock);
+ 
+ 	/* Disable vblank irqs aggressively for power-saving */
+-	rdev->ddev->vblank_disable_immediate = true;
++	rdev_to_drm(rdev)->vblank_disable_immediate = true;
+ 
+-	r = drm_vblank_init(rdev->ddev, rdev->num_crtc);
++	r = drm_vblank_init(rdev_to_drm(rdev), rdev->num_crtc);
+ 	if (r) {
+ 		return r;
+ 	}
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index 10c0fbd9d2b44..6f3c9a20a2de5 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -152,7 +152,7 @@ int radeon_bo_create(struct radeon_device *rdev,
+ 	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
+ 	if (bo == NULL)
+ 		return -ENOMEM;
+-	drm_gem_private_object_init(rdev->ddev, &bo->tbo.base, size);
++	drm_gem_private_object_init(rdev_to_drm(rdev), &bo->tbo.base, size);
+ 	bo->rdev = rdev;
+ 	bo->surface_reg = -1;
+ 	INIT_LIST_HEAD(&bo->list);
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index b73fd9ab02522..66fe9fb920452 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -281,7 +281,7 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
+ 
+ 	if (rdev->irq.installed) {
+ 		i = 0;
+-		drm_for_each_crtc(crtc, rdev->ddev) {
++		drm_for_each_crtc(crtc, rdev_to_drm(rdev)) {
+ 			if (rdev->pm.active_crtcs & (1 << i)) {
+ 				/* This can fail if a modeset is in progress */
+ 				if (drm_crtc_vblank_get(crtc) == 0)
+@@ -298,7 +298,7 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
+ 
+ 	if (rdev->irq.installed) {
+ 		i = 0;
+-		drm_for_each_crtc(crtc, rdev->ddev) {
++		drm_for_each_crtc(crtc, rdev_to_drm(rdev)) {
+ 			if (rdev->pm.req_vblank & (1 << i)) {
+ 				rdev->pm.req_vblank &= ~(1 << i);
+ 				drm_crtc_vblank_put(crtc);
+@@ -670,7 +670,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
+ 				      char *buf)
+ {
+ 	struct radeon_device *rdev = dev_get_drvdata(dev);
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	int temp;
+ 
+ 	/* Can't get temperature when the card is off */
+@@ -714,7 +714,7 @@ static ssize_t radeon_hwmon_show_sclk(struct device *dev,
+ 				      struct device_attribute *attr, char *buf)
+ {
+ 	struct radeon_device *rdev = dev_get_drvdata(dev);
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	u32 sclk = 0;
+ 
+ 	/* Can't get clock frequency when the card is off */
+@@ -739,7 +739,7 @@ static ssize_t radeon_hwmon_show_vddc(struct device *dev,
+ 				      struct device_attribute *attr, char *buf)
+ {
+ 	struct radeon_device *rdev = dev_get_drvdata(dev);
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	u16 vddc = 0;
+ 
+ 	/* Can't get vddc when the card is off */
+@@ -1691,7 +1691,7 @@ void radeon_pm_fini(struct radeon_device *rdev)
+ 
+ static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 
+@@ -1764,7 +1764,7 @@ static void radeon_pm_compute_clocks_old(struct radeon_device *rdev)
+ 
+ static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	struct radeon_connector *radeon_connector;
+@@ -1825,7 +1825,7 @@ static bool radeon_pm_in_vbl(struct radeon_device *rdev)
+ 	 */
+ 	for (crtc = 0; (crtc < rdev->num_crtc) && in_vbl; crtc++) {
+ 		if (rdev->pm.active_crtcs & (1 << crtc)) {
+-			vbl_status = radeon_get_crtc_scanoutpos(rdev->ddev,
++			vbl_status = radeon_get_crtc_scanoutpos(rdev_to_drm(rdev),
+ 								crtc,
+ 								USE_REAL_VBLANKSTART,
+ 								&vpos, &hpos, NULL, NULL,
+@@ -1917,7 +1917,7 @@ static void radeon_dynpm_idle_work_handler(struct work_struct *work)
+ static int radeon_debugfs_pm_info_show(struct seq_file *m, void *unused)
+ {
+ 	struct radeon_device *rdev = m->private;
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 
+ 	if  ((rdev->flags & RADEON_IS_PX) &&
+ 	     (ddev->switch_power_state != DRM_SWITCH_POWER_ON)) {
+@@ -1954,7 +1954,7 @@ DEFINE_SHOW_ATTRIBUTE(radeon_debugfs_pm_info);
+ static void radeon_debugfs_pm_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("radeon_pm_info", 0444, root, rdev,
+ 			    &radeon_debugfs_pm_info_fops);
+diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
+index e6534fa9f1fb5..8626171e9a6db 100644
+--- a/drivers/gpu/drm/radeon/radeon_ring.c
++++ b/drivers/gpu/drm/radeon/radeon_ring.c
+@@ -548,7 +548,7 @@ static void radeon_debugfs_ring_init(struct radeon_device *rdev, struct radeon_r
+ {
+ #if defined(CONFIG_DEBUG_FS)
+ 	const char *ring_name = radeon_debugfs_ring_idx_to_name(ring->idx);
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	if (ring_name)
+ 		debugfs_create_file(ring_name, 0444, root, ring,
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 4eb83ccc4906a..065a09e7997cd 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -689,8 +689,8 @@ int radeon_ttm_init(struct radeon_device *rdev)
+ 
+ 	/* No others user of address space so set it to 0 */
+ 	r = ttm_device_init(&rdev->mman.bdev, &radeon_bo_driver, rdev->dev,
+-			       rdev->ddev->anon_inode->i_mapping,
+-			       rdev->ddev->vma_offset_manager,
++			       rdev_to_drm(rdev)->anon_inode->i_mapping,
++			       rdev_to_drm(rdev)->vma_offset_manager,
+ 			       rdev->need_swiotlb,
+ 			       dma_addressing_limited(&rdev->pdev->dev));
+ 	if (r) {
+@@ -897,7 +897,7 @@ static const struct file_operations radeon_ttm_gtt_fops = {
+ static void radeon_ttm_debugfs_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct drm_minor *minor = rdev->ddev->primary;
++	struct drm_minor *minor = rdev_to_drm(rdev)->primary;
+ 	struct dentry *root = minor->debugfs_root;
+ 
+ 	debugfs_create_file("radeon_vram", 0444, root, rdev,
+diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
+index 922a29e588802..4f93fe468ec7f 100644
+--- a/drivers/gpu/drm/radeon/rs400.c
++++ b/drivers/gpu/drm/radeon/rs400.c
+@@ -378,7 +378,7 @@ DEFINE_SHOW_ATTRIBUTE(rs400_debugfs_gart_info);
+ static void rs400_debugfs_pcie_gart_info_init(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("rs400_gart_info", 0444, root, rdev,
+ 			    &rs400_debugfs_gart_info_fops);
+@@ -473,7 +473,7 @@ int rs400_resume(struct radeon_device *rdev)
+ 			RREG32(R_0007C0_CP_STAT));
+ 	}
+ 	/* post */
+-	radeon_combios_asic_init(rdev->ddev);
++	radeon_combios_asic_init(rdev_to_drm(rdev));
+ 	/* Resume clock after posting */
+ 	r300_clock_startup(rdev);
+ 	/* Initialize surface registers */
+@@ -551,7 +551,7 @@ int rs400_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize memory controller */
+ 	rs400_mc_init(rdev);
+ 	/* Fence driver */
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 8cf87a0a2b2a0..fa4cc2a185dd0 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -322,7 +322,7 @@ void rs600_pm_misc(struct radeon_device *rdev)
+ 
+ void rs600_pm_prepare(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -340,7 +340,7 @@ void rs600_pm_prepare(struct radeon_device *rdev)
+ 
+ void rs600_pm_finish(struct radeon_device *rdev)
+ {
+-	struct drm_device *ddev = rdev->ddev;
++	struct drm_device *ddev = rdev_to_drm(rdev);
+ 	struct drm_crtc *crtc;
+ 	struct radeon_crtc *radeon_crtc;
+ 	u32 tmp;
+@@ -409,7 +409,7 @@ void rs600_hpd_set_polarity(struct radeon_device *rdev,
+ 
+ void rs600_hpd_init(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned enable = 0;
+ 
+@@ -436,7 +436,7 @@ void rs600_hpd_init(struct radeon_device *rdev)
+ 
+ void rs600_hpd_fini(struct radeon_device *rdev)
+ {
+-	struct drm_device *dev = rdev->ddev;
++	struct drm_device *dev = rdev_to_drm(rdev);
+ 	struct drm_connector *connector;
+ 	unsigned disable = 0;
+ 
+@@ -798,7 +798,7 @@ int rs600_irq_process(struct radeon_device *rdev)
+ 		/* Vertical blank interrupts */
+ 		if (G_007EDC_LB_D1_VBLANK_INTERRUPT(rdev->irq.stat_regs.r500.disp_int)) {
+ 			if (rdev->irq.crtc_vblank_int[0]) {
+-				drm_handle_vblank(rdev->ddev, 0);
++				drm_handle_vblank(rdev_to_drm(rdev), 0);
+ 				rdev->pm.vblank_sync = true;
+ 				wake_up(&rdev->irq.vblank_queue);
+ 			}
+@@ -807,7 +807,7 @@ int rs600_irq_process(struct radeon_device *rdev)
+ 		}
+ 		if (G_007EDC_LB_D2_VBLANK_INTERRUPT(rdev->irq.stat_regs.r500.disp_int)) {
+ 			if (rdev->irq.crtc_vblank_int[1]) {
+-				drm_handle_vblank(rdev->ddev, 1);
++				drm_handle_vblank(rdev_to_drm(rdev), 1);
+ 				rdev->pm.vblank_sync = true;
+ 				wake_up(&rdev->irq.vblank_queue);
+ 			}
+@@ -1134,7 +1134,7 @@ int rs600_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize memory controller */
+ 	rs600_mc_init(rdev);
+ 	r100_debugfs_rbbm_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
+index 14fb0819b8c19..016eb4992803d 100644
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -845,7 +845,7 @@ int rs690_init(struct radeon_device *rdev)
+ 		return -EINVAL;
+ 
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize memory controller */
+ 	rs690_mc_init(rdev);
+ 	rv515_debugfs(rdev);
+diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
+index 76260fdfbaa72..19a26d85e029c 100644
+--- a/drivers/gpu/drm/radeon/rv515.c
++++ b/drivers/gpu/drm/radeon/rv515.c
+@@ -255,7 +255,7 @@ DEFINE_SHOW_ATTRIBUTE(rv515_debugfs_ga_info);
+ void rv515_debugfs(struct radeon_device *rdev)
+ {
+ #if defined(CONFIG_DEBUG_FS)
+-	struct dentry *root = rdev->ddev->primary->debugfs_root;
++	struct dentry *root = rdev_to_drm(rdev)->primary->debugfs_root;
+ 
+ 	debugfs_create_file("rv515_pipes_info", 0444, root, rdev,
+ 			    &rv515_debugfs_pipes_info_fops);
+@@ -636,7 +636,7 @@ int rv515_init(struct radeon_device *rdev)
+ 	if (radeon_boot_test_post_card(rdev) == false)
+ 		return -EINVAL;
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* initialize AGP */
+ 	if (rdev->flags & RADEON_IS_AGP) {
+ 		r = radeon_agp_init(rdev);
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 9ce12fa3c3568..7d4b0bf591090 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -1935,7 +1935,7 @@ int rv770_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+ 	/* initialize AGP */
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 85e9cba49cecb..312fe76944a94 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6296,7 +6296,7 @@ int si_irq_process(struct radeon_device *rdev)
+ 				event_name = "vblank";
+ 
+ 				if (rdev->irq.crtc_vblank_int[crtc_idx]) {
+-					drm_handle_vblank(rdev->ddev, crtc_idx);
++					drm_handle_vblank(rdev_to_drm(rdev), crtc_idx);
+ 					rdev->pm.vblank_sync = true;
+ 					wake_up(&rdev->irq.vblank_queue);
+ 				}
+@@ -6858,7 +6858,7 @@ int si_init(struct radeon_device *rdev)
+ 	/* Initialize surface registers */
+ 	radeon_surface_init(rdev);
+ 	/* Initialize clocks */
+-	radeon_get_clock_info(rdev->ddev);
++	radeon_get_clock_info(rdev_to_drm(rdev));
+ 
+ 	/* Fence driver */
+ 	radeon_fence_driver_init(rdev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-radeon-fix-spurious-unplug-event-on-radeon-hdmi.patch b/queue-6.6/drm-radeon-fix-spurious-unplug-event-on-radeon-hdmi.patch
new file mode 100644
index 00000000000..2e8a8ed66c8
--- /dev/null
+++ b/queue-6.6/drm-radeon-fix-spurious-unplug-event-on-radeon-hdmi.patch
@@ -0,0 +1,64 @@
+From 413957951eb33dca78179a1455c98e44a2a365b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 21:17:58 +0000
+Subject: drm/radeon: Fix spurious unplug event on radeon HDMI
+
+From: Steven 'Steve' Kendall <skend@chromium.org>
+
+[ Upstream commit 7037bb04265ef05c6ffad56d884b0df76f57b095 ]
+
+On several HP models (tested on HP 3125 and HP Probook 455 G2),
+spurious unplug events are emitted upon login on Chrome OS.
+This is likely due to the way Chrome OS restarts graphics
+upon login, so it's possible it's an issue on other
+distributions but not as common, though I haven't
+reproduced the issue elsewhere.
+Use logic from an earlier version of the merged change
+(see link below) which iterates over connectors and finds
+matching encoders, rather than the other way around.
+Also fixes an issue with screen mirroring on Chrome OS.
+I've deployed this patch on Fedora and did not observe
+any regression on these devices.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1569#note_1603002
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3771
+Fixes: 20ea34710f7b ("drm/radeon: Add HD-audio component notifier support (v6)")
+Signed-off-by: Steven 'Steve' Kendall <skend@chromium.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_audio.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
+index ff0ff2642a8d0..fc22fe709b9c1 100644
+--- a/drivers/gpu/drm/radeon/radeon_audio.c
++++ b/drivers/gpu/drm/radeon/radeon_audio.c
+@@ -758,16 +758,20 @@ static int radeon_audio_component_get_eld(struct device *kdev, int port,
+ 	if (!rdev->audio.enabled || !rdev->mode_info.mode_config_initialized)
+ 		return 0;
+ 
+-	list_for_each_entry(encoder, &rdev_to_drm(rdev)->mode_config.encoder_list, head) {
++	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++		const struct drm_connector_helper_funcs *connector_funcs =
++				connector->helper_private;
++		encoder = connector_funcs->best_encoder(connector);
++
++		if (!encoder)
++			continue;
++
+ 		if (!radeon_encoder_is_digital(encoder))
+ 			continue;
+ 		radeon_encoder = to_radeon_encoder(encoder);
+ 		dig = radeon_encoder->enc_priv;
+ 		if (!dig->pin || dig->pin->id != port)
+ 			continue;
+-		connector = radeon_get_connector_for_encoder(encoder);
+-		if (!connector)
+-			continue;
+ 		*enabled = true;
+ 		ret = drm_eld_size(connector->eld);
+ 		memcpy(buf, connector->eld, min(max_bytes, ret));
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-use-atomic64_init-for-atomic64_t.patch b/queue-6.6/drm-use-atomic64_init-for-atomic64_t.patch
new file mode 100644
index 00000000000..c023801ba30
--- /dev/null
+++ b/queue-6.6/drm-use-atomic64_init-for-atomic64_t.patch
@@ -0,0 +1,37 @@
+From e87a64c087788cf8e34e0ed8ea8962c4396bddf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 13:30:45 +1100
+Subject: drm: use ATOMIC64_INIT() for atomic64_t
+
+From: Jonathan Gray <jsg@jsg.id.au>
+
+[ Upstream commit 9877bb2775d020fb7000af5ca989331d09d0e372 ]
+
+use ATOMIC64_INIT() not ATOMIC_INIT() for atomic64_t
+
+Fixes: 3f09a0cd4ea3 ("drm: Add common fdinfo helper")
+Signed-off-by: Jonathan Gray <jsg@jsg.id.au>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240111023045.50013-1-jsg@jsg.id.au
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
+index 48af0e2960a22..1d22dba69b275 100644
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -149,7 +149,7 @@ bool drm_dev_needs_global_mutex(struct drm_device *dev)
+  */
+ struct drm_file *drm_file_alloc(struct drm_minor *minor)
+ {
+-	static atomic64_t ident = ATOMIC_INIT(0);
++	static atomic64_t ident = ATOMIC64_INIT(0);
+ 	struct drm_device *dev = minor->dev;
+ 	struct drm_file *file;
+ 	int ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-v3d-address-race-condition-in-mmu-flush.patch b/queue-6.6/drm-v3d-address-race-condition-in-mmu-flush.patch
new file mode 100644
index 00000000000..c46b084574f
--- /dev/null
+++ b/queue-6.6/drm-v3d-address-race-condition-in-mmu-flush.patch
@@ -0,0 +1,80 @@
+From f14815f9615ac2ee4ccccdd9ed652183e4106198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 10:55:05 -0300
+Subject: drm/v3d: Address race-condition in MMU flush
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit cf1becb7f996a0a23ea2c270cf6bb0911ec3ca1a ]
+
+We must first flush the MMU cache and then, flush the TLB, not the other
+way around. Currently, we can see a race condition between the MMU cache
+and the TLB when running multiple rendering processes at the same time.
+This is evidenced by MMU errors triggered by the IRQ.
+
+Fix the MMU flush order by flushing the MMU cache and then the TLB.
+Also, in order to address the race condition, wait for the MMU cache flush
+to finish before starting the TLB flush.
+
+Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240923141348.2422499-2-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_mmu.c | 29 ++++++++++-------------------
+ 1 file changed, 10 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_mmu.c b/drivers/gpu/drm/v3d/v3d_mmu.c
+index 5a453532901f1..166d4a88daee5 100644
+--- a/drivers/gpu/drm/v3d/v3d_mmu.c
++++ b/drivers/gpu/drm/v3d/v3d_mmu.c
+@@ -34,32 +34,23 @@ static int v3d_mmu_flush_all(struct v3d_dev *v3d)
+ {
+ 	int ret;
+ 
+-	/* Make sure that another flush isn't already running when we
+-	 * start this one.
+-	 */
+-	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
+-			 V3D_MMU_CTL_TLB_CLEARING), 100);
+-	if (ret)
+-		dev_err(v3d->drm.dev, "TLB clear wait idle pre-wait failed\n");
+-
+-	V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL) |
+-		  V3D_MMU_CTL_TLB_CLEAR);
+-
+-	V3D_WRITE(V3D_MMUC_CONTROL,
+-		  V3D_MMUC_CONTROL_FLUSH |
++	V3D_WRITE(V3D_MMUC_CONTROL, V3D_MMUC_CONTROL_FLUSH |
+ 		  V3D_MMUC_CONTROL_ENABLE);
+ 
+-	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
+-			 V3D_MMU_CTL_TLB_CLEARING), 100);
++	ret = wait_for(!(V3D_READ(V3D_MMUC_CONTROL) &
++			 V3D_MMUC_CONTROL_FLUSHING), 100);
+ 	if (ret) {
+-		dev_err(v3d->drm.dev, "TLB clear wait idle failed\n");
++		dev_err(v3d->drm.dev, "MMUC flush wait idle failed\n");
+ 		return ret;
+ 	}
+ 
+-	ret = wait_for(!(V3D_READ(V3D_MMUC_CONTROL) &
+-			 V3D_MMUC_CONTROL_FLUSHING), 100);
++	V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL) |
++		  V3D_MMU_CTL_TLB_CLEAR);
++
++	ret = wait_for(!(V3D_READ(V3D_MMU_CTL) &
++			 V3D_MMU_CTL_TLB_CLEARING), 100);
+ 	if (ret)
+-		dev_err(v3d->drm.dev, "MMUC flush wait idle failed\n");
++		dev_err(v3d->drm.dev, "MMU TLB clear wait idle failed\n");
+ 
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-hdmi-avoid-hang-with-debug-registers-when-su.patch b/queue-6.6/drm-vc4-hdmi-avoid-hang-with-debug-registers-when-su.patch
new file mode 100644
index 00000000000..aef66cc9b4a
--- /dev/null
+++ b/queue-6.6/drm-vc4-hdmi-avoid-hang-with-debug-registers-when-su.patch
@@ -0,0 +1,53 @@
+From c386421abb46776270f55020701c55fc00b42c71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:40 +0100
+Subject: drm/vc4: hdmi: Avoid hang with debug registers when suspended
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 223ee2567a55e4f80315c768d2969e6a3b9fb23d ]
+
+Trying to read /sys/kernel/debug/dri/1/hdmi1_regs
+when the hdmi is disconnected results in a fatal system hang.
+
+This is due to the pm suspend code disabling the dvp clock.
+That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG,
+which results in accesses hanging AXI bus.
+
+Protect against this.
+
+Fixes: 25eb441d55d4 ("drm/vc4: hdmi: Add all the vc5 HDMI registers into the debugfs dumps")
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-17-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index c6e986f71a26f..d4487f4cb3034 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -179,6 +179,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused)
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return -ENODEV;
+ 
++	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
++
+ 	drm_print_regset32(&p, &vc4_hdmi->hdmi_regset);
+ 	drm_print_regset32(&p, &vc4_hdmi->hd_regset);
+ 	drm_print_regset32(&p, &vc4_hdmi->cec_regset);
+@@ -188,6 +190,8 @@ static int vc4_hdmi_debugfs_regs(struct seq_file *m, void *unused)
+ 	drm_print_regset32(&p, &vc4_hdmi->ram_regset);
+ 	drm_print_regset32(&p, &vc4_hdmi->rm_regset);
+ 
++	pm_runtime_put(&vc4_hdmi->pdev->dev);
++
+ 	drm_dev_exit(idx);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-hvs-correct-logic-on-stopping-an-hvs-channel.patch b/queue-6.6/drm-vc4-hvs-correct-logic-on-stopping-an-hvs-channel.patch
new file mode 100644
index 00000000000..5a06c964574
--- /dev/null
+++ b/queue-6.6/drm-vc4-hvs-correct-logic-on-stopping-an-hvs-channel.patch
@@ -0,0 +1,55 @@
+From 622d315543fe0c7a14093cbde6c42286d7f04e12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:55 +0100
+Subject: drm/vc4: hvs: Correct logic on stopping an HVS channel
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 7ab6512e7942889c0962588355cb92424a690be6 ]
+
+When factoring out __vc4_hvs_stop_channel, the logic got inverted from
+	if (condition)
+	  // stop channel
+to
+	if (condition)
+	  goto out
+	//stop channel
+	out:
+and also changed the exact register writes used to stop the channel.
+
+Correct the logic so that the channel is actually stopped, and revert
+to the original register writes.
+
+Fixes: 6d01a106b4c8 ("drm/vc4: crtc: Move HVS init and close to a function")
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-32-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 3e72219a6a75f..27c8fb9efa854 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -420,13 +420,11 @@ void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+-	if (HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE)
++	if (!(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE))
+ 		goto out;
+ 
+-	HVS_WRITE(SCALER_DISPCTRLX(chan),
+-		  HVS_READ(SCALER_DISPCTRLX(chan)) | SCALER_DISPCTRLX_RESET);
+-	HVS_WRITE(SCALER_DISPCTRLX(chan),
+-		  HVS_READ(SCALER_DISPCTRLX(chan)) & ~SCALER_DISPCTRLX_ENABLE);
++	HVS_WRITE(SCALER_DISPCTRLX(chan), SCALER_DISPCTRLX_RESET);
++	HVS_WRITE(SCALER_DISPCTRLX(chan), 0);
+ 
+ 	/* Once we leave, the scaler should be disabled and its fifo empty. */
+ 	WARN_ON_ONCE(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_RESET);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-hvs-don-t-write-gamma-luts-on-2711.patch b/queue-6.6/drm-vc4-hvs-don-t-write-gamma-luts-on-2711.patch
new file mode 100644
index 00000000000..9d530606031
--- /dev/null
+++ b/queue-6.6/drm-vc4-hvs-don-t-write-gamma-luts-on-2711.patch
@@ -0,0 +1,41 @@
+From c0a60c29eb861dad78c27ca5478871f71dfcd222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:38 +0100
+Subject: drm/vc4: hvs: Don't write gamma luts on 2711
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 52efe364d1968ee3e3ed45eb44eb924b63635315 ]
+
+The gamma block has changed in 2711, therefore writing the lut
+in vc4_hvs_lut_load is incorrect.
+
+Whilst the gamma property isn't created for 2711, it is called
+from vc4_hvs_init_channel, so abort if attempted.
+
+Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5")
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-15-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 04af672caacb1..1ac55c19197cb 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -222,6 +222,9 @@ static void vc4_hvs_lut_load(struct vc4_hvs *hvs,
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
++	if (hvs->vc4->is_vc5)
++		return;
++
+ 	/* The LUT memory is laid out with each HVS channel in order,
+ 	 * each of which takes 256 writes for R, 256 for G, then 256
+ 	 * for B.
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-hvs-fix-dlist-debug-not-resetting-the-next-e.patch b/queue-6.6/drm-vc4-hvs-fix-dlist-debug-not-resetting-the-next-e.patch
new file mode 100644
index 00000000000..74f417b7f19
--- /dev/null
+++ b/queue-6.6/drm-vc4-hvs-fix-dlist-debug-not-resetting-the-next-e.patch
@@ -0,0 +1,46 @@
+From 9a6d5211a052668c080e620630afba38a9f65691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:41 +0100
+Subject: drm/vc4: hvs: Fix dlist debug not resetting the next entry pointer
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 6d5f76e0544b04ec5bdd2a09c19d90aeeb2cd479 ]
+
+The debug function to display the dlists didn't reset next_entry_start
+when starting each display, so resulting in not stopping the
+list at the correct place.
+
+Fixes: c6dac00340fc ("drm/vc4: hvs: Add debugfs node that dumps the current display lists")
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-18-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 1ac55c19197cb..7137a90e6efa7 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -110,7 +110,7 @@ static int vc4_hvs_debugfs_dlist(struct seq_file *m, void *data)
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct drm_printer p = drm_seq_file_printer(m);
+-	unsigned int next_entry_start = 0;
++	unsigned int next_entry_start;
+ 	unsigned int i, j;
+ 	u32 dlist_word, dispstat;
+ 
+@@ -124,6 +124,7 @@ static int vc4_hvs_debugfs_dlist(struct seq_file *m, void *data)
+ 		}
+ 
+ 		drm_printf(&p, "HVS chan %u:\n", i);
++		next_entry_start = 0;
+ 
+ 		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < 256; j++) {
+ 			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-hvs-remove-incorrect-limit-from-hvs_dlist-de.patch b/queue-6.6/drm-vc4-hvs-remove-incorrect-limit-from-hvs_dlist-de.patch
new file mode 100644
index 00000000000..766eb970cf7
--- /dev/null
+++ b/queue-6.6/drm-vc4-hvs-remove-incorrect-limit-from-hvs_dlist-de.patch
@@ -0,0 +1,74 @@
+From 612388f48d16bcc7678b97c3d1ca58bbe17d5b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 16:20:42 +0100
+Subject: drm/vc4: hvs: Remove incorrect limit from hvs_dlist debugfs function
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit d285bb622ebdfaa84f51df3a1abccb87036157ea ]
+
+The debugfs function to dump dlists aborted at 256 bytes,
+when actually the dlist memory is generally significantly
+larger but varies based on SoC.
+
+We already have the correct limit in __vc4_hvs_alloc, so
+store it for use in the debugfs dlist function.
+
+Fixes: c6dac00340fc ("drm/vc4: hvs: Add debugfs node that dumps the current display lists")
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240621152055.4180873-19-dave.stevenson@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h | 1 +
+ drivers/gpu/drm/vc4/vc4_hvs.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
+index bf66499765fbb..ac4ad95b36438 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -314,6 +314,7 @@ struct vc4_hvs {
+ 	struct platform_device *pdev;
+ 	void __iomem *regs;
+ 	u32 __iomem *dlist;
++	unsigned int dlist_mem_size;
+ 
+ 	struct clk *core_clk;
+ 
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 7137a90e6efa7..3e72219a6a75f 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -110,6 +110,7 @@ static int vc4_hvs_debugfs_dlist(struct seq_file *m, void *data)
+ 	struct vc4_dev *vc4 = to_vc4_dev(dev);
+ 	struct vc4_hvs *hvs = vc4->hvs;
+ 	struct drm_printer p = drm_seq_file_printer(m);
++	unsigned int dlist_mem_size = hvs->dlist_mem_size;
+ 	unsigned int next_entry_start;
+ 	unsigned int i, j;
+ 	u32 dlist_word, dispstat;
+@@ -126,7 +127,7 @@ static int vc4_hvs_debugfs_dlist(struct seq_file *m, void *data)
+ 		drm_printf(&p, "HVS chan %u:\n", i);
+ 		next_entry_start = 0;
+ 
+-		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < 256; j++) {
++		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < dlist_mem_size; j++) {
+ 			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
+ 			drm_printf(&p, "dlist: %02d: 0x%08x\n", j,
+ 				   dlist_word);
+@@ -804,9 +805,10 @@ struct vc4_hvs *__vc4_hvs_alloc(struct vc4_dev *vc4, struct platform_device *pde
+ 	 * our 16K), since we don't want to scramble the screen when
+ 	 * transitioning from the firmware's boot setup to runtime.
+ 	 */
++	hvs->dlist_mem_size = (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END;
+ 	drm_mm_init(&hvs->dlist_mm,
+ 		    HVS_BOOTLOADER_DLIST_END,
+-		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
++		    hvs->dlist_mem_size);
+ 
+ 	/* Set up the HVS LBM memory manager.  We could have some more
+ 	 * complicated data structure that allowed reuse of LBM areas
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vc4-match-drm_dev_enter-and-exit-calls-in-vc4_hv.patch b/queue-6.6/drm-vc4-match-drm_dev_enter-and-exit-calls-in-vc4_hv.patch
new file mode 100644
index 00000000000..dbb302d5dad
--- /dev/null
+++ b/queue-6.6/drm-vc4-match-drm_dev_enter-and-exit-calls-in-vc4_hv.patch
@@ -0,0 +1,51 @@
+From a0780472979032fe53de65965631da467084d6a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 17:44:35 +0100
+Subject: drm/vc4: Match drm_dev_enter and exit calls in vc4_hvs_atomic_flush
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit 6b0bd1b02ea24b10522c92b2503981970b26d1a2 ]
+
+Commit 92c17d16476c ("drm/vc4: hvs: Ignore atomic_flush if we're disabled")
+added a path which returned early without having called drm_dev_exit.
+
+Ensure all paths call drm_dev_exit.
+
+Fixes: 92c17d16476c ("drm/vc4: hvs: Ignore atomic_flush if we're disabled")
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241008-drm-vc4-fixes-v1-2-9d0396ca9f42@raspberrypi.com
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index 27c8fb9efa854..008352166579e 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -583,7 +583,7 @@ void vc4_hvs_atomic_flush(struct drm_crtc *crtc,
+ 	}
+ 
+ 	if (vc4_state->assigned_channel == VC4_HVS_CHANNEL_DISABLED)
+-		return;
++		goto exit;
+ 
+ 	if (debug_dump_regs) {
+ 		DRM_INFO("CRTC %d HVS before:\n", drm_crtc_index(crtc));
+@@ -666,6 +666,7 @@ void vc4_hvs_atomic_flush(struct drm_crtc *crtc,
+ 		vc4_hvs_dump_state(hvs);
+ 	}
+ 
++exit:
+ 	drm_dev_exit(idx);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-vkms-drop-unnecessary-call-to-drm_crtc_cleanup.patch b/queue-6.6/drm-vkms-drop-unnecessary-call-to-drm_crtc_cleanup.patch
new file mode 100644
index 00000000000..b44981f5f39
--- /dev/null
+++ b/queue-6.6/drm-vkms-drop-unnecessary-call-to-drm_crtc_cleanup.patch
@@ -0,0 +1,52 @@
+From a27e718be6af3b571f20910513fb5fa2d9d03947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 19:38:35 +0100
+Subject: drm/vkms: Drop unnecessary call to drm_crtc_cleanup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Expósito <jose.exposito89@gmail.com>
+
+[ Upstream commit 1d43dddd7c38ea1aa93f78f7ee10087afb0a561f ]
+
+CRTC creation uses drmm_crtc_init_with_planes(), which automatically
+handles cleanup. However, an unnecessary call to drm_crtc_cleanup() is
+still present in the vkms_output_init() error path.
+
+Fixes: 99cc528ebe92 ("drm/vkms: Use drmm_crtc_init_with_planes()")
+Signed-off-by: José Expósito <jose.exposito89@gmail.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241031183835.3633-1-jose.exposito89@gmail.com
+Acked-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_output.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
+index 5ce70dd946aa6..24589b947dea3 100644
+--- a/drivers/gpu/drm/vkms/vkms_output.c
++++ b/drivers/gpu/drm/vkms/vkms_output.c
+@@ -84,7 +84,7 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index)
+ 				 DRM_MODE_CONNECTOR_VIRTUAL);
+ 	if (ret) {
+ 		DRM_ERROR("Failed to init connector\n");
+-		goto err_connector;
++		return ret;
+ 	}
+ 
+ 	drm_connector_helper_add(connector, &vkms_conn_helper_funcs);
+@@ -119,8 +119,5 @@ int vkms_output_init(struct vkms_device *vkmsdev, int index)
+ err_encoder:
+ 	drm_connector_cleanup(connector);
+ 
+-err_connector:
+-	drm_crtc_cleanup(crtc);
+-
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/drm-zynqmp_kms-unplug-drm-device-before-removal.patch b/queue-6.6/drm-zynqmp_kms-unplug-drm-device-before-removal.patch
new file mode 100644
index 00000000000..f267e94d78a
--- /dev/null
+++ b/queue-6.6/drm-zynqmp_kms-unplug-drm-device-before-removal.patch
@@ -0,0 +1,40 @@
+From f6f0950f7f2b52bbf9d557237251a8a1d65f0504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 15:35:53 -0400
+Subject: drm: zynqmp_kms: Unplug DRM device before removal
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit 2e07c88914fc5289c21820b1aa94f058feb38197 ]
+
+Prevent userspace accesses to the DRM device from causing
+use-after-frees by unplugging the device before we remove it. This
+causes any further userspace accesses to result in an error without
+further calls into this driver's internals.
+
+Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
+Closes: https://lore.kernel.org/dri-devel/4d8f4c9b-2efb-4774-9a37-2f257f79b2c9@linux.dev/
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240809193600.3360015-2-sean.anderson@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_kms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_kms.c b/drivers/gpu/drm/xlnx/zynqmp_kms.c
+index 44d4a510ad7d6..ccb6e065dc6d1 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_kms.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c
+@@ -533,7 +533,7 @@ void zynqmp_dpsub_drm_cleanup(struct zynqmp_dpsub *dpsub)
+ {
+ 	struct drm_device *drm = &dpsub->drm->dev;
+ 
+-	drm_dev_unregister(drm);
++	drm_dev_unplug(drm);
+ 	drm_atomic_helper_shutdown(drm);
+ 	drm_encoder_cleanup(&dpsub->drm->encoder);
+ 	drm_kms_helper_poll_fini(drm);
+-- 
+2.43.0
+
diff --git a/queue-6.6/dt-bindings-clock-axi-clkgen-include-axi-clk.patch b/queue-6.6/dt-bindings-clock-axi-clkgen-include-axi-clk.patch
new file mode 100644
index 00000000000..bf920f5fbaf
--- /dev/null
+++ b/queue-6.6/dt-bindings-clock-axi-clkgen-include-axi-clk.patch
@@ -0,0 +1,72 @@
+From c0ad9b325d1b5f84f9ecf9d873b53877b7a4941d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 14:59:41 +0100
+Subject: dt-bindings: clock: axi-clkgen: include AXI clk
+
+From: Nuno Sa <nuno.sa@analog.com>
+
+[ Upstream commit 47f3f5a82a31527e027929c5cec3dd1ef5ef30f5 ]
+
+In order to access the registers of the HW, we need to make sure that
+the AXI bus clock is enabled. Hence let's increase the number of clocks
+by one and add clock-names to differentiate between parent clocks and
+the bus clock.
+
+Fixes: 0e646c52cf0e ("clk: Add axi-clkgen driver")
+Signed-off-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20241029-axi-clkgen-fix-axiclk-v2-1-bc5e0733ad76@analog.com
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/clock/adi,axi-clkgen.yaml        | 22 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
+index 5e942bccf2778..2b2041818a0a4 100644
+--- a/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
++++ b/Documentation/devicetree/bindings/clock/adi,axi-clkgen.yaml
+@@ -26,9 +26,21 @@ properties:
+     description:
+       Specifies the reference clock(s) from which the output frequency is
+       derived. This must either reference one clock if only the first clock
+-      input is connected or two if both clock inputs are connected.
+-    minItems: 1
+-    maxItems: 2
++      input is connected or two if both clock inputs are connected. The last
++      clock is the AXI bus clock that needs to be enabled so we can access the
++      core registers.
++    minItems: 2
++    maxItems: 3
++
++  clock-names:
++    oneOf:
++      - items:
++          - const: clkin1
++          - const: s_axi_aclk
++      - items:
++          - const: clkin1
++          - const: clkin2
++          - const: s_axi_aclk
+ 
+   '#clock-cells':
+     const: 0
+@@ -40,6 +52,7 @@ required:
+   - compatible
+   - reg
+   - clocks
++  - clock-names
+   - '#clock-cells'
+ 
+ additionalProperties: false
+@@ -50,5 +63,6 @@ examples:
+       compatible = "adi,axi-clkgen-2.00.a";
+       #clock-cells = <0>;
+       reg = <0xff000000 0x1000>;
+-      clocks = <&osc 1>;
++      clocks = <&osc 1>, <&clkc 15>;
++      clock-names = "clkin1", "s_axi_aclk";
+     };
+-- 
+2.43.0
+
diff --git a/queue-6.6/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch b/queue-6.6/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch
new file mode 100644
index 00000000000..12395a2cc6a
--- /dev/null
+++ b/queue-6.6/dt-bindings-vendor-prefixes-add-neofidelity-inc.patch
@@ -0,0 +1,36 @@
+From e27ee55eca9676d103b9bec176bf5d7b528147fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 17:52:39 +0300
+Subject: dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
+
+From: Igor Prusov <ivprusov@salutedevices.com>
+
+[ Upstream commit 5d9e6d6fc1b98c8c22d110ee931b3b233d43cd13 ]
+
+Add vendor prefix for NeoFidelity, Inc
+
+Signed-off-by: Igor Prusov <ivprusov@salutedevices.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20240925-ntp-amps-8918-8835-v3-1-e2459a8191a6@salutedevices.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/vendor-prefixes.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.yaml b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+index 573578db95091..12a16031d7b6d 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
++++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
+@@ -923,6 +923,8 @@ patternProperties:
+     description: National Semiconductor
+   "^nec,.*":
+     description: NEC LCD Technologies, Ltd.
++  "^neofidelity,.*":
++    description: Neofidelity Inc.
+   "^neonode,.*":
+     description: Neonode Inc.
+   "^netgear,.*":
+-- 
+2.43.0
+
diff --git a/queue-6.6/edac-bluefield-fix-potential-integer-overflow.patch b/queue-6.6/edac-bluefield-fix-potential-integer-overflow.patch
new file mode 100644
index 00000000000..4185f67d898
--- /dev/null
+++ b/queue-6.6/edac-bluefield-fix-potential-integer-overflow.patch
@@ -0,0 +1,43 @@
+From 07344f277a681dc3ac67dd165b682e3a1a01e00e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 11:10:56 -0400
+Subject: EDAC/bluefield: Fix potential integer overflow
+
+From: David Thompson <davthompson@nvidia.com>
+
+[ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ]
+
+The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx
+left-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as
+32-bits wide the left-shift operation truncates the upper 16 bits of
+information during the calculation of the SMC argument.
+
+The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any
+potential integer overflow, i.e. loss of data from upper 16 bits.
+
+Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4")
+Signed-off-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Shravan Kumar Ramani <shravankr@nvidia.com>
+Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/bluefield_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c
+index e4736eb37bfb3..0ef0489827682 100644
+--- a/drivers/edac/bluefield_edac.c
++++ b/drivers/edac/bluefield_edac.c
+@@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci)
+ static void bluefield_edac_init_dimms(struct mem_ctl_info *mci)
+ {
+ 	struct bluefield_edac_priv *priv = mci->pvt_info;
+-	int mem_ctrl_idx = mci->mc_idx;
++	u64 mem_ctrl_idx = mci->mc_idx;
+ 	struct dimm_info *dimm;
+ 	u64 smc_info, smc_arg;
+ 	int is_empty = 1, i;
+-- 
+2.43.0
+
diff --git a/queue-6.6/edac-fsl_ddr-fix-bad-bit-shift-operations.patch b/queue-6.6/edac-fsl_ddr-fix-bad-bit-shift-operations.patch
new file mode 100644
index 00000000000..cb77b135125
--- /dev/null
+++ b/queue-6.6/edac-fsl_ddr-fix-bad-bit-shift-operations.patch
@@ -0,0 +1,75 @@
+From fafa8d564c80d34a38287d1fb2dfa708e9d0f117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 16:31:11 -0400
+Subject: EDAC/fsl_ddr: Fix bad bit shift operations
+
+From: Priyanka Singh <priyanka.singh@nxp.com>
+
+[ Upstream commit 9ec22ac4fe766c6abba845290d5139a3fbe0153b ]
+
+Fix undefined behavior caused by left-shifting a negative value in the
+expression:
+
+    cap_high ^ (1 << (bad_data_bit - 32))
+
+The variable bad_data_bit ranges from 0 to 63. When it is less than 32,
+bad_data_bit - 32 becomes negative, and left-shifting by a negative
+value in C is undefined behavior.
+
+Fix this by combining cap_high and cap_low into a 64-bit variable.
+
+  [ bp: Massage commit message, simplify error bits handling. ]
+
+Fixes: ea2eb9a8b620 ("EDAC, fsl-ddr: Separate FSL DDR driver from MPC85xx")
+Signed-off-by: Priyanka Singh <priyanka.singh@nxp.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20241016-imx95_edac-v3-3-86ae6fc2756a@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/fsl_ddr_edac.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/edac/fsl_ddr_edac.c b/drivers/edac/fsl_ddr_edac.c
+index b81757555a8a9..7809427c2dbeb 100644
+--- a/drivers/edac/fsl_ddr_edac.c
++++ b/drivers/edac/fsl_ddr_edac.c
+@@ -328,21 +328,25 @@ static void fsl_mc_check(struct mem_ctl_info *mci)
+ 	 * TODO: Add support for 32-bit wide buses
+ 	 */
+ 	if ((err_detect & DDR_EDE_SBE) && (bus_width == 64)) {
++		u64 cap = (u64)cap_high << 32 | cap_low;
++		u32 s = syndrome;
++
+ 		sbe_ecc_decode(cap_high, cap_low, syndrome,
+ 				&bad_data_bit, &bad_ecc_bit);
+ 
+-		if (bad_data_bit != -1)
+-			fsl_mc_printk(mci, KERN_ERR,
+-				"Faulty Data bit: %d\n", bad_data_bit);
+-		if (bad_ecc_bit != -1)
+-			fsl_mc_printk(mci, KERN_ERR,
+-				"Faulty ECC bit: %d\n", bad_ecc_bit);
++		if (bad_data_bit >= 0) {
++			fsl_mc_printk(mci, KERN_ERR, "Faulty Data bit: %d\n", bad_data_bit);
++			cap ^= 1ULL << bad_data_bit;
++		}
++
++		if (bad_ecc_bit >= 0) {
++			fsl_mc_printk(mci, KERN_ERR, "Faulty ECC bit: %d\n", bad_ecc_bit);
++			s ^= 1 << bad_ecc_bit;
++		}
+ 
+ 		fsl_mc_printk(mci, KERN_ERR,
+ 			"Expected Data / ECC:\t%#8.8x_%08x / %#2.2x\n",
+-			cap_high ^ (1 << (bad_data_bit - 32)),
+-			cap_low ^ (1 << bad_data_bit),
+-			syndrome ^ (1 << bad_ecc_bit));
++			upper_32_bits(cap), lower_32_bits(cap), s);
+ 	}
+ 
+ 	fsl_mc_printk(mci, KERN_ERR,
+-- 
+2.43.0
+
diff --git a/queue-6.6/edac-igen6-avoid-segmentation-fault-on-module-unload.patch b/queue-6.6/edac-igen6-avoid-segmentation-fault-on-module-unload.patch
new file mode 100644
index 00000000000..fca16b730a2
--- /dev/null
+++ b/queue-6.6/edac-igen6-avoid-segmentation-fault-on-module-unload.patch
@@ -0,0 +1,56 @@
+From 82848856172b32077ba2c07f47411aa44c22fd2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:40:52 +0000
+Subject: EDAC/igen6: Avoid segmentation fault on module unload
+
+From: Orange Kao <orange@aiven.io>
+
+[ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ]
+
+The segmentation fault happens because:
+
+During modprobe:
+1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
+2. In igen6_register_mci(), mci->pvt_info will point to
+   &igen6_pvt->imc[mc]
+
+During rmmod:
+1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
+2. In igen6_remove(), it will kfree(igen6_pvt);
+
+Fix this issue by setting mci->pvt_info to NULL to avoid the double
+kfree.
+
+Fixes: 10590a9d4f23 ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219360
+Signed-off-by: Orange Kao <orange@aiven.io>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20241104124237.124109-2-orange@aiven.io
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/igen6_edac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
+index a0edb61a5a01a..0b408299699a8 100644
+--- a/drivers/edac/igen6_edac.c
++++ b/drivers/edac/igen6_edac.c
+@@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev)
+ 	imc->mci = mci;
+ 	return 0;
+ fail3:
++	mci->pvt_info = NULL;
+ 	kfree(mci->ctl_name);
+ fail2:
+ 	edac_mc_free(mci);
+@@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void)
+ 
+ 		edac_mc_del_mc(mci->pdev);
+ 		kfree(mci->ctl_name);
++		mci->pvt_info = NULL;
+ 		edac_mc_free(mci);
+ 		iounmap(imc->window);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/edac-skx_common-differentiate-memory-error-sources.patch b/queue-6.6/edac-skx_common-differentiate-memory-error-sources.patch
new file mode 100644
index 00000000000..f6713a32951
--- /dev/null
+++ b/queue-6.6/edac-skx_common-differentiate-memory-error-sources.patch
@@ -0,0 +1,147 @@
+From 609c888fcfbab94ec1049072b7d48c5dfb5013a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 15:22:35 +0800
+Subject: EDAC/skx_common: Differentiate memory error sources
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2397f795735219caa9c2fe61e7bcdd0652e670d3 ]
+
+The current skx_common determines whether the memory error source is the
+near memory of the 2LM system and then retrieves the decoded error results
+from the ADXL components (near-memory vs. far-memory) accordingly.
+
+However, some memory controllers may have limitations in correctly
+reporting the memory error source, leading to the retrieval of incorrect
+decoded parts from the ADXL.
+
+To address these limitations, instead of simply determining whether the
+memory error is from the near memory of the 2LM system, it is necessary to
+distinguish the memory error source details as follows:
+
+  Memory error from the near memory of the 2LM system.
+  Memory error from the far memory of the 2LM system.
+  Memory error from the 1LM system.
+  Not a memory error.
+
+This will enable the i10nm_edac driver to take appropriate actions for
+those memory controllers that have limitations in reporting the memory
+error source.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Diego Garcia Rodriguez <diego.garcia.rodriguez@intel.com>
+Link: https://lore.kernel.org/r/20241015072236.24543-2-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_common.c | 34 ++++++++++++++++------------------
+ drivers/edac/skx_common.h |  7 +++++++
+ 2 files changed, 23 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c
+index 8d18099fd528c..42266120ef427 100644
+--- a/drivers/edac/skx_common.c
++++ b/drivers/edac/skx_common.c
+@@ -119,7 +119,7 @@ void skx_adxl_put(void)
+ }
+ EXPORT_SYMBOL_GPL(skx_adxl_put);
+ 
+-static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_mem)
++static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)
+ {
+ 	struct skx_dev *d;
+ 	int i, len = 0;
+@@ -136,7 +136,7 @@ static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_me
+ 	}
+ 
+ 	res->socket  = (int)adxl_values[component_indices[INDEX_SOCKET]];
+-	if (error_in_1st_level_mem) {
++	if (err_src == ERR_SRC_2LM_NM) {
+ 		res->imc     = (adxl_nm_bitmap & BIT_NM_MEMCTRL) ?
+ 			       (int)adxl_values[component_indices[INDEX_NM_MEMCTRL]] : -1;
+ 		res->channel = (adxl_nm_bitmap & BIT_NM_CHANNEL) ?
+@@ -620,31 +620,27 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
+ 			     optype, skx_msg);
+ }
+ 
+-static bool skx_error_in_1st_level_mem(const struct mce *m)
++static enum error_source skx_error_source(const struct mce *m)
+ {
+-	u32 errcode;
++	u32 errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
+ 
+-	if (!skx_mem_cfg_2lm)
+-		return false;
+-
+-	errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
+-
+-	return errcode == MCACOD_EXT_MEM_ERR;
+-}
++	if (errcode != MCACOD_MEM_CTL_ERR && errcode != MCACOD_EXT_MEM_ERR)
++		return ERR_SRC_NOT_MEMORY;
+ 
+-static bool skx_error_in_mem(const struct mce *m)
+-{
+-	u32 errcode;
++	if (!skx_mem_cfg_2lm)
++		return ERR_SRC_1LM;
+ 
+-	errcode = GET_BITFIELD(m->status, 0, 15) & MCACOD_MEM_ERR_MASK;
++	if (errcode == MCACOD_EXT_MEM_ERR)
++		return ERR_SRC_2LM_NM;
+ 
+-	return (errcode == MCACOD_MEM_CTL_ERR || errcode == MCACOD_EXT_MEM_ERR);
++	return ERR_SRC_2LM_FM;
+ }
+ 
+ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+ 			void *data)
+ {
+ 	struct mce *mce = (struct mce *)data;
++	enum error_source err_src;
+ 	struct decoded_addr res;
+ 	struct mem_ctl_info *mci;
+ 	char *type;
+@@ -652,8 +648,10 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+ 	if (mce->kflags & MCE_HANDLED_CEC)
+ 		return NOTIFY_DONE;
+ 
++	err_src = skx_error_source(mce);
++
+ 	/* Ignore unless this is memory related with an address */
+-	if (!skx_error_in_mem(mce) || !(mce->status & MCI_STATUS_ADDRV))
++	if (err_src == ERR_SRC_NOT_MEMORY || !(mce->status & MCI_STATUS_ADDRV))
+ 		return NOTIFY_DONE;
+ 
+ 	memset(&res, 0, sizeof(res));
+@@ -667,7 +665,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+ 	/* Try driver decoder first */
+ 	if (!(driver_decode && driver_decode(&res))) {
+ 		/* Then try firmware decoder (ACPI DSM methods) */
+-		if (!(adxl_component_count && skx_adxl_decode(&res, skx_error_in_1st_level_mem(mce))))
++		if (!(adxl_component_count && skx_adxl_decode(&res, err_src)))
+ 			return NOTIFY_DONE;
+ 	}
+ 
+diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h
+index 11faf1db4fa48..30a795d8b8d36 100644
+--- a/drivers/edac/skx_common.h
++++ b/drivers/edac/skx_common.h
+@@ -147,6 +147,13 @@ enum {
+ 	INDEX_MAX
+ };
+ 
++enum error_source {
++	ERR_SRC_1LM,
++	ERR_SRC_2LM_NM,
++	ERR_SRC_2LM_FM,
++	ERR_SRC_NOT_MEMORY,
++};
++
+ #define BIT_NM_MEMCTRL	BIT_ULL(INDEX_NM_MEMCTRL)
+ #define BIT_NM_CHANNEL	BIT_ULL(INDEX_NM_CHANNEL)
+ #define BIT_NM_DIMM	BIT_ULL(INDEX_NM_DIMM)
+-- 
+2.43.0
+
diff --git a/queue-6.6/edac-skx_common-i10nm-fix-incorrect-far-memory-error.patch b/queue-6.6/edac-skx_common-i10nm-fix-incorrect-far-memory-error.patch
new file mode 100644
index 00000000000..f2dcff375df
--- /dev/null
+++ b/queue-6.6/edac-skx_common-i10nm-fix-incorrect-far-memory-error.patch
@@ -0,0 +1,107 @@
+From cca78beb571704dede524ce9def0c89e2b3b1dbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 15:22:36 +0800
+Subject: EDAC/{skx_common,i10nm}: Fix incorrect far-memory error source
+ indicator
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit a36667037a0c0e36c59407f8ae636295390239a5 ]
+
+The Granite Rapids CPUs with Flat2LM memory configurations may
+mistakenly report near-memory errors as far-memory errors, resulting
+in the invalid decoded ADXL results:
+
+  EDAC skx: Bad imc -1
+
+Fix this incorrect far-memory error source indicator by prefetching the
+decoded far-memory controller ID, and adjust the error source indicator
+to near-memory if the far-memory controller ID is invalid.
+
+Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Tested-by: Diego Garcia Rodriguez <diego.garcia.rodriguez@intel.com>
+Link: https://lore.kernel.org/r/20241015072236.24543-3-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c |  1 +
+ drivers/edac/skx_common.c | 23 +++++++++++++++++++++++
+ drivers/edac/skx_common.h |  1 +
+ 3 files changed, 25 insertions(+)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index 2b83d6de9352b..535f058b48eef 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -1088,6 +1088,7 @@ static int __init i10nm_init(void)
+ 		return -ENODEV;
+ 
+ 	cfg = (struct res_config *)id->driver_data;
++	skx_set_res_cfg(cfg);
+ 	res_cfg = cfg;
+ 
+ 	rc = skx_get_hi_lo(0x09a2, off, &tolm, &tohm);
+diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c
+index 42266120ef427..0b8aaf5f77d9f 100644
+--- a/drivers/edac/skx_common.c
++++ b/drivers/edac/skx_common.c
+@@ -47,6 +47,7 @@ static skx_show_retry_log_f skx_show_retry_rd_err_log;
+ static u64 skx_tolm, skx_tohm;
+ static LIST_HEAD(dev_edac_list);
+ static bool skx_mem_cfg_2lm;
++static struct res_config *skx_res_cfg;
+ 
+ int skx_adxl_get(void)
+ {
+@@ -135,6 +136,22 @@ static bool skx_adxl_decode(struct decoded_addr *res, enum error_source err_src)
+ 		return false;
+ 	}
+ 
++	/*
++	 * GNR with a Flat2LM memory configuration may mistakenly classify
++	 * a near-memory error(DDR5) as a far-memory error(CXL), resulting
++	 * in the incorrect selection of decoded ADXL components.
++	 * To address this, prefetch the decoded far-memory controller ID
++	 * and adjust the error source to near-memory if the far-memory
++	 * controller ID is invalid.
++	 */
++	if (skx_res_cfg && skx_res_cfg->type == GNR && err_src == ERR_SRC_2LM_FM) {
++		res->imc = (int)adxl_values[component_indices[INDEX_MEMCTRL]];
++		if (res->imc == -1) {
++			err_src = ERR_SRC_2LM_NM;
++			edac_dbg(0, "Adjust the error source to near-memory.\n");
++		}
++	}
++
+ 	res->socket  = (int)adxl_values[component_indices[INDEX_SOCKET]];
+ 	if (err_src == ERR_SRC_2LM_NM) {
+ 		res->imc     = (adxl_nm_bitmap & BIT_NM_MEMCTRL) ?
+@@ -191,6 +208,12 @@ void skx_set_mem_cfg(bool mem_cfg_2lm)
+ }
+ EXPORT_SYMBOL_GPL(skx_set_mem_cfg);
+ 
++void skx_set_res_cfg(struct res_config *cfg)
++{
++	skx_res_cfg = cfg;
++}
++EXPORT_SYMBOL_GPL(skx_set_res_cfg);
++
+ void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log)
+ {
+ 	driver_decode = decode;
+diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h
+index 30a795d8b8d36..e7f18ada16681 100644
+--- a/drivers/edac/skx_common.h
++++ b/drivers/edac/skx_common.h
+@@ -242,6 +242,7 @@ int skx_adxl_get(void);
+ void skx_adxl_put(void);
+ void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log);
+ void skx_set_mem_cfg(bool mem_cfg_2lm);
++void skx_set_res_cfg(struct res_config *cfg);
+ 
+ int skx_get_src_id(struct skx_dev *d, int off, u8 *id);
+ int skx_get_node_id(struct skx_dev *d, u8 *id);
+-- 
+2.43.0
+
diff --git a/queue-6.6/efi-libstub-fix-efi_parse_options-ignoring-the-defau.patch b/queue-6.6/efi-libstub-fix-efi_parse_options-ignoring-the-defau.patch
new file mode 100644
index 00000000000..5b33a93d63c
--- /dev/null
+++ b/queue-6.6/efi-libstub-fix-efi_parse_options-ignoring-the-defau.patch
@@ -0,0 +1,41 @@
+From 6fba4ada9cebb2b1ec8d7918be86f5180908944c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2024 01:11:56 -0400
+Subject: efi/libstub: fix efi_parse_options() ignoring the default command
+ line
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit aacfa0ef247b0130b7a98bb52378f8cd727a66ca ]
+
+efi_convert_cmdline() always returns a size of at least 1 because it
+counts the NUL terminator, so the "cmdline_size == 0" condition is never
+satisfied.
+
+Change it to check if the string starts with a NUL character to get the
+intended behavior: to use CONFIG_CMDLINE when load_options_size == 0.
+
+Fixes: 60f38de7a8d4 ("efi/libstub: Unify command line param parsing")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/efi-stub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/efi/libstub/efi-stub.c b/drivers/firmware/efi/libstub/efi-stub.c
+index f9c1e8a2bd1d3..c5732fb5a5654 100644
+--- a/drivers/firmware/efi/libstub/efi-stub.c
++++ b/drivers/firmware/efi/libstub/efi-stub.c
+@@ -129,7 +129,7 @@ efi_status_t efi_handle_cmdline(efi_loaded_image_t *image, char **cmdline_ptr)
+ 
+ 	if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) ||
+ 	    IS_ENABLED(CONFIG_CMDLINE_FORCE) ||
+-	    cmdline_size == 0) {
++	    cmdline[0] == 0) {
+ 		status = efi_parse_options(CONFIG_CMDLINE);
+ 		if (status != EFI_SUCCESS) {
+ 			efi_err("Failed to parse options\n");
+-- 
+2.43.0
+
diff --git a/queue-6.6/erofs-handle-nonhead-delta-1-lclusters-gracefully.patch b/queue-6.6/erofs-handle-nonhead-delta-1-lclusters-gracefully.patch
new file mode 100644
index 00000000000..a606e959320
--- /dev/null
+++ b/queue-6.6/erofs-handle-nonhead-delta-1-lclusters-gracefully.patch
@@ -0,0 +1,90 @@
+From bb14b6dcf105807ab184822af2a12b498bbfc1dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 01:36:51 +0800
+Subject: erofs: handle NONHEAD !delta[1] lclusters gracefully
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c ]
+
+syzbot reported a WARNING in iomap_iter_done:
+ iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80
+ ioctl_fiemap fs/ioctl.c:220 [inline]
+
+Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted
+images and filesystems created by pre-1.0 mkfs versions.
+
+Previously, it would immediately bail out if delta[1]==0, which led to
+inadequate decompressed lengths (thus FIEMAP is impacted).  Treat it as
+delta[1]=1 to work around these legacy mkfs versions.
+
+`lclusterbits > 14` is illegal for compact indexes, error out too.
+
+Reported-by: syzbot+6c0b301317aa0156f9eb@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/67373c0c.050a0220.2a2fcc.0079.GAE@google.com
+Tested-by: syzbot+6c0b301317aa0156f9eb@syzkaller.appspotmail.com
+Fixes: d95ae5e25326 ("erofs: add support for the full decompressed length")
+Fixes: 001b8ccd0650 ("erofs: fix compact 4B support for 16k block size")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20241115173651.3339514-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zmap.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index 6bd435a565f61..76566c2cbf63e 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -234,7 +234,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,
+ 	unsigned int amortizedshift;
+ 	erofs_off_t pos;
+ 
+-	if (lcn >= totalidx)
++	if (lcn >= totalidx || vi->z_logical_clusterbits > 14)
+ 		return -EINVAL;
+ 
+ 	m->lcn = lcn;
+@@ -409,7 +409,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)
+ 	u64 lcn = m->lcn, headlcn = map->m_la >> lclusterbits;
+ 	int err;
+ 
+-	do {
++	while (1) {
+ 		/* handle the last EOF pcluster (no next HEAD lcluster) */
+ 		if ((lcn << lclusterbits) >= inode->i_size) {
+ 			map->m_llen = inode->i_size - map->m_la;
+@@ -421,14 +421,16 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)
+ 			return err;
+ 
+ 		if (m->type == Z_EROFS_LCLUSTER_TYPE_NONHEAD) {
+-			DBG_BUGON(!m->delta[1] &&
+-				  m->clusterofs != 1 << lclusterbits);
++			/* work around invalid d1 generated by pre-1.0 mkfs */
++			if (unlikely(!m->delta[1])) {
++				m->delta[1] = 1;
++				DBG_BUGON(1);
++			}
+ 		} else if (m->type == Z_EROFS_LCLUSTER_TYPE_PLAIN ||
+ 			   m->type == Z_EROFS_LCLUSTER_TYPE_HEAD1 ||
+ 			   m->type == Z_EROFS_LCLUSTER_TYPE_HEAD2) {
+-			/* go on until the next HEAD lcluster */
+ 			if (lcn != headlcn)
+-				break;
++				break;	/* ends at the next HEAD lcluster */
+ 			m->delta[1] = 1;
+ 		} else {
+ 			erofs_err(inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
+@@ -437,8 +439,7 @@ static int z_erofs_get_extent_decompressedlen(struct z_erofs_maprecorder *m)
+ 			return -EOPNOTSUPP;
+ 		}
+ 		lcn += m->delta[1];
+-	} while (m->delta[1]);
+-
++	}
+ 	map->m_llen = (lcn << lclusterbits) + m->clusterofs - map->m_la;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/ext4-avoid-remount-errors-with-abort-mount-option.patch b/queue-6.6/ext4-avoid-remount-errors-with-abort-mount-option.patch
new file mode 100644
index 00000000000..0e6b774db1f
--- /dev/null
+++ b/queue-6.6/ext4-avoid-remount-errors-with-abort-mount-option.patch
@@ -0,0 +1,66 @@
+From 23d23895e62d71cff59251c1962a0ccdc6dea88d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2024 00:15:56 +0200
+Subject: ext4: avoid remount errors with 'abort' mount option
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 76486b104168ae59703190566e372badf433314b ]
+
+When we remount filesystem with 'abort' mount option while changing
+other mount options as well (as is LTP test doing), we can return error
+from the system call after commit d3476f3dad4a ("ext4: don't set
+SB_RDONLY after filesystem errors") because the application of mount
+option changes detects shutdown filesystem and refuses to do anything.
+The behavior of application of other mount options in presence of
+'abort' mount option is currently rather arbitary as some mount option
+changes are handled before 'abort' and some after it.
+
+Move aborting of the filesystem to the end of remount handling so all
+requested changes are properly applied before the filesystem is shutdown
+to have a reasonably consistent behavior.
+
+Fixes: d3476f3dad4a ("ext4: don't set SB_RDONLY after filesystem errors")
+Reported-by: Jan Stancek <jstancek@redhat.com>
+Link: https://lore.kernel.org/all/Zvp6L+oFnfASaoHl@t14s
+Signed-off-by: Jan Kara <jack@suse.cz>
+Tested-by: Jan Stancek <jstancek@redhat.com>
+Link: https://patch.msgid.link/20241004221556.19222-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1d14a38017a7f..c7dc14af6438a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -6544,9 +6544,6 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
+ 		goto restore_opts;
+ 	}
+ 
+-	if (test_opt2(sb, ABORT))
+-		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
+-
+ 	sb->s_flags = (sb->s_flags & ~SB_POSIXACL) |
+ 		(test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0);
+ 
+@@ -6715,6 +6712,14 @@ static int __ext4_remount(struct fs_context *fc, struct super_block *sb)
+ 	if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
+ 		ext4_stop_mmpd(sbi);
+ 
++	/*
++	 * Handle aborting the filesystem as the last thing during remount to
++	 * avoid obsure errors during remount when some option changes fail to
++	 * apply due to shutdown filesystem.
++	 */
++	if (test_opt2(sb, ABORT))
++		ext4_abort(sb, ESHUTDOWN, "Abort forced by user");
++
+ 	return 0;
+ 
+ restore_opts:
+-- 
+2.43.0
+
diff --git a/queue-6.6/ext4-fix-race-in-buffer_head-read-fault-injection.patch b/queue-6.6/ext4-fix-race-in-buffer_head-read-fault-injection.patch
new file mode 100644
index 00000000000..9d1676762b4
--- /dev/null
+++ b/queue-6.6/ext4-fix-race-in-buffer_head-read-fault-injection.patch
@@ -0,0 +1,293 @@
+From 49f117a5ddec225ac06d642e4bd560d7368d1438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 17:17:46 +0800
+Subject: ext4: fix race in buffer_head read fault injection
+
+From: Long Li <leo.lilong@huawei.com>
+
+[ Upstream commit 2f3d93e210b9c2866c8b3662adae427d5bf511ec ]
+
+When I enabled ext4 debug for fault injection testing, I encountered the
+following warning:
+
+  EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:
+         Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051
+  WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0
+
+The root cause of the issue lies in the improper implementation of ext4's
+buffer_head read fault injection. The actual completion of buffer_head
+read and the buffer_head fault injection are not atomic, which can lead
+to the uptodate flag being cleared on normally used buffer_heads in race
+conditions.
+
+[CPU0]           [CPU1]         [CPU2]
+ext4_read_inode_bitmap
+  ext4_read_bh()
+  <bh read complete>
+                 ext4_read_inode_bitmap
+                   if (buffer_uptodate(bh))
+                     return bh
+                               jbd2_journal_commit_transaction
+                                 __jbd2_journal_refile_buffer
+                                   __jbd2_journal_unfile_buffer
+                                     __jbd2_journal_temp_unlink_buffer
+  ext4_simulate_fail_bh()
+    clear_buffer_uptodate
+                                      mark_buffer_dirty
+                                        <report warning>
+                                        WARN_ON_ONCE(!buffer_uptodate(bh))
+
+The best approach would be to perform fault injection in the IO completion
+callback function, rather than after IO completion. However, the IO
+completion callback function cannot get the fault injection code in sb.
+
+Fix it by passing the result of fault injection into the bh read function,
+we simulate faults within the bh read function itself. This requires adding
+an extra parameter to the bh read functions that need fault injection.
+
+Fixes: 46f870d690fe ("ext4: simulate various I/O and checksum errors when reading metadata")
+Signed-off-by: Long Li <leo.lilong@huawei.com>
+Link: https://patch.msgid.link/20240906091746.510163-1-leo.lilong@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/balloc.c      |  4 ++--
+ fs/ext4/ext4.h        | 12 ++----------
+ fs/ext4/extents.c     |  2 +-
+ fs/ext4/ialloc.c      |  5 +++--
+ fs/ext4/indirect.c    |  2 +-
+ fs/ext4/inode.c       |  4 ++--
+ fs/ext4/mmp.c         |  2 +-
+ fs/ext4/move_extent.c |  2 +-
+ fs/ext4/resize.c      |  2 +-
+ fs/ext4/super.c       | 23 +++++++++++++++--------
+ 10 files changed, 29 insertions(+), 29 deletions(-)
+
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index 79b20d6ae39ec..396474e9e2bff 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -545,7 +545,8 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group,
+ 	trace_ext4_read_block_bitmap_load(sb, block_group, ignore_locked);
+ 	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO |
+ 			    (ignore_locked ? REQ_RAHEAD : 0),
+-			    ext4_end_bitmap_read);
++			    ext4_end_bitmap_read,
++			    ext4_simulate_fail(sb, EXT4_SIM_BBITMAP_EIO));
+ 	return bh;
+ verify:
+ 	err = ext4_validate_block_bitmap(sb, desc, block_group, bh);
+@@ -569,7 +570,6 @@ int ext4_wait_block_bitmap(struct super_block *sb, ext4_group_t block_group,
+ 	if (!desc)
+ 		return -EFSCORRUPTED;
+ 	wait_on_buffer(bh);
+-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_BBITMAP_EIO);
+ 	if (!buffer_uptodate(bh)) {
+ 		ext4_error_err(sb, EIO, "Cannot read block bitmap - "
+ 			       "block_group = %u, block_bitmap = %llu",
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 7bbf0b9bdff23..3db01b933c3e8 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1849,14 +1849,6 @@ static inline bool ext4_simulate_fail(struct super_block *sb,
+ 	return false;
+ }
+ 
+-static inline void ext4_simulate_fail_bh(struct super_block *sb,
+-					 struct buffer_head *bh,
+-					 unsigned long code)
+-{
+-	if (!IS_ERR(bh) && ext4_simulate_fail(sb, code))
+-		clear_buffer_uptodate(bh);
+-}
+-
+ /*
+  * Error number codes for s_{first,last}_error_errno
+  *
+@@ -3072,9 +3064,9 @@ extern struct buffer_head *ext4_sb_bread(struct super_block *sb,
+ extern struct buffer_head *ext4_sb_bread_unmovable(struct super_block *sb,
+ 						   sector_t block);
+ extern void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
+-				bh_end_io_t *end_io);
++				bh_end_io_t *end_io, bool simu_fail);
+ extern int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
+-			bh_end_io_t *end_io);
++			bh_end_io_t *end_io, bool simu_fail);
+ extern int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait);
+ extern void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block);
+ extern int ext4_seq_options_show(struct seq_file *seq, void *offset);
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 1c059ac1c1ef2..5ea75af6ca223 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -564,7 +564,7 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ 
+ 	if (!bh_uptodate_or_lock(bh)) {
+ 		trace_ext4_ext_load_extent(inode, pblk, _RET_IP_);
+-		err = ext4_read_bh(bh, 0, NULL);
++		err = ext4_read_bh(bh, 0, NULL, false);
+ 		if (err < 0)
+ 			goto errout;
+ 	}
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 1a1e2214c581f..d4d0ad689d3c1 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -194,8 +194,9 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
+ 	 * submit the buffer_head for reading
+ 	 */
+ 	trace_ext4_load_inode_bitmap(sb, block_group);
+-	ext4_read_bh(bh, REQ_META | REQ_PRIO, ext4_end_bitmap_read);
+-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_IBITMAP_EIO);
++	ext4_read_bh(bh, REQ_META | REQ_PRIO,
++		     ext4_end_bitmap_read,
++		     ext4_simulate_fail(sb, EXT4_SIM_IBITMAP_EIO));
+ 	if (!buffer_uptodate(bh)) {
+ 		put_bh(bh);
+ 		ext4_error_err(sb, EIO, "Cannot read inode bitmap - "
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index a9f3716119d37..f2c495b745f1e 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -170,7 +170,7 @@ static Indirect *ext4_get_branch(struct inode *inode, int depth,
+ 		}
+ 
+ 		if (!bh_uptodate_or_lock(bh)) {
+-			if (ext4_read_bh(bh, 0, NULL) < 0) {
++			if (ext4_read_bh(bh, 0, NULL, false) < 0) {
+ 				put_bh(bh);
+ 				goto failure;
+ 			}
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 14f7098bcefe1..18ec9106c5b09 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4508,10 +4508,10 @@ static int __ext4_get_inode_loc(struct super_block *sb, unsigned long ino,
+ 	 * Read the block from disk.
+ 	 */
+ 	trace_ext4_load_inode(sb, ino);
+-	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL);
++	ext4_read_bh_nowait(bh, REQ_META | REQ_PRIO, NULL,
++			    ext4_simulate_fail(sb, EXT4_SIM_INODE_EIO));
+ 	blk_finish_plug(&plug);
+ 	wait_on_buffer(bh);
+-	ext4_simulate_fail_bh(sb, bh, EXT4_SIM_INODE_EIO);
+ 	if (!buffer_uptodate(bh)) {
+ 		if (ret_block)
+ 			*ret_block = block;
+diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
+index bd946d0c71b70..d64c04ed061ae 100644
+--- a/fs/ext4/mmp.c
++++ b/fs/ext4/mmp.c
+@@ -94,7 +94,7 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh,
+ 	}
+ 
+ 	lock_buffer(*bh);
+-	ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL);
++	ret = ext4_read_bh(*bh, REQ_META | REQ_PRIO, NULL, false);
+ 	if (ret)
+ 		goto warn_exit;
+ 
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index f082bccdb01ad..5e6b07b349600 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -214,7 +214,7 @@ static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to)
+ 			unlock_buffer(bh);
+ 			continue;
+ 		}
+-		ext4_read_bh_nowait(bh, 0, NULL);
++		ext4_read_bh_nowait(bh, 0, NULL, false);
+ 		nr++;
+ 	}
+ 	/* No io required */
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 5f105171df7b5..b34007541e08c 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1301,7 +1301,7 @@ static struct buffer_head *ext4_get_bitmap(struct super_block *sb, __u64 block)
+ 	if (unlikely(!bh))
+ 		return NULL;
+ 	if (!bh_uptodate_or_lock(bh)) {
+-		if (ext4_read_bh(bh, 0, NULL) < 0) {
++		if (ext4_read_bh(bh, 0, NULL, false) < 0) {
+ 			brelse(bh);
+ 			return NULL;
+ 		}
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c7dc14af6438a..04b0ad21fad27 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -161,8 +161,14 @@ MODULE_ALIAS("ext3");
+ 
+ 
+ static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
+-				  bh_end_io_t *end_io)
++				  bh_end_io_t *end_io, bool simu_fail)
+ {
++	if (simu_fail) {
++		clear_buffer_uptodate(bh);
++		unlock_buffer(bh);
++		return;
++	}
++
+ 	/*
+ 	 * buffer's verified bit is no longer valid after reading from
+ 	 * disk again due to write out error, clear it to make sure we
+@@ -176,7 +182,7 @@ static inline void __ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
+ }
+ 
+ void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
+-			 bh_end_io_t *end_io)
++			 bh_end_io_t *end_io, bool simu_fail)
+ {
+ 	BUG_ON(!buffer_locked(bh));
+ 
+@@ -184,10 +190,11 @@ void ext4_read_bh_nowait(struct buffer_head *bh, blk_opf_t op_flags,
+ 		unlock_buffer(bh);
+ 		return;
+ 	}
+-	__ext4_read_bh(bh, op_flags, end_io);
++	__ext4_read_bh(bh, op_flags, end_io, simu_fail);
+ }
+ 
+-int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_io)
++int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags,
++		 bh_end_io_t *end_io, bool simu_fail)
+ {
+ 	BUG_ON(!buffer_locked(bh));
+ 
+@@ -196,7 +203,7 @@ int ext4_read_bh(struct buffer_head *bh, blk_opf_t op_flags, bh_end_io_t *end_io
+ 		return 0;
+ 	}
+ 
+-	__ext4_read_bh(bh, op_flags, end_io);
++	__ext4_read_bh(bh, op_flags, end_io, simu_fail);
+ 
+ 	wait_on_buffer(bh);
+ 	if (buffer_uptodate(bh))
+@@ -208,10 +215,10 @@ int ext4_read_bh_lock(struct buffer_head *bh, blk_opf_t op_flags, bool wait)
+ {
+ 	lock_buffer(bh);
+ 	if (!wait) {
+-		ext4_read_bh_nowait(bh, op_flags, NULL);
++		ext4_read_bh_nowait(bh, op_flags, NULL, false);
+ 		return 0;
+ 	}
+-	return ext4_read_bh(bh, op_flags, NULL);
++	return ext4_read_bh(bh, op_flags, NULL, false);
+ }
+ 
+ /*
+@@ -259,7 +266,7 @@ void ext4_sb_breadahead_unmovable(struct super_block *sb, sector_t block)
+ 
+ 	if (likely(bh)) {
+ 		if (trylock_buffer(bh))
+-			ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL);
++			ext4_read_bh_nowait(bh, REQ_RAHEAD, NULL, false);
+ 		brelse(bh);
+ 	}
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/ext4-pipeline-buffer-reads-in-mext_page_mkuptodate.patch b/queue-6.6/ext4-pipeline-buffer-reads-in-mext_page_mkuptodate.patch
new file mode 100644
index 00000000000..769fae4bde3
--- /dev/null
+++ b/queue-6.6/ext4-pipeline-buffer-reads-in-mext_page_mkuptodate.patch
@@ -0,0 +1,86 @@
+From b9d40f9cb9d1c30ac1d2ade58e151bb15ef9197c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 23:30:00 +0100
+Subject: ext4: pipeline buffer reads in mext_page_mkuptodate()
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 368a83cebbb949adbcc20877c35367178497d9cc ]
+
+Instead of synchronously reading one buffer at a time, submit reads
+as we walk the buffers in the first loop, then wait for them in the
+second loop.  This should be significantly more efficient, particularly
+on HDDs, but I have not measured.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Link: https://patch.msgid.link/20240718223005.568869-2-willy@infradead.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/move_extent.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index a3aa85795d4a1..28d59548770d7 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -173,7 +173,9 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 	sector_t block;
+ 	struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE];
+ 	unsigned int blocksize, block_start, block_end;
+-	int i, err,  nr = 0, partial = 0;
++	int i, nr = 0;
++	bool partial = false;
++
+ 	BUG_ON(!folio_test_locked(folio));
+ 	BUG_ON(folio_test_writeback(folio));
+ 
+@@ -193,13 +195,13 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 		block_end = block_start + blocksize;
+ 		if (block_end <= from || block_start >= to) {
+ 			if (!buffer_uptodate(bh))
+-				partial = 1;
++				partial = true;
+ 			continue;
+ 		}
+ 		if (buffer_uptodate(bh))
+ 			continue;
+ 		if (!buffer_mapped(bh)) {
+-			err = ext4_get_block(inode, block, bh, 0);
++			int err = ext4_get_block(inode, block, bh, 0);
+ 			if (err)
+ 				return err;
+ 			if (!buffer_mapped(bh)) {
+@@ -208,6 +210,12 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 				continue;
+ 			}
+ 		}
++		lock_buffer(bh);
++		if (buffer_uptodate(bh)) {
++			unlock_buffer(bh);
++			continue;
++		}
++		ext4_read_bh_nowait(bh, 0, NULL);
+ 		BUG_ON(nr >= MAX_BUF_PER_PAGE);
+ 		arr[nr++] = bh;
+ 	}
+@@ -217,11 +225,10 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 
+ 	for (i = 0; i < nr; i++) {
+ 		bh = arr[i];
+-		if (!bh_uptodate_or_lock(bh)) {
+-			err = ext4_read_bh(bh, 0, NULL);
+-			if (err)
+-				return err;
+-		}
++		wait_on_buffer(bh);
++		if (buffer_uptodate(bh))
++			continue;
++		return -EIO;
+ 	}
+ out:
+ 	if (!partial)
+-- 
+2.43.0
+
diff --git a/queue-6.6/ext4-remove-array-of-buffer_heads-from-mext_page_mku.patch b/queue-6.6/ext4-remove-array-of-buffer_heads-from-mext_page_mku.patch
new file mode 100644
index 00000000000..2b87a87ffc7
--- /dev/null
+++ b/queue-6.6/ext4-remove-array-of-buffer_heads-from-mext_page_mku.patch
@@ -0,0 +1,79 @@
+From 53794e8b5ccd777ae4070f7d1bf53b5b3723e8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 23:30:01 +0100
+Subject: ext4: remove array of buffer_heads from mext_page_mkuptodate()
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit a40759fb16ae839f8c769174fde017564ea564ff ]
+
+Iterate the folio's list of buffer_heads twice instead of keeping
+an array of pointers.  This solves a too-large-array-for-stack problem
+on architectures with a ridiculoously large PAGE_SIZE and prepares
+ext4 to support larger folios.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Link: https://patch.msgid.link/20240718223005.568869-3-willy@infradead.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/move_extent.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 28d59548770d7..f082bccdb01ad 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -165,15 +165,14 @@ mext_folio_double_lock(struct inode *inode1, struct inode *inode2,
+ 	return 0;
+ }
+ 
+-/* Force page buffers uptodate w/o dropping page's lock */
+-static int
+-mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
++/* Force folio buffers uptodate w/o dropping folio's lock */
++static int mext_page_mkuptodate(struct folio *folio, size_t from, size_t to)
+ {
+ 	struct inode *inode = folio->mapping->host;
+ 	sector_t block;
+-	struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE];
++	struct buffer_head *bh, *head;
+ 	unsigned int blocksize, block_start, block_end;
+-	int i, nr = 0;
++	int nr = 0;
+ 	bool partial = false;
+ 
+ 	BUG_ON(!folio_test_locked(folio));
+@@ -216,20 +215,23 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 			continue;
+ 		}
+ 		ext4_read_bh_nowait(bh, 0, NULL);
+-		BUG_ON(nr >= MAX_BUF_PER_PAGE);
+-		arr[nr++] = bh;
++		nr++;
+ 	}
+ 	/* No io required */
+ 	if (!nr)
+ 		goto out;
+ 
+-	for (i = 0; i < nr; i++) {
+-		bh = arr[i];
++	bh = head;
++	do {
++		if (bh_offset(bh) + blocksize <= from)
++			continue;
++		if (bh_offset(bh) > to)
++			break;
+ 		wait_on_buffer(bh);
+ 		if (buffer_uptodate(bh))
+ 			continue;
+ 		return -EIO;
+-	}
++	} while ((bh = bh->b_this_page) != head);
+ out:
+ 	if (!partial)
+ 		folio_mark_uptodate(folio);
+-- 
+2.43.0
+
diff --git a/queue-6.6/ext4-remove-calls-to-to-set-clear-the-folio-error-fl.patch b/queue-6.6/ext4-remove-calls-to-to-set-clear-the-folio-error-fl.patch
new file mode 100644
index 00000000000..c6ea5e2ab3e
--- /dev/null
+++ b/queue-6.6/ext4-remove-calls-to-to-set-clear-the-folio-error-fl.patch
@@ -0,0 +1,77 @@
+From 3692c2b8286cc2c872dbabdd0240606ac8081581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Apr 2024 03:50:05 +0100
+Subject: ext4: remove calls to to set/clear the folio error flag
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit ea4fd933ab4310822e244af28d22ff63785dea0e ]
+
+Nobody checks this flag on ext4 folios, stop setting and clearing it.
+
+Cc: Theodore Ts'o <tytso@mit.edu>
+Cc: Andreas Dilger <adilger.kernel@dilger.ca>
+Cc: linux-ext4@vger.kernel.org
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Link: https://lore.kernel.org/r/20240420025029.2166544-11-willy@infradead.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: 2f3d93e210b9 ("ext4: fix race in buffer_head read fault injection")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/move_extent.c | 4 +---
+ fs/ext4/page-io.c     | 3 ---
+ fs/ext4/readpage.c    | 1 -
+ 3 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 0bfd5ff103aa4..a3aa85795d4a1 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -200,10 +200,8 @@ mext_page_mkuptodate(struct folio *folio, unsigned from, unsigned to)
+ 			continue;
+ 		if (!buffer_mapped(bh)) {
+ 			err = ext4_get_block(inode, block, bh, 0);
+-			if (err) {
+-				folio_set_error(folio);
++			if (err)
+ 				return err;
+-			}
+ 			if (!buffer_mapped(bh)) {
+ 				folio_zero_range(folio, block_start, blocksize);
+ 				set_buffer_uptodate(bh);
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index dfdd7e5cf0389..7ab4f5a9bf5b8 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -117,7 +117,6 @@ static void ext4_finish_bio(struct bio *bio)
+ 
+ 		if (bio->bi_status) {
+ 			int err = blk_status_to_errno(bio->bi_status);
+-			folio_set_error(folio);
+ 			mapping_set_error(folio->mapping, err);
+ 		}
+ 		bh = head = folio_buffers(folio);
+@@ -441,8 +440,6 @@ int ext4_bio_write_folio(struct ext4_io_submit *io, struct folio *folio,
+ 	BUG_ON(!folio_test_locked(folio));
+ 	BUG_ON(folio_test_writeback(folio));
+ 
+-	folio_clear_error(folio);
+-
+ 	/*
+ 	 * Comments copied from block_write_full_page:
+ 	 *
+diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c
+index 3e7d160f543f0..8cb83e7b699bd 100644
+--- a/fs/ext4/readpage.c
++++ b/fs/ext4/readpage.c
+@@ -296,7 +296,6 @@ int ext4_mpage_readpages(struct inode *inode,
+ 
+ 				if (ext4_map_blocks(NULL, inode, &map, 0) < 0) {
+ 				set_error_page:
+-					folio_set_error(folio);
+ 					folio_zero_segment(folio, 0,
+ 							  folio_size(folio));
+ 					folio_unlock(folio);
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-check-curseg-inited-before-write_sum_page-in-ch.patch b/queue-6.6/f2fs-check-curseg-inited-before-write_sum_page-in-ch.patch
new file mode 100644
index 00000000000..20318b0baf5
--- /dev/null
+++ b/queue-6.6/f2fs-check-curseg-inited-before-write_sum_page-in-ch.patch
@@ -0,0 +1,39 @@
+From 382314d0d5918403e1d30d28a741360a3b3a25e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 12:48:01 +0800
+Subject: f2fs: check curseg->inited before write_sum_page in change_curseg
+
+From: Yongpeng Yang <yangyongpeng1@oppo.com>
+
+[ Upstream commit 43563069e1c1df417d2eed6eca8a22fc6b04691d ]
+
+In the __f2fs_init_atgc_curseg->get_atssr_segment calling,
+curseg->segno is NULL_SEGNO, indicating that there is no summary
+block that needs to be written.
+
+Fixes: 093749e296e2 ("f2fs: support age threshold based garbage collection")
+Signed-off-by: Yongpeng Yang <yangyongpeng1@oppo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 9ccff4f159c3b..670104628ddbe 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -2848,7 +2848,8 @@ static void change_curseg(struct f2fs_sb_info *sbi, int type)
+ 	struct f2fs_summary_block *sum_node;
+ 	struct page *sum_page;
+ 
+-	write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, curseg->segno));
++	if (curseg->inited)
++		write_sum_page(sbi, curseg->sum_blk, GET_SUM_BLOCK(sbi, curseg->segno));
+ 
+ 	__set_test_and_inuse(sbi, new_segno);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-compress-fix-inconsistent-update-of-i_blocks-in.patch b/queue-6.6/f2fs-compress-fix-inconsistent-update-of-i_blocks-in.patch
new file mode 100644
index 00000000000..9a2fc20da01
--- /dev/null
+++ b/queue-6.6/f2fs-compress-fix-inconsistent-update-of-i_blocks-in.patch
@@ -0,0 +1,67 @@
+From 28c68468c4aecd779be695318ba4abe6009af490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 02:00:10 -0600
+Subject: f2fs: compress: fix inconsistent update of i_blocks in
+ release_compress_blocks and reserve_compress_blocks
+
+From: Qi Han <hanqi@vivo.com>
+
+[ Upstream commit 26413ce18e85de3dda2cd3d72c3c3e8ab8f4f996 ]
+
+After release a file and subsequently reserve it, the FSCK flag is set
+when the file is deleted, as shown in the following backtrace:
+
+F2FS-fs (dm-48): Inconsistent i_blocks, ino:401231, iblocks:1448, sectors:1472
+fs_rec_info_write_type+0x58/0x274
+f2fs_rec_info_write+0x1c/0x2c
+set_sbi_flag+0x74/0x98
+dec_valid_block_count+0x150/0x190
+f2fs_truncate_data_blocks_range+0x2d4/0x3cc
+f2fs_do_truncate_blocks+0x2fc/0x5f0
+f2fs_truncate_blocks+0x68/0x100
+f2fs_truncate+0x80/0x128
+f2fs_evict_inode+0x1a4/0x794
+evict+0xd4/0x280
+iput+0x238/0x284
+do_unlinkat+0x1ac/0x298
+__arm64_sys_unlinkat+0x48/0x68
+invoke_syscall+0x58/0x11c
+
+For clusters of the following type, i_blocks are decremented by 1 and
+i_compr_blocks are incremented by 7 in release_compress_blocks, while
+updates to i_blocks and i_compr_blocks are skipped in reserve_compress_blocks.
+
+raw node:
+D D D D D D D D
+after compress:
+C D D D D D D D
+after reserve:
+C D D D D D D D
+
+Let's update i_blocks and i_compr_blocks properly in reserve_compress_blocks.
+
+Fixes: eb8fbaa53374 ("f2fs: compress: fix to check unreleased compressed cluster")
+Signed-off-by: Qi Han <hanqi@vivo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 74fac935bd092..ad26733f1f46c 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3755,7 +3755,7 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count,
+ 		to_reserved = cluster_size - compr_blocks - reserved;
+ 
+ 		/* for the case all blocks in cluster were reserved */
+-		if (to_reserved == 1) {
++		if (reserved && to_reserved == 1) {
+ 			dn->ofs_in_node += cluster_size;
+ 			goto next;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-race-in-concurrent-f2fs_stop_gc_thread.patch b/queue-6.6/f2fs-fix-race-in-concurrent-f2fs_stop_gc_thread.patch
new file mode 100644
index 00000000000..604d3b17dc1
--- /dev/null
+++ b/queue-6.6/f2fs-fix-race-in-concurrent-f2fs_stop_gc_thread.patch
@@ -0,0 +1,93 @@
+From c70fb02a4614a97f90b89d77093cb9ebd41e8236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 10:05:42 +0800
+Subject: f2fs: fix race in concurrent f2fs_stop_gc_thread
+
+From: Long Li <leo.lilong@huawei.com>
+
+[ Upstream commit 7b0033dbc48340a1c1c3f12448ba17d6587ca092 ]
+
+In my test case, concurrent calls to f2fs shutdown report the following
+stack trace:
+
+ Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI
+ CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85
+ Call Trace:
+  <TASK>
+  ? show_regs+0x8b/0xa0
+  ? __die_body+0x26/0xa0
+  ? die_addr+0x54/0x90
+  ? exc_general_protection+0x24b/0x5c0
+  ? asm_exc_general_protection+0x26/0x30
+  ? kthread_stop+0x46/0x390
+  f2fs_stop_gc_thread+0x6c/0x110
+  f2fs_do_shutdown+0x309/0x3a0
+  f2fs_ioc_shutdown+0x150/0x1c0
+  __f2fs_ioctl+0xffd/0x2ac0
+  f2fs_ioctl+0x76/0xe0
+  vfs_ioctl+0x23/0x60
+  __x64_sys_ioctl+0xce/0xf0
+  x64_sys_call+0x2b1b/0x4540
+  do_syscall_64+0xa7/0x240
+  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+The root cause is a race condition in f2fs_stop_gc_thread() called from
+different f2fs shutdown paths:
+
+  [CPU0]                       [CPU1]
+  ----------------------       -----------------------
+  f2fs_stop_gc_thread          f2fs_stop_gc_thread
+                                 gc_th = sbi->gc_thread
+    gc_th = sbi->gc_thread
+    kfree(gc_th)
+    sbi->gc_thread = NULL
+                                 < gc_th != NULL >
+                                 kthread_stop(gc_th->f2fs_gc_task) //UAF
+
+The commit c7f114d864ac ("f2fs: fix to avoid use-after-free in
+f2fs_stop_gc_thread()") attempted to fix this issue by using a read
+semaphore to prevent races between shutdown and remount threads, but
+it fails to prevent all race conditions.
+
+Fix it by converting to write lock of s_umount in f2fs_do_shutdown().
+
+Fixes: 7950e9ac638e ("f2fs: stop gc/discard thread after fs shutdown")
+Signed-off-by: Long Li <leo.lilong@huawei.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index ad26733f1f46c..c6bc4cbd72b9d 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2308,9 +2308,12 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
+ 	if (readonly)
+ 		goto out;
+ 
+-	/* grab sb->s_umount to avoid racing w/ remount() */
++	/*
++	 * grab sb->s_umount to avoid racing w/ remount() and other shutdown
++	 * paths.
++	 */
+ 	if (need_lock)
+-		down_read(&sbi->sb->s_umount);
++		down_write(&sbi->sb->s_umount);
+ 
+ 	f2fs_stop_gc_thread(sbi);
+ 	f2fs_stop_discard_thread(sbi);
+@@ -2319,7 +2322,7 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
+ 	clear_opt(sbi, DISCARD);
+ 
+ 	if (need_lock)
+-		up_read(&sbi->sb->s_umount);
++		up_write(&sbi->sb->s_umount);
+ 
+ 	f2fs_update_time(sbi, REQ_TIME);
+ out:
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-the-wrong-f2fs_bug_on-condition-in-f2fs_do_.patch b/queue-6.6/f2fs-fix-the-wrong-f2fs_bug_on-condition-in-f2fs_do_.patch
new file mode 100644
index 00000000000..422013e0941
--- /dev/null
+++ b/queue-6.6/f2fs-fix-the-wrong-f2fs_bug_on-condition-in-f2fs_do_.patch
@@ -0,0 +1,40 @@
+From e1a1c2b54ec437a9a7c339f66c2269f531ab4775 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 10:31:47 +0800
+Subject: f2fs: fix the wrong f2fs_bug_on condition in f2fs_do_replace_block
+
+From: LongPing Wei <weilongping@oppo.com>
+
+[ Upstream commit c3af1f13476ec23fd99c98d060a89be28c1e8871 ]
+
+This f2fs_bug_on was introduced by commit 2c1905042c8c ("f2fs: check
+segment type in __f2fs_replace_block") when there were only 6 curseg types.
+After commit d0b9e42ab615 ("f2fs: introduce inmem curseg") was introduced,
+the condition should be changed to checking curseg->seg_type.
+
+Fixes: d0b9e42ab615 ("f2fs: introduce inmem curseg")
+Signed-off-by: LongPing Wei <weilongping@oppo.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index c0ba379a6d8f3..9ccff4f159c3b 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3757,8 +3757,8 @@ void f2fs_do_replace_block(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
+ 		}
+ 	}
+ 
+-	f2fs_bug_on(sbi, !IS_DATASEG(type));
+ 	curseg = CURSEG_I(sbi, type);
++	f2fs_bug_on(sbi, !IS_DATASEG(curseg->seg_type));
+ 
+ 	mutex_lock(&curseg->curseg_mutex);
+ 	down_write(&sit_i->sentry_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-to-account-dirty-data-in-__get_secs_require.patch b/queue-6.6/f2fs-fix-to-account-dirty-data-in-__get_secs_require.patch
new file mode 100644
index 00000000000..18f39ec02db
--- /dev/null
+++ b/queue-6.6/f2fs-fix-to-account-dirty-data-in-__get_secs_require.patch
@@ -0,0 +1,132 @@
+From 1c9dca3be5948896ce3d24eb892963eb5c6e15c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 11:43:39 +0800
+Subject: f2fs: fix to account dirty data in __get_secs_required()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 1acd73edbbfef2c3c5b43cba4006a7797eca7050 ]
+
+It will trigger system panic w/ testcase in [1]:
+
+------------[ cut here ]------------
+kernel BUG at fs/f2fs/segment.c:2752!
+RIP: 0010:new_curseg+0xc81/0x2110
+Call Trace:
+ f2fs_allocate_data_block+0x1c91/0x4540
+ do_write_page+0x163/0xdf0
+ f2fs_outplace_write_data+0x1aa/0x340
+ f2fs_do_write_data_page+0x797/0x2280
+ f2fs_write_single_data_page+0x16cd/0x2190
+ f2fs_write_cache_pages+0x994/0x1c80
+ f2fs_write_data_pages+0x9cc/0xea0
+ do_writepages+0x194/0x7a0
+ filemap_fdatawrite_wbc+0x12b/0x1a0
+ __filemap_fdatawrite_range+0xbb/0xf0
+ file_write_and_wait_range+0xa1/0x110
+ f2fs_do_sync_file+0x26f/0x1c50
+ f2fs_sync_file+0x12b/0x1d0
+ vfs_fsync_range+0xfa/0x230
+ do_fsync+0x3d/0x80
+ __x64_sys_fsync+0x37/0x50
+ x64_sys_call+0x1e88/0x20d0
+ do_syscall_64+0x4b/0x110
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+The root cause is if checkpoint_disabling and lfs_mode are both on,
+it will trigger OPU for all overwritten data, it may cost more free
+segment than expected, so f2fs must account those data correctly to
+calculate cosumed free segments later, and return ENOSPC earlier to
+avoid run out of free segment during block allocation.
+
+[1] https://lore.kernel.org/fstests/20241015025106.3203676-1-chao@kernel.org/
+
+Fixes: 4354994f097d ("f2fs: checkpoint disabling")
+Cc: Daniel Rosenberg <drosen@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.h | 35 +++++++++++++++++++++++++----------
+ 1 file changed, 25 insertions(+), 10 deletions(-)
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 952970166d5da..cd2ec6acc7177 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -559,18 +559,21 @@ static inline int reserved_sections(struct f2fs_sb_info *sbi)
+ }
+ 
+ static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi,
+-			unsigned int node_blocks, unsigned int dent_blocks)
++			unsigned int node_blocks, unsigned int data_blocks,
++			unsigned int dent_blocks)
+ {
+ 
+-	unsigned segno, left_blocks;
++	unsigned int segno, left_blocks, blocks;
+ 	int i;
+ 
+-	/* check current node sections in the worst case. */
+-	for (i = CURSEG_HOT_NODE; i <= CURSEG_COLD_NODE; i++) {
++	/* check current data/node sections in the worst case. */
++	for (i = CURSEG_HOT_DATA; i < NR_PERSISTENT_LOG; i++) {
+ 		segno = CURSEG_I(sbi, i)->segno;
+ 		left_blocks = CAP_BLKS_PER_SEC(sbi) -
+ 				get_ckpt_valid_blocks(sbi, segno, true);
+-		if (node_blocks > left_blocks)
++
++		blocks = i <= CURSEG_COLD_DATA ? data_blocks : node_blocks;
++		if (blocks > left_blocks)
+ 			return false;
+ 	}
+ 
+@@ -584,8 +587,9 @@ static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi,
+ }
+ 
+ /*
+- * calculate needed sections for dirty node/dentry
+- * and call has_curseg_enough_space
++ * calculate needed sections for dirty node/dentry and call
++ * has_curseg_enough_space, please note that, it needs to account
++ * dirty data as well in lfs mode when checkpoint is disabled.
+  */
+ static inline void __get_secs_required(struct f2fs_sb_info *sbi,
+ 		unsigned int *lower_p, unsigned int *upper_p, bool *curseg_p)
+@@ -594,19 +598,30 @@ static inline void __get_secs_required(struct f2fs_sb_info *sbi,
+ 					get_pages(sbi, F2FS_DIRTY_DENTS) +
+ 					get_pages(sbi, F2FS_DIRTY_IMETA);
+ 	unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
++	unsigned int total_data_blocks = 0;
+ 	unsigned int node_secs = total_node_blocks / CAP_BLKS_PER_SEC(sbi);
+ 	unsigned int dent_secs = total_dent_blocks / CAP_BLKS_PER_SEC(sbi);
++	unsigned int data_secs = 0;
+ 	unsigned int node_blocks = total_node_blocks % CAP_BLKS_PER_SEC(sbi);
+ 	unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi);
++	unsigned int data_blocks = 0;
++
++	if (f2fs_lfs_mode(sbi) &&
++		unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
++		total_data_blocks = get_pages(sbi, F2FS_DIRTY_DATA);
++		data_secs = total_data_blocks / CAP_BLKS_PER_SEC(sbi);
++		data_blocks = total_data_blocks % CAP_BLKS_PER_SEC(sbi);
++	}
+ 
+ 	if (lower_p)
+-		*lower_p = node_secs + dent_secs;
++		*lower_p = node_secs + dent_secs + data_secs;
+ 	if (upper_p)
+ 		*upper_p = node_secs + dent_secs +
+-			(node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0);
++			(node_blocks ? 1 : 0) + (dent_blocks ? 1 : 0) +
++			(data_blocks ? 1 : 0);
+ 	if (curseg_p)
+ 		*curseg_p = has_curseg_enough_space(sbi,
+-				node_blocks, dent_blocks);
++				node_blocks, data_blocks, dent_blocks);
+ }
+ 
+ static inline bool has_not_enough_free_secs(struct f2fs_sb_info *sbi,
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-to-avoid-forcing-direct-write-to-use-buffer.patch b/queue-6.6/f2fs-fix-to-avoid-forcing-direct-write-to-use-buffer.patch
new file mode 100644
index 00000000000..100436d94ad
--- /dev/null
+++ b/queue-6.6/f2fs-fix-to-avoid-forcing-direct-write-to-use-buffer.patch
@@ -0,0 +1,49 @@
+From 9a6c4f5d162fe03cff9326a7824795c084738f1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 09:50:16 +0800
+Subject: f2fs: fix to avoid forcing direct write to use buffered IO on
+ inline_data inode
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 26e6f59d0bbaac76fa3413462d780bd2b5f9f653 ]
+
+Jinsu Lee reported a performance regression issue, after commit
+5c8764f8679e ("f2fs: fix to force buffered IO on inline_data
+inode"), we forced direct write to use buffered IO on inline_data
+inode, it will cause performace regression due to memory copy
+and data flush.
+
+It's fine to not force direct write to use buffered IO, as it
+can convert inline inode before committing direct write IO.
+
+Fixes: 5c8764f8679e ("f2fs: fix to force buffered IO on inline_data inode")
+Reported-by: Jinsu Lee <jinsu1.lee@samsung.com>
+Closes: https://lore.kernel.org/linux-f2fs-devel/af03dd2c-e361-4f80-b2fd-39440766cf6e@kernel.org
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index c6bc4cbd72b9d..196755a34833d 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -846,7 +846,11 @@ static bool f2fs_force_buffered_io(struct inode *inode, int rw)
+ 		return true;
+ 	if (f2fs_compressed_file(inode))
+ 		return true;
+-	if (f2fs_has_inline_data(inode))
++	/*
++	 * only force direct read to use buffered IO, for direct write,
++	 * it expects inline data conversion before committing IO.
++	 */
++	if (f2fs_has_inline_data(inode) && rw == READ)
+ 		return true;
+ 
+ 	/* disallow direct IO if any of devices has unaligned blksize */
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-to-avoid-potential-deadlock-in-f2fs_record_.patch b/queue-6.6/f2fs-fix-to-avoid-potential-deadlock-in-f2fs_record_.patch
new file mode 100644
index 00000000000..1637d96eee4
--- /dev/null
+++ b/queue-6.6/f2fs-fix-to-avoid-potential-deadlock-in-f2fs_record_.patch
@@ -0,0 +1,230 @@
+From 86dec43c12e21db192c30abf7118e63665b7015c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 16:36:23 +0800
+Subject: f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit f10a890308a7cd8794e21f646f09827c6cb4bf5d ]
+
+syzbot reports deadlock issue of f2fs as below:
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.12.0-rc3-syzkaller-00087-gc964ced77262 #0 Not tainted
+------------------------------------------------------
+kswapd0/79 is trying to acquire lock:
+ffff888011824088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_down_write fs/f2fs/f2fs.h:2199 [inline]
+ffff888011824088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_record_stop_reason+0x52/0x1d0 fs/f2fs/super.c:4068
+
+but task is already holding lock:
+ffff88804bd92610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x662/0x15c0 fs/f2fs/inode.c:842
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (sb_internal#2){.+.+}-{0:0}:
+       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
+       percpu_down_read include/linux/percpu-rwsem.h:51 [inline]
+       __sb_start_write include/linux/fs.h:1716 [inline]
+       sb_start_intwrite+0x4d/0x1c0 include/linux/fs.h:1899
+       f2fs_evict_inode+0x662/0x15c0 fs/f2fs/inode.c:842
+       evict+0x4e8/0x9b0 fs/inode.c:725
+       f2fs_evict_inode+0x1a4/0x15c0 fs/f2fs/inode.c:807
+       evict+0x4e8/0x9b0 fs/inode.c:725
+       dispose_list fs/inode.c:774 [inline]
+       prune_icache_sb+0x239/0x2f0 fs/inode.c:963
+       super_cache_scan+0x38c/0x4b0 fs/super.c:223
+       do_shrink_slab+0x701/0x1160 mm/shrinker.c:435
+       shrink_slab+0x1093/0x14d0 mm/shrinker.c:662
+       shrink_one+0x43b/0x850 mm/vmscan.c:4818
+       shrink_many mm/vmscan.c:4879 [inline]
+       lru_gen_shrink_node mm/vmscan.c:4957 [inline]
+       shrink_node+0x3799/0x3de0 mm/vmscan.c:5937
+       kswapd_shrink_node mm/vmscan.c:6765 [inline]
+       balance_pgdat mm/vmscan.c:6957 [inline]
+       kswapd+0x1ca3/0x3700 mm/vmscan.c:7226
+       kthread+0x2f0/0x390 kernel/kthread.c:389
+       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
+       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+
+-> #1 (fs_reclaim){+.+.}-{0:0}:
+       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
+       __fs_reclaim_acquire mm/page_alloc.c:3834 [inline]
+       fs_reclaim_acquire+0x88/0x130 mm/page_alloc.c:3848
+       might_alloc include/linux/sched/mm.h:318 [inline]
+       prepare_alloc_pages+0x147/0x5b0 mm/page_alloc.c:4493
+       __alloc_pages_noprof+0x16f/0x710 mm/page_alloc.c:4722
+       alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
+       alloc_pages_noprof mm/mempolicy.c:2345 [inline]
+       folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2352
+       filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1010
+       do_read_cache_folio+0x2eb/0x850 mm/filemap.c:3787
+       read_mapping_folio include/linux/pagemap.h:1011 [inline]
+       f2fs_commit_super+0x3c0/0x7d0 fs/f2fs/super.c:4032
+       f2fs_record_stop_reason+0x13b/0x1d0 fs/f2fs/super.c:4079
+       f2fs_handle_critical_error+0x2ac/0x5c0 fs/f2fs/super.c:4174
+       f2fs_write_inode+0x35f/0x4d0 fs/f2fs/inode.c:785
+       write_inode fs/fs-writeback.c:1503 [inline]
+       __writeback_single_inode+0x711/0x10d0 fs/fs-writeback.c:1723
+       writeback_single_inode+0x1f3/0x660 fs/fs-writeback.c:1779
+       sync_inode_metadata+0xc4/0x120 fs/fs-writeback.c:2849
+       f2fs_release_file+0xa8/0x100 fs/f2fs/file.c:1941
+       __fput+0x23f/0x880 fs/file_table.c:431
+       task_work_run+0x24f/0x310 kernel/task_work.c:228
+       resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
+       exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
+       exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
+       __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
+       syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218
+       do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
+       entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+-> #0 (&sbi->sb_lock){++++}-{3:3}:
+       check_prev_add kernel/locking/lockdep.c:3161 [inline]
+       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
+       validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
+       __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202
+       lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825
+       down_write+0x99/0x220 kernel/locking/rwsem.c:1577
+       f2fs_down_write fs/f2fs/f2fs.h:2199 [inline]
+       f2fs_record_stop_reason+0x52/0x1d0 fs/f2fs/super.c:4068
+       f2fs_handle_critical_error+0x2ac/0x5c0 fs/f2fs/super.c:4174
+       f2fs_evict_inode+0xa61/0x15c0 fs/f2fs/inode.c:883
+       evict+0x4e8/0x9b0 fs/inode.c:725
+       f2fs_evict_inode+0x1a4/0x15c0 fs/f2fs/inode.c:807
+       evict+0x4e8/0x9b0 fs/inode.c:725
+       dispose_list fs/inode.c:774 [inline]
+       prune_icache_sb+0x239/0x2f0 fs/inode.c:963
+       super_cache_scan+0x38c/0x4b0 fs/super.c:223
+       do_shrink_slab+0x701/0x1160 mm/shrinker.c:435
+       shrink_slab+0x1093/0x14d0 mm/shrinker.c:662
+       shrink_one+0x43b/0x850 mm/vmscan.c:4818
+       shrink_many mm/vmscan.c:4879 [inline]
+       lru_gen_shrink_node mm/vmscan.c:4957 [inline]
+       shrink_node+0x3799/0x3de0 mm/vmscan.c:5937
+       kswapd_shrink_node mm/vmscan.c:6765 [inline]
+       balance_pgdat mm/vmscan.c:6957 [inline]
+       kswapd+0x1ca3/0x3700 mm/vmscan.c:7226
+       kthread+0x2f0/0x390 kernel/kthread.c:389
+       ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
+       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+
+other info that might help us debug this:
+
+Chain exists of:
+  &sbi->sb_lock --> fs_reclaim --> sb_internal#2
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  rlock(sb_internal#2);
+                               lock(fs_reclaim);
+                               lock(sb_internal#2);
+  lock(&sbi->sb_lock);
+
+Root cause is there will be potential deadlock in between
+below tasks:
+
+Thread A				Kswapd
+- f2fs_ioc_commit_atomic_write
+ - mnt_want_write_file -- down_read lock A
+					- balance_pgdat
+					 - __fs_reclaim_acquire  -- lock B
+					  - shrink_node
+					   - prune_icache_sb
+					    - dispose_list
+					     - f2fs_evict_inode
+					      - sb_start_intwrite  -- down_read lock A
+ - f2fs_do_sync_file
+  - f2fs_write_inode
+   - f2fs_handle_critical_error
+    - f2fs_record_stop_reason
+     - f2fs_commit_super
+      - read_mapping_folio
+       - filemap_alloc_folio_noprof
+        - fs_reclaim_acquire  -- lock B
+
+Both threads try to acquire read lock of lock A, then its upcoming write
+lock grabber will trigger deadlock.
+
+Let's always create an asynchronous task in f2fs_handle_critical_error()
+rather than calling f2fs_record_stop_reason() synchronously to avoid
+this potential deadlock issue.
+
+Fixes: b62e71be2110 ("f2fs: support errors=remount-ro|continue|panic mountoption")
+Reported-by: syzbot+be4a9983e95a5e25c8d3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/6704d667.050a0220.1e4d62.0081.GAE@google.com
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Daejun Park <daejun7.park@samsung.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/checkpoint.c |  2 +-
+ fs/f2fs/f2fs.h       |  3 +--
+ fs/f2fs/super.c      | 13 +++++++------
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 1a33a8c1623f2..c6317596e695c 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -32,7 +32,7 @@ void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io,
+ 	f2fs_build_fault_attr(sbi, 0, 0);
+ 	if (!end_io)
+ 		f2fs_flush_merged_writes(sbi);
+-	f2fs_handle_critical_error(sbi, reason, end_io);
++	f2fs_handle_critical_error(sbi, reason);
+ }
+ 
+ /*
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 7faf9446ea5dc..33620642ae5ec 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3588,8 +3588,7 @@ int f2fs_quota_sync(struct super_block *sb, int type);
+ loff_t max_file_blocks(struct inode *inode);
+ void f2fs_quota_off_umount(struct super_block *sb);
+ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag);
+-void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
+-							bool irq_context);
++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason);
+ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error);
+ void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error);
+ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 540fa1dfc77df..f05d0e43db9e2 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -4093,8 +4093,7 @@ static bool system_going_down(void)
+ 		|| system_state == SYSTEM_RESTART;
+ }
+ 
+-void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
+-							bool irq_context)
++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
+ {
+ 	struct super_block *sb = sbi->sb;
+ 	bool shutdown = reason == STOP_CP_REASON_SHUTDOWN;
+@@ -4106,10 +4105,12 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
+ 	if (!f2fs_hw_is_readonly(sbi)) {
+ 		save_stop_reason(sbi, reason);
+ 
+-		if (irq_context && !shutdown)
+-			schedule_work(&sbi->s_error_work);
+-		else
+-			f2fs_record_stop_reason(sbi);
++		/*
++		 * always create an asynchronous task to record stop_reason
++		 * in order to avoid potential deadlock when running into
++		 * f2fs_record_stop_reason() synchronously.
++		 */
++		schedule_work(&sbi->s_error_work);
+ 	}
+ 
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.6/f2fs-fix-to-avoid-use-gc_at-when-setting-gc_mode-as-.patch b/queue-6.6/f2fs-fix-to-avoid-use-gc_at-when-setting-gc_mode-as-.patch
new file mode 100644
index 00000000000..d0afe177fb8
--- /dev/null
+++ b/queue-6.6/f2fs-fix-to-avoid-use-gc_at-when-setting-gc_mode-as-.patch
@@ -0,0 +1,70 @@
+From 3736b851aa4b1bd45daad53654b66dd27e8d10ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 11:12:49 +0800
+Subject: f2fs: fix to avoid use GC_AT when setting gc_mode as GC_URGENT_LOW or
+ GC_URGENT_MID
+
+From: Zhiguo Niu <zhiguo.niu@unisoc.com>
+
+[ Upstream commit 296b8cb34e65fa93382cf919be5a056f719c9a26 ]
+
+If gc_mode is set to GC_URGENT_LOW or GC_URGENT_MID, cost benefit GC
+approach should be used, but if ATGC is enabled at the same time,
+Age-threshold approach will be selected, which can only do amount of
+GC and it is much less than the numbers of CB approach.
+
+some traces:
+  f2fs_gc-254:48-396     [007] ..... 2311600.684028: f2fs_gc_begin: dev = (254,48), gc_type = Background GC, no_background_GC = 0, nr_free_secs = 0, nodes = 1053, dents = 2, imeta = 18, free_sec:44898, free_seg:44898, rsv_seg:239, prefree_seg:0
+  f2fs_gc-254:48-396     [007] ..... 2311600.684527: f2fs_get_victim: dev = (254,48), type = No TYPE, policy = (Background GC, LFS-mode, Age-threshold), victim = 10, cost = 4294364975, ofs_unit = 1, pre_victim_secno = -1, prefree = 0, free = 44898
+  f2fs_gc-254:48-396     [007] ..... 2311600.714835: f2fs_gc_end: dev = (254,48), ret = 0, seg_freed = 0, sec_freed = 0, nodes = 1562, dents = 2, imeta = 18, free_sec:44898, free_seg:44898, rsv_seg:239, prefree_seg:0
+  f2fs_gc-254:48-396     [007] ..... 2311600.714843: f2fs_background_gc: dev = (254,48), wait_ms = 50, prefree = 0, free = 44898
+  f2fs_gc-254:48-396     [007] ..... 2311600.771785: f2fs_gc_begin: dev = (254,48), gc_type = Background GC, no_background_GC = 0, nr_free_secs = 0, nodes = 1562, dents = 2, imeta = 18, free_sec:44898, free_seg:44898, rsv_seg:239, prefree_seg:
+  f2fs_gc-254:48-396     [007] ..... 2311600.772275: f2fs_gc_end: dev = (254,48), ret = -61, seg_freed = 0, sec_freed = 0, nodes = 1562, dents = 2, imeta = 18, free_sec:44898, free_seg:44898, rsv_seg:239, prefree_seg:0
+
+Fixes: 0e5e81114de1 ("f2fs: add GC_URGENT_LOW mode in gc_urgent")
+Fixes: d98af5f45520 ("f2fs: introduce gc_urgent_mid mode")
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-fs-f2fs | 7 +++++--
+ fs/f2fs/gc.c                            | 2 ++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-fs-f2fs b/Documentation/ABI/testing/sysfs-fs-f2fs
+index 36c3cb5479013..33675e718a376 100644
+--- a/Documentation/ABI/testing/sysfs-fs-f2fs
++++ b/Documentation/ABI/testing/sysfs-fs-f2fs
+@@ -311,10 +311,13 @@ Description:	Do background GC aggressively when set. Set to 0 by default.
+ 		GC approach and turns SSR mode on.
+ 		gc urgent low(2): lowers the bar of checking I/O idling in
+ 		order to process outstanding discard commands and GC a
+-		little bit aggressively. uses cost benefit GC approach.
++		little bit aggressively. always uses cost benefit GC approach,
++		and will override age-threshold GC approach if ATGC is enabled
++		at the same time.
+ 		gc urgent mid(3): does GC forcibly in a period of given
+ 		gc_urgent_sleep_time and executes a mid level of I/O idling check.
+-		uses cost benefit GC approach.
++		always uses cost benefit GC approach, and will override
++		age-threshold GC approach if ATGC is enabled at the same time.
+ 
+ What:		/sys/fs/f2fs/<disk>/gc_urgent_sleep_time
+ Date:		August 2017
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 888c301ffe8f4..e990415824146 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -228,6 +228,8 @@ static int select_gc_type(struct f2fs_sb_info *sbi, int gc_type)
+ 
+ 	switch (sbi->gc_mode) {
+ 	case GC_IDLE_CB:
++	case GC_URGENT_LOW:
++	case GC_URGENT_MID:
+ 		gc_mode = GC_CB;
+ 		break;
+ 	case GC_IDLE_GREEDY:
+-- 
+2.43.0
+
diff --git a/queue-6.6/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch b/queue-6.6/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch
new file mode 100644
index 00000000000..9840c205966
--- /dev/null
+++ b/queue-6.6/fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch
@@ -0,0 +1,43 @@
+From 6667871f0a4ad2c012c3d844893c06efeec35e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 11:56:34 +0800
+Subject: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit f89d17ae2ac42931be2a0153fecbf8533280c927 ]
+
+When information such as info->screen_base is not ready, calling
+sh7760fb_free_mem() does not release memory correctly. Call
+dma_free_coherent() instead.
+
+Fixes: 4a25e41831ee ("video: sh7760fb: SH7760/SH7763 LCDC framebuffer driver")
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sh7760fb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/sh7760fb.c b/drivers/video/fbdev/sh7760fb.c
+index 08a4943dc5418..d0ee5fec647ad 100644
+--- a/drivers/video/fbdev/sh7760fb.c
++++ b/drivers/video/fbdev/sh7760fb.c
+@@ -409,12 +409,11 @@ static int sh7760fb_alloc_mem(struct fb_info *info)
+ 		vram = PAGE_SIZE;
+ 
+ 	fbmem = dma_alloc_coherent(info->device, vram, &par->fbdma, GFP_KERNEL);
+-
+ 	if (!fbmem)
+ 		return -ENOMEM;
+ 
+ 	if ((par->fbdma & SH7760FB_DMA_MASK) != SH7760FB_DMA_MASK) {
+-		sh7760fb_free_mem(info);
++		dma_free_coherent(info->device, vram, fbmem, par->fbdma);
+ 		dev_err(info->device, "kernel gave me memory at 0x%08lx, which is"
+ 			"unusable for the LCDC\n", (unsigned long)par->fbdma);
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.6/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch b/queue-6.6/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch
new file mode 100644
index 00000000000..d1f99ebb2dd
--- /dev/null
+++ b/queue-6.6/firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch
@@ -0,0 +1,93 @@
+From d216166903e44a686ae01a893207b00e3cf386b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 11:21:15 +0800
+Subject: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
+
+From: Luo Qiu <luoqiu@kylinsec.com.cn>
+
+[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ]
+
+Fix a kernel crash with the below call trace when the SCPI firmware
+returns OPP count of zero.
+
+dvfs_info.opp_count may be zero on some platforms during the reboot
+test, and the kernel will crash after dereferencing the pointer to
+kcalloc(info->count, sizeof(*opp), GFP_KERNEL).
+
+  |  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
+  |  Mem abort info:
+  |    ESR = 0x96000004
+  |    Exception class = DABT (current EL), IL = 32 bits
+  |    SET = 0, FnV = 0
+  |    EA = 0, S1PTW = 0
+  |  Data abort info:
+  |    ISV = 0, ISS = 0x00000004
+  |    CM = 0, WnR = 0
+  |  user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
+  |  [0000000000000028] pgd=0000000000000000
+  |  Internal error: Oops: 96000004 [#1] SMP
+  |  scpi-hwmon: probe of PHYT000D:00 failed with error -110
+  |  Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
+  |  CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
+  |  Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
+  |  pstate: 60000005 (nZCv daif -PAN -UAO)
+  |  pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
+  |  lr : clk_register+0x438/0x720
+  |  Call trace:
+  |   scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
+  |   devm_clk_hw_register+0x50/0xa0
+  |   scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
+  |   scpi_clocks_probe+0x528/0x70c [clk_scpi]
+  |   platform_drv_probe+0x58/0xa8
+  |   really_probe+0x260/0x3d0
+  |   driver_probe_device+0x12c/0x148
+  |   device_driver_attach+0x74/0x98
+  |   __driver_attach+0xb4/0xe8
+  |   bus_for_each_dev+0x88/0xe0
+  |   driver_attach+0x30/0x40
+  |   bus_add_driver+0x178/0x2b0
+  |   driver_register+0x64/0x118
+  |   __platform_driver_register+0x54/0x60
+  |   scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
+  |   do_one_initcall+0x54/0x220
+  |   do_init_module+0x54/0x1c8
+  |   load_module+0x14a4/0x1668
+  |   __se_sys_finit_module+0xf8/0x110
+  |   __arm64_sys_finit_module+0x24/0x30
+  |   el0_svc_common+0x78/0x170
+  |   el0_svc_handler+0x38/0x78
+  |   el0_svc+0x8/0x340
+  |  Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
+  |  ---[ end trace 06feb22469d89fa8 ]---
+  |  Kernel panic - not syncing: Fatal exception
+  |  SMP: stopping secondary CPUs
+  |  Kernel Offset: disabled
+  |  CPU features: 0x10,a0002008
+  |  Memory Limit: none
+
+Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
+Signed-off-by: Luo Qiu <luoqiu@kylinsec.com.cn>
+Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scpi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
+index 435d0e2658a42..3de25e9d18ef8 100644
+--- a/drivers/firmware/arm_scpi.c
++++ b/drivers/firmware/arm_scpi.c
+@@ -627,6 +627,9 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)
+ 	if (ret)
+ 		return ERR_PTR(ret);
+ 
++	if (!buf.opp_count)
++		return ERR_PTR(-ENOENT);
++
+ 	info = kmalloc(sizeof(*info), GFP_KERNEL);
+ 	if (!info)
+ 		return ERR_PTR(-ENOMEM);
+-- 
+2.43.0
+
diff --git a/queue-6.6/firmware-google-unregister-driver_info-on-failure.patch b/queue-6.6/firmware-google-unregister-driver_info-on-failure.patch
new file mode 100644
index 00000000000..c98fdf91274
--- /dev/null
+++ b/queue-6.6/firmware-google-unregister-driver_info-on-failure.patch
@@ -0,0 +1,53 @@
+From af028606aa5ff1882cc66d3fb98fc96d4c9527cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 21:13:44 +0800
+Subject: firmware: google: Unregister driver_info on failure
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 32b0901e141f6d4cf49d820b53eb09b88b1f72f7 ]
+
+When platform_device_register_full() returns error, the gsmi_init() returns
+without unregister gsmi_driver_info, fix by add missing
+platform_driver_unregister() when platform_device_register_full() failed.
+
+Fixes: 8942b2d5094b ("gsmi: Add GSMI commands to log S0ix info")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Acked-by: Brian Norris <briannorris@chromium.org>
+Link: https://lore.kernel.org/r/20241015131344.20272-1-yuancan@huawei.com
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/google/gsmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
+index 96ea1fa76d351..854d488e025e9 100644
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -918,7 +918,8 @@ static __init int gsmi_init(void)
+ 	gsmi_dev.pdev = platform_device_register_full(&gsmi_dev_info);
+ 	if (IS_ERR(gsmi_dev.pdev)) {
+ 		printk(KERN_ERR "gsmi: unable to register platform device\n");
+-		return PTR_ERR(gsmi_dev.pdev);
++		ret = PTR_ERR(gsmi_dev.pdev);
++		goto out_unregister;
+ 	}
+ 
+ 	/* SMI access needs to be serialized */
+@@ -1056,10 +1057,11 @@ static __init int gsmi_init(void)
+ 	gsmi_buf_free(gsmi_dev.name_buf);
+ 	kmem_cache_destroy(gsmi_dev.mem_pool);
+ 	platform_device_unregister(gsmi_dev.pdev);
+-	pr_info("gsmi: failed to load: %d\n", ret);
++out_unregister:
+ #ifdef CONFIG_PM
+ 	platform_driver_unregister(&gsmi_driver_info);
+ #endif
++	pr_info("gsmi: failed to load: %d\n", ret);
+ 	return ret;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/firmware_loader-fix-possible-resource-leak-in-fw_log.patch b/queue-6.6/firmware_loader-fix-possible-resource-leak-in-fw_log.patch
new file mode 100644
index 00000000000..a9a431eeea5
--- /dev/null
+++ b/queue-6.6/firmware_loader-fix-possible-resource-leak-in-fw_log.patch
@@ -0,0 +1,58 @@
+From e42bc3ab532d4693632356a5dc957a2e17c00c01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 19:03:35 +0800
+Subject: firmware_loader: Fix possible resource leak in fw_log_firmware_info()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit 369a9c046c2fdfe037f05b43b84c386bdbccc103 ]
+
+The alg instance should be released under the exception path, otherwise
+there may be resource leak here.
+
+To mitigate this, free the alg instance with crypto_free_shash when kmalloc
+fails.
+
+Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Russ Weight <russ.weight@linux.dev>
+Link: https://lore.kernel.org/r/20241016110335.3677924-1-cuigaosheng1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/firmware_loader/main.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
+index 0b18c6b46e65d..f3133ba831c5e 100644
+--- a/drivers/base/firmware_loader/main.c
++++ b/drivers/base/firmware_loader/main.c
+@@ -824,19 +824,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st
+ 	shash->tfm = alg;
+ 
+ 	if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0)
+-		goto out_shash;
++		goto out_free;
+ 
+ 	for (int i = 0; i < SHA256_DIGEST_SIZE; i++)
+ 		sprintf(&outbuf[i * 2], "%02x", sha256buf[i]);
+ 	outbuf[SHA256_BLOCK_SIZE] = 0;
+ 	dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf);
+ 
+-out_shash:
+-	crypto_free_shash(alg);
+ out_free:
+ 	kfree(shash);
+ 	kfree(outbuf);
+ 	kfree(sha256buf);
++	crypto_free_shash(alg);
+ }
+ #else
+ static void fw_log_firmware_info(const struct firmware *fw, const char *name,
+-- 
+2.43.0
+
diff --git a/queue-6.6/fs-proc-kcore.c-fix-coccinelle-reported-error-instan.patch b/queue-6.6/fs-proc-kcore.c-fix-coccinelle-reported-error-instan.patch
new file mode 100644
index 00000000000..e741e823870
--- /dev/null
+++ b/queue-6.6/fs-proc-kcore.c-fix-coccinelle-reported-error-instan.patch
@@ -0,0 +1,79 @@
+From 93a60d78696caee320709361a92499ca827354fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 06:46:52 +0100
+Subject: fs/proc/kcore.c: fix coccinelle reported ERROR instances
+
+From: Mirsad Todorovac <mtodorovac69@gmail.com>
+
+[ Upstream commit 82e33f249f1126cf3c5f39a31b850d485ac33bc3 ]
+
+Coccinelle complains about the nested reuse of the pointer `iter' with
+different pointer type:
+
+./fs/proc/kcore.c:515:26-30: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:534:23-27: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:550:40-44: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:568:27-31: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:581:28-32: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:599:27-31: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:607:38-42: ERROR: invalid reference to the index variable of the iterator on line 499
+./fs/proc/kcore.c:614:26-30: ERROR: invalid reference to the index variable of the iterator on line 499
+
+Replacing `struct kcore_list *iter' with `struct kcore_list *tmp' doesn't change the
+scope and the functionality is the same and coccinelle seems happy.
+
+NOTE: There was an issue with using `struct kcore_list *pos' as the nested iterator.
+      The build did not work!
+
+[akpm@linux-foundation.org: s/tmp/pos/]
+Link: https://lkml.kernel.org/r/20241029054651.86356-2-mtodorovac69@gmail.com
+Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
+Link: https://lkml.kernel.org/r/20220331223700.902556-1-jakobkoschel@gmail.com
+Fixes: 04d168c6d42d ("fs/proc/kcore.c: remove check of list iterator against head past the loop body")
+Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
+Signed-off-by: Mirsad Todorovac <mtodorovac69@gmail.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Brian Johannesmeyer" <bjohannesmeyer@gmail.com>
+Cc: Cristiano Giuffrida <c.giuffrida@vu.nl>
+Cc: "Bos, H.J." <h.j.bos@vu.nl>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Yang Li <yang.lee@linux.alibaba.com>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Hari Bathini <hbathini@linux.ibm.com>
+Cc: Yan Zhen <yanzhen@vivo.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/kcore.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index 7e4fa9c68c1dd..0a91f3538459a 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -493,13 +493,13 @@ static ssize_t read_kcore_iter(struct kiocb *iocb, struct iov_iter *iter)
+ 		 * the previous entry, search for a matching entry.
+ 		 */
+ 		if (!m || start < m->addr || start >= m->addr + m->size) {
+-			struct kcore_list *iter;
++			struct kcore_list *pos;
+ 
+ 			m = NULL;
+-			list_for_each_entry(iter, &kclist_head, list) {
+-				if (start >= iter->addr &&
+-				    start < iter->addr + iter->size) {
+-					m = iter;
++			list_for_each_entry(pos, &kclist_head, list) {
++				if (start >= pos->addr &&
++				    start < pos->addr + pos->size) {
++					m = pos;
+ 					break;
+ 				}
+ 			}
+-- 
+2.43.0
+
diff --git a/queue-6.6/fs_parser-update-mount_api-doc-to-match-function-sig.patch b/queue-6.6/fs_parser-update-mount_api-doc-to-match-function-sig.patch
new file mode 100644
index 00000000000..98178ccedfc
--- /dev/null
+++ b/queue-6.6/fs_parser-update-mount_api-doc-to-match-function-sig.patch
@@ -0,0 +1,45 @@
+From 7776754526466d12d669d0bfacbcc6ce5d9be39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 13:50:21 -0800
+Subject: fs_parser: update mount_api doc to match function signature
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c66f759832a83cb273ba5a55c66dcc99384efa74 ]
+
+Add the missing 'name' parameter to the mount_api documentation for
+fs_validate_description().
+
+Fixes: 96cafb9ccb15 ("fs_parser: remove fs_parameter_description name field")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20241125215021.231758-1-rdunlap@infradead.org
+Cc: Eric Sandeen <sandeen@redhat.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: linux-doc@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/filesystems/mount_api.rst | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/filesystems/mount_api.rst b/Documentation/filesystems/mount_api.rst
+index 9aaf6ef75eb53..0c69aa574ab9a 100644
+--- a/Documentation/filesystems/mount_api.rst
++++ b/Documentation/filesystems/mount_api.rst
+@@ -766,7 +766,8 @@ process the parameters it is given.
+ 
+    * ::
+ 
+-       bool fs_validate_description(const struct fs_parameter_description *desc);
++       bool fs_validate_description(const char *name,
++                                    const struct fs_parameter_description *desc);
+ 
+      This performs some validation checks on a parameter description.  It
+      returns true if the description is good and false if it is not.  It will
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-allow-immediate-glf_verify_delete-work.patch b/queue-6.6/gfs2-allow-immediate-glf_verify_delete-work.patch
new file mode 100644
index 00000000000..760761e8c37
--- /dev/null
+++ b/queue-6.6/gfs2-allow-immediate-glf_verify_delete-work.patch
@@ -0,0 +1,64 @@
+From f5dffd4b495432b2215b6d97f17f54649277aee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 18:38:00 +0200
+Subject: gfs2: Allow immediate GLF_VERIFY_DELETE work
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 160bc9555d8654464cbbd7bb1f6687048471d2f6 ]
+
+Add an argument to gfs2_queue_verify_delete() that allows it to queue
+GLF_VERIFY_DELETE work for immediate execution.  This is used in the
+next patch.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 7c6f714d8847 ("gfs2: Fix unlinked inode cleanup")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index eda0d52ae333b..e9b5a8eaf3003 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1028,14 +1028,15 @@ bool gfs2_queue_try_to_evict(struct gfs2_glock *gl)
+ 				  &gl->gl_delete, 0);
+ }
+ 
+-static bool gfs2_queue_verify_delete(struct gfs2_glock *gl)
++static bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later)
+ {
+ 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
++	unsigned long delay;
+ 
+ 	if (test_and_set_bit(GLF_VERIFY_DELETE, &gl->gl_flags))
+ 		return false;
+-	return queue_delayed_work(sdp->sd_delete_wq,
+-				  &gl->gl_delete, 5 * HZ);
++	delay = later ? 5 * HZ : 0;
++	return queue_delayed_work(sdp->sd_delete_wq, &gl->gl_delete, delay);
+ }
+ 
+ static void delete_work_func(struct work_struct *work)
+@@ -1067,7 +1068,7 @@ static void delete_work_func(struct work_struct *work)
+ 		if (gfs2_try_evict(gl)) {
+ 			if (test_bit(SDF_KILL, &sdp->sd_flags))
+ 				goto out;
+-			if (gfs2_queue_verify_delete(gl))
++			if (gfs2_queue_verify_delete(gl, true))
+ 				return;
+ 		}
+ 		goto out;
+@@ -1079,7 +1080,7 @@ static void delete_work_func(struct work_struct *work)
+ 		if (IS_ERR(inode)) {
+ 			if (PTR_ERR(inode) == -EAGAIN &&
+ 			    !test_bit(SDF_KILL, &sdp->sd_flags) &&
+-			    gfs2_queue_verify_delete(gl))
++			    gfs2_queue_verify_delete(gl, true))
+ 				return;
+ 		} else {
+ 			d_prune_aliases(inode);
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-don-t-set-glf_lock-in-gfs2_dispose_glock_lru.patch b/queue-6.6/gfs2-don-t-set-glf_lock-in-gfs2_dispose_glock_lru.patch
new file mode 100644
index 00000000000..a892828098e
--- /dev/null
+++ b/queue-6.6/gfs2-don-t-set-glf_lock-in-gfs2_dispose_glock_lru.patch
@@ -0,0 +1,43 @@
+From c8bcdaacf56a91ff12a3d5728c32a4035d3b22ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Apr 2024 07:11:48 +0200
+Subject: gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 927cfc90d27cb7732a62464f95fd9aa7edfa9b70 ]
+
+In gfs2_dispose_glock_lru(), we want to skip glocks which are in the
+process of transitioning state (as indicated by the set GLF_LOCK flag),
+but we we don't need to set that flag for requesting a state transition.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 1e86044402c4 ("gfs2: Remove and replace gfs2_glock_queue_work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 20fb2296fe3e0..f38d8558f4c18 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -2018,14 +2018,13 @@ __acquires(&lru_lock)
+ 			atomic_inc(&lru_count);
+ 			continue;
+ 		}
+-		if (test_and_set_bit(GLF_LOCK, &gl->gl_flags)) {
++		if (test_bit(GLF_LOCK, &gl->gl_flags)) {
+ 			spin_unlock(&gl->gl_lockref.lock);
+ 			goto add_back_to_lru;
+ 		}
+ 		gl->gl_lockref.count++;
+ 		if (demote_ok(gl))
+ 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
+-		WARN_ON(!test_and_clear_bit(GLF_LOCK, &gl->gl_flags));
+ 		__gfs2_glock_queue_work(gl, 0);
+ 		spin_unlock(&gl->gl_lockref.lock);
+ 		cond_resched_lock(&lru_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-fix-unlinked-inode-cleanup.patch b/queue-6.6/gfs2-fix-unlinked-inode-cleanup.patch
new file mode 100644
index 00000000000..b7c33d78dc3
--- /dev/null
+++ b/queue-6.6/gfs2-fix-unlinked-inode-cleanup.patch
@@ -0,0 +1,85 @@
+From d5a72d518267acc7fb89da322abfc6c076c45ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2024 20:06:21 +0200
+Subject: gfs2: Fix unlinked inode cleanup
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 7c6f714d88475ceae5342264858a641eafa19632 ]
+
+Before commit f0e56edc2ec7 ("gfs2: Split the two kinds of glock "delete"
+work"), function delete_work_func() was used to trigger the eviction of
+in-memory inodes from remote as well as deleting unlinked inodes at a
+later point.  These two kinds of work were then split into two kinds of
+work, and the two places in the code were deferred deletion of inodes is
+required accidentally ended up queuing the wrong kind of work.  This
+caused unlinked inodes to be left behind, which could in the worst case
+fill up filesystems and require a filesystem check to recover.
+
+Fix that by queuing the right kind of work in try_rgrp_unlink() and
+gfs2_drop_inode().
+
+Fixes: f0e56edc2ec7 ("gfs2: Split the two kinds of glock "delete" work")
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 2 +-
+ fs/gfs2/glock.h | 1 +
+ fs/gfs2/rgrp.c  | 2 +-
+ fs/gfs2/super.c | 2 +-
+ 4 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index e9b5a8eaf3003..20fb2296fe3e0 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1028,7 +1028,7 @@ bool gfs2_queue_try_to_evict(struct gfs2_glock *gl)
+ 				  &gl->gl_delete, 0);
+ }
+ 
+-static bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later)
++bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later)
+ {
+ 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+ 	unsigned long delay;
+diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
+index 29fd58de0597d..aae9fabbb76cc 100644
+--- a/fs/gfs2/glock.h
++++ b/fs/gfs2/glock.h
+@@ -259,6 +259,7 @@ static inline int gfs2_glock_nq_init(struct gfs2_glock *gl,
+ void gfs2_glock_cb(struct gfs2_glock *gl, unsigned int state);
+ void gfs2_glock_complete(struct gfs2_glock *gl, int ret);
+ bool gfs2_queue_try_to_evict(struct gfs2_glock *gl);
++bool gfs2_queue_verify_delete(struct gfs2_glock *gl, bool later);
+ void gfs2_cancel_delete_work(struct gfs2_glock *gl);
+ void gfs2_flush_delete_work(struct gfs2_sbd *sdp);
+ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 396d0f4a259d5..4a5e2732d1da2 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1879,7 +1879,7 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip
+ 		 */
+ 		ip = gl->gl_object;
+ 
+-		if (ip || !gfs2_queue_try_to_evict(gl))
++		if (ip || !gfs2_queue_verify_delete(gl, false))
+ 			gfs2_glock_put(gl);
+ 		else
+ 			found++;
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index b37f8bd79286a..09285dc782cf8 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1053,7 +1053,7 @@ static int gfs2_drop_inode(struct inode *inode)
+ 		struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
+ 
+ 		gfs2_glock_hold(gl);
+-		if (!gfs2_queue_try_to_evict(gl))
++		if (!gfs2_queue_verify_delete(gl, true))
+ 			gfs2_glock_put_async(gl);
+ 		return 0;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-get-rid-of-gfs2_glock_queue_put-in-signal_our_w.patch b/queue-6.6/gfs2-get-rid-of-gfs2_glock_queue_put-in-signal_our_w.patch
new file mode 100644
index 00000000000..bd152721f5b
--- /dev/null
+++ b/queue-6.6/gfs2-get-rid-of-gfs2_glock_queue_put-in-signal_our_w.patch
@@ -0,0 +1,36 @@
+From 9b399efa6c29298a238a23c829ce11f498c1246c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 16:56:09 +0100
+Subject: gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit f80d882edcf242d0256d9e51b09d5fb7a3a0d3b4 ]
+
+In function signal_our_withdraw(), we are calling gfs2_glock_queue_put()
+in a context in which we are actually allowed to sleep, so replace that
+with a simple call to gfs2_glock_put().
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 7c6f714d8847 ("gfs2: Fix unlinked inode cleanup")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c
+index b65261e0cae3a..268ff47b03963 100644
+--- a/fs/gfs2/util.c
++++ b/fs/gfs2/util.c
+@@ -255,7 +255,7 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp)
+ 		gfs2_glock_nq(&sdp->sd_live_gh);
+ 	}
+ 
+-	gfs2_glock_queue_put(live_gl); /* drop extra reference we acquired */
++	gfs2_glock_put(live_gl); /* drop extra reference we acquired */
+ 	clear_bit(SDF_WITHDRAW_RECOVERY, &sdp->sd_flags);
+ 
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-remove-and-replace-gfs2_glock_queue_work.patch b/queue-6.6/gfs2-remove-and-replace-gfs2_glock_queue_work.patch
new file mode 100644
index 00000000000..7f01b734dd5
--- /dev/null
+++ b/queue-6.6/gfs2-remove-and-replace-gfs2_glock_queue_work.patch
@@ -0,0 +1,163 @@
+From 1af72b3fcea70cda09fd6c78ec4a198af99e0a5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2024 21:58:15 +0200
+Subject: gfs2: Remove and replace gfs2_glock_queue_work
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 1e86044402c45b70a9b31beeaefb5cc732a7470c ]
+
+There are no more callers of gfs2_glock_queue_work() left, so remove
+that helper.  With that, we can now rename __gfs2_glock_queue_work()
+back to gfs2_glock_queue_work() to get rid of some unnecessary clutter.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 35 +++++++++++++++--------------------
+ 1 file changed, 15 insertions(+), 20 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index f38d8558f4c18..2c0908a302102 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -274,7 +274,7 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+  * Enqueue the glock on the work queue.  Passes one glock reference on to the
+  * work queue.
+  */
+-static void __gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
++static void gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
+ 	if (!queue_delayed_work(glock_workqueue, &gl->gl_work, delay)) {
+ 		/*
+ 		 * We are holding the lockref spinlock, and the work was still
+@@ -287,12 +287,6 @@ static void __gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay)
+ 	}
+ }
+ 
+-static void gfs2_glock_queue_work(struct gfs2_glock *gl, unsigned long delay) {
+-	spin_lock(&gl->gl_lockref.lock);
+-	__gfs2_glock_queue_work(gl, delay);
+-	spin_unlock(&gl->gl_lockref.lock);
+-}
+-
+ static void __gfs2_glock_put(struct gfs2_glock *gl)
+ {
+ 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+@@ -337,7 +331,8 @@ void gfs2_glock_put_async(struct gfs2_glock *gl)
+ 	if (lockref_put_or_lock(&gl->gl_lockref))
+ 		return;
+ 
+-	__gfs2_glock_queue_work(gl, 0);
++	GLOCK_BUG_ON(gl, gl->gl_lockref.count != 1);
++	gfs2_glock_queue_work(gl, 0);
+ 	spin_unlock(&gl->gl_lockref.lock);
+ }
+ 
+@@ -814,7 +809,7 @@ __acquires(&gl->gl_lockref.lock)
+ 			 */
+ 			clear_bit(GLF_LOCK, &gl->gl_flags);
+ 			clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
+-			__gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
++			gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
+ 			return;
+ 		} else {
+ 			clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
+@@ -844,7 +839,7 @@ __acquires(&gl->gl_lockref.lock)
+ 
+ 	/* Complete the operation now. */
+ 	finish_xmote(gl, target);
+-	__gfs2_glock_queue_work(gl, 0);
++	gfs2_glock_queue_work(gl, 0);
+ }
+ 
+ /**
+@@ -891,7 +886,7 @@ __acquires(&gl->gl_lockref.lock)
+ 	clear_bit(GLF_LOCK, &gl->gl_flags);
+ 	smp_mb__after_atomic();
+ 	gl->gl_lockref.count++;
+-	__gfs2_glock_queue_work(gl, 0);
++	gfs2_glock_queue_work(gl, 0);
+ 	return;
+ 
+ out_unlock:
+@@ -1124,12 +1119,12 @@ static void glock_work_func(struct work_struct *work)
+ 		drop_refs--;
+ 		if (gl->gl_name.ln_type != LM_TYPE_INODE)
+ 			delay = 0;
+-		__gfs2_glock_queue_work(gl, delay);
++		gfs2_glock_queue_work(gl, delay);
+ 	}
+ 
+ 	/*
+ 	 * Drop the remaining glock references manually here. (Mind that
+-	 * __gfs2_glock_queue_work depends on the lockref spinlock begin held
++	 * gfs2_glock_queue_work depends on the lockref spinlock begin held
+ 	 * here as well.)
+ 	 */
+ 	gl->gl_lockref.count -= drop_refs;
+@@ -1616,7 +1611,7 @@ int gfs2_glock_nq(struct gfs2_holder *gh)
+ 		     test_and_clear_bit(GLF_FROZEN, &gl->gl_flags))) {
+ 		set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
+ 		gl->gl_lockref.count++;
+-		__gfs2_glock_queue_work(gl, 0);
++		gfs2_glock_queue_work(gl, 0);
+ 	}
+ 	run_queue(gl, 1);
+ 	spin_unlock(&gl->gl_lockref.lock);
+@@ -1681,7 +1676,7 @@ static void __gfs2_glock_dq(struct gfs2_holder *gh)
+ 		    !test_bit(GLF_DEMOTE, &gl->gl_flags) &&
+ 		    gl->gl_name.ln_type == LM_TYPE_INODE)
+ 			delay = gl->gl_hold_time;
+-		__gfs2_glock_queue_work(gl, delay);
++		gfs2_glock_queue_work(gl, delay);
+ 	}
+ }
+ 
+@@ -1905,7 +1900,7 @@ void gfs2_glock_cb(struct gfs2_glock *gl, unsigned int state)
+ 			delay = gl->gl_hold_time;
+ 	}
+ 	handle_callback(gl, state, delay, true);
+-	__gfs2_glock_queue_work(gl, delay);
++	gfs2_glock_queue_work(gl, delay);
+ 	spin_unlock(&gl->gl_lockref.lock);
+ }
+ 
+@@ -1965,7 +1960,7 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
+ 
+ 	gl->gl_lockref.count++;
+ 	set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
+-	__gfs2_glock_queue_work(gl, 0);
++	gfs2_glock_queue_work(gl, 0);
+ 	spin_unlock(&gl->gl_lockref.lock);
+ }
+ 
+@@ -2025,7 +2020,7 @@ __acquires(&lru_lock)
+ 		gl->gl_lockref.count++;
+ 		if (demote_ok(gl))
+ 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
+-		__gfs2_glock_queue_work(gl, 0);
++		gfs2_glock_queue_work(gl, 0);
+ 		spin_unlock(&gl->gl_lockref.lock);
+ 		cond_resched_lock(&lru_lock);
+ 	}
+@@ -2163,7 +2158,7 @@ static void thaw_glock(struct gfs2_glock *gl)
+ 
+ 	spin_lock(&gl->gl_lockref.lock);
+ 	set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
+-	__gfs2_glock_queue_work(gl, 0);
++	gfs2_glock_queue_work(gl, 0);
+ 	spin_unlock(&gl->gl_lockref.lock);
+ }
+ 
+@@ -2182,7 +2177,7 @@ static void clear_glock(struct gfs2_glock *gl)
+ 		gl->gl_lockref.count++;
+ 		if (gl->gl_state != LM_ST_UNLOCKED)
+ 			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
+-		__gfs2_glock_queue_work(gl, 0);
++		gfs2_glock_queue_work(gl, 0);
+ 	}
+ 	spin_unlock(&gl->gl_lockref.lock);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-rename-glf_verify_evict-to-glf_verify_delete.patch b/queue-6.6/gfs2-rename-glf_verify_evict-to-glf_verify_delete.patch
new file mode 100644
index 00000000000..dcfa32ad04a
--- /dev/null
+++ b/queue-6.6/gfs2-rename-glf_verify_evict-to-glf_verify_delete.patch
@@ -0,0 +1,99 @@
+From 4fd1b8545a3d4094d2cfd52ce633a90acfd1b763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 22:02:05 +0200
+Subject: gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 820ce8ed53ce2111aa5171f7349f289d7e9d0693 ]
+
+Rename the GLF_VERIFY_EVICT flag to GLF_VERIFY_DELETE: that flag
+indicates that we want to delete an inode / verify that it has been
+deleted.
+
+To match, rename gfs2_queue_verify_evict() to
+gfs2_queue_verify_delete().
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 7c6f714d8847 ("gfs2: Fix unlinked inode cleanup")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c  | 14 +++++++-------
+ fs/gfs2/incore.h |  2 +-
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 88ddc9828c6c0..eda0d52ae333b 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1028,11 +1028,11 @@ bool gfs2_queue_try_to_evict(struct gfs2_glock *gl)
+ 				  &gl->gl_delete, 0);
+ }
+ 
+-static bool gfs2_queue_verify_evict(struct gfs2_glock *gl)
++static bool gfs2_queue_verify_delete(struct gfs2_glock *gl)
+ {
+ 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
+ 
+-	if (test_and_set_bit(GLF_VERIFY_EVICT, &gl->gl_flags))
++	if (test_and_set_bit(GLF_VERIFY_DELETE, &gl->gl_flags))
+ 		return false;
+ 	return queue_delayed_work(sdp->sd_delete_wq,
+ 				  &gl->gl_delete, 5 * HZ);
+@@ -1067,19 +1067,19 @@ static void delete_work_func(struct work_struct *work)
+ 		if (gfs2_try_evict(gl)) {
+ 			if (test_bit(SDF_KILL, &sdp->sd_flags))
+ 				goto out;
+-			if (gfs2_queue_verify_evict(gl))
++			if (gfs2_queue_verify_delete(gl))
+ 				return;
+ 		}
+ 		goto out;
+ 	}
+ 
+-	if (test_and_clear_bit(GLF_VERIFY_EVICT, &gl->gl_flags)) {
++	if (test_and_clear_bit(GLF_VERIFY_DELETE, &gl->gl_flags)) {
+ 		inode = gfs2_lookup_by_inum(sdp, no_addr, gl->gl_no_formal_ino,
+ 					    GFS2_BLKST_UNLINKED);
+ 		if (IS_ERR(inode)) {
+ 			if (PTR_ERR(inode) == -EAGAIN &&
+ 			    !test_bit(SDF_KILL, &sdp->sd_flags) &&
+-			    gfs2_queue_verify_evict(gl))
++			    gfs2_queue_verify_delete(gl))
+ 				return;
+ 		} else {
+ 			d_prune_aliases(inode);
+@@ -2125,7 +2125,7 @@ static void glock_hash_walk(glock_examiner examiner, const struct gfs2_sbd *sdp)
+ void gfs2_cancel_delete_work(struct gfs2_glock *gl)
+ {
+ 	clear_bit(GLF_TRY_TO_EVICT, &gl->gl_flags);
+-	clear_bit(GLF_VERIFY_EVICT, &gl->gl_flags);
++	clear_bit(GLF_VERIFY_DELETE, &gl->gl_flags);
+ 	if (cancel_delayed_work(&gl->gl_delete))
+ 		gfs2_glock_put(gl);
+ }
+@@ -2362,7 +2362,7 @@ static const char *gflags2str(char *buf, const struct gfs2_glock *gl)
+ 		*p++ = 'N';
+ 	if (test_bit(GLF_TRY_TO_EVICT, gflags))
+ 		*p++ = 'e';
+-	if (test_bit(GLF_VERIFY_EVICT, gflags))
++	if (test_bit(GLF_VERIFY_DELETE, gflags))
+ 		*p++ = 'E';
+ 	*p = 0;
+ 	return buf;
+diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
+index 60abd7050c998..853fad2bc4855 100644
+--- a/fs/gfs2/incore.h
++++ b/fs/gfs2/incore.h
+@@ -331,7 +331,7 @@ enum {
+ 	GLF_BLOCKING			= 15,
+ 	GLF_FREEING			= 16, /* Wait for glock to be freed */
+ 	GLF_TRY_TO_EVICT		= 17, /* iopen glocks only */
+-	GLF_VERIFY_EVICT		= 18, /* iopen glocks only */
++	GLF_VERIFY_DELETE		= 18, /* iopen glocks only */
+ };
+ 
+ struct gfs2_glock {
+-- 
+2.43.0
+
diff --git a/queue-6.6/gfs2-replace-gfs2_glock_queue_put-with-gfs2_glock_pu.patch b/queue-6.6/gfs2-replace-gfs2_glock_queue_put-with-gfs2_glock_pu.patch
new file mode 100644
index 00000000000..cf765296d40
--- /dev/null
+++ b/queue-6.6/gfs2-replace-gfs2_glock_queue_put-with-gfs2_glock_pu.patch
@@ -0,0 +1,129 @@
+From 13fc9bbf2185748af632ae9690eb542bbf5a88be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 16:45:39 +0100
+Subject: gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit ee2be7d7c7f32783f60ee5fe59b91548a4571f10 ]
+
+Function gfs2_glock_queue_put() puts a glock reference by enqueuing
+glock work instead of putting the reference directly.  This ensures that
+the operation won't sleep, but it is costly and really only necessary
+when putting the final glock reference.  Replace it with a new
+gfs2_glock_put_async() function that only queues glock work when putting
+the last glock reference.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 7c6f714d8847 ("gfs2: Fix unlinked inode cleanup")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 27 +++++++++++++++++----------
+ fs/gfs2/glock.h |  2 +-
+ fs/gfs2/log.c   |  2 +-
+ fs/gfs2/super.c |  4 ++--
+ 4 files changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 685e3ef9e9008..88ddc9828c6c0 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -311,14 +311,6 @@ static void __gfs2_glock_put(struct gfs2_glock *gl)
+ 	sdp->sd_lockstruct.ls_ops->lm_put_lock(gl);
+ }
+ 
+-/*
+- * Cause the glock to be put in work queue context.
+- */
+-void gfs2_glock_queue_put(struct gfs2_glock *gl)
+-{
+-	gfs2_glock_queue_work(gl, 0);
+-}
+-
+ /**
+  * gfs2_glock_put() - Decrement reference count on glock
+  * @gl: The glock to put
+@@ -333,6 +325,22 @@ void gfs2_glock_put(struct gfs2_glock *gl)
+ 	__gfs2_glock_put(gl);
+ }
+ 
++/*
++ * gfs2_glock_put_async - Decrement reference count without sleeping
++ * @gl: The glock to put
++ *
++ * Decrement the reference count on glock immediately unless it is the last
++ * reference.  Defer putting the last reference to work queue context.
++ */
++void gfs2_glock_put_async(struct gfs2_glock *gl)
++{
++	if (lockref_put_or_lock(&gl->gl_lockref))
++		return;
++
++	__gfs2_glock_queue_work(gl, 0);
++	spin_unlock(&gl->gl_lockref.lock);
++}
++
+ /**
+  * may_grant - check if it's ok to grant a new lock
+  * @gl: The glock
+@@ -2533,8 +2541,7 @@ static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi, loff_t n)
+ 	if (gl) {
+ 		if (n == 0)
+ 			return;
+-		if (!lockref_put_not_zero(&gl->gl_lockref))
+-			gfs2_glock_queue_put(gl);
++		gfs2_glock_put_async(gl);
+ 	}
+ 	for (;;) {
+ 		gl = rhashtable_walk_next(&gi->hti);
+diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
+index f7ee9ca948eee..29fd58de0597d 100644
+--- a/fs/gfs2/glock.h
++++ b/fs/gfs2/glock.h
+@@ -186,7 +186,7 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
+ 		   int create, struct gfs2_glock **glp);
+ struct gfs2_glock *gfs2_glock_hold(struct gfs2_glock *gl);
+ void gfs2_glock_put(struct gfs2_glock *gl);
+-void gfs2_glock_queue_put(struct gfs2_glock *gl);
++void gfs2_glock_put_async(struct gfs2_glock *gl);
+ 
+ void __gfs2_holder_init(struct gfs2_glock *gl, unsigned int state,
+ 		        u16 flags, struct gfs2_holder *gh,
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 767549066066c..2be5551241b3a 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -790,7 +790,7 @@ void gfs2_glock_remove_revoke(struct gfs2_glock *gl)
+ {
+ 	if (atomic_dec_return(&gl->gl_revokes) == 0) {
+ 		clear_bit(GLF_LFLUSH, &gl->gl_flags);
+-		gfs2_glock_queue_put(gl);
++		gfs2_glock_put_async(gl);
+ 	}
+ }
+ 
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 1200cb8059995..b37f8bd79286a 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1054,7 +1054,7 @@ static int gfs2_drop_inode(struct inode *inode)
+ 
+ 		gfs2_glock_hold(gl);
+ 		if (!gfs2_queue_try_to_evict(gl))
+-			gfs2_glock_queue_put(gl);
++			gfs2_glock_put_async(gl);
+ 		return 0;
+ 	}
+ 
+@@ -1270,7 +1270,7 @@ static int gfs2_dinode_dealloc(struct gfs2_inode *ip)
+ static void gfs2_glock_put_eventually(struct gfs2_glock *gl)
+ {
+ 	if (current->flags & PF_MEMALLOC)
+-		gfs2_glock_queue_put(gl);
++		gfs2_glock_put_async(gl);
+ 	else
+ 		gfs2_glock_put(gl);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/gpio-zevio-add-missed-label-initialisation.patch b/queue-6.6/gpio-zevio-add-missed-label-initialisation.patch
new file mode 100644
index 00000000000..60b6c7cab3f
--- /dev/null
+++ b/queue-6.6/gpio-zevio-add-missed-label-initialisation.patch
@@ -0,0 +1,55 @@
+From 1040bd9a53266e9ad557e073d216f9bb20690434 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 11:27:07 +0200
+Subject: gpio: zevio: Add missed label initialisation
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5bbed54ba66925ebca19092d0750630f943d7bf2 ]
+
+Initialise the GPIO chip label correctly as it was done by
+of_mm_gpiochip_add_data() before the below mentioned change.
+
+Fixes: cf8f4462e5fa ("gpio: zevio: drop of_gpio.h header")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20241118092729.516736-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-zevio.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpio/gpio-zevio.c b/drivers/gpio/gpio-zevio.c
+index 2de61337ad3b5..d7230fd83f5d6 100644
+--- a/drivers/gpio/gpio-zevio.c
++++ b/drivers/gpio/gpio-zevio.c
+@@ -11,6 +11,7 @@
+ #include <linux/io.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+ 
+@@ -169,6 +170,7 @@ static const struct gpio_chip zevio_gpio_chip = {
+ /* Initialization */
+ static int zevio_gpio_probe(struct platform_device *pdev)
+ {
++	struct device *dev = &pdev->dev;
+ 	struct zevio_gpio *controller;
+ 	int status, i;
+ 
+@@ -180,6 +182,10 @@ static int zevio_gpio_probe(struct platform_device *pdev)
+ 	controller->chip = zevio_gpio_chip;
+ 	controller->chip.parent = &pdev->dev;
+ 
++	controller->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%pfw", dev_fwnode(dev));
++	if (!controller->chip.label)
++		return -ENOMEM;
++
+ 	controller->regs = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(controller->regs))
+ 		return dev_err_probe(&pdev->dev, PTR_ERR(controller->regs),
+-- 
+2.43.0
+
diff --git a/queue-6.6/hfsplus-don-t-query-the-device-logical-block-size-mu.patch b/queue-6.6/hfsplus-don-t-query-the-device-logical-block-size-mu.patch
new file mode 100644
index 00000000000..0619363c897
--- /dev/null
+++ b/queue-6.6/hfsplus-don-t-query-the-device-logical-block-size-mu.patch
@@ -0,0 +1,139 @@
+From 7dbd5bcd415fa36f2b558c8055cab5e207477823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 08:41:09 -0300
+Subject: hfsplus: don't query the device logical block size multiple times
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ]
+
+Devices block sizes may change. One of these cases is a loop device by
+using ioctl LOOP_SET_BLOCK_SIZE.
+
+While this may cause other issues like IO being rejected, in the case of
+hfsplus, it will allocate a block by using that size and potentially write
+out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the
+latter function reads a different io_size.
+
+Using a new min_io_size initally set to sb_min_blocksize works for the
+purposes of the original fix, since it will be set to the max between
+HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the
+max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not
+initialized.
+
+Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024
+and 4096.
+
+The produced KASAN report before the fix looks like this:
+
+[  419.944641] ==================================================================
+[  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a
+[  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678
+[  419.947612]
+[  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84
+[  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
+[  419.950035] Call Trace:
+[  419.950384]  <TASK>
+[  419.950676]  dump_stack_lvl+0x57/0x78
+[  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a
+[  419.951830]  print_report+0x14c/0x49e
+[  419.952361]  ? __virt_addr_valid+0x267/0x278
+[  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d
+[  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a
+[  419.954231]  kasan_report+0x89/0xb0
+[  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a
+[  419.955367]  hfsplus_read_wrapper+0x659/0xa0a
+[  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10
+[  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9
+[  419.957214]  ? _raw_spin_unlock+0x1a/0x2e
+[  419.957772]  hfsplus_fill_super+0x348/0x1590
+[  419.958355]  ? hlock_class+0x4c/0x109
+[  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10
+[  419.959499]  ? __pfx_string+0x10/0x10
+[  419.960006]  ? lock_acquire+0x3e2/0x454
+[  419.960532]  ? bdev_name.constprop.0+0xce/0x243
+[  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10
+[  419.961799]  ? pointer+0x3f0/0x62f
+[  419.962277]  ? __pfx_pointer+0x10/0x10
+[  419.962761]  ? vsnprintf+0x6c4/0xfba
+[  419.963178]  ? __pfx_vsnprintf+0x10/0x10
+[  419.963621]  ? setup_bdev_super+0x376/0x3b3
+[  419.964029]  ? snprintf+0x9d/0xd2
+[  419.964344]  ? __pfx_snprintf+0x10/0x10
+[  419.964675]  ? lock_acquired+0x45c/0x5e9
+[  419.965016]  ? set_blocksize+0x139/0x1c1
+[  419.965381]  ? sb_set_blocksize+0x6d/0xae
+[  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10
+[  419.966179]  mount_bdev+0x12f/0x1bf
+[  419.966512]  ? __pfx_mount_bdev+0x10/0x10
+[  419.966886]  ? vfs_parse_fs_string+0xce/0x111
+[  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10
+[  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10
+[  419.968073]  legacy_get_tree+0x104/0x178
+[  419.968414]  vfs_get_tree+0x86/0x296
+[  419.968751]  path_mount+0xba3/0xd0b
+[  419.969157]  ? __pfx_path_mount+0x10/0x10
+[  419.969594]  ? kmem_cache_free+0x1e2/0x260
+[  419.970311]  do_mount+0x99/0xe0
+[  419.970630]  ? __pfx_do_mount+0x10/0x10
+[  419.971008]  __do_sys_mount+0x199/0x1c9
+[  419.971397]  do_syscall_64+0xd0/0x135
+[  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[  419.972233] RIP: 0033:0x7c3cb812972e
+[  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48
+[  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
+[  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e
+[  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0
+[  419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000
+[  419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000
+[  419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000
+[  419.978375]  </TASK>
+[  419.978589]
+
+Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/hfsplus_fs.h | 3 ++-
+ fs/hfsplus/wrapper.c    | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
+index 583c196ecd520..1473b04fc0f31 100644
+--- a/fs/hfsplus/hfsplus_fs.h
++++ b/fs/hfsplus/hfsplus_fs.h
+@@ -156,6 +156,7 @@ struct hfsplus_sb_info {
+ 
+ 	/* Runtime variables */
+ 	u32 blockoffset;
++	u32 min_io_size;
+ 	sector_t part_start;
+ 	sector_t sect_count;
+ 	int fs_shift;
+@@ -306,7 +307,7 @@ struct hfsplus_readdir_data {
+  */
+ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
+ {
+-	return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev),
++	return max_t(unsigned short, HFSPLUS_SB(sb)->min_io_size,
+ 		     HFSPLUS_SECTOR_SIZE);
+ }
+ 
+diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
+index 0b791adf02e53..a51a58db3fef0 100644
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -171,6 +171,8 @@ int hfsplus_read_wrapper(struct super_block *sb)
+ 	if (!blocksize)
+ 		goto out;
+ 
++	sbi->min_io_size = blocksize;
++
+ 	if (hfsplus_get_last_session(sb, &part_start, &part_size))
+ 		goto out;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/hid-hyperv-streamline-driver-probe-to-avoid-devres-i.patch b/queue-6.6/hid-hyperv-streamline-driver-probe-to-avoid-devres-i.patch
new file mode 100644
index 00000000000..076cd72e4f1
--- /dev/null
+++ b/queue-6.6/hid-hyperv-streamline-driver-probe-to-avoid-devres-i.patch
@@ -0,0 +1,182 @@
+From b9f630bf4c1223f5cf83cdec69c7b441c8a3af66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 14:12:40 +0100
+Subject: HID: hyperv: streamline driver probe to avoid devres issues
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit 66ef47faa90d838cda131fe1f7776456cc3b59f2 ]
+
+It was found that unloading 'hid_hyperv' module results in a devres
+complaint:
+
+ ...
+ hv_vmbus: unregistering driver hid_hyperv
+ ------------[ cut here ]------------
+ WARNING: CPU: 2 PID: 3983 at drivers/base/devres.c:691 devres_release_group+0x1f2/0x2c0
+ ...
+ Call Trace:
+  <TASK>
+  ? devres_release_group+0x1f2/0x2c0
+  ? __warn+0xd1/0x1c0
+  ? devres_release_group+0x1f2/0x2c0
+  ? report_bug+0x32a/0x3c0
+  ? handle_bug+0x53/0xa0
+  ? exc_invalid_op+0x18/0x50
+  ? asm_exc_invalid_op+0x1a/0x20
+  ? devres_release_group+0x1f2/0x2c0
+  ? devres_release_group+0x90/0x2c0
+  ? rcu_is_watching+0x15/0xb0
+  ? __pfx_devres_release_group+0x10/0x10
+  hid_device_remove+0xf5/0x220
+  device_release_driver_internal+0x371/0x540
+  ? klist_put+0xf3/0x170
+  bus_remove_device+0x1f1/0x3f0
+  device_del+0x33f/0x8c0
+  ? __pfx_device_del+0x10/0x10
+  ? cleanup_srcu_struct+0x337/0x500
+  hid_destroy_device+0xc8/0x130
+  mousevsc_remove+0xd2/0x1d0 [hid_hyperv]
+  device_release_driver_internal+0x371/0x540
+  driver_detach+0xc5/0x180
+  bus_remove_driver+0x11e/0x2a0
+  ? __mutex_unlock_slowpath+0x160/0x5e0
+  vmbus_driver_unregister+0x62/0x2b0 [hv_vmbus]
+  ...
+
+And the issue seems to be that the corresponding devres group is not
+allocated. Normally, devres_open_group() is called from
+__hid_device_probe() but Hyper-V HID driver overrides 'hid_dev->driver'
+with 'mousevsc_hid_driver' stub and basically re-implements
+__hid_device_probe() by calling hid_parse() and hid_hw_start() but not
+devres_open_group(). hid_device_probe() does not call __hid_device_probe()
+for it. Later, when the driver is removed, hid_device_remove() calls
+devres_release_group() as it doesn't check whether hdev->driver was
+initially overridden or not.
+
+The issue seems to be related to the commit 62c68e7cee33 ("HID: ensure
+timely release of driver-allocated resources") but the commit itself seems
+to be correct.
+
+Fix the issue by dropping the 'hid_dev->driver' override and using
+hid_register_driver()/hid_unregister_driver() instead. Alternatively, it
+would have been possible to rely on the default handling but
+HID_CONNECT_DEFAULT implies HID_CONNECT_HIDRAW and it doesn't seem to work
+for mousevsc as-is.
+
+Fixes: 62c68e7cee33 ("HID: ensure timely release of driver-allocated resources")
+Suggested-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Tested-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-hyperv.c | 58 ++++++++++++++++++++++++++++------------
+ 1 file changed, 41 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c
+index f33485d83d24f..0fb210e40a412 100644
+--- a/drivers/hid/hid-hyperv.c
++++ b/drivers/hid/hid-hyperv.c
+@@ -422,6 +422,25 @@ static int mousevsc_hid_raw_request(struct hid_device *hid,
+ 	return 0;
+ }
+ 
++static int mousevsc_hid_probe(struct hid_device *hid_dev, const struct hid_device_id *id)
++{
++	int ret;
++
++	ret = hid_parse(hid_dev);
++	if (ret) {
++		hid_err(hid_dev, "parse failed\n");
++		return ret;
++	}
++
++	ret = hid_hw_start(hid_dev, HID_CONNECT_HIDINPUT | HID_CONNECT_HIDDEV);
++	if (ret) {
++		hid_err(hid_dev, "hw start failed\n");
++		return ret;
++	}
++
++	return 0;
++}
++
+ static const struct hid_ll_driver mousevsc_ll_driver = {
+ 	.parse = mousevsc_hid_parse,
+ 	.open = mousevsc_hid_open,
+@@ -431,7 +450,16 @@ static const struct hid_ll_driver mousevsc_ll_driver = {
+ 	.raw_request = mousevsc_hid_raw_request,
+ };
+ 
+-static struct hid_driver mousevsc_hid_driver;
++static const struct hid_device_id mousevsc_devices[] = {
++	{ HID_DEVICE(BUS_VIRTUAL, HID_GROUP_ANY, 0x045E, 0x0621) },
++	{ }
++};
++
++static struct hid_driver mousevsc_hid_driver = {
++	.name = "hid-hyperv",
++	.id_table = mousevsc_devices,
++	.probe = mousevsc_hid_probe,
++};
+ 
+ static int mousevsc_probe(struct hv_device *device,
+ 			const struct hv_vmbus_device_id *dev_id)
+@@ -473,7 +501,6 @@ static int mousevsc_probe(struct hv_device *device,
+ 	}
+ 
+ 	hid_dev->ll_driver = &mousevsc_ll_driver;
+-	hid_dev->driver = &mousevsc_hid_driver;
+ 	hid_dev->bus = BUS_VIRTUAL;
+ 	hid_dev->vendor = input_dev->hid_dev_info.vendor;
+ 	hid_dev->product = input_dev->hid_dev_info.product;
+@@ -488,20 +515,6 @@ static int mousevsc_probe(struct hv_device *device,
+ 	if (ret)
+ 		goto probe_err2;
+ 
+-
+-	ret = hid_parse(hid_dev);
+-	if (ret) {
+-		hid_err(hid_dev, "parse failed\n");
+-		goto probe_err2;
+-	}
+-
+-	ret = hid_hw_start(hid_dev, HID_CONNECT_HIDINPUT | HID_CONNECT_HIDDEV);
+-
+-	if (ret) {
+-		hid_err(hid_dev, "hw start failed\n");
+-		goto probe_err2;
+-	}
+-
+ 	device_init_wakeup(&device->device, true);
+ 
+ 	input_dev->connected = true;
+@@ -579,12 +592,23 @@ static struct  hv_driver mousevsc_drv = {
+ 
+ static int __init mousevsc_init(void)
+ {
+-	return vmbus_driver_register(&mousevsc_drv);
++	int ret;
++
++	ret = hid_register_driver(&mousevsc_hid_driver);
++	if (ret)
++		return ret;
++
++	ret = vmbus_driver_register(&mousevsc_drv);
++	if (ret)
++		hid_unregister_driver(&mousevsc_hid_driver);
++
++	return ret;
+ }
+ 
+ static void __exit mousevsc_exit(void)
+ {
+ 	vmbus_driver_unregister(&mousevsc_drv);
++	hid_unregister_driver(&mousevsc_hid_driver);
+ }
+ 
+ MODULE_LICENSE("GPL");
+-- 
+2.43.0
+
diff --git a/queue-6.6/hwmon-nct6775-core-fix-overflows-seen-when-writing-l.patch b/queue-6.6/hwmon-nct6775-core-fix-overflows-seen-when-writing-l.patch
new file mode 100644
index 00000000000..d1d02a41ca5
--- /dev/null
+++ b/queue-6.6/hwmon-nct6775-core-fix-overflows-seen-when-writing-l.patch
@@ -0,0 +1,58 @@
+From 8dc1785b23c24c8027d8a936ca19a5afb5acbbc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 09:39:51 +0800
+Subject: hwmon: (nct6775-core) Fix overflows seen when writing limit
+ attributes
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit 57ee12b6c514146c19b6a159013b48727a012960 ]
+
+DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large
+number such as 18446744073709551615 is provided by the user.
+Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
+
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver")
+Message-ID: <7d5084cea33f7c0fd0578c59adfff71f93de94d9.1731375425.git.xiaopei01@kylinos.cn>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-core.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
+index 8da7aa1614d7d..16f6b7ba2a5de 100644
+--- a/drivers/hwmon/nct6775-core.c
++++ b/drivers/hwmon/nct6775-core.c
+@@ -2878,8 +2878,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr,
+ 	if (err < 0)
+ 		return err;
+ 
+-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0,
+-			data->target_temp_mask);
++	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->target_temp_mask * 1000), 1000);
+ 
+ 	mutex_lock(&data->update_lock);
+ 	data->target_temp[nr] = val;
+@@ -2959,7 +2958,7 @@ store_temp_tolerance(struct device *dev, struct device_attribute *attr,
+ 		return err;
+ 
+ 	/* Limit tolerance as needed */
+-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, data->tolerance_mask);
++	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->tolerance_mask * 1000), 1000);
+ 
+ 	mutex_lock(&data->update_lock);
+ 	data->temp_tolerance[index][nr] = val;
+@@ -3085,7 +3084,7 @@ store_weight_temp(struct device *dev, struct device_attribute *attr,
+ 	if (err < 0)
+ 		return err;
+ 
+-	val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255);
++	val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000);
+ 
+ 	mutex_lock(&data->update_lock);
+ 	data->weight_temp[index][nr] = val;
+-- 
+2.43.0
+
diff --git a/queue-6.6/hwmon-pmbus-core-clear-faults-after-setting-smbalert.patch b/queue-6.6/hwmon-pmbus-core-clear-faults-after-setting-smbalert.patch
new file mode 100644
index 00000000000..a9873cd2e6c
--- /dev/null
+++ b/queue-6.6/hwmon-pmbus-core-clear-faults-after-setting-smbalert.patch
@@ -0,0 +1,61 @@
+From e1b21c0195816439d0b18338250f4cfa758c00c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 18:58:42 +0100
+Subject: hwmon: (pmbus/core) clear faults after setting smbalert mask
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 509c3a362675bc995771df74d545548f98e37621 ]
+
+pmbus_write_smbalert_mask() ignores the errors if the chip can't set
+smbalert mask the standard way. It is not necessarily a problem for the irq
+support if the chip is otherwise properly setup but it may leave an
+uncleared fault behind.
+
+pmbus_core will pick the fault on the next register_check(). The register
+check will fails regardless of the actual register support by the chip.
+
+This leads to missing attributes or debugfs entries for chips that should
+provide them.
+
+We cannot rely on register_check() as PMBUS_SMBALERT_MASK may be read-only.
+
+Unconditionally clear the page fault after setting PMBUS_SMBALERT_MASK to
+avoid the problem.
+
+Suggested-by: Guenter Roeck <linux@roeck-us.net>
+Fixes: 221819ca4c36 ("hwmon: (pmbus/core) Add interrupt support")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Message-ID: <20241105-tps25990-v4-5-0e312ac70b62@baylibre.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index e592446b26653..019c5982ba564 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -3199,7 +3199,17 @@ static int pmbus_regulator_notify(struct pmbus_data *data, int page, int event)
+ 
+ static int pmbus_write_smbalert_mask(struct i2c_client *client, u8 page, u8 reg, u8 val)
+ {
+-	return _pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
++	int ret;
++
++	ret = _pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
++
++	/*
++	 * Clear fault systematically in case writing PMBUS_SMBALERT_MASK
++	 * is not supported by the chip.
++	 */
++	pmbus_clear_fault_page(client, page);
++
++	return ret;
+ }
+ 
+ static irqreturn_t pmbus_fault_handler(int irq, void *pdata)
+-- 
+2.43.0
+
diff --git a/queue-6.6/hwmon-pmbus_core-allow-to-hook-pmbus_smbalert_mask.patch b/queue-6.6/hwmon-pmbus_core-allow-to-hook-pmbus_smbalert_mask.patch
new file mode 100644
index 00000000000..53f87f66db9
--- /dev/null
+++ b/queue-6.6/hwmon-pmbus_core-allow-to-hook-pmbus_smbalert_mask.patch
@@ -0,0 +1,41 @@
+From 6a1c78b6340c5d67fbd8cdbbab3e31b44f1cd2dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 20:59:03 +0530
+Subject: hwmon: (pmbus_core) Allow to hook PMBUS_SMBALERT_MASK
+
+From: Patrick Rudolph <patrick.rudolph@9elements.com>
+
+[ Upstream commit 9c6df63a66c1fdf99d6e1ad278d140080c724120 ]
+
+Use _pmbus_write_word_data to allow intercepting writes to
+PMBUS_SMBALERT_MASK in the custom chip specific code.
+
+This is required for MP2971/MP2973 which doesn't follow the
+PMBUS specification for PMBUS_SMBALERT_MASK.
+
+Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
+Signed-off-by: Naresh Solanki <naresh.solanki@9elements.com>
+Link: https://lore.kernel.org/r/20240130152903.3651341-1-naresh.solanki@9elements.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Stable-dep-of: 509c3a362675 ("hwmon: (pmbus/core) clear faults after setting smbalert mask")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 728c07c42651c..e592446b26653 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -3199,7 +3199,7 @@ static int pmbus_regulator_notify(struct pmbus_data *data, int page, int event)
+ 
+ static int pmbus_write_smbalert_mask(struct i2c_client *client, u8 page, u8 reg, u8 val)
+ {
+-	return pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
++	return _pmbus_write_word_data(client, page, PMBUS_SMBALERT_MASK, reg | (val << 8));
+ }
+ 
+ static irqreturn_t pmbus_fault_handler(int irq, void *pdata)
+-- 
+2.43.0
+
diff --git a/queue-6.6/hwmon-tps23861-fix-reporting-of-negative-temperature.patch b/queue-6.6/hwmon-tps23861-fix-reporting-of-negative-temperature.patch
new file mode 100644
index 00000000000..4621cdcd2d7
--- /dev/null
+++ b/queue-6.6/hwmon-tps23861-fix-reporting-of-negative-temperature.patch
@@ -0,0 +1,42 @@
+From 95ab588ed3faf3592754bd7a757e1eefb17f832f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 20:36:03 +0300
+Subject: hwmon: (tps23861) Fix reporting of negative temperatures
+
+From: Murad Masimov <m.masimov@maxima.ru>
+
+[ Upstream commit de2bf507fabba9c0c678cf5ed54beb546f5ca29a ]
+
+Negative temperatures are reported as large positive temperatures
+due to missing sign extension from unsigned int to long. Cast unsigned
+raw register values to signed before performing the calculations
+to fix the problem.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: fff7b8ab2255 ("hwmon: add Texas Instruments TPS23861 driver")
+Signed-off-by: Murad Masimov <m.masimov@maxima.ru>
+Message-ID: <20241121173604.2021-1-m.masimov@maxima.ru>
+[groeck: Updated subject and description]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tps23861.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/tps23861.c b/drivers/hwmon/tps23861.c
+index d33ecbac00d6d..cea34fb9ba582 100644
+--- a/drivers/hwmon/tps23861.c
++++ b/drivers/hwmon/tps23861.c
+@@ -132,7 +132,7 @@ static int tps23861_read_temp(struct tps23861_data *data, long *val)
+ 	if (err < 0)
+ 		return err;
+ 
+-	*val = (regval * TEMPERATURE_LSB) - 20000;
++	*val = ((long)regval * TEMPERATURE_LSB) - 20000;
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/ib-mlx5-allocate-resources-just-before-first-qp-srq-.patch b/queue-6.6/ib-mlx5-allocate-resources-just-before-first-qp-srq-.patch
new file mode 100644
index 00000000000..0107abc03ac
--- /dev/null
+++ b/queue-6.6/ib-mlx5-allocate-resources-just-before-first-qp-srq-.patch
@@ -0,0 +1,295 @@
+From 3aa502c9e7cb511f4d8c99e00c6286aa6c1801f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2024 13:26:39 +0300
+Subject: IB/mlx5: Allocate resources just before first QP/SRQ is created
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jianbo Liu <jianbol@nvidia.com>
+
+[ Upstream commit 5895e70f2e6e8dc67b551ca554d6fcde0a7f0467 ]
+
+Previously, all IB dev resources are initialized on driver load. As
+they are not always used, move the initialization to the time when
+they are needed.
+
+To be more specific, move PD (p0) and CQ (c0) initialization to the
+time when the first SRQ is created. and move SRQs（s0 and s1)
+initialization to the time first QP is created. To avoid concurrent
+creations, two new mutexes are also added.
+
+Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
+Link: https://lore.kernel.org/r/98c3e53a8cc0bdfeb6dec6e5bb8b037d78ab00d8.1717409369.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Stable-dep-of: ede132a5cf55 ("RDMA/mlx5: Move events notifier registration to be after device registration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c    | 149 +++++++++++++++++++--------
+ drivers/infiniband/hw/mlx5/mlx5_ib.h |   4 +
+ drivers/infiniband/hw/mlx5/qp.c      |   4 +
+ drivers/infiniband/hw/mlx5/srq.c     |   4 +
+ 4 files changed, 118 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 296af7a5c2794..bc38af6cda6ee 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2796,37 +2796,72 @@ static u8 mlx5_get_umr_fence(u8 umr_fence_cap)
+ 	}
+ }
+ 
+-static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
++int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev)
+ {
+ 	struct mlx5_ib_resources *devr = &dev->devr;
+-	struct ib_srq_init_attr attr;
+-	struct ib_device *ibdev;
+ 	struct ib_cq_init_attr cq_attr = {.cqe = 1};
+-	int port;
++	struct ib_device *ibdev;
++	struct ib_pd *pd;
++	struct ib_cq *cq;
+ 	int ret = 0;
+ 
+-	ibdev = &dev->ib_dev;
+ 
+-	if (!MLX5_CAP_GEN(dev->mdev, xrc))
+-		return -EOPNOTSUPP;
++	/*
++	 * devr->c0 is set once, never changed until device unload.
++	 * Avoid taking the mutex if initialization is already done.
++	 */
++	if (devr->c0)
++		return 0;
+ 
+-	devr->p0 = ib_alloc_pd(ibdev, 0);
+-	if (IS_ERR(devr->p0))
+-		return PTR_ERR(devr->p0);
++	mutex_lock(&devr->cq_lock);
++	if (devr->c0)
++		goto unlock;
+ 
+-	devr->c0 = ib_create_cq(ibdev, NULL, NULL, NULL, &cq_attr);
+-	if (IS_ERR(devr->c0)) {
+-		ret = PTR_ERR(devr->c0);
+-		goto error1;
++	ibdev = &dev->ib_dev;
++	pd = ib_alloc_pd(ibdev, 0);
++	if (IS_ERR(pd)) {
++		ret = PTR_ERR(pd);
++		mlx5_ib_err(dev, "Couldn't allocate PD for res init, err=%d\n", ret);
++		goto unlock;
+ 	}
+ 
+-	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn0, 0);
+-	if (ret)
+-		goto error2;
++	cq = ib_create_cq(ibdev, NULL, NULL, NULL, &cq_attr);
++	if (IS_ERR(cq)) {
++		ret = PTR_ERR(cq);
++		mlx5_ib_err(dev, "Couldn't create CQ for res init, err=%d\n", ret);
++		ib_dealloc_pd(pd);
++		goto unlock;
++	}
+ 
+-	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn1, 0);
++	devr->p0 = pd;
++	devr->c0 = cq;
++
++unlock:
++	mutex_unlock(&devr->cq_lock);
++	return ret;
++}
++
++int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev)
++{
++	struct mlx5_ib_resources *devr = &dev->devr;
++	struct ib_srq_init_attr attr;
++	struct ib_srq *s0, *s1;
++	int ret = 0;
++
++	/*
++	 * devr->s1 is set once, never changed until device unload.
++	 * Avoid taking the mutex if initialization is already done.
++	 */
++	if (devr->s1)
++		return 0;
++
++	mutex_lock(&devr->srq_lock);
++	if (devr->s1)
++		goto unlock;
++
++	ret = mlx5_ib_dev_res_cq_init(dev);
+ 	if (ret)
+-		goto error3;
++		goto unlock;
+ 
+ 	memset(&attr, 0, sizeof(attr));
+ 	attr.attr.max_sge = 1;
+@@ -2834,10 +2869,11 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+ 	attr.srq_type = IB_SRQT_XRC;
+ 	attr.ext.cq = devr->c0;
+ 
+-	devr->s0 = ib_create_srq(devr->p0, &attr);
+-	if (IS_ERR(devr->s0)) {
+-		ret = PTR_ERR(devr->s0);
+-		goto err_create;
++	s0 = ib_create_srq(devr->p0, &attr);
++	if (IS_ERR(s0)) {
++		ret = PTR_ERR(s0);
++		mlx5_ib_err(dev, "Couldn't create SRQ 0 for res init, err=%d\n", ret);
++		goto unlock;
+ 	}
+ 
+ 	memset(&attr, 0, sizeof(attr));
+@@ -2845,29 +2881,48 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+ 	attr.attr.max_wr = 1;
+ 	attr.srq_type = IB_SRQT_BASIC;
+ 
+-	devr->s1 = ib_create_srq(devr->p0, &attr);
+-	if (IS_ERR(devr->s1)) {
+-		ret = PTR_ERR(devr->s1);
+-		goto error6;
++	s1 = ib_create_srq(devr->p0, &attr);
++	if (IS_ERR(s1)) {
++		ret = PTR_ERR(s1);
++		mlx5_ib_err(dev, "Couldn't create SRQ 1 for res init, err=%d\n", ret);
++		ib_destroy_srq(s0);
++	}
++
++	devr->s0 = s0;
++	devr->s1 = s1;
++
++unlock:
++	mutex_unlock(&devr->srq_lock);
++	return ret;
++}
++
++static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
++{
++	struct mlx5_ib_resources *devr = &dev->devr;
++	int port;
++	int ret;
++
++	if (!MLX5_CAP_GEN(dev->mdev, xrc))
++		return -EOPNOTSUPP;
++
++	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn0, 0);
++	if (ret)
++		return ret;
++
++	ret = mlx5_cmd_xrcd_alloc(dev->mdev, &devr->xrcdn1, 0);
++	if (ret) {
++		mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
++		return ret;
+ 	}
+ 
+ 	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+ 		INIT_WORK(&devr->ports[port].pkey_change_work,
+ 			  pkey_change_handler);
+ 
+-	return 0;
++	mutex_init(&devr->cq_lock);
++	mutex_init(&devr->srq_lock);
+ 
+-error6:
+-	ib_destroy_srq(devr->s0);
+-err_create:
+-	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn1, 0);
+-error3:
+-	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
+-error2:
+-	ib_destroy_cq(devr->c0);
+-error1:
+-	ib_dealloc_pd(devr->p0);
+-	return ret;
++	return 0;
+ }
+ 
+ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev)
+@@ -2884,12 +2939,20 @@ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev)
+ 	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+ 		cancel_work_sync(&devr->ports[port].pkey_change_work);
+ 
+-	ib_destroy_srq(devr->s1);
+-	ib_destroy_srq(devr->s0);
++	/* After s0/s1 init, they are not unset during the device lifetime. */
++	if (devr->s1) {
++		ib_destroy_srq(devr->s1);
++		ib_destroy_srq(devr->s0);
++	}
+ 	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn1, 0);
+ 	mlx5_cmd_xrcd_dealloc(dev->mdev, devr->xrcdn0, 0);
+-	ib_destroy_cq(devr->c0);
+-	ib_dealloc_pd(devr->p0);
++	/* After p0/c0 init, they are not unset during the device lifetime. */
++	if (devr->c0) {
++		ib_destroy_cq(devr->c0);
++		ib_dealloc_pd(devr->p0);
++	}
++	mutex_destroy(&devr->cq_lock);
++	mutex_destroy(&devr->srq_lock);
+ }
+ 
+ static u32 get_core_cap_flags(struct ib_device *ibdev,
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 43a963e205eb4..1c83d132197f5 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -820,11 +820,13 @@ struct mlx5_ib_port_resources {
+ 
+ struct mlx5_ib_resources {
+ 	struct ib_cq	*c0;
++	struct mutex cq_lock;
+ 	u32 xrcdn0;
+ 	u32 xrcdn1;
+ 	struct ib_pd	*p0;
+ 	struct ib_srq	*s0;
+ 	struct ib_srq	*s1;
++	struct mutex srq_lock;
+ 	struct mlx5_ib_port_resources ports[2];
+ };
+ 
+@@ -1270,6 +1272,8 @@ to_mmmap(struct rdma_user_mmap_entry *rdma_entry)
+ 		struct mlx5_user_mmap_entry, rdma_entry);
+ }
+ 
++int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev);
++int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev);
+ int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
+ 			struct mlx5_db *db);
+ void mlx5_ib_db_unmap_user(struct mlx5_ib_ucontext *context, struct mlx5_db *db);
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 93d9b15cbbb98..71a856409cee2 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3247,6 +3247,10 @@ int mlx5_ib_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attr,
+ 	enum ib_qp_type type;
+ 	int err;
+ 
++	err = mlx5_ib_dev_res_srq_init(dev);
++	if (err)
++		return err;
++
+ 	err = check_qp_type(dev, attr, &type);
+ 	if (err)
+ 		return err;
+diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
+index 84be0c3d56995..bcb6b324af506 100644
+--- a/drivers/infiniband/hw/mlx5/srq.c
++++ b/drivers/infiniband/hw/mlx5/srq.c
+@@ -216,6 +216,10 @@ int mlx5_ib_create_srq(struct ib_srq *ib_srq,
+ 		return -EINVAL;
+ 	}
+ 
++	err = mlx5_ib_dev_res_cq_init(dev);
++	if (err)
++		return err;
++
+ 	mutex_init(&srq->mutex);
+ 	spin_lock_init(&srq->lock);
+ 	srq->msrq.max    = roundup_pow_of_two(init_attr->attr.max_wr + 1);
+-- 
+2.43.0
+
diff --git a/queue-6.6/ice-consistently-use-q_idx-in-ice_vc_cfg_qs_msg.patch b/queue-6.6/ice-consistently-use-q_idx-in-ice_vc_cfg_qs_msg.patch
new file mode 100644
index 00000000000..a0f2705b9b3
--- /dev/null
+++ b/queue-6.6/ice-consistently-use-q_idx-in-ice_vc_cfg_qs_msg.patch
@@ -0,0 +1,105 @@
+From b57fdb5fb4dea7022f58a5c20085755727dfdbb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 16:07:44 -0700
+Subject: ice: consistently use q_idx in ice_vc_cfg_qs_msg()
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit a884c304e18a40e1c7a6525a9274e64c2c061c3f ]
+
+The ice_vc_cfg_qs_msg() function is used to configure VF queues in response
+to a VIRTCHNL_OP_CONFIG_VSI_QUEUES command.
+
+The virtchnl command contains an array of queue pair data for configuring
+Tx and Rx queues. This data includes a queue ID. When configuring the
+queues, the driver generally uses this queue ID to determine which Tx and
+Rx ring to program. However, a handful of places use the index into the
+queue pair data from the VF. While most VF implementations appear to send
+this data in order, it is not mandated by the virtchnl and it is not
+verified that the queue pair data comes in order.
+
+Fix the driver to consistently use the q_idx field instead of the 'i'
+iterator value when accessing the rings. For the Rx case, introduce a local
+ring variable to keep lines short.
+
+Fixes: 7ad15440acf8 ("ice: Refactor VIRTCHNL_OP_CONFIG_VSI_QUEUES handling")
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 21 +++++++++----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+index 216c029661db2..9f7268bb2ee3b 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+@@ -1645,8 +1645,8 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 
+ 		/* copy Tx queue info from VF into VSI */
+ 		if (qpi->txq.ring_len > 0) {
+-			vsi->tx_rings[i]->dma = qpi->txq.dma_ring_addr;
+-			vsi->tx_rings[i]->count = qpi->txq.ring_len;
++			vsi->tx_rings[q_idx]->dma = qpi->txq.dma_ring_addr;
++			vsi->tx_rings[q_idx]->count = qpi->txq.ring_len;
+ 
+ 			/* Disable any existing queue first */
+ 			if (ice_vf_vsi_dis_single_txq(vf, vsi, q_idx))
+@@ -1655,7 +1655,7 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 			/* Configure a queue with the requested settings */
+ 			if (ice_vsi_cfg_single_txq(vsi, vsi->tx_rings, q_idx)) {
+ 				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure TX queue %d\n",
+-					 vf->vf_id, i);
++					 vf->vf_id, q_idx);
+ 				goto error_param;
+ 			}
+ 		}
+@@ -1663,10 +1663,11 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 		/* copy Rx queue info from VF into VSI */
+ 		if (qpi->rxq.ring_len > 0) {
+ 			u16 max_frame_size = ice_vc_get_max_frame_size(vf);
++			struct ice_rx_ring *ring = vsi->rx_rings[q_idx];
+ 			u32 rxdid;
+ 
+-			vsi->rx_rings[i]->dma = qpi->rxq.dma_ring_addr;
+-			vsi->rx_rings[i]->count = qpi->rxq.ring_len;
++			ring->dma = qpi->rxq.dma_ring_addr;
++			ring->count = qpi->rxq.ring_len;
+ 
+ 			if (qpi->rxq.crc_disable &&
+ 			    !(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_CRC)) {
+@@ -1674,18 +1675,16 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 			}
+ 
+ 			if (qpi->rxq.crc_disable)
+-				vsi->rx_rings[q_idx]->flags |=
+-					ICE_RX_FLAGS_CRC_STRIP_DIS;
++				ring->flags |= ICE_RX_FLAGS_CRC_STRIP_DIS;
+ 			else
+-				vsi->rx_rings[q_idx]->flags &=
+-					~ICE_RX_FLAGS_CRC_STRIP_DIS;
++				ring->flags &= ~ICE_RX_FLAGS_CRC_STRIP_DIS;
+ 
+ 			if (qpi->rxq.databuffer_size != 0 &&
+ 			    (qpi->rxq.databuffer_size > ((16 * 1024) - 128) ||
+ 			     qpi->rxq.databuffer_size < 1024))
+ 				goto error_param;
+ 			vsi->rx_buf_len = qpi->rxq.databuffer_size;
+-			vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len;
++			ring->rx_buf_len = vsi->rx_buf_len;
+ 			if (qpi->rxq.max_pkt_size > max_frame_size ||
+ 			    qpi->rxq.max_pkt_size < 64)
+ 				goto error_param;
+@@ -1700,7 +1699,7 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 
+ 			if (ice_vsi_cfg_single_rxq(vsi, q_idx)) {
+ 				dev_warn(ice_pf_to_dev(pf), "VF-%d failed to configure RX queue %d\n",
+-					 vf->vf_id, i);
++					 vf->vf_id, q_idx);
+ 				goto error_param;
+ 			}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/ice-support-fcs-crc-strip-disable-for-vf.patch b/queue-6.6/ice-support-fcs-crc-strip-disable-for-vf.patch
new file mode 100644
index 00000000000..77c6212fec2
--- /dev/null
+++ b/queue-6.6/ice-support-fcs-crc-strip-disable-for-vf.patch
@@ -0,0 +1,60 @@
+From f3b46dbc468a30e778753e72ef02fce280a31ed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 13:57:02 -0600
+Subject: ice: Support FCS/CRC strip disable for VF
+
+From: Haiyue Wang <haiyue.wang@intel.com>
+
+[ Upstream commit 730cb741815c71d9dd8d1bc7d0b7d9a0acc615a8 ]
+
+To support CRC strip enable/disable functionality, VF needs the explicit
+request VIRTCHNL_VF_OFFLOAD_CRC offload. Then according to crc_disable
+flag of Rx queue configuration information to set up the queue context.
+
+Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Stable-dep-of: a884c304e18a ("ice: consistently use q_idx in ice_vc_cfg_qs_msg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_virtchnl.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+index 6c6f267dcccc3..216c029661db2 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+@@ -479,6 +479,9 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg)
+ 	if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_REQ_QUEUES)
+ 		vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_REQ_QUEUES;
+ 
++	if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_CRC)
++		vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_CRC;
++
+ 	if (vf->driver_caps & VIRTCHNL_VF_CAP_ADV_LINK_SPEED)
+ 		vfres->vf_cap_flags |= VIRTCHNL_VF_CAP_ADV_LINK_SPEED;
+ 
+@@ -1665,6 +1668,18 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ 			vsi->rx_rings[i]->dma = qpi->rxq.dma_ring_addr;
+ 			vsi->rx_rings[i]->count = qpi->rxq.ring_len;
+ 
++			if (qpi->rxq.crc_disable &&
++			    !(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_CRC)) {
++				goto error_param;
++			}
++
++			if (qpi->rxq.crc_disable)
++				vsi->rx_rings[q_idx]->flags |=
++					ICE_RX_FLAGS_CRC_STRIP_DIS;
++			else
++				vsi->rx_rings[q_idx]->flags &=
++					~ICE_RX_FLAGS_CRC_STRIP_DIS;
++
+ 			if (qpi->rxq.databuffer_size != 0 &&
+ 			    (qpi->rxq.databuffer_size > ((16 * 1024) - 128) ||
+ 			     qpi->rxq.databuffer_size < 1024))
+-- 
+2.43.0
+
diff --git a/queue-6.6/iio-light-al3010-fix-an-error-handling-path-in-al301.patch b/queue-6.6/iio-light-al3010-fix-an-error-handling-path-in-al301.patch
new file mode 100644
index 00000000000..cf3cf846ff2
--- /dev/null
+++ b/queue-6.6/iio-light-al3010-fix-an-error-handling-path-in-al301.patch
@@ -0,0 +1,58 @@
+From b1c047b30f7052dd48dadb06a6cefbe6a4756d5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 20:36:06 +0200
+Subject: iio: light: al3010: Fix an error handling path in al3010_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a4b7064d34186cf4970fe0333c3b27346cf8f819 ]
+
+If i2c_smbus_write_byte_data() fails in al3010_init(),
+al3010_set_pwr(false) is not called.
+
+In order to avoid such a situation, move the devm_add_action_or_reset()
+witch calls al3010_set_pwr(false) right after a successful
+al3010_set_pwr(true).
+
+Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://patch.msgid.link/ee5d10a2dd2b70f29772d5df33774d3974a80f30.1725993353.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/al3010.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iio/light/al3010.c b/drivers/iio/light/al3010.c
+index 8f0119f392b70..7d4053bfceea2 100644
+--- a/drivers/iio/light/al3010.c
++++ b/drivers/iio/light/al3010.c
+@@ -87,7 +87,12 @@ static int al3010_init(struct al3010_data *data)
+ 	int ret;
+ 
+ 	ret = al3010_set_pwr(data->client, true);
++	if (ret < 0)
++		return ret;
+ 
++	ret = devm_add_action_or_reset(&data->client->dev,
++				       al3010_set_pwr_off,
++				       data);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -190,12 +195,6 @@ static int al3010_probe(struct i2c_client *client)
+ 		return ret;
+ 	}
+ 
+-	ret = devm_add_action_or_reset(&client->dev,
+-					al3010_set_pwr_off,
+-					data);
+-	if (ret < 0)
+-		return ret;
+-
+ 	return devm_iio_device_register(&client->dev, indio_dev);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/initramfs-avoid-filename-buffer-overrun.patch b/queue-6.6/initramfs-avoid-filename-buffer-overrun.patch
new file mode 100644
index 00000000000..4b984f4bfa7
--- /dev/null
+++ b/queue-6.6/initramfs-avoid-filename-buffer-overrun.patch
@@ -0,0 +1,118 @@
+From b38b7a14753f7655069486d5b385b38604f9b89b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 03:55:10 +0000
+Subject: initramfs: avoid filename buffer overrun
+
+From: David Disseldorp <ddiss@suse.de>
+
+[ Upstream commit e017671f534dd3f568db9e47b0583e853d2da9b5 ]
+
+The initramfs filename field is defined in
+Documentation/driver-api/early-userspace/buffer-format.rst as:
+
+ 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data
+...
+ 55 ============= ================== =========================
+ 56 Field name    Field size         Meaning
+ 57 ============= ================== =========================
+...
+ 70 c_namesize    8 bytes            Length of filename, including final \0
+
+When extracting an initramfs cpio archive, the kernel's do_name() path
+handler assumes a zero-terminated path at @collected, passing it
+directly to filp_open() / init_mkdir() / init_mknod().
+
+If a specially crafted cpio entry carries a non-zero-terminated filename
+and is followed by uninitialized memory, then a file may be created with
+trailing characters that represent the uninitialized memory. The ability
+to create an initramfs entry would imply already having full control of
+the system, so the buffer overrun shouldn't be considered a security
+vulnerability.
+
+Append the output of the following bash script to an existing initramfs
+and observe any created /initramfs_test_fname_overrunAA* path. E.g.
+  ./reproducer.sh | gzip >> /myinitramfs
+
+It's easiest to observe non-zero uninitialized memory when the output is
+gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(),
+rather than the initrd_start+initrd_size block.
+
+---- reproducer.sh ----
+nilchar="A"	# change to "\0" to properly zero terminate / pad
+magic="070701"
+ino=1
+mode=$(( 0100777 ))
+uid=0
+gid=0
+nlink=1
+mtime=1
+filesize=0
+devmajor=0
+devminor=1
+rdevmajor=0
+rdevminor=0
+csum=0
+fname="initramfs_test_fname_overrun"
+namelen=$(( ${#fname} + 1 ))	# plus one to account for terminator
+
+printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \
+	$magic $ino $mode $uid $gid $nlink $mtime $filesize \
+	$devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname
+
+termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) ))
+printf "%.s${nilchar}" $(seq 1 $termpadlen)
+---- reproducer.sh ----
+
+Symlink filename fields handled in do_symlink() won't overrun past the
+data segment, due to the explicit zero-termination of the symlink
+target.
+
+Fix filename buffer overrun by aborting the initramfs FSM if any cpio
+entry doesn't carry a zero-terminator at the expected (name_len - 1)
+offset.
+
+Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Link: https://lore.kernel.org/r/20241030035509.20194-2-ddiss@suse.de
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/initramfs.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/init/initramfs.c b/init/initramfs.c
+index efc477b905a48..148988bd8ab27 100644
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -358,6 +358,15 @@ static int __init do_name(void)
+ {
+ 	state = SkipIt;
+ 	next_state = Reset;
++
++	/* name_len > 0 && name_len <= PATH_MAX checked in do_header */
++	if (collected[name_len - 1] != '\0') {
++		pr_err("initramfs name without nulterm: %.*s\n",
++		       (int)name_len, collected);
++		error("malformed archive");
++		return 1;
++	}
++
+ 	if (strcmp(collected, "TRAILER!!!") == 0) {
+ 		free_hash();
+ 		return 0;
+@@ -422,6 +431,12 @@ static int __init do_copy(void)
+ 
+ static int __init do_symlink(void)
+ {
++	if (collected[name_len - 1] != '\0') {
++		pr_err("initramfs symlink without nulterm: %.*s\n",
++		       (int)name_len, collected);
++		error("malformed archive");
++		return 1;
++	}
+ 	collected[N_ALIGN(name_len) + body_len] = '\0';
+ 	clean_path(collected, 0);
+ 	init_symlink(collected + N_ALIGN(name_len), collected);
+-- 
+2.43.0
+
diff --git a/queue-6.6/iommu-vt-d-fix-checks-and-print-in-dmar_fault_dump_p.patch b/queue-6.6/iommu-vt-d-fix-checks-and-print-in-dmar_fault_dump_p.patch
new file mode 100644
index 00000000000..2c619447ff2
--- /dev/null
+++ b/queue-6.6/iommu-vt-d-fix-checks-and-print-in-dmar_fault_dump_p.patch
@@ -0,0 +1,131 @@
+From b263fb1481a5a6e2af0c9a2733d82dc6daa391a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 09:40:32 +0800
+Subject: iommu/vt-d: Fix checks and print in dmar_fault_dump_ptes()
+
+From: Zhenzhong Duan <zhenzhong.duan@intel.com>
+
+[ Upstream commit 6ceb93f952f6ca34823ce3650c902c31b8385b40 ]
+
+There are some issues in dmar_fault_dump_ptes():
+
+1. return value of phys_to_virt() is used for checking if an entry is
+   present.
+2. dump is confusing, e.g., "pasid table entry is not present", confusing
+   by unpresent pasid table vs. unpresent pasid table entry. Current code
+   means the former.
+3. pgtable_walk() is called without checking if page table is present.
+
+Fix 1 by checking present bit of an entry before dump a lower level entry.
+Fix 2 by removing "entry" string, e.g., "pasid table is not present".
+Fix 3 by checking page table present before walk.
+
+Take issue 3 for example, before fix:
+
+[  442.240357] DMAR: pasid dir entry: 0x000000012c83e001
+[  442.246661] DMAR: pasid table entry[0]: 0x0000000000000000
+[  442.253429] DMAR: pasid table entry[1]: 0x0000000000000000
+[  442.260203] DMAR: pasid table entry[2]: 0x0000000000000000
+[  442.266969] DMAR: pasid table entry[3]: 0x0000000000000000
+[  442.273733] DMAR: pasid table entry[4]: 0x0000000000000000
+[  442.280479] DMAR: pasid table entry[5]: 0x0000000000000000
+[  442.287234] DMAR: pasid table entry[6]: 0x0000000000000000
+[  442.293989] DMAR: pasid table entry[7]: 0x0000000000000000
+[  442.300742] DMAR: PTE not present at level 2
+
+After fix:
+...
+[  357.241214] DMAR: pasid table entry[6]: 0x0000000000000000
+[  357.248022] DMAR: pasid table entry[7]: 0x0000000000000000
+[  357.254824] DMAR: scalable mode page table is not present
+
+Fixes: 914ff7719e8a ("iommu/vt-d: Dump DMAR translation structure when DMA fault occurs")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Link: https://lore.kernel.org/r/20241024092146.715063-2-zhenzhong.duan@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 29 ++++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 3a7c647d3affa..7d00e9cf7db02 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -845,11 +845,11 @@ void dmar_fault_dump_ptes(struct intel_iommu *iommu, u16 source_id,
+ 	pr_info("Dump %s table entries for IOVA 0x%llx\n", iommu->name, addr);
+ 
+ 	/* root entry dump */
+-	rt_entry = &iommu->root_entry[bus];
+-	if (!rt_entry) {
+-		pr_info("root table entry is not present\n");
++	if (!iommu->root_entry) {
++		pr_info("root table is not present\n");
+ 		return;
+ 	}
++	rt_entry = &iommu->root_entry[bus];
+ 
+ 	if (sm_supported(iommu))
+ 		pr_info("scalable mode root entry: hi 0x%016llx, low 0x%016llx\n",
+@@ -860,7 +860,7 @@ void dmar_fault_dump_ptes(struct intel_iommu *iommu, u16 source_id,
+ 	/* context entry dump */
+ 	ctx_entry = iommu_context_addr(iommu, bus, devfn, 0);
+ 	if (!ctx_entry) {
+-		pr_info("context table entry is not present\n");
++		pr_info("context table is not present\n");
+ 		return;
+ 	}
+ 
+@@ -869,17 +869,23 @@ void dmar_fault_dump_ptes(struct intel_iommu *iommu, u16 source_id,
+ 
+ 	/* legacy mode does not require PASID entries */
+ 	if (!sm_supported(iommu)) {
++		if (!context_present(ctx_entry)) {
++			pr_info("legacy mode page table is not present\n");
++			return;
++		}
+ 		level = agaw_to_level(ctx_entry->hi & 7);
+ 		pgtable = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
+ 		goto pgtable_walk;
+ 	}
+ 
+-	/* get the pointer to pasid directory entry */
+-	dir = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
+-	if (!dir) {
+-		pr_info("pasid directory entry is not present\n");
++	if (!context_present(ctx_entry)) {
++		pr_info("pasid directory table is not present\n");
+ 		return;
+ 	}
++
++	/* get the pointer to pasid directory entry */
++	dir = phys_to_virt(ctx_entry->lo & VTD_PAGE_MASK);
++
+ 	/* For request-without-pasid, get the pasid from context entry */
+ 	if (intel_iommu_sm && pasid == IOMMU_PASID_INVALID)
+ 		pasid = IOMMU_NO_PASID;
+@@ -891,7 +897,7 @@ void dmar_fault_dump_ptes(struct intel_iommu *iommu, u16 source_id,
+ 	/* get the pointer to the pasid table entry */
+ 	entries = get_pasid_table_from_pde(pde);
+ 	if (!entries) {
+-		pr_info("pasid table entry is not present\n");
++		pr_info("pasid table is not present\n");
+ 		return;
+ 	}
+ 	index = pasid & PASID_PTE_MASK;
+@@ -899,6 +905,11 @@ void dmar_fault_dump_ptes(struct intel_iommu *iommu, u16 source_id,
+ 	for (i = 0; i < ARRAY_SIZE(pte->val); i++)
+ 		pr_info("pasid table entry[%d]: 0x%016llx\n", i, pte->val[i]);
+ 
++	if (!pasid_pte_is_present(pte)) {
++		pr_info("scalable mode page table is not present\n");
++		return;
++	}
++
+ 	if (pasid_pte_get_pgtt(pte) == PASID_ENTRY_PGTT_FL_ONLY) {
+ 		level = pte->val[2] & BIT_ULL(2) ? 5 : 4;
+ 		pgtable = phys_to_virt(pte->val[2] & VTD_PAGE_MASK);
+-- 
+2.43.0
+
diff --git a/queue-6.6/iommu-vt-d-fix-checks-and-print-in-pgtable_walk.patch b/queue-6.6/iommu-vt-d-fix-checks-and-print-in-pgtable_walk.patch
new file mode 100644
index 00000000000..9a3e7c9662b
--- /dev/null
+++ b/queue-6.6/iommu-vt-d-fix-checks-and-print-in-pgtable_walk.patch
@@ -0,0 +1,62 @@
+From a7ee7636724d52e463a06780edc03d9e108f4d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 09:40:33 +0800
+Subject: iommu/vt-d: Fix checks and print in pgtable_walk()
+
+From: Zhenzhong Duan <zhenzhong.duan@intel.com>
+
+[ Upstream commit f1645676f25d2c846798f0233c3a953efd62aafb ]
+
+There are some issues in pgtable_walk():
+
+1. Super page is dumped as non-present page
+2. dma_pte_superpage() should not check against leaf page table entries
+3. Pointer pte is never NULL so checking it is meaningless
+4. When an entry is not present, it still makes sense to dump the entry
+   content.
+
+Fix 1,2 by checking dma_pte_superpage()'s returned value after level check.
+Fix 3 by removing pte check.
+Fix 4 by checking present bit after printing.
+
+By this chance, change to print "page table not present" instead of "PTE
+not present" to be clearer.
+
+Fixes: 914ff7719e8a ("iommu/vt-d: Dump DMAR translation structure when DMA fault occurs")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Link: https://lore.kernel.org/r/20241024092146.715063-3-zhenzhong.duan@intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 7d00e9cf7db02..d6381c00bb8dd 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -815,14 +815,15 @@ static void pgtable_walk(struct intel_iommu *iommu, unsigned long pfn,
+ 	while (1) {
+ 		offset = pfn_level_offset(pfn, level);
+ 		pte = &parent[offset];
+-		if (!pte || (dma_pte_superpage(pte) || !dma_pte_present(pte))) {
+-			pr_info("PTE not present at level %d\n", level);
+-			break;
+-		}
+ 
+ 		pr_info("pte level: %d, pte value: 0x%016llx\n", level, pte->val);
+ 
+-		if (level == 1)
++		if (!dma_pte_present(pte)) {
++			pr_info("page table not present at level %d\n", level - 1);
++			break;
++		}
++
++		if (level == 1 || dma_pte_superpage(pte))
+ 			break;
+ 
+ 		parent = phys_to_virt(dma_pte_addr(pte));
+-- 
+2.43.0
+
diff --git a/queue-6.6/ip6mr-fix-tables-suspicious-rcu-usage.patch b/queue-6.6/ip6mr-fix-tables-suspicious-rcu-usage.patch
new file mode 100644
index 00000000000..0a604c75c6b
--- /dev/null
+++ b/queue-6.6/ip6mr-fix-tables-suspicious-rcu-usage.patch
@@ -0,0 +1,140 @@
+From 33aae3d897f2a4054b4ce3ca0ee0dbacac55e8f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 16:40:57 +0100
+Subject: ip6mr: fix tables suspicious RCU usage
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit f1553c9894b4dbeb10a2ab15ab1aa113b3b4047c ]
+
+Several places call ip6mr_get_table() with no RCU nor RTNL lock.
+Add RCU protection inside such helper and provide a lockless variant
+for the few callers that already acquired the relevant lock.
+
+Note that some users additionally reference the table outside the RCU
+lock. That is actually safe as the table deletion can happen only
+after all table accesses are completed.
+
+Fixes: e2d57766e674 ("net: Provide compat support for SIOCGETMIFCNT_IN6 and SIOCGETSGCNT_IN6.")
+Fixes: d7c31cbde4bc ("net: ip6mr: add RTM_GETROUTE netlink op")
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6mr.c | 38 +++++++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 11 deletions(-)
+
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 30ca064b76ef1..e24fa0843c7d1 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -125,7 +125,7 @@ static struct mr_table *ip6mr_mr_table_iter(struct net *net,
+ 	return ret;
+ }
+ 
+-static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
++static struct mr_table *__ip6mr_get_table(struct net *net, u32 id)
+ {
+ 	struct mr_table *mrt;
+ 
+@@ -136,6 +136,16 @@ static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
+ 	return NULL;
+ }
+ 
++static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
++{
++	struct mr_table *mrt;
++
++	rcu_read_lock();
++	mrt = __ip6mr_get_table(net, id);
++	rcu_read_unlock();
++	return mrt;
++}
++
+ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
+ 			    struct mr_table **mrt)
+ {
+@@ -177,7 +187,7 @@ static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp,
+ 
+ 	arg->table = fib_rule_get_table(rule, arg);
+ 
+-	mrt = ip6mr_get_table(rule->fr_net, arg->table);
++	mrt = __ip6mr_get_table(rule->fr_net, arg->table);
+ 	if (!mrt)
+ 		return -EAGAIN;
+ 	res->mrt = mrt;
+@@ -304,6 +314,8 @@ static struct mr_table *ip6mr_get_table(struct net *net, u32 id)
+ 	return net->ipv6.mrt6;
+ }
+ 
++#define __ip6mr_get_table ip6mr_get_table
++
+ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
+ 			    struct mr_table **mrt)
+ {
+@@ -382,7 +394,7 @@ static struct mr_table *ip6mr_new_table(struct net *net, u32 id)
+ {
+ 	struct mr_table *mrt;
+ 
+-	mrt = ip6mr_get_table(net, id);
++	mrt = __ip6mr_get_table(net, id);
+ 	if (mrt)
+ 		return mrt;
+ 
+@@ -411,13 +423,15 @@ static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos)
+ 	struct net *net = seq_file_net(seq);
+ 	struct mr_table *mrt;
+ 
+-	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
+-	if (!mrt)
++	rcu_read_lock();
++	mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
++	if (!mrt) {
++		rcu_read_unlock();
+ 		return ERR_PTR(-ENOENT);
++	}
+ 
+ 	iter->mrt = mrt;
+ 
+-	rcu_read_lock();
+ 	return mr_vif_seq_start(seq, pos);
+ }
+ 
+@@ -2278,11 +2292,13 @@ int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm,
+ 	struct mfc6_cache *cache;
+ 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+ 
+-	mrt = ip6mr_get_table(net, RT6_TABLE_DFLT);
+-	if (!mrt)
++	rcu_read_lock();
++	mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT);
++	if (!mrt) {
++		rcu_read_unlock();
+ 		return -ENOENT;
++	}
+ 
+-	rcu_read_lock();
+ 	cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr);
+ 	if (!cache && skb->dev) {
+ 		int vif = ip6mr_find_vif(mrt, skb->dev);
+@@ -2563,7 +2579,7 @@ static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+ 		grp = nla_get_in6_addr(tb[RTA_DST]);
+ 	tableid = tb[RTA_TABLE] ? nla_get_u32(tb[RTA_TABLE]) : 0;
+ 
+-	mrt = ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT);
++	mrt = __ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT);
+ 	if (!mrt) {
+ 		NL_SET_ERR_MSG_MOD(extack, "MR table does not exist");
+ 		return -ENOENT;
+@@ -2608,7 +2624,7 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
+ 	if (filter.table_id) {
+ 		struct mr_table *mrt;
+ 
+-		mrt = ip6mr_get_table(sock_net(skb->sk), filter.table_id);
++		mrt = __ip6mr_get_table(sock_net(skb->sk), filter.table_id);
+ 		if (!mrt) {
+ 			if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IP6MR)
+ 				return skb->len;
+-- 
+2.43.0
+
diff --git a/queue-6.6/ipmr-fix-tables-suspicious-rcu-usage.patch b/queue-6.6/ipmr-fix-tables-suspicious-rcu-usage.patch
new file mode 100644
index 00000000000..905708b2d40
--- /dev/null
+++ b/queue-6.6/ipmr-fix-tables-suspicious-rcu-usage.patch
@@ -0,0 +1,154 @@
+From 07b9ee3050731b1e69076b88a8110880301fd742 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 16:40:58 +0100
+Subject: ipmr: fix tables suspicious RCU usage
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit fc9c273d6daaa9866f349bbe8cae25c67764c456 ]
+
+Similar to the previous patch, plumb the RCU lock inside
+the ipmr_get_table(), provided a lockless variant and apply
+the latter in the few spots were the lock is already held.
+
+Fixes: 709b46e8d90b ("net: Add compat ioctl support for the ipv4 multicast ioctl SIOCGETSGCNT")
+Fixes: f0ad0860d01e ("ipv4: ipmr: support multiple tables")
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr.c | 42 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 66eade3fb629f..dc0ad979a894a 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -136,7 +136,7 @@ static struct mr_table *ipmr_mr_table_iter(struct net *net,
+ 	return ret;
+ }
+ 
+-static struct mr_table *ipmr_get_table(struct net *net, u32 id)
++static struct mr_table *__ipmr_get_table(struct net *net, u32 id)
+ {
+ 	struct mr_table *mrt;
+ 
+@@ -147,6 +147,16 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+ 	return NULL;
+ }
+ 
++static struct mr_table *ipmr_get_table(struct net *net, u32 id)
++{
++	struct mr_table *mrt;
++
++	rcu_read_lock();
++	mrt = __ipmr_get_table(net, id);
++	rcu_read_unlock();
++	return mrt;
++}
++
+ static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
+ 			   struct mr_table **mrt)
+ {
+@@ -188,7 +198,7 @@ static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp,
+ 
+ 	arg->table = fib_rule_get_table(rule, arg);
+ 
+-	mrt = ipmr_get_table(rule->fr_net, arg->table);
++	mrt = __ipmr_get_table(rule->fr_net, arg->table);
+ 	if (!mrt)
+ 		return -EAGAIN;
+ 	res->mrt = mrt;
+@@ -314,6 +324,8 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+ 	return net->ipv4.mrt;
+ }
+ 
++#define __ipmr_get_table ipmr_get_table
++
+ static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
+ 			   struct mr_table **mrt)
+ {
+@@ -402,7 +414,7 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id)
+ 	if (id != RT_TABLE_DEFAULT && id >= 1000000000)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	mrt = ipmr_get_table(net, id);
++	mrt = __ipmr_get_table(net, id);
+ 	if (mrt)
+ 		return mrt;
+ 
+@@ -1373,7 +1385,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
+ 		goto out_unlock;
+ 	}
+ 
+-	mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
++	mrt = __ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+ 	if (!mrt) {
+ 		ret = -ENOENT;
+ 		goto out_unlock;
+@@ -2261,11 +2273,13 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
+ 	struct mr_table *mrt;
+ 	int err;
+ 
+-	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
+-	if (!mrt)
++	rcu_read_lock();
++	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
++	if (!mrt) {
++		rcu_read_unlock();
+ 		return -ENOENT;
++	}
+ 
+-	rcu_read_lock();
+ 	cache = ipmr_cache_find(mrt, saddr, daddr);
+ 	if (!cache && skb->dev) {
+ 		int vif = ipmr_find_vif(mrt, skb->dev);
+@@ -2550,7 +2564,7 @@ static int ipmr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+ 	grp = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
+ 	tableid = tb[RTA_TABLE] ? nla_get_u32(tb[RTA_TABLE]) : 0;
+ 
+-	mrt = ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT);
++	mrt = __ipmr_get_table(net, tableid ? tableid : RT_TABLE_DEFAULT);
+ 	if (!mrt) {
+ 		err = -ENOENT;
+ 		goto errout_free;
+@@ -2602,7 +2616,7 @@ static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
+ 	if (filter.table_id) {
+ 		struct mr_table *mrt;
+ 
+-		mrt = ipmr_get_table(sock_net(skb->sk), filter.table_id);
++		mrt = __ipmr_get_table(sock_net(skb->sk), filter.table_id);
+ 		if (!mrt) {
+ 			if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IPMR)
+ 				return skb->len;
+@@ -2710,7 +2724,7 @@ static int rtm_to_ipmr_mfcc(struct net *net, struct nlmsghdr *nlh,
+ 			break;
+ 		}
+ 	}
+-	mrt = ipmr_get_table(net, tblid);
++	mrt = __ipmr_get_table(net, tblid);
+ 	if (!mrt) {
+ 		ret = -ENOENT;
+ 		goto out;
+@@ -2918,13 +2932,15 @@ static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos)
+ 	struct net *net = seq_file_net(seq);
+ 	struct mr_table *mrt;
+ 
+-	mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
+-	if (!mrt)
++	rcu_read_lock();
++	mrt = __ipmr_get_table(net, RT_TABLE_DEFAULT);
++	if (!mrt) {
++		rcu_read_unlock();
+ 		return ERR_PTR(-ENOENT);
++	}
+ 
+ 	iter->mrt = mrt;
+ 
+-	rcu_read_lock();
+ 	return mr_vif_seq_start(seq, pos);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/ipv6-release-nexthop-on-device-removal.patch b/queue-6.6/ipv6-release-nexthop-on-device-removal.patch
new file mode 100644
index 00000000000..b170aa93964
--- /dev/null
+++ b/queue-6.6/ipv6-release-nexthop-on-device-removal.patch
@@ -0,0 +1,99 @@
+From c9d0671fe53fd43108980aa4df4b5eae30481bfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 19:23:50 +0100
+Subject: ipv6: release nexthop on device removal
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit eb02688c5c45c3e7af7e71f036a7144f5639cbfe ]
+
+The CI is hitting some aperiodic hangup at device removal time in the
+pmtu.sh self-test:
+
+unregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6
+ref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at
+	dst_init+0x84/0x4a0
+	dst_alloc+0x97/0x150
+	ip6_dst_alloc+0x23/0x90
+	ip6_rt_pcpu_alloc+0x1e6/0x520
+	ip6_pol_route+0x56f/0x840
+	fib6_rule_lookup+0x334/0x630
+	ip6_route_output_flags+0x259/0x480
+	ip6_dst_lookup_tail.constprop.0+0x5c2/0x940
+	ip6_dst_lookup_flow+0x88/0x190
+	udp_tunnel6_dst_lookup+0x2a7/0x4c0
+	vxlan_xmit_one+0xbde/0x4a50 [vxlan]
+	vxlan_xmit+0x9ad/0xf20 [vxlan]
+	dev_hard_start_xmit+0x10e/0x360
+	__dev_queue_xmit+0xf95/0x18c0
+	arp_solicit+0x4a2/0xe00
+	neigh_probe+0xaa/0xf0
+
+While the first suspect is the dst_cache, explicitly tracking the dst
+owing the last device reference via probes proved such dst is held by
+the nexthop in the originating fib6_info.
+
+Similar to commit f5b51fe804ec ("ipv6: route: purge exception on
+removal"), we need to explicitly release the originating fib info when
+disconnecting a to-be-removed device from a live ipv6 dst: move the
+fib6_info cleanup into ip6_dst_ifdown().
+
+Tested running:
+
+./pmtu.sh cleanup_ipv6_exception
+
+in a tight loop for more than 400 iterations with no spat, running an
+unpatched kernel  I observed a splat every ~10 iterations.
+
+Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/604c45c188c609b732286b47ac2a451a40f6cf6d.1730828007.git.pabeni@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 341a42c2d6f14..e320dfa7fe7fc 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -376,6 +376,7 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
+ {
+ 	struct rt6_info *rt = (struct rt6_info *)dst;
+ 	struct inet6_dev *idev = rt->rt6i_idev;
++	struct fib6_info *from;
+ 
+ 	if (idev && idev->dev != blackhole_netdev) {
+ 		struct inet6_dev *blackhole_idev = in6_dev_get(blackhole_netdev);
+@@ -385,6 +386,8 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
+ 			in6_dev_put(idev);
+ 		}
+ 	}
++	from = unrcu_pointer(xchg(&rt->from, NULL));
++	fib6_info_release(from);
+ }
+ 
+ static bool __rt6_check_expired(const struct rt6_info *rt)
+@@ -1447,7 +1450,6 @@ static DEFINE_SPINLOCK(rt6_exception_lock);
+ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+ 				 struct rt6_exception *rt6_ex)
+ {
+-	struct fib6_info *from;
+ 	struct net *net;
+ 
+ 	if (!bucket || !rt6_ex)
+@@ -1459,8 +1461,6 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+ 	/* purge completely the exception to allow releasing the held resources:
+ 	 * some [sk] cache may keep the dst around for unlimited time
+ 	 */
+-	from = unrcu_pointer(xchg(&rt6_ex->rt6i->from, NULL));
+-	fib6_info_release(from);
+ 	dst_dev_put(&rt6_ex->rt6i->dst);
+ 
+ 	hlist_del_rcu(&rt6_ex->hlist);
+-- 
+2.43.0
+
diff --git a/queue-6.6/kcsan-seqlock-fix-incorrect-assumption-in-read_seqbe.patch b/queue-6.6/kcsan-seqlock-fix-incorrect-assumption-in-read_seqbe.patch
new file mode 100644
index 00000000000..d6a8bf941b1
--- /dev/null
+++ b/queue-6.6/kcsan-seqlock-fix-incorrect-assumption-in-read_seqbe.patch
@@ -0,0 +1,78 @@
+From 296b7360be36c429cffaa175cca5f3e28178de86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 16:43:09 +0100
+Subject: kcsan, seqlock: Fix incorrect assumption in read_seqbegin()
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 183ec5f26b2fc97a4a9871865bfe9b33c41fddb2 ]
+
+During testing of the preceding changes, I noticed that in some cases,
+current->kcsan_ctx.in_flat_atomic remained true until task exit. This is
+obviously wrong, because _all_ accesses for the given task will be
+treated as atomic, resulting in false negatives i.e. missed data races.
+
+Debugging led to fs/dcache.c, where we can see this usage of seqlock:
+
+	struct dentry *d_lookup(const struct dentry *parent, const struct qstr *name)
+	{
+		struct dentry *dentry;
+		unsigned seq;
+
+		do {
+			seq = read_seqbegin(&rename_lock);
+			dentry = __d_lookup(parent, name);
+			if (dentry)
+				break;
+		} while (read_seqretry(&rename_lock, seq));
+	[...]
+
+As can be seen, read_seqretry() is never called if dentry != NULL;
+consequently, current->kcsan_ctx.in_flat_atomic will never be reset to
+false by read_seqretry().
+
+Give up on the wrong assumption of "assume closing read_seqretry()", and
+rely on the already-present annotations in read_seqcount_begin/retry().
+
+Fixes: 88ecd153be95 ("seqlock, kcsan: Add annotations for KCSAN")
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241104161910.780003-6-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/seqlock.h | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index 484f9a179fc12..b4b4ce9a4151e 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -890,11 +890,7 @@ typedef struct {
+  */
+ static inline unsigned read_seqbegin(const seqlock_t *sl)
+ {
+-	unsigned ret = read_seqcount_begin(&sl->seqcount);
+-
+-	kcsan_atomic_next(0);  /* non-raw usage, assume closing read_seqretry() */
+-	kcsan_flat_atomic_begin();
+-	return ret;
++	return read_seqcount_begin(&sl->seqcount);
+ }
+ 
+ /**
+@@ -910,12 +906,6 @@ static inline unsigned read_seqbegin(const seqlock_t *sl)
+  */
+ static inline unsigned read_seqretry(const seqlock_t *sl, unsigned start)
+ {
+-	/*
+-	 * Assume not nested: read_seqretry() may be called multiple times when
+-	 * completing read critical section.
+-	 */
+-	kcsan_flat_atomic_end();
+-
+ 	return read_seqcount_retry(&sl->seqcount, start);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/kcsan-seqlock-support-seqcount_latch_t.patch b/queue-6.6/kcsan-seqlock-support-seqcount_latch_t.patch
new file mode 100644
index 00000000000..3dffe3ec4fd
--- /dev/null
+++ b/queue-6.6/kcsan-seqlock-support-seqcount_latch_t.patch
@@ -0,0 +1,210 @@
+From debd6e8989feffd3a357544b527e920a9690e61c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 16:43:07 +0100
+Subject: kcsan, seqlock: Support seqcount_latch_t
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 5c1806c41ce0a0110db5dd4c483cf2dc28b3ddf0 ]
+
+While fuzzing an arm64 kernel, Alexander Potapenko reported:
+
+| BUG: KCSAN: data-race in ktime_get_mono_fast_ns / timekeeping_update
+|
+| write to 0xffffffc082e74248 of 56 bytes by interrupt on cpu 0:
+|  update_fast_timekeeper kernel/time/timekeeping.c:430 [inline]
+|  timekeeping_update+0x1d8/0x2d8 kernel/time/timekeeping.c:768
+|  timekeeping_advance+0x9e8/0xb78 kernel/time/timekeeping.c:2344
+|  update_wall_time+0x18/0x38 kernel/time/timekeeping.c:2360
+|  [...]
+|
+| read to 0xffffffc082e74258 of 8 bytes by task 5260 on cpu 1:
+|  __ktime_get_fast_ns kernel/time/timekeeping.c:372 [inline]
+|  ktime_get_mono_fast_ns+0x88/0x174 kernel/time/timekeeping.c:489
+|  init_srcu_struct_fields+0x40c/0x530 kernel/rcu/srcutree.c:263
+|  init_srcu_struct+0x14/0x20 kernel/rcu/srcutree.c:311
+|  [...]
+|
+| value changed: 0x000002f875d33266 -> 0x000002f877416866
+|
+| Reported by Kernel Concurrency Sanitizer on:
+| CPU: 1 UID: 0 PID: 5260 Comm: syz.2.7483 Not tainted 6.12.0-rc3-dirty #78
+
+This is a false positive data race between a seqcount latch writer and a reader
+accessing stale data. Since its introduction, KCSAN has never understood the
+seqcount_latch interface (due to being unannotated).
+
+Unlike the regular seqlock interface, the seqcount_latch interface for latch
+writers never has had a well-defined critical section, making it difficult to
+teach tooling where the critical section starts and ends.
+
+Introduce an instrumentable (non-raw) seqcount_latch interface, with
+which we can clearly denote writer critical sections. This both helps
+readability and tooling like KCSAN to understand when the writer is done
+updating all latch copies.
+
+Fixes: 88ecd153be95 ("seqlock, kcsan: Add annotations for KCSAN")
+Reported-by: Alexander Potapenko <glider@google.com>
+Co-developed-by: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Signed-off-by: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241104161910.780003-4-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/locking/seqlock.rst |  2 +-
+ include/linux/seqlock.h           | 86 +++++++++++++++++++++++++------
+ 2 files changed, 72 insertions(+), 16 deletions(-)
+
+diff --git a/Documentation/locking/seqlock.rst b/Documentation/locking/seqlock.rst
+index bfda1a5fecadc..ec6411d02ac8f 100644
+--- a/Documentation/locking/seqlock.rst
++++ b/Documentation/locking/seqlock.rst
+@@ -153,7 +153,7 @@ Use seqcount_latch_t when the write side sections cannot be protected
+ from interruption by readers. This is typically the case when the read
+ side can be invoked from NMI handlers.
+ 
+-Check `raw_write_seqcount_latch()` for more information.
++Check `write_seqcount_latch()` for more information.
+ 
+ 
+ .. _seqlock_t:
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index e9bd2f65d7f4e..484f9a179fc12 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -682,6 +682,23 @@ static __always_inline unsigned raw_read_seqcount_latch(const seqcount_latch_t *
+ 	return READ_ONCE(s->seqcount.sequence);
+ }
+ 
++/**
++ * read_seqcount_latch() - pick even/odd latch data copy
++ * @s: Pointer to seqcount_latch_t
++ *
++ * See write_seqcount_latch() for details and a full reader/writer usage
++ * example.
++ *
++ * Return: sequence counter raw value. Use the lowest bit as an index for
++ * picking which data copy to read. The full counter must then be checked
++ * with read_seqcount_latch_retry().
++ */
++static __always_inline unsigned read_seqcount_latch(const seqcount_latch_t *s)
++{
++	kcsan_atomic_next(KCSAN_SEQLOCK_REGION_MAX);
++	return raw_read_seqcount_latch(s);
++}
++
+ /**
+  * raw_read_seqcount_latch_retry() - end a seqcount_latch_t read section
+  * @s:		Pointer to seqcount_latch_t
+@@ -696,9 +713,34 @@ raw_read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
+ 	return unlikely(READ_ONCE(s->seqcount.sequence) != start);
+ }
+ 
++/**
++ * read_seqcount_latch_retry() - end a seqcount_latch_t read section
++ * @s:		Pointer to seqcount_latch_t
++ * @start:	count, from read_seqcount_latch()
++ *
++ * Return: true if a read section retry is required, else false
++ */
++static __always_inline int
++read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
++{
++	kcsan_atomic_next(0);
++	return raw_read_seqcount_latch_retry(s, start);
++}
++
+ /**
+  * raw_write_seqcount_latch() - redirect latch readers to even/odd copy
+  * @s: Pointer to seqcount_latch_t
++ */
++static __always_inline void raw_write_seqcount_latch(seqcount_latch_t *s)
++{
++	smp_wmb();	/* prior stores before incrementing "sequence" */
++	s->seqcount.sequence++;
++	smp_wmb();      /* increment "sequence" before following stores */
++}
++
++/**
++ * write_seqcount_latch_begin() - redirect latch readers to odd copy
++ * @s: Pointer to seqcount_latch_t
+  *
+  * The latch technique is a multiversion concurrency control method that allows
+  * queries during non-atomic modifications. If you can guarantee queries never
+@@ -726,17 +768,11 @@ raw_read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
+  *
+  *	void latch_modify(struct latch_struct *latch, ...)
+  *	{
+- *		smp_wmb();	// Ensure that the last data[1] update is visible
+- *		latch->seq.sequence++;
+- *		smp_wmb();	// Ensure that the seqcount update is visible
+- *
++ *		write_seqcount_latch_begin(&latch->seq);
+  *		modify(latch->data[0], ...);
+- *
+- *		smp_wmb();	// Ensure that the data[0] update is visible
+- *		latch->seq.sequence++;
+- *		smp_wmb();	// Ensure that the seqcount update is visible
+- *
++ *		write_seqcount_latch(&latch->seq);
+  *		modify(latch->data[1], ...);
++ *		write_seqcount_latch_end(&latch->seq);
+  *	}
+  *
+  * The query will have a form like::
+@@ -747,13 +783,13 @@ raw_read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
+  *		unsigned seq, idx;
+  *
+  *		do {
+- *			seq = raw_read_seqcount_latch(&latch->seq);
++ *			seq = read_seqcount_latch(&latch->seq);
+  *
+  *			idx = seq & 0x01;
+  *			entry = data_query(latch->data[idx], ...);
+  *
+  *		// This includes needed smp_rmb()
+- *		} while (raw_read_seqcount_latch_retry(&latch->seq, seq));
++ *		} while (read_seqcount_latch_retry(&latch->seq, seq));
+  *
+  *		return entry;
+  *	}
+@@ -777,11 +813,31 @@ raw_read_seqcount_latch_retry(const seqcount_latch_t *s, unsigned start)
+  *	When data is a dynamic data structure; one should use regular RCU
+  *	patterns to manage the lifetimes of the objects within.
+  */
+-static inline void raw_write_seqcount_latch(seqcount_latch_t *s)
++static __always_inline void write_seqcount_latch_begin(seqcount_latch_t *s)
+ {
+-	smp_wmb();	/* prior stores before incrementing "sequence" */
+-	s->seqcount.sequence++;
+-	smp_wmb();      /* increment "sequence" before following stores */
++	kcsan_nestable_atomic_begin();
++	raw_write_seqcount_latch(s);
++}
++
++/**
++ * write_seqcount_latch() - redirect latch readers to even copy
++ * @s: Pointer to seqcount_latch_t
++ */
++static __always_inline void write_seqcount_latch(seqcount_latch_t *s)
++{
++	raw_write_seqcount_latch(s);
++}
++
++/**
++ * write_seqcount_latch_end() - end a seqcount_latch_t write section
++ * @s:		Pointer to seqcount_latch_t
++ *
++ * Marks the end of a seqcount_latch_t writer section, after all copies of the
++ * latch-protected data have been updated.
++ */
++static __always_inline void write_seqcount_latch_end(seqcount_latch_t *s)
++{
++	kcsan_nestable_atomic_end();
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-_.patch b/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-_.patch
new file mode 100644
index 00000000000..875ae843347
--- /dev/null
+++ b/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-_.patch
@@ -0,0 +1,59 @@
+From c6e4aaa32c35e1ea638d75a39508539251631122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2024 16:32:49 +0100
+Subject: kselftest/arm64: mte: fix printf type warnings about __u64
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 7e893dc81de3e342156389ea0b83ec7d07f25281 ]
+
+When printing the signal context's PC, we use a "%lx" format specifier,
+which matches the common userland (glibc's) definition of uint64_t as an
+"unsigned long". However the structure in question is defined in a
+kernel uapi header, which uses a self defined __u64 type, and the arm64
+kernel headers define this using "int-ll64.h", so it becomes an
+"unsigned long long". This mismatch leads to the usual compiler warning.
+
+The common fix would be to use "PRIx64", but because this is defined by
+the userland's toolchain libc headers, it wouldn't match as well. Since
+we know the exact type of __u64, just use "%llx" here instead, to silence
+this warning.
+
+This also fixes a more severe typo: "$lx" is not a valid format
+specifier.
+
+Fixes: 191e678bdc9b ("kselftest/arm64: Log unexpected asynchronous MTE faults")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240816153251.2833702-7-andre.przywara@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/mte/mte_common_util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/mte/mte_common_util.c b/tools/testing/selftests/arm64/mte/mte_common_util.c
+index 00ffd34c66d30..1120f5aa76550 100644
+--- a/tools/testing/selftests/arm64/mte/mte_common_util.c
++++ b/tools/testing/selftests/arm64/mte/mte_common_util.c
+@@ -38,7 +38,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)
+ 			if (cur_mte_cxt.trig_si_code == si->si_code)
+ 				cur_mte_cxt.fault_valid = true;
+ 			else
+-				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=$lx, fault addr=%lx\n",
++				ksft_print_msg("Got unexpected SEGV_MTEAERR at pc=%llx, fault addr=%lx\n",
+ 					       ((ucontext_t *)uc)->uc_mcontext.pc,
+ 					       addr);
+ 			return;
+@@ -64,7 +64,7 @@ void mte_default_handler(int signum, siginfo_t *si, void *uc)
+ 			exit(1);
+ 		}
+ 	} else if (signum == SIGBUS) {
+-		ksft_print_msg("INFO: SIGBUS signal at pc=%lx, fault addr=%lx, si_code=%lx\n",
++		ksft_print_msg("INFO: SIGBUS signal at pc=%llx, fault addr=%lx, si_code=%x\n",
+ 				((ucontext_t *)uc)->uc_mcontext.pc, addr, si->si_code);
+ 		if ((cur_mte_cxt.trig_range >= 0 &&
+ 		     addr >= MT_CLEAR_TAG(cur_mte_cxt.trig_addr) &&
+-- 
+2.43.0
+
diff --git a/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-l.patch b/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-l.patch
new file mode 100644
index 00000000000..bd185f9c471
--- /dev/null
+++ b/queue-6.6/kselftest-arm64-mte-fix-printf-type-warnings-about-l.patch
@@ -0,0 +1,51 @@
+From a417750d11ed3144d5e64816138a474576b3494d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2024 16:32:51 +0100
+Subject: kselftest/arm64: mte: fix printf type warnings about longs
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 96dddb7b9406259baace9a1831e8da155311be6f ]
+
+When checking MTE tags, we print some diagnostic messages when the tests
+fail. Some variables uses there are "longs", however we only use "%x"
+for the format specifier.
+
+Update the format specifiers to "%lx", to match the variable types they
+are supposed to print.
+
+Fixes: f3b2a26ca78d ("kselftest/arm64: Verify mte tag inclusion via prctl")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240816153251.2833702-9-andre.przywara@arm.com
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/mte/check_tags_inclusion.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/arm64/mte/check_tags_inclusion.c b/tools/testing/selftests/arm64/mte/check_tags_inclusion.c
+index 2b1425b92b699..a3d1e23fe02af 100644
+--- a/tools/testing/selftests/arm64/mte/check_tags_inclusion.c
++++ b/tools/testing/selftests/arm64/mte/check_tags_inclusion.c
+@@ -65,7 +65,7 @@ static int check_single_included_tags(int mem_type, int mode)
+ 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
+ 			/* Check tag value */
+ 			if (MT_FETCH_TAG((uintptr_t)ptr) == tag) {
+-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
++				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%x\n",
+ 					       MT_FETCH_TAG((uintptr_t)ptr),
+ 					       MT_INCLUDE_VALID_TAG(tag));
+ 				result = KSFT_FAIL;
+@@ -97,7 +97,7 @@ static int check_multiple_included_tags(int mem_type, int mode)
+ 			ptr = mte_insert_tags(ptr, BUFFER_SIZE);
+ 			/* Check tag value */
+ 			if (MT_FETCH_TAG((uintptr_t)ptr) < tag) {
+-				ksft_print_msg("FAIL: wrong tag = 0x%x with include mask=0x%x\n",
++				ksft_print_msg("FAIL: wrong tag = 0x%lx with include mask=0x%lx\n",
+ 					       MT_FETCH_TAG((uintptr_t)ptr),
+ 					       MT_INCLUDE_VALID_TAGS(excl_mask));
+ 				result = KSFT_FAIL;
+-- 
+2.43.0
+
diff --git a/queue-6.6/kvm-ppc-book3s-hv-avoid-returning-to-nested-hypervis.patch b/queue-6.6/kvm-ppc-book3s-hv-avoid-returning-to-nested-hypervis.patch
new file mode 100644
index 00000000000..7805b7c7306
--- /dev/null
+++ b/queue-6.6/kvm-ppc-book3s-hv-avoid-returning-to-nested-hypervis.patch
@@ -0,0 +1,78 @@
+From 29ca51baddaa1b84243a2f831950c1b8e5f42b26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 12:02:57 +0530
+Subject: KVM: PPC: Book3S HV: Avoid returning to nested hypervisor on pending
+ doorbells
+
+From: Gautam Menghani <gautam@linux.ibm.com>
+
+[ Upstream commit 26686db69917399fa30e3b3135360771e90f83ec ]
+
+Commit 6398326b9ba1 ("KVM: PPC: Book3S HV P9: Stop using vc->dpdes")
+dropped the use of vcore->dpdes for msgsndp / SMT emulation. Prior to that
+commit, the below code at L1 level (see [1] for terminology) was
+responsible for setting vc->dpdes for the respective L2 vCPU:
+
+if (!nested) {
+	kvmppc_core_prepare_to_enter(vcpu);
+	if (vcpu->arch.doorbell_request) {
+		vc->dpdes = 1;
+		smp_wmb();
+		vcpu->arch.doorbell_request = 0;
+	}
+
+L1 then sent vc->dpdes to L0 via kvmhv_save_hv_regs(), and while
+servicing H_ENTER_NESTED at L0, the below condition at L0 level made sure
+to abort and go back to L1 if vcpu->arch.doorbell_request = 1 so that L1
+sets vc->dpdes as per above if condition:
+
+} else if (vcpu->arch.pending_exceptions ||
+	   vcpu->arch.doorbell_request ||
+	   xive_interrupt_pending(vcpu)) {
+	vcpu->arch.ret = RESUME_HOST;
+	goto out;
+}
+
+This worked fine since vcpu->arch.doorbell_request was used more like a
+flag and vc->dpdes was used to pass around the doorbell state. But after
+Commit 6398326b9ba1 ("KVM: PPC: Book3S HV P9: Stop using vc->dpdes"),
+vcpu->arch.doorbell_request is the only variable used to pass around
+doorbell state.
+With the plumbing for handling doorbells for nested guests updated to use
+vcpu->arch.doorbell_request over vc->dpdes, the above "else if" stops
+doorbells from working correctly as L0 aborts execution of L2 and
+instead goes back to L1.
+
+Remove vcpu->arch.doorbell_request from the above "else if" condition as
+it is no longer needed for L0 to correctly handle the doorbell status
+while running L2.
+
+[1] Terminology
+1. L0 : PowerNV linux running with HV privileges
+2. L1 : Pseries KVM guest running on top of L0
+2. L2 : Nested KVM guest running on top of L1
+
+Fixes: 6398326b9ba1 ("KVM: PPC: Book3S HV P9: Stop using vc->dpdes")
+Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/20241109063301.105289-4-gautam@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 14511e457ade1..924689fa5efa1 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -4687,7 +4687,6 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit,
+ 				lpcr |= LPCR_MER;
+ 		}
+ 	} else if (vcpu->arch.pending_exceptions ||
+-		   vcpu->arch.doorbell_request ||
+ 		   xive_interrupt_pending(vcpu)) {
+ 		vcpu->arch.ret = RESUME_HOST;
+ 		goto out;
+-- 
+2.43.0
+
diff --git a/queue-6.6/kvm-ppc-book3s-hv-stop-using-vc-dpdes-for-nested-kvm.patch b/queue-6.6/kvm-ppc-book3s-hv-stop-using-vc-dpdes-for-nested-kvm.patch
new file mode 100644
index 00000000000..b1024640665
--- /dev/null
+++ b/queue-6.6/kvm-ppc-book3s-hv-stop-using-vc-dpdes-for-nested-kvm.patch
@@ -0,0 +1,113 @@
+From 2b67c93da9a2aab6158cd1b86175c464d677cf92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2024 12:02:56 +0530
+Subject: KVM: PPC: Book3S HV: Stop using vc->dpdes for nested KVM guests
+
+From: Gautam Menghani <gautam@linux.ibm.com>
+
+[ Upstream commit 0d3c6b28896f9889c8864dab469e0343a0ad1c0c ]
+
+commit 6398326b9ba1 ("KVM: PPC: Book3S HV P9: Stop using vc->dpdes")
+introduced an optimization to use only vcpu->doorbell_request for SMT
+emulation for Power9 and above guests, but the code for nested guests
+still relies on the old way of handling doorbells, due to which an L2
+guest (see [1]) cannot be booted with XICS with SMT>1. The command to
+repro this issue is:
+
+// To be run in L1
+
+qemu-system-ppc64 \
+	-drive file=rhel.qcow2,format=qcow2 \
+	-m 20G \
+	-smp 8,cores=1,threads=8 \
+	-cpu  host \
+	-nographic \
+	-machine pseries,ic-mode=xics -accel kvm
+
+Fix the plumbing to utilize vcpu->doorbell_request instead of vcore->dpdes
+for nested KVM guests on P9 and above.
+
+[1] Terminology
+1. L0 : PowerNV linux running with HV privileges
+2. L1 : Pseries KVM guest running on top of L0
+2. L2 : Nested KVM guest running on top of L1
+
+Fixes: 6398326b9ba1 ("KVM: PPC: Book3S HV P9: Stop using vc->dpdes")
+Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/20241109063301.105289-3-gautam@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c        |  9 +++++++++
+ arch/powerpc/kvm/book3s_hv_nested.c | 14 ++++++++++----
+ 2 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 1bb00c7215440..14511e457ade1 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -4090,6 +4090,15 @@ static int kvmhv_vcpu_entry_p9_nested(struct kvm_vcpu *vcpu, u64 time_limit, uns
+ 	}
+ 	hvregs.hdec_expiry = time_limit;
+ 
++	/*
++	 * hvregs has the doorbell status, so zero it here which
++	 * enables us to receive doorbells when H_ENTER_NESTED is
++	 * in progress for this vCPU
++	 */
++
++	if (vcpu->arch.doorbell_request)
++		vcpu->arch.doorbell_request = 0;
++
+ 	/*
+ 	 * When setting DEC, we must always deal with irq_work_raise
+ 	 * via NMI vs setting DEC. The problem occurs right as we
+diff --git a/arch/powerpc/kvm/book3s_hv_nested.c b/arch/powerpc/kvm/book3s_hv_nested.c
+index 377d0b4a05eeb..49144129da420 100644
+--- a/arch/powerpc/kvm/book3s_hv_nested.c
++++ b/arch/powerpc/kvm/book3s_hv_nested.c
+@@ -32,7 +32,7 @@ void kvmhv_save_hv_regs(struct kvm_vcpu *vcpu, struct hv_guest_state *hr)
+ 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
+ 
+ 	hr->pcr = vc->pcr | PCR_MASK;
+-	hr->dpdes = vc->dpdes;
++	hr->dpdes = vcpu->arch.doorbell_request;
+ 	hr->hfscr = vcpu->arch.hfscr;
+ 	hr->tb_offset = vc->tb_offset;
+ 	hr->dawr0 = vcpu->arch.dawr0;
+@@ -105,7 +105,7 @@ static void save_hv_return_state(struct kvm_vcpu *vcpu,
+ {
+ 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
+ 
+-	hr->dpdes = vc->dpdes;
++	hr->dpdes = vcpu->arch.doorbell_request;
+ 	hr->purr = vcpu->arch.purr;
+ 	hr->spurr = vcpu->arch.spurr;
+ 	hr->ic = vcpu->arch.ic;
+@@ -143,7 +143,7 @@ static void restore_hv_regs(struct kvm_vcpu *vcpu, const struct hv_guest_state *
+ 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
+ 
+ 	vc->pcr = hr->pcr | PCR_MASK;
+-	vc->dpdes = hr->dpdes;
++	vcpu->arch.doorbell_request = hr->dpdes;
+ 	vcpu->arch.hfscr = hr->hfscr;
+ 	vcpu->arch.dawr0 = hr->dawr0;
+ 	vcpu->arch.dawrx0 = hr->dawrx0;
+@@ -170,7 +170,13 @@ void kvmhv_restore_hv_return_state(struct kvm_vcpu *vcpu,
+ {
+ 	struct kvmppc_vcore *vc = vcpu->arch.vcore;
+ 
+-	vc->dpdes = hr->dpdes;
++	/*
++	 * This L2 vCPU might have received a doorbell while H_ENTER_NESTED was being handled.
++	 * Make sure we preserve the doorbell if it was either:
++	 *   a) Sent after H_ENTER_NESTED was called on this vCPU (arch.doorbell_request would be 1)
++	 *   b) Doorbell was not handled and L2 exited for some other reason (hr->dpdes would be 1)
++	 */
++	vcpu->arch.doorbell_request = vcpu->arch.doorbell_request | hr->dpdes;
+ 	vcpu->arch.hfscr = hr->hfscr;
+ 	vcpu->arch.purr = hr->purr;
+ 	vcpu->arch.spurr = hr->spurr;
+-- 
+2.43.0
+
diff --git a/queue-6.6/libbpf-fix-expected_attach_type-set-handling-in-prog.patch b/queue-6.6/libbpf-fix-expected_attach_type-set-handling-in-prog.patch
new file mode 100644
index 00000000000..ba74495cc58
--- /dev/null
+++ b/queue-6.6/libbpf-fix-expected_attach_type-set-handling-in-prog.patch
@@ -0,0 +1,68 @@
+From c125f485e5e03d6569e2ca4ff8607f18b3347dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 23:30:12 +0800
+Subject: libbpf: Fix expected_attach_type set handling in program load
+ callback
+
+From: Tao Chen <chen.dylane@gmail.com>
+
+[ Upstream commit a400d08b3014a4f4e939366bb6fd769b9caff4c9 ]
+
+Referenced commit broke the logic of resetting expected_attach_type to
+zero for allowed program types if kernel doesn't yet support such field.
+We do need to overwrite and preserve expected_attach_type for
+multi-uprobe though, but that can be done explicitly in
+libbpf_prepare_prog_load().
+
+Fixes: 5902da6d8a52 ("libbpf: Add uprobe multi link support to bpf_program__attach_usdt")
+Suggested-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Tao Chen <chen.dylane@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240925153012.212866-1-chen.dylane@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index ceed16a10285a..834b3e6bc72c3 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -6837,8 +6837,14 @@ static int libbpf_prepare_prog_load(struct bpf_program *prog,
+ 		opts->prog_flags |= BPF_F_XDP_HAS_FRAGS;
+ 
+ 	/* special check for usdt to use uprobe_multi link */
+-	if ((def & SEC_USDT) && kernel_supports(prog->obj, FEAT_UPROBE_MULTI_LINK))
++	if ((def & SEC_USDT) && kernel_supports(prog->obj, FEAT_UPROBE_MULTI_LINK)) {
++		/* for BPF_TRACE_UPROBE_MULTI, user might want to query expected_attach_type
++		 * in prog, and expected_attach_type we set in kernel is from opts, so we
++		 * update both.
++		 */
+ 		prog->expected_attach_type = BPF_TRACE_UPROBE_MULTI;
++		opts->expected_attach_type = BPF_TRACE_UPROBE_MULTI;
++	}
+ 
+ 	if ((def & SEC_ATTACH_BTF) && !prog->attach_btf_id) {
+ 		int btf_obj_fd = 0, btf_type_id = 0, err;
+@@ -6915,6 +6921,7 @@ static int bpf_object_load_prog(struct bpf_object *obj, struct bpf_program *prog
+ 	load_attr.attach_btf_id = prog->attach_btf_id;
+ 	load_attr.kern_version = kern_version;
+ 	load_attr.prog_ifindex = prog->prog_ifindex;
++	load_attr.expected_attach_type = prog->expected_attach_type;
+ 
+ 	/* specify func_info/line_info only if kernel supports them */
+ 	btf_fd = bpf_object__btf_fd(obj);
+@@ -6943,9 +6950,6 @@ static int bpf_object_load_prog(struct bpf_object *obj, struct bpf_program *prog
+ 		insns_cnt = prog->insns_cnt;
+ 	}
+ 
+-	/* allow prog_prepare_load_fn to change expected_attach_type */
+-	load_attr.expected_attach_type = prog->expected_attach_type;
+-
+ 	if (obj->gen_loader) {
+ 		bpf_gen__prog_load(obj->gen_loader, prog->type, prog->name,
+ 				   license, insns, insns_cnt, &load_attr,
+-- 
+2.43.0
+
diff --git a/queue-6.6/libbpf-fix-output-.symtab-byte-order-during-linking.patch b/queue-6.6/libbpf-fix-output-.symtab-byte-order-during-linking.patch
new file mode 100644
index 00000000000..7e4087614ca
--- /dev/null
+++ b/queue-6.6/libbpf-fix-output-.symtab-byte-order-during-linking.patch
@@ -0,0 +1,40 @@
+From 009dd8142dfbc618dc4a4c3a0a516c185dc7f382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 01:37:42 -0700
+Subject: libbpf: Fix output .symtab byte-order during linking
+
+From: Tony Ambardar <tony.ambardar@gmail.com>
+
+[ Upstream commit f896b4a5399e97af0b451fcf04754ed316935674 ]
+
+Object linking output data uses the default ELF_T_BYTE type for '.symtab'
+section data, which disables any libelf-based translation. Explicitly set
+the ELF_T_SYM type for output to restore libelf's byte-order conversion,
+noting that input '.symtab' data is already correctly translated.
+
+Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs")
+Signed-off-by: Tony Ambardar <tony.ambardar@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/87868bfeccf3f51aec61260073f8778e9077050a.1726475448.git.tony.ambardar@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/linker.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
+index b311bb91f672e..88cc7236f1220 100644
+--- a/tools/lib/bpf/linker.c
++++ b/tools/lib/bpf/linker.c
+@@ -396,6 +396,8 @@ static int init_output_elf(struct bpf_linker *linker, const char *file)
+ 		pr_warn_elf("failed to create SYMTAB data");
+ 		return -EINVAL;
+ 	}
++	/* Ensure libelf translates byte-order of symbol records */
++	sec->data->d_type = ELF_T_SYM;
+ 
+ 	str_off = strset__add_str(linker->strtab_strs, sec->sec_name);
+ 	if (str_off < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.6/libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch b/queue-6.6/libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
new file mode 100644
index 00000000000..602f95b0f21
--- /dev/null
+++ b/queue-6.6/libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
@@ -0,0 +1,49 @@
+From 890d12ba0cb406bfb62b048ed7e3393a7746748a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 18:15:54 -0700
+Subject: libbpf: fix sym_is_subprog() logic for weak global subprogs
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 4073213488be542f563eb4b2457ab4cbcfc2b738 ]
+
+sym_is_subprog() is incorrectly rejecting relocations against *weak*
+global subprogs. Fix that by realizing that STB_WEAK is also a global
+function.
+
+While it seems like verifier doesn't support taking an address of
+non-static subprog right now, it's still best to fix support for it on
+libbpf side, otherwise users will get a very confusing error during BPF
+skeleton generation or static linking due to misinterpreted relocation:
+
+  libbpf: prog 'handle_tp': bad map relo against 'foo' in section '.text'
+  Error: failed to open BPF object file: Relocation failed
+
+It's clearly not a map relocation, but is treated and reported as such
+without this fix.
+
+Fixes: 53eddb5e04ac ("libbpf: Support subprog address relocation")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20241009011554.880168-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 834b3e6bc72c3..d39b340222d61 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -3586,7 +3586,7 @@ static bool sym_is_subprog(const Elf64_Sym *sym, int text_shndx)
+ 		return true;
+ 
+ 	/* global function */
+-	return bind == STB_GLOBAL && type == STT_FUNC;
++	return (bind == STB_GLOBAL || bind == STB_WEAK) && type == STT_FUNC;
+ }
+ 
+ static int find_extern_btf_id(const struct btf *btf, const char *ext_name)
+-- 
+2.43.0
+
diff --git a/queue-6.6/libbpf-never-interpret-subprogs-in-.text-as-entry-pr.patch b/queue-6.6/libbpf-never-interpret-subprogs-in-.text-as-entry-pr.patch
new file mode 100644
index 00000000000..d1bc889c324
--- /dev/null
+++ b/queue-6.6/libbpf-never-interpret-subprogs-in-.text-as-entry-pr.patch
@@ -0,0 +1,47 @@
+From 53f3df0c06ee96752692a836f7903ab51a06bcf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 14:17:30 -0700
+Subject: libbpf: never interpret subprogs in .text as entry programs
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit db089c9158c1d535a36dfc010e5db37fccea2561 ]
+
+Libbpf pre-1.0 had a legacy logic of allowing singular non-annotated
+(i.e., not having explicit SEC() annotation) function to be treated as
+sole entry BPF program (unless there were other explicit entry
+programs).
+
+This behavior was dropped during libbpf 1.0 transition period (unless
+LIBBPF_STRICT_SEC_NAME flag was unset in libbpf_mode). When 1.0 was
+released and all the legacy behavior was removed, the bug slipped
+through leaving this legacy behavior around.
+
+Fix this for good, as it actually causes very confusing behavior if BPF
+object file only has subprograms, but no entry programs.
+
+Fixes: bd054102a8c7 ("libbpf: enforce strict libbpf 1.0 behaviors")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20241010211731.4121837-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index d39b340222d61..2fad178949efe 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -3990,7 +3990,7 @@ static int bpf_object__collect_externs(struct bpf_object *obj)
+ 
+ static bool prog_is_subprog(const struct bpf_object *obj, const struct bpf_program *prog)
+ {
+-	return prog->sec_idx == obj->efile.text_shndx && obj->nr_programs > 1;
++	return prog->sec_idx == obj->efile.text_shndx;
+ }
+ 
+ struct bpf_program *
+-- 
+2.43.0
+
diff --git a/queue-6.6/llc-improve-setsockopt-handling-of-malformed-user-in.patch b/queue-6.6/llc-improve-setsockopt-handling-of-malformed-user-in.patch
new file mode 100644
index 00000000000..0bbe5672595
--- /dev/null
+++ b/queue-6.6/llc-improve-setsockopt-handling-of-malformed-user-in.patch
@@ -0,0 +1,42 @@
+From 0ea7dbedfd4c998d2d6138ab89c6442e7f485cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 14:31:41 +0100
+Subject: llc: Improve setsockopt() handling of malformed user input
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 1465036b10be4b8b00eb31c879e86de633ad74c1 ]
+
+copy_from_sockptr() is used incorrectly: return value is the number of
+bytes that could not be copied. Since it's deprecated, switch to
+copy_safe_from_sockptr().
+
+Note: Keeping the `optlen != sizeof(int)` check as copy_safe_from_sockptr()
+by itself would also accept optlen > sizeof(int). Which would allow a more
+lenient handling of inputs.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Suggested-by: David Wei <dw@davidwei.uk>
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/af_llc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index fde1140d899ef..cc25fec44f850 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -1099,7 +1099,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
+ 	lock_sock(sk);
+ 	if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
+ 		goto out;
+-	rc = copy_from_sockptr(&opt, optval, sizeof(opt));
++	rc = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
+ 	if (rc)
+ 		goto out;
+ 	rc = -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.6/loongarch-bpf-sign-extend-return-values.patch b/queue-6.6/loongarch-bpf-sign-extend-return-values.patch
new file mode 100644
index 00000000000..7616fd27588
--- /dev/null
+++ b/queue-6.6/loongarch-bpf-sign-extend-return-values.patch
@@ -0,0 +1,91 @@
+From c308b5cb8dc768f98f2acaa7c65b4f4cc0969160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:47:48 +0800
+Subject: LoongArch: BPF: Sign-extend return values
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 73c359d1d356cf10236ccd358bd55edab33e9424 ]
+
+(1) Description of Problem:
+
+When testing BPF JIT with the latest compiler toolchains on LoongArch,
+there exist some strange failed test cases, dmesg shows something like
+this:
+
+  # dmesg -t | grep FAIL | head -1
+  ... ret -3 != -3 (0xfffffffd != 0xfffffffd)FAIL ...
+
+(2) Steps to Reproduce:
+
+  # echo 1 > /proc/sys/net/core/bpf_jit_enable
+  # modprobe test_bpf
+
+(3) Additional Info:
+
+There are no failed test cases compiled with the lower version of GCC
+such as 13.3.0, while the problems only appear with higher version of
+GCC such as 14.2.0.
+
+This is because the problems were hidden by the lower version of GCC due
+to redundant sign extension instructions generated by compiler, but with
+optimization of higher version of GCC, the sign extension instructions
+have been removed.
+
+(4) Root Cause Analysis:
+
+The LoongArch architecture does not expose sub-registers, and hold all
+32-bit values in a sign-extended format. While BPF, on the other hand,
+exposes sub-registers, and use zero-extension (similar to arm64/x86).
+
+This has led to some subtle bugs, where a BPF JITted program has not
+sign-extended the a0 register (return value in LoongArch land), passed
+the return value up the kernel, for example:
+
+  | int from_bpf(void);
+  |
+  | long foo(void)
+  | {
+  |    return from_bpf();
+  | }
+
+Here, a0 would be 0xffffffff instead of the expected 0xffffffffffffffff.
+
+Internally, the LoongArch JIT uses a5 as a dedicated register for BPF
+return values. That is to say, the LoongArch BPF uses a5 for BPF return
+values, which are zero-extended, whereas the LoongArch ABI uses a0 which
+is sign-extended.
+
+(5) Final Solution:
+
+Keep a5 zero-extended, but explicitly sign-extend a0 (which is used
+outside BPF land). Because libbpf currently defines the return value
+of an ebpf program as a 32-bit unsigned integer, just use addi.w to
+extend bit 31 into bits 63 through 32 of a5 to a0. This is similar to
+commit 2f1b0d3d7331 ("riscv, bpf: Sign-extend return values").
+
+Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/net/bpf_jit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
+index 9eb7753d117df..497f8b0a5f1ef 100644
+--- a/arch/loongarch/net/bpf_jit.c
++++ b/arch/loongarch/net/bpf_jit.c
+@@ -179,7 +179,7 @@ static void __build_epilogue(struct jit_ctx *ctx, bool is_tail_call)
+ 
+ 	if (!is_tail_call) {
+ 		/* Set return value */
+-		move_reg(ctx, LOONGARCH_GPR_A0, regmap[BPF_REG_0]);
++		emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0);
+ 		/* Return to the caller */
+ 		emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0);
+ 	} else {
+-- 
+2.43.0
+
diff --git a/queue-6.6/loongarch-fix-build-failure-with-gcc-15-std-gnu23.patch b/queue-6.6/loongarch-fix-build-failure-with-gcc-15-std-gnu23.patch
new file mode 100644
index 00000000000..f43cfdf33b3
--- /dev/null
+++ b/queue-6.6/loongarch-fix-build-failure-with-gcc-15-std-gnu23.patch
@@ -0,0 +1,68 @@
+From 334de7270cd7148dfd39c96d964dda1184ee5c27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:47:47 +0800
+Subject: LoongArch: Fix build failure with GCC 15 (-std=gnu23)
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 947d5d036c788156f09e83e7f16322ffe8124384 ]
+
+Whenever I try to build the kernel with upcoming GCC 15 which defaults
+to -std=gnu23 I get a build failure:
+
+  CC      arch/loongarch/vdso/vgetcpu.o
+In file included from ./include/uapi/linux/posix_types.h:5,
+                 from ./include/uapi/linux/types.h:14,
+                 from ./include/linux/types.h:6,
+                 from ./include/linux/kasan-checks.h:5,
+                 from ./include/asm-generic/rwonce.h:26,
+                 from ./arch/loongarch/include/generated/asm/rwonce.h:1,
+                 from ./include/linux/compiler.h:317,
+                 from ./include/asm-generic/bug.h:5,
+                 from ./arch/loongarch/include/asm/bug.h:60,
+                 from ./include/linux/bug.h:5,
+                 from ./include/linux/mmdebug.h:5,
+                 from ./include/linux/mm.h:6,
+                 from ./arch/loongarch/include/asm/vdso.h:10,
+                 from arch/loongarch/vdso/vgetcpu.c:6:
+./include/linux/stddef.h:11:9: error: expected identifier before 'false'
+   11 |         false   = 0,
+      |         ^~~~~
+./include/linux/types.h:35:33: error: two or more data types in declaration specifiers
+   35 | typedef _Bool                   bool;
+      |                                 ^~~~
+./include/linux/types.h:35:1: warning: useless type name in empty declaration
+   35 | typedef _Bool                   bool;
+      | ^~~~~~~
+
+The kernel builds explicitly with -std=gnu11 in top Makefile, but
+arch/loongarch/vdso does not use KBUILD_CFLAGS from the rest of the
+kernel, just add -std=gnu11 flag to arch/loongarch/vdso/Makefile.
+
+By the way, commit e8c07082a810 ("Kbuild: move to -std=gnu11") did a
+similar change for arch/arm64/kernel/vdso32/Makefile.
+
+Fixes: c6b99bed6b8f ("LoongArch: Add VDSO and VSYSCALL support")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/vdso/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/vdso/Makefile b/arch/loongarch/vdso/Makefile
+index f597cd08a96be..1a0f6ca0247b4 100644
+--- a/arch/loongarch/vdso/Makefile
++++ b/arch/loongarch/vdso/Makefile
+@@ -22,7 +22,7 @@ ccflags-vdso := \
+ cflags-vdso := $(ccflags-vdso) \
+ 	-isystem $(shell $(CC) -print-file-name=include) \
+ 	$(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \
+-	-O2 -g -fno-strict-aliasing -fno-common -fno-builtin \
++	-std=gnu11 -O2 -g -fno-strict-aliasing -fno-common -fno-builtin \
+ 	-fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \
+ 	$(call cc-option, -fno-asynchronous-unwind-tables) \
+ 	$(call cc-option, -fno-stack-protector)
+-- 
+2.43.0
+
diff --git a/queue-6.6/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch b/queue-6.6/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch
new file mode 100644
index 00000000000..2c1a2dbceba
--- /dev/null
+++ b/queue-6.6/m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch
@@ -0,0 +1,77 @@
+From f8e716f942b6cec86f0af617fbad349e3ab8fb71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 22:43:15 +0100
+Subject: m68k: coldfire/device.c: only build FEC when HW macros are defined
+
+From: Antonio Quartulli <antonio@mandelbit.com>
+
+[ Upstream commit 63a24cf8cc330e5a68ebd2e20ae200096974c475 ]
+
+When CONFIG_FEC is set (due to COMPILE_TEST) along with
+CONFIG_M54xx, coldfire/device.c has compile errors due to
+missing MCFEC_* and MCF_IRQ_FEC_* symbols.
+
+Make the whole FEC blocks dependent on having the HW macros
+defined, rather than on CONFIG_FEC itself.
+
+This fix is very similar to commit e6e1e7b19fa1 ("m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined")
+
+Fixes: b7ce7f0d0efc ("m68knommu: merge common ColdFire FEC platform setup code")
+To: Greg Ungerer <gerg@linux-m68k.org>
+To: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: linux-m68k@lists.linux-m68k.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/coldfire/device.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c
+index 7dab46728aeda..b6958ec2a220c 100644
+--- a/arch/m68k/coldfire/device.c
++++ b/arch/m68k/coldfire/device.c
+@@ -93,7 +93,7 @@ static struct platform_device mcf_uart = {
+ 	.dev.platform_data	= mcf_uart_platform_data,
+ };
+ 
+-#if IS_ENABLED(CONFIG_FEC)
++#ifdef MCFFEC_BASE0
+ 
+ #ifdef CONFIG_M5441x
+ #define FEC_NAME	"enet-fec"
+@@ -145,6 +145,7 @@ static struct platform_device mcf_fec0 = {
+ 		.platform_data		= FEC_PDATA,
+ 	}
+ };
++#endif /* MCFFEC_BASE0 */
+ 
+ #ifdef MCFFEC_BASE1
+ static struct resource mcf_fec1_resources[] = {
+@@ -182,7 +183,6 @@ static struct platform_device mcf_fec1 = {
+ 	}
+ };
+ #endif /* MCFFEC_BASE1 */
+-#endif /* CONFIG_FEC */
+ 
+ #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
+ /*
+@@ -624,12 +624,12 @@ static struct platform_device mcf_flexcan0 = {
+ 
+ static struct platform_device *mcf_devices[] __initdata = {
+ 	&mcf_uart,
+-#if IS_ENABLED(CONFIG_FEC)
++#ifdef MCFFEC_BASE0
+ 	&mcf_fec0,
++#endif
+ #ifdef MCFFEC_BASE1
+ 	&mcf_fec1,
+ #endif
+-#endif
+ #if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
+ 	&mcf_qspi,
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch b/queue-6.6/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch
new file mode 100644
index 00000000000..a4fd3ca9497
--- /dev/null
+++ b/queue-6.6/m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch
@@ -0,0 +1,37 @@
+From 25cdd754dd025ce18ad00faf89c8c015c776e904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 09:24:35 +0200
+Subject: m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
+
+From: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
+
+[ Upstream commit f212140962c93cd5da43283a18e31681540fc23d ]
+
+Fix a typo in the CONFIG_M5441x preprocessor condition, where the GPIO
+register offset was incorrectly set to 8 instead of 0. This prevented
+proper GPIO configuration for m5441x targets.
+
+Fixes: bea8bcb12da0 ("m68knommu: Add support for the Coldfire m5441x.")
+Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
+Signed-off-by: Greg Ungerer <gerg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/include/asm/mcfgpio.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/m68k/include/asm/mcfgpio.h b/arch/m68k/include/asm/mcfgpio.h
+index 7abd322c019fc..295624d01d3dc 100644
+--- a/arch/m68k/include/asm/mcfgpio.h
++++ b/arch/m68k/include/asm/mcfgpio.h
+@@ -136,7 +136,7 @@ static inline void gpio_free(unsigned gpio)
+  * read-modify-write as well as those controlled by the EPORT and GPIO modules.
+  */
+ #define MCFGPIO_SCR_START		40
+-#elif defined(CONFIGM5441x)
++#elif defined(CONFIG_M5441x)
+ /* The m5441x EPORT doesn't have its own GPIO port, uses PORT C */
+ #define MCFGPIO_SCR_START		0
+ #else
+-- 
+2.43.0
+
diff --git a/queue-6.6/m68k-mvme147-fix-scsi-controller-irq-numbers.patch b/queue-6.6/m68k-mvme147-fix-scsi-controller-irq-numbers.patch
new file mode 100644
index 00000000000..e523036d975
--- /dev/null
+++ b/queue-6.6/m68k-mvme147-fix-scsi-controller-irq-numbers.patch
@@ -0,0 +1,46 @@
+From 3668bc5635e1f250dc9e56a231d62a6d7ba0e700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 13:29:47 +1000
+Subject: m68k: mvme147: Fix SCSI controller IRQ numbers
+
+From: Daniel Palmer <daniel@0x0f.com>
+
+[ Upstream commit 47bc874427382018fa2e3e982480e156271eee70 ]
+
+Sometime long ago the m68k IRQ code was refactored and the interrupt
+numbers for SCSI controller on this board ended up wrong, and it hasn't
+worked since.
+
+The PCC adds 0x40 to the vector for its interrupts so they end up in
+the user interrupt range. Hence, the kernel number should be the kernel
+offset for user interrupt range + the PCC interrupt number.
+
+Fixes: 200a3d352cd5 ("[PATCH] m68k: convert VME irq code")
+Signed-off-by: Daniel Palmer <daniel@0x0f.com>
+Reviewed-by: Finn Thain <fthain@linux-m68k.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/0e7636a21a0274eea35bfd5d874459d5078e97cc.1727926187.git.fthain@linux-m68k.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/include/asm/mvme147hw.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/m68k/include/asm/mvme147hw.h b/arch/m68k/include/asm/mvme147hw.h
+index e28eb1c0e0bfb..dbf88059e47a4 100644
+--- a/arch/m68k/include/asm/mvme147hw.h
++++ b/arch/m68k/include/asm/mvme147hw.h
+@@ -93,8 +93,8 @@ struct pcc_regs {
+ #define M147_SCC_B_ADDR		0xfffe3000
+ #define M147_SCC_PCLK		5000000
+ 
+-#define MVME147_IRQ_SCSI_PORT	(IRQ_USER+0x45)
+-#define MVME147_IRQ_SCSI_DMA	(IRQ_USER+0x46)
++#define MVME147_IRQ_SCSI_PORT	(IRQ_USER + 5)
++#define MVME147_IRQ_SCSI_DMA	(IRQ_USER + 6)
+ 
+ /* SCC interrupts, for MVME147 */
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/m68k-mvme147-reinstate-early-console.patch b/queue-6.6/m68k-mvme147-reinstate-early-console.patch
new file mode 100644
index 00000000000..9f4276d8a45
--- /dev/null
+++ b/queue-6.6/m68k-mvme147-reinstate-early-console.patch
@@ -0,0 +1,113 @@
+From f09c8e85e0bbbf78fa8993676bf6162d3cb36c98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 10:51:24 +1100
+Subject: m68k: mvme147: Reinstate early console
+
+From: Daniel Palmer <daniel@0x0f.com>
+
+[ Upstream commit 077b33b9e2833ff25050d986178a2c4c4036cbac ]
+
+Commit a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused
+functions"), removed the console functionality for the mvme147 instead
+of wiring it up to an early console.  Put the console write function
+back and wire it up like mvme16x does so it's possible to see Linux boot
+on this fine hardware once more.
+
+Fixes: a38eaa07a0ce ("m68k/mvme147: config.c - Remove unused functions")
+Signed-off-by: Daniel Palmer <daniel@0x0f.com>
+Co-developed-by: Finn Thain <fthain@linux-m68k.org>
+Signed-off-by: Finn Thain <fthain@linux-m68k.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/a82e8f0068a8722996a0ccfe666abb5e0a5c120d.1730850684.git.fthain@linux-m68k.org
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/early_printk.c |  5 ++++-
+ arch/m68k/mvme147/config.c      | 30 ++++++++++++++++++++++++++++++
+ arch/m68k/mvme147/mvme147.h     |  6 ++++++
+ 3 files changed, 40 insertions(+), 1 deletion(-)
+ create mode 100644 arch/m68k/mvme147/mvme147.h
+
+diff --git a/arch/m68k/kernel/early_printk.c b/arch/m68k/kernel/early_printk.c
+index 3cc944df04f65..f11ef9f1f56fc 100644
+--- a/arch/m68k/kernel/early_printk.c
++++ b/arch/m68k/kernel/early_printk.c
+@@ -13,6 +13,7 @@
+ #include <asm/setup.h>
+ 
+ 
++#include "../mvme147/mvme147.h"
+ #include "../mvme16x/mvme16x.h"
+ 
+ asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
+@@ -22,7 +23,9 @@ static void __ref debug_cons_write(struct console *c,
+ {
+ #if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
+       defined(CONFIG_COLDFIRE))
+-	if (MACH_IS_MVME16x)
++	if (MACH_IS_MVME147)
++		mvme147_scc_write(c, s, n);
++	else if (MACH_IS_MVME16x)
+ 		mvme16x_cons_write(c, s, n);
+ 	else
+ 		debug_cons_nputs(s, n);
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index 4e6218115f43c..95d4a7e13b33d 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -35,6 +35,7 @@
+ #include <asm/mvme147hw.h>
+ #include <asm/config.h>
+ 
++#include "mvme147.h"
+ 
+ static void mvme147_get_model(char *model);
+ extern void mvme147_sched_init(void);
+@@ -188,3 +189,32 @@ int mvme147_hwclk(int op, struct rtc_time *t)
+ 	}
+ 	return 0;
+ }
++
++static void scc_delay(void)
++{
++	__asm__ __volatile__ ("nop; nop;");
++}
++
++static void scc_write(char ch)
++{
++	do {
++		scc_delay();
++	} while (!(in_8(M147_SCC_A_ADDR) & BIT(2)));
++	scc_delay();
++	out_8(M147_SCC_A_ADDR, 8);
++	scc_delay();
++	out_8(M147_SCC_A_ADDR, ch);
++}
++
++void mvme147_scc_write(struct console *co, const char *str, unsigned int count)
++{
++	unsigned long flags;
++
++	local_irq_save(flags);
++	while (count--)	{
++		if (*str == '\n')
++			scc_write('\r');
++		scc_write(*str++);
++	}
++	local_irq_restore(flags);
++}
+diff --git a/arch/m68k/mvme147/mvme147.h b/arch/m68k/mvme147/mvme147.h
+new file mode 100644
+index 0000000000000..140bc98b0102a
+--- /dev/null
++++ b/arch/m68k/mvme147/mvme147.h
+@@ -0,0 +1,6 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++struct console;
++
++/* config.c */
++void mvme147_scc_write(struct console *co, const char *str, unsigned int count);
+-- 
+2.43.0
+
diff --git a/queue-6.6/m68k-mvme16x-add-and-use-mvme16x.h.patch b/queue-6.6/m68k-mvme16x-add-and-use-mvme16x.h.patch
new file mode 100644
index 00000000000..6a52ebc5c78
--- /dev/null
+++ b/queue-6.6/m68k-mvme16x-add-and-use-mvme16x.h.patch
@@ -0,0 +1,76 @@
+From 3f24c30bb5da4369d6cbac153d55a5ea745a8fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:08:25 +0200
+Subject: m68k: mvme16x: Add and use "mvme16x.h"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit dcec33c1fc4ab63983d93ffb0d82b68fc5775b88 ]
+
+When building with W=1:
+
+    arch/m68k/mvme16x/config.c:208:6: warning: no previous prototype for ‘mvme16x_cons_write’ [-Wmissing-prototypes]
+      208 | void mvme16x_cons_write(struct console *co, const char *str, unsigned count)
+	  |      ^~~~~~~~~~~~~~~~~~
+
+Fix this by introducing a new header file "mvme16x.h" for holding the
+prototypes of functions implemented in arch/m68k/mvme16x/.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/6200cc3b26fad215c4524748af04692e38c5ecd2.1694613528.git.geert@linux-m68k.org
+Stable-dep-of: 077b33b9e283 ("m68k: mvme147: Reinstate early console")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/early_printk.c | 4 ++--
+ arch/m68k/mvme16x/config.c      | 2 ++
+ arch/m68k/mvme16x/mvme16x.h     | 6 ++++++
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+ create mode 100644 arch/m68k/mvme16x/mvme16x.h
+
+diff --git a/arch/m68k/kernel/early_printk.c b/arch/m68k/kernel/early_printk.c
+index 7d3fe08a48eb0..3cc944df04f65 100644
+--- a/arch/m68k/kernel/early_printk.c
++++ b/arch/m68k/kernel/early_printk.c
+@@ -12,8 +12,8 @@
+ #include <linux/string.h>
+ #include <asm/setup.h>
+ 
+-extern void mvme16x_cons_write(struct console *co,
+-			       const char *str, unsigned count);
++
++#include "../mvme16x/mvme16x.h"
+ 
+ asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
+ 
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index f00c7aa058dec..2b7eac224138e 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -38,6 +38,8 @@
+ #include <asm/mvme16xhw.h>
+ #include <asm/config.h>
+ 
++#include "mvme16x.h"
++
+ extern t_bdid mvme_bdid;
+ 
+ static MK48T08ptr_t volatile rtc = (MK48T08ptr_t)MVME_RTC_BASE;
+diff --git a/arch/m68k/mvme16x/mvme16x.h b/arch/m68k/mvme16x/mvme16x.h
+new file mode 100644
+index 0000000000000..159c34b700394
+--- /dev/null
++++ b/arch/m68k/mvme16x/mvme16x.h
+@@ -0,0 +1,6 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++struct console;
++
++/* config.c */
++void mvme16x_cons_write(struct console *co, const char *str, unsigned count);
+-- 
+2.43.0
+
diff --git a/queue-6.6/mailbox-arm_mhuv2-clean-up-loop-in-get_irq_chan_comb.patch b/queue-6.6/mailbox-arm_mhuv2-clean-up-loop-in-get_irq_chan_comb.patch
new file mode 100644
index 00000000000..54027135f4a
--- /dev/null
+++ b/queue-6.6/mailbox-arm_mhuv2-clean-up-loop-in-get_irq_chan_comb.patch
@@ -0,0 +1,58 @@
+From b7799ff0f6df17e55391dae9e4ceef7465b2f013 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 12:00:12 +0300
+Subject: mailbox: arm_mhuv2: clean up loop in get_irq_chan_comb()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 192a16a3430ca459c4e986f3d10758c4d6b1aa29 ]
+
+Both the inner and outer loops in this code use the "i" iterator.
+The inner loop should really use a different iterator.
+
+It doesn't affect things in practice because the data comes from the
+device tree.  The "protocol" and "windows" variables are going to be
+zero.  That means we're always going to hit the "return &chans[channel];"
+statement and we're not going to want to iterate through the outer
+loop again.
+
+Still it's worth fixing this for future use cases.
+
+Fixes: 5a6338cce9f4 ("mailbox: arm_mhuv2: Add driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/arm_mhuv2.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mailbox/arm_mhuv2.c b/drivers/mailbox/arm_mhuv2.c
+index 0ec21dcdbde72..cff7c343ee082 100644
+--- a/drivers/mailbox/arm_mhuv2.c
++++ b/drivers/mailbox/arm_mhuv2.c
+@@ -500,7 +500,7 @@ static const struct mhuv2_protocol_ops mhuv2_data_transfer_ops = {
+ static struct mbox_chan *get_irq_chan_comb(struct mhuv2 *mhu, u32 __iomem *reg)
+ {
+ 	struct mbox_chan *chans = mhu->mbox.chans;
+-	int channel = 0, i, offset = 0, windows, protocol, ch_wn;
++	int channel = 0, i, j, offset = 0, windows, protocol, ch_wn;
+ 	u32 stat;
+ 
+ 	for (i = 0; i < MHUV2_CMB_INT_ST_REG_CNT; i++) {
+@@ -510,9 +510,9 @@ static struct mbox_chan *get_irq_chan_comb(struct mhuv2 *mhu, u32 __iomem *reg)
+ 
+ 		ch_wn = i * MHUV2_STAT_BITS + __builtin_ctz(stat);
+ 
+-		for (i = 0; i < mhu->length; i += 2) {
+-			protocol = mhu->protocols[i];
+-			windows = mhu->protocols[i + 1];
++		for (j = 0; j < mhu->length; j += 2) {
++			protocol = mhu->protocols[j];
++			windows = mhu->protocols[j + 1];
+ 
+ 			if (ch_wn >= offset + windows) {
+ 				if (protocol == DOORBELL)
+-- 
+2.43.0
+
diff --git a/queue-6.6/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch b/queue-6.6/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch
new file mode 100644
index 00000000000..69161802b86
--- /dev/null
+++ b/queue-6.6/marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch
@@ -0,0 +1,76 @@
+From 73007b2fd31fe64f69c867210b5fa98b70b4070b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 23:06:58 +0300
+Subject: marvell: pxa168_eth: fix call balance of pep->clk handling routines
+
+From: Vitalii Mordan <mordan@ispras.ru>
+
+[ Upstream commit b032ae57d4fe2b2445e3bc190db6fcaa8c102f68 ]
+
+If the clock pep->clk was not enabled in pxa168_eth_probe,
+it should not be disabled in any path.
+
+Conversely, if it was enabled in pxa168_eth_probe, it must be disabled
+in all error paths to ensure proper cleanup.
+
+Use the devm_clk_get_enabled helper function to ensure proper call balance
+for pep->clk.
+
+Found by Linux Verification Center (linuxtesting.org) with Klever.
+
+Fixes: a49f37eed22b ("net: add Fast Ethernet driver for PXA168.")
+Signed-off-by: Vitalii Mordan <mordan@ispras.ru>
+Link: https://patch.msgid.link/20241121200658.2203871-1-mordan@ispras.ru
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/pxa168_eth.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
+index d5691b6a2bc54..f2ca4376b48c6 100644
+--- a/drivers/net/ethernet/marvell/pxa168_eth.c
++++ b/drivers/net/ethernet/marvell/pxa168_eth.c
+@@ -1394,18 +1394,15 @@ static int pxa168_eth_probe(struct platform_device *pdev)
+ 
+ 	printk(KERN_NOTICE "PXA168 10/100 Ethernet Driver\n");
+ 
+-	clk = devm_clk_get(&pdev->dev, NULL);
++	clk = devm_clk_get_enabled(&pdev->dev, NULL);
+ 	if (IS_ERR(clk)) {
+-		dev_err(&pdev->dev, "Fast Ethernet failed to get clock\n");
++		dev_err(&pdev->dev, "Fast Ethernet failed to get and enable clock\n");
+ 		return -ENODEV;
+ 	}
+-	clk_prepare_enable(clk);
+ 
+ 	dev = alloc_etherdev(sizeof(struct pxa168_eth_private));
+-	if (!dev) {
+-		err = -ENOMEM;
+-		goto err_clk;
+-	}
++	if (!dev)
++		return -ENOMEM;
+ 
+ 	platform_set_drvdata(pdev, dev);
+ 	pep = netdev_priv(dev);
+@@ -1523,8 +1520,6 @@ static int pxa168_eth_probe(struct platform_device *pdev)
+ 	mdiobus_free(pep->smi_bus);
+ err_netdev:
+ 	free_netdev(dev);
+-err_clk:
+-	clk_disable_unprepare(clk);
+ 	return err;
+ }
+ 
+@@ -1542,7 +1537,6 @@ static int pxa168_eth_remove(struct platform_device *pdev)
+ 	if (dev->phydev)
+ 		phy_disconnect(dev->phydev);
+ 
+-	clk_disable_unprepare(pep->clk);
+ 	mdiobus_unregister(pep->smi_bus);
+ 	mdiobus_free(pep->smi_bus);
+ 	unregister_netdev(dev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-atomisp-add-check-for-rgby_data-memory-allocat.patch b/queue-6.6/media-atomisp-add-check-for-rgby_data-memory-allocat.patch
new file mode 100644
index 00000000000..a9731e2985a
--- /dev/null
+++ b/queue-6.6/media-atomisp-add-check-for-rgby_data-memory-allocat.patch
@@ -0,0 +1,42 @@
+From 5d80fa0f9bad8cb340f4b84189d1dd6e40df27b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 22:50:51 +0800
+Subject: media: atomisp: Add check for rgby_data memory allocation failure
+
+From: Li Huafei <lihuafei1@huawei.com>
+
+[ Upstream commit ed61c59139509f76d3592683c90dc3fdc6e23cd6 ]
+
+In ia_css_3a_statistics_allocate(), there is no check on the allocation
+result of the rgby_data memory. If rgby_data is not successfully
+allocated, it may trigger the assert(host_stats->rgby_data) assertion in
+ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.
+
+Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
+Signed-off-by: Li Huafei <lihuafei1@huawei.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20241104145051.3088231-1-lihuafei1@huawei.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/sh_css_params.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c
+index 588f2adab058c..760fe9bef2119 100644
+--- a/drivers/staging/media/atomisp/pci/sh_css_params.c
++++ b/drivers/staging/media/atomisp/pci/sh_css_params.c
+@@ -4144,6 +4144,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid)
+ 		goto err;
+ 	/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */
+ 	me->rgby_data = kvmalloc(sizeof_hmem(HMEM0_ID), GFP_KERNEL);
++	if (!me->rgby_data)
++		goto err;
+ 
+ 	IA_CSS_LEAVE("return=%p", me);
+ 	return me;
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-i2c-ds90ub960-fix-missing-return-check-on-ub96.patch b/queue-6.6/media-i2c-ds90ub960-fix-missing-return-check-on-ub96.patch
new file mode 100644
index 00000000000..7f56b07e399
--- /dev/null
+++ b/queue-6.6/media-i2c-ds90ub960-fix-missing-return-check-on-ub96.patch
@@ -0,0 +1,41 @@
+From 19a2ae6a55b65094786b75adc36179ae5dc3b4f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 17:53:29 +0100
+Subject: media: i2c: ds90ub960: Fix missing return check on ub960_rxport_read
+ call
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 24ad2d1f773a11f69eecec3ec37ea3d76f2e9e7d ]
+
+The function ub960_rxport_read is being called and afterwards ret is
+being checked for any failures, however ret is not being assigned to
+the return of the function call. Fix this by assigning ret to the
+return of the call which appears to be missing.
+
+Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ds90ub960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ds90ub960.c b/drivers/media/i2c/ds90ub960.c
+index 8ba5750f5a231..7f30e8923633e 100644
+--- a/drivers/media/i2c/ds90ub960.c
++++ b/drivers/media/i2c/ds90ub960.c
+@@ -1286,7 +1286,7 @@ static int ub960_rxport_get_strobe_pos(struct ub960_data *priv,
+ 
+ 	clk_delay += v & UB960_IR_RX_ANA_STROBE_SET_CLK_DELAY_MASK;
+ 
+-	ub960_rxport_read(priv, nport, UB960_RR_SFILTER_STS_1, &v);
++	ret = ub960_rxport_read(priv, nport, UB960_RR_SFILTER_STS_1, &v);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-venus-fix-enc-dec-destruction-order.patch b/queue-6.6/media-venus-fix-enc-dec-destruction-order.patch
new file mode 100644
index 00000000000..49047cd5b5c
--- /dev/null
+++ b/queue-6.6/media-venus-fix-enc-dec-destruction-order.patch
@@ -0,0 +1,74 @@
+From 0d77f36c1ae77200d162e20f9cd107e3a257ebe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 01:56:41 +0900
+Subject: media: venus: fix enc/dec destruction order
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit 6c9934c5a00ae722a98d1a06ed44b673514407b5 ]
+
+We destroy mutex-es too early as they are still taken in
+v4l2_fh_exit()->v4l2_event_unsubscribe()->v4l2_ctrl_find().
+
+We should destroy mutex-es right before kfree().  Also
+do not vdec_ctrl_deinit() before v4l2_fh_exit().
+
+Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files")
+Suggested-by: Tomasz Figa <tfiga@google.com>
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 7 ++++---
+ drivers/media/platform/qcom/venus/venc.c | 6 +++---
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 884ee6e9d4bd1..00aadf5907da4 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -1750,13 +1750,14 @@ static int vdec_close(struct file *file)
+ 	cancel_work_sync(&inst->delayed_process_work);
+ 	v4l2_m2m_ctx_release(inst->m2m_ctx);
+ 	v4l2_m2m_release(inst->m2m_dev);
+-	vdec_ctrl_deinit(inst);
+ 	ida_destroy(&inst->dpb_ids);
+ 	hfi_session_destroy(inst);
+-	mutex_destroy(&inst->lock);
+-	mutex_destroy(&inst->ctx_q_lock);
+ 	v4l2_fh_del(&inst->fh);
+ 	v4l2_fh_exit(&inst->fh);
++	vdec_ctrl_deinit(inst);
++
++	mutex_destroy(&inst->lock);
++	mutex_destroy(&inst->ctx_q_lock);
+ 
+ 	vdec_pm_put(inst, false);
+ 
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 44b13696cf82a..41c93d43ac545 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -1517,14 +1517,14 @@ static int venc_close(struct file *file)
+ 
+ 	v4l2_m2m_ctx_release(inst->m2m_ctx);
+ 	v4l2_m2m_release(inst->m2m_dev);
+-	venc_ctrl_deinit(inst);
+ 	hfi_session_destroy(inst);
+-	mutex_destroy(&inst->lock);
+-	mutex_destroy(&inst->ctx_q_lock);
+ 	v4l2_fh_del(&inst->fh);
+ 	v4l2_fh_exit(&inst->fh);
++	venc_ctrl_deinit(inst);
+ 
+ 	inst->enc_state = VENUS_ENC_STATE_DEINIT;
++	mutex_destroy(&inst->lock);
++	mutex_destroy(&inst->ctx_q_lock);
+ 
+ 	venc_pm_put(inst, false);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/media-venus-sync-with-threaded-irq-during-inst-destr.patch b/queue-6.6/media-venus-sync-with-threaded-irq-during-inst-destr.patch
new file mode 100644
index 00000000000..a42365908bb
--- /dev/null
+++ b/queue-6.6/media-venus-sync-with-threaded-irq-during-inst-destr.patch
@@ -0,0 +1,146 @@
+From abd2a799d605b322d2fdf8db3b84dbb1fa05ad3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 01:56:42 +0900
+Subject: media: venus: sync with threaded IRQ during inst destruction
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit 45b1a1b348ec178a599323f1ce7d7932aea8c6d4 ]
+
+When destroying an inst we should make sure that we don't race
+against threaded IRQ (or pending IRQ), otherwise we can concurrently
+kfree() inst context and inst itself.
+
+BUG: KASAN: slab-use-after-free in vb2_queue_error+0x80/0x90
+Call trace:
+dump_backtrace+0x1c4/0x1f8
+show_stack+0x38/0x60
+dump_stack_lvl+0x168/0x1f0
+print_report+0x170/0x4c8
+kasan_report+0x94/0xd0
+__asan_report_load2_noabort+0x20/0x30
+vb2_queue_error+0x80/0x90
+venus_helper_vb2_queue_error+0x54/0x78
+venc_event_notify+0xec/0x158
+hfi_event_notify+0x878/0xd20
+hfi_process_msg_packet+0x27c/0x4e0
+venus_isr_thread+0x258/0x6e8
+hfi_isr_thread+0x70/0x90
+venus_isr_thread+0x34/0x50
+irq_thread_fn+0x88/0x130
+irq_thread+0x160/0x2c0
+kthread+0x294/0x328
+ret_from_fork+0x10/0x20
+
+Allocated by task 20291:
+kasan_set_track+0x4c/0x80
+kasan_save_alloc_info+0x28/0x38
+__kasan_kmalloc+0x84/0xa0
+kmalloc_trace+0x7c/0x98
+v4l2_m2m_ctx_init+0x74/0x280
+venc_open+0x444/0x6d0
+v4l2_open+0x19c/0x2a0
+chrdev_open+0x374/0x3f0
+do_dentry_open+0x710/0x10a8
+vfs_open+0x88/0xa8
+path_openat+0x1e6c/0x2700
+do_filp_open+0x1a4/0x2e0
+do_sys_openat2+0xe8/0x508
+do_sys_open+0x15c/0x1a0
+__arm64_sys_openat+0xa8/0xc8
+invoke_syscall+0xdc/0x270
+el0_svc_common+0x1ec/0x250
+do_el0_svc+0x54/0x70
+el0_svc+0x50/0xe8
+el0t_64_sync_handler+0x48/0x120
+el0t_64_sync+0x1a8/0x1b0
+
+Freed by task 20291:
+ kasan_set_track+0x4c/0x80
+ kasan_save_free_info+0x3c/0x60
+ ____kasan_slab_free+0x124/0x1a0
+ __kasan_slab_free+0x18/0x28
+ __kmem_cache_free+0x134/0x300
+ kfree+0xc8/0x1a8
+ v4l2_m2m_ctx_release+0x44/0x60
+ venc_close+0x78/0x130 [venus_enc]
+ v4l2_release+0x20c/0x2f8
+ __fput+0x328/0x7f0
+ ____fput+0x2c/0x48
+ task_work_run+0x1e0/0x280
+ get_signal+0xfb8/0x1190
+ do_notify_resume+0x34c/0x16a8
+ el0_svc+0x9c/0xe8
+ el0t_64_sync_handler+0x48/0x120
+ el0t_64_sync+0x1a8/0x1b0
+
+Rearrange inst destruction.  First remove the inst from the
+core->instances list, second synchronize IRQ/IRQ-thread to
+make sure that nothing else would see the inst while we take
+it down.
+
+Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files")
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/vdec.c | 12 +++++++++++-
+ drivers/media/platform/qcom/venus/venc.c | 12 +++++++++++-
+ 2 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c
+index 00aadf5907da4..d802ece8948fa 100644
+--- a/drivers/media/platform/qcom/venus/vdec.c
++++ b/drivers/media/platform/qcom/venus/vdec.c
+@@ -1748,10 +1748,20 @@ static int vdec_close(struct file *file)
+ 	vdec_pm_get(inst);
+ 
+ 	cancel_work_sync(&inst->delayed_process_work);
++	/*
++	 * First, remove the inst from the ->instances list, so that
++	 * to_instance() will return NULL.
++	 */
++	hfi_session_destroy(inst);
++	/*
++	 * Second, make sure we don't have IRQ/IRQ-thread currently running
++	 * or pending execution, which would race with the inst destruction.
++	 */
++	synchronize_irq(inst->core->irq);
++
+ 	v4l2_m2m_ctx_release(inst->m2m_ctx);
+ 	v4l2_m2m_release(inst->m2m_dev);
+ 	ida_destroy(&inst->dpb_ids);
+-	hfi_session_destroy(inst);
+ 	v4l2_fh_del(&inst->fh);
+ 	v4l2_fh_exit(&inst->fh);
+ 	vdec_ctrl_deinit(inst);
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 41c93d43ac545..35f3f3a519cf4 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -1515,9 +1515,19 @@ static int venc_close(struct file *file)
+ 
+ 	venc_pm_get(inst);
+ 
++	/*
++	 * First, remove the inst from the ->instances list, so that
++	 * to_instance() will return NULL.
++	 */
++	hfi_session_destroy(inst);
++	/*
++	 * Second, make sure we don't have IRQ/IRQ-thread currently running
++	 * or pending execution, which would race with the inst destruction.
++	 */
++	synchronize_irq(inst->core->irq);
++
+ 	v4l2_m2m_ctx_release(inst->m2m_ctx);
+ 	v4l2_m2m_release(inst->m2m_dev);
+-	hfi_session_destroy(inst);
+ 	v4l2_fh_del(&inst->fh);
+ 	v4l2_fh_exit(&inst->fh);
+ 	venc_ctrl_deinit(inst);
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-da9052-spi-change-read-mask-to-write-mask.patch b/queue-6.6/mfd-da9052-spi-change-read-mask-to-write-mask.patch
new file mode 100644
index 00000000000..3f018aefc35
--- /dev/null
+++ b/queue-6.6/mfd-da9052-spi-change-read-mask-to-write-mask.patch
@@ -0,0 +1,38 @@
+From 73cd3b701c112adb418f9d1865fbb13d8fc1f749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 12:19:53 +0200
+Subject: mfd: da9052-spi: Change read-mask to write-mask
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 2e3378f6c79a1b3f7855ded1ef306ea4406352ed ]
+
+Driver has mixed up the R/W bit.
+The LSB bit is set on write rather than read.
+Change it to avoid nasty things to happen.
+
+Fixes: e9e9d3973594 ("mfd: da9052: Avoid setting read_flag_mask for da9052-i2c driver")
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://lore.kernel.org/r/20240925-da9052-v2-1-f243e4505b07@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/da9052-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/da9052-spi.c b/drivers/mfd/da9052-spi.c
+index be5f2b34e18ae..80fc5c0cac2fb 100644
+--- a/drivers/mfd/da9052-spi.c
++++ b/drivers/mfd/da9052-spi.c
+@@ -37,7 +37,7 @@ static int da9052_spi_probe(struct spi_device *spi)
+ 	spi_set_drvdata(spi, da9052);
+ 
+ 	config = da9052_regmap_config;
+-	config.read_flag_mask = 1;
++	config.write_flag_mask = 1;
+ 	config.reg_bits = 7;
+ 	config.pad_bits = 1;
+ 	config.val_bits = 8;
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch
new file mode 100644
index 00000000000..5f553176f64
--- /dev/null
+++ b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch
@@ -0,0 +1,118 @@
+From 2d2237e190cf1ae8722cf9bd5c55be0da31963a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2024 22:27:06 +0300
+Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 0350d783ab888cb1cb48ced36cc28b372723f1a4 ]
+
+While design wise the idea of converting the driver to use
+the hierarchy of the IRQ chips is correct, the implementation
+has (inherited) flaws. This was unveiled when platform_get_irq()
+had started WARN() on IRQ 0 that is supposed to be a Linux
+IRQ number (also known as vIRQ).
+
+Rework the driver to respect IRQ domain when creating each MFD
+device separately, as the domain is not the same for all of them.
+
+Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips")
+Tested-by: Zhang Ning <zhangn1985@outlook.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20241005193029.1929139-4-andriy.shevchenko@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel_soc_pmic_bxtwc.c | 54 +++++++++++++++++-------------
+ 1 file changed, 30 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
+index 5fc9d3aa61428..3aa7857271dad 100644
+--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
+@@ -231,21 +231,11 @@ static const struct resource tmu_resources[] = {
+ };
+ 
+ static struct mfd_cell bxt_wc_dev[] = {
+-	{
+-		.name = "bxt_wcove_gpadc",
+-		.num_resources = ARRAY_SIZE(adc_resources),
+-		.resources = adc_resources,
+-	},
+ 	{
+ 		.name = "bxt_wcove_thermal",
+ 		.num_resources = ARRAY_SIZE(thermal_resources),
+ 		.resources = thermal_resources,
+ 	},
+-	{
+-		.name = "bxt_wcove_bcu",
+-		.num_resources = ARRAY_SIZE(bcu_resources),
+-		.resources = bcu_resources,
+-	},
+ 	{
+ 		.name = "bxt_wcove_gpio",
+ 		.num_resources = ARRAY_SIZE(gpio_resources),
+@@ -264,6 +254,22 @@ static const struct mfd_cell bxt_wc_tmu_dev[] = {
+ 	},
+ };
+ 
++static const struct mfd_cell bxt_wc_bcu_dev[] = {
++	{
++		.name = "bxt_wcove_bcu",
++		.num_resources = ARRAY_SIZE(bcu_resources),
++		.resources = bcu_resources,
++	},
++};
++
++static const struct mfd_cell bxt_wc_adc_dev[] = {
++	{
++		.name = "bxt_wcove_gpadc",
++		.num_resources = ARRAY_SIZE(adc_resources),
++		.resources = adc_resources,
++	},
++};
++
+ static struct mfd_cell bxt_wc_chgr_dev[] = {
+ 	{
+ 		.name = "bxt_wcove_usbc",
+@@ -509,23 +515,23 @@ static int bxtwc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n");
+ 
+-	/* Add chained IRQ handler for BCU IRQs */
+-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+-					 BXTWC_BCU_LVL1_IRQ,
+-					 IRQF_ONESHOT,
+-					 &bxtwc_regmap_irq_chip_bcu,
+-					 &pmic->irq_chip_data_bcu);
++	ret = bxtwc_add_chained_devices(pmic, bxt_wc_bcu_dev, ARRAY_SIZE(bxt_wc_bcu_dev),
++					pmic->irq_chip_data,
++					BXTWC_BCU_LVL1_IRQ,
++					IRQF_ONESHOT,
++					&bxtwc_regmap_irq_chip_bcu,
++					&pmic->irq_chip_data_bcu);
+ 	if (ret)
+-		return dev_err_probe(dev, ret, "Failed to add BUC IRQ chip\n");
++		return ret;
+ 
+-	/* Add chained IRQ handler for ADC IRQs */
+-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+-					 BXTWC_ADC_LVL1_IRQ,
+-					 IRQF_ONESHOT,
+-					 &bxtwc_regmap_irq_chip_adc,
+-					 &pmic->irq_chip_data_adc);
++	ret = bxtwc_add_chained_devices(pmic, bxt_wc_adc_dev, ARRAY_SIZE(bxt_wc_adc_dev),
++					pmic->irq_chip_data,
++					BXTWC_ADC_LVL1_IRQ,
++					IRQF_ONESHOT,
++					&bxtwc_regmap_irq_chip_adc,
++					&pmic->irq_chip_data_adc);
+ 	if (ret)
+-		return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n");
++		return ret;
+ 
+ 	ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev),
+ 					pmic->irq_chip_data,
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch
new file mode 100644
index 00000000000..9daaf32bdde
--- /dev/null
+++ b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch
@@ -0,0 +1,147 @@
+From dfe6168d2d96cea77bfcdf5a2636db8b94c5ecce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2024 22:27:05 +0300
+Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 9b79d59e6b2b515eb9a22bc469ef7b8f0904fc73 ]
+
+While design wise the idea of converting the driver to use
+the hierarchy of the IRQ chips is correct, the implementation
+has (inherited) flaws. This was unveiled when platform_get_irq()
+had started WARN() on IRQ 0 that is supposed to be a Linux
+IRQ number (also known as vIRQ).
+
+Rework the driver to respect IRQ domain when creating each MFD
+device separately, as the domain is not the same for all of them.
+
+Fixes: 957ae5098185 ("platform/x86: Add Whiskey Cove PMIC TMU support")
+Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips")
+Reported-by: Zhang Ning <zhangn1985@outlook.com>
+Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3322.jpnprd01.prod.outlook.com
+Tested-by: Zhang Ning <zhangn1985@outlook.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20241005193029.1929139-3-andriy.shevchenko@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel_soc_pmic_bxtwc.c     | 31 ++++++++++++++------------
+ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++-------------
+ 2 files changed, 23 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
+index 6ea98321bbf20..5fc9d3aa61428 100644
+--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
+@@ -246,12 +246,6 @@ static struct mfd_cell bxt_wc_dev[] = {
+ 		.num_resources = ARRAY_SIZE(bcu_resources),
+ 		.resources = bcu_resources,
+ 	},
+-	{
+-		.name = "bxt_wcove_tmu",
+-		.num_resources = ARRAY_SIZE(tmu_resources),
+-		.resources = tmu_resources,
+-	},
+-
+ 	{
+ 		.name = "bxt_wcove_gpio",
+ 		.num_resources = ARRAY_SIZE(gpio_resources),
+@@ -262,6 +256,14 @@ static struct mfd_cell bxt_wc_dev[] = {
+ 	},
+ };
+ 
++static const struct mfd_cell bxt_wc_tmu_dev[] = {
++	{
++		.name = "bxt_wcove_tmu",
++		.num_resources = ARRAY_SIZE(tmu_resources),
++		.resources = tmu_resources,
++	},
++};
++
+ static struct mfd_cell bxt_wc_chgr_dev[] = {
+ 	{
+ 		.name = "bxt_wcove_usbc",
+@@ -490,6 +492,15 @@ static int bxtwc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Failed to add IRQ chip\n");
+ 
++	ret = bxtwc_add_chained_devices(pmic, bxt_wc_tmu_dev, ARRAY_SIZE(bxt_wc_tmu_dev),
++					pmic->irq_chip_data,
++					BXTWC_TMU_LVL1_IRQ,
++					IRQF_ONESHOT,
++					&bxtwc_regmap_irq_chip_tmu,
++					&pmic->irq_chip_data_tmu);
++	if (ret)
++		return ret;
++
+ 	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+ 					 BXTWC_PWRBTN_LVL1_IRQ,
+ 					 IRQF_ONESHOT,
+@@ -498,14 +509,6 @@ static int bxtwc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Failed to add PWRBTN IRQ chip\n");
+ 
+-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+-					 BXTWC_TMU_LVL1_IRQ,
+-					 IRQF_ONESHOT,
+-					 &bxtwc_regmap_irq_chip_tmu,
+-					 &pmic->irq_chip_data_tmu);
+-	if (ret)
+-		return dev_err_probe(dev, ret, "Failed to add TMU IRQ chip\n");
+-
+ 	/* Add chained IRQ handler for BCU IRQs */
+ 	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+ 					 BXTWC_BCU_LVL1_IRQ,
+diff --git a/drivers/platform/x86/intel/bxtwc_tmu.c b/drivers/platform/x86/intel/bxtwc_tmu.c
+index d0e2a3c293b0b..9ac801b929b93 100644
+--- a/drivers/platform/x86/intel/bxtwc_tmu.c
++++ b/drivers/platform/x86/intel/bxtwc_tmu.c
+@@ -48,9 +48,8 @@ static irqreturn_t bxt_wcove_tmu_irq_handler(int irq, void *data)
+ static int bxt_wcove_tmu_probe(struct platform_device *pdev)
+ {
+ 	struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent);
+-	struct regmap_irq_chip_data *regmap_irq_chip;
+ 	struct wcove_tmu *wctmu;
+-	int ret, virq, irq;
++	int ret;
+ 
+ 	wctmu = devm_kzalloc(&pdev->dev, sizeof(*wctmu), GFP_KERNEL);
+ 	if (!wctmu)
+@@ -59,27 +58,18 @@ static int bxt_wcove_tmu_probe(struct platform_device *pdev)
+ 	wctmu->dev = &pdev->dev;
+ 	wctmu->regmap = pmic->regmap;
+ 
+-	irq = platform_get_irq(pdev, 0);
+-	if (irq < 0)
+-		return irq;
++	wctmu->irq = platform_get_irq(pdev, 0);
++	if (wctmu->irq < 0)
++		return wctmu->irq;
+ 
+-	regmap_irq_chip = pmic->irq_chip_data_tmu;
+-	virq = regmap_irq_get_virq(regmap_irq_chip, irq);
+-	if (virq < 0) {
+-		dev_err(&pdev->dev,
+-			"failed to get virtual interrupt=%d\n", irq);
+-		return virq;
+-	}
+-
+-	ret = devm_request_threaded_irq(&pdev->dev, virq,
++	ret = devm_request_threaded_irq(&pdev->dev, wctmu->irq,
+ 					NULL, bxt_wcove_tmu_irq_handler,
+ 					IRQF_ONESHOT, "bxt_wcove_tmu", wctmu);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "request irq failed: %d,virq: %d\n",
+-							ret, virq);
++			ret, wctmu->irq);
+ 		return ret;
+ 	}
+-	wctmu->irq = virq;
+ 
+ 	/* Unmask TMU second level Wake & System alarm */
+ 	regmap_update_bits(wctmu->regmap, BXTWC_MTMUIRQ_REG,
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch
new file mode 100644
index 00000000000..a16ede1f088
--- /dev/null
+++ b/queue-6.6/mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch
@@ -0,0 +1,142 @@
+From 27f303d5506bff8057f779f9cac219379cddf944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2024 22:27:04 +0300
+Subject: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 686fb77712a4bc94b76a0c5ae74c60118b7a0d79 ]
+
+While design wise the idea of converting the driver to use
+the hierarchy of the IRQ chips is correct, the implementation
+has (inherited) flaws. This was unveiled when platform_get_irq()
+had started WARN() on IRQ 0 that is supposed to be a Linux
+IRQ number (also known as vIRQ).
+
+Rework the driver to respect IRQ domain when creating each MFD
+device separately, as the domain is not the same for all of them.
+
+Fixes: 9c6235c86332 ("mfd: intel_soc_pmic_bxtwc: Add bxt_wcove_usbc device")
+Fixes: d2061f9cc32d ("usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY")
+Fixes: 57129044f504 ("mfd: intel_soc_pmic_bxtwc: Use chained IRQs for second level IRQ chips")
+Reported-by: Zhang Ning <zhangn1985@outlook.com>
+Closes: https://lore.kernel.org/r/TY2PR01MB3322FEDCDC048B7D3794F922CDBA2@TY2PR01MB3322.jpnprd01.prod.outlook.com
+Tested-by: Zhang Ning <zhangn1985@outlook.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20241005193029.1929139-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel_soc_pmic_bxtwc.c | 57 +++++++++++++++++++++---------
+ drivers/usb/typec/tcpm/wcove.c     |  4 ---
+ 2 files changed, 40 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
+index 8dac0d41f64f3..6ea98321bbf20 100644
+--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
+@@ -241,16 +241,6 @@ static struct mfd_cell bxt_wc_dev[] = {
+ 		.num_resources = ARRAY_SIZE(thermal_resources),
+ 		.resources = thermal_resources,
+ 	},
+-	{
+-		.name = "bxt_wcove_usbc",
+-		.num_resources = ARRAY_SIZE(usbc_resources),
+-		.resources = usbc_resources,
+-	},
+-	{
+-		.name = "bxt_wcove_ext_charger",
+-		.num_resources = ARRAY_SIZE(charger_resources),
+-		.resources = charger_resources,
+-	},
+ 	{
+ 		.name = "bxt_wcove_bcu",
+ 		.num_resources = ARRAY_SIZE(bcu_resources),
+@@ -272,6 +262,19 @@ static struct mfd_cell bxt_wc_dev[] = {
+ 	},
+ };
+ 
++static struct mfd_cell bxt_wc_chgr_dev[] = {
++	{
++		.name = "bxt_wcove_usbc",
++		.num_resources = ARRAY_SIZE(usbc_resources),
++		.resources = usbc_resources,
++	},
++	{
++		.name = "bxt_wcove_ext_charger",
++		.num_resources = ARRAY_SIZE(charger_resources),
++		.resources = charger_resources,
++	},
++};
++
+ static int regmap_ipc_byte_reg_read(void *context, unsigned int reg,
+ 				    unsigned int *val)
+ {
+@@ -426,6 +429,26 @@ static int bxtwc_add_chained_irq_chip(struct intel_soc_pmic *pmic,
+ 					0, chip, data);
+ }
+ 
++static int bxtwc_add_chained_devices(struct intel_soc_pmic *pmic,
++				     const struct mfd_cell *cells, int n_devs,
++				     struct regmap_irq_chip_data *pdata,
++				     int pirq, int irq_flags,
++				     const struct regmap_irq_chip *chip,
++				     struct regmap_irq_chip_data **data)
++{
++	struct device *dev = pmic->dev;
++	struct irq_domain *domain;
++	int ret;
++
++	ret = bxtwc_add_chained_irq_chip(pmic, pdata, pirq, irq_flags, chip, data);
++	if (ret)
++		return dev_err_probe(dev, ret, "Failed to add %s IRQ chip\n", chip->name);
++
++	domain = regmap_irq_get_domain(*data);
++
++	return devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, cells, n_devs, NULL, 0, domain);
++}
++
+ static int bxtwc_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -501,14 +524,14 @@ static int bxtwc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Failed to add ADC IRQ chip\n");
+ 
+-	/* Add chained IRQ handler for CHGR IRQs */
+-	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+-					 BXTWC_CHGR_LVL1_IRQ,
+-					 IRQF_ONESHOT,
+-					 &bxtwc_regmap_irq_chip_chgr,
+-					 &pmic->irq_chip_data_chgr);
++	ret = bxtwc_add_chained_devices(pmic, bxt_wc_chgr_dev, ARRAY_SIZE(bxt_wc_chgr_dev),
++					pmic->irq_chip_data,
++					BXTWC_CHGR_LVL1_IRQ,
++					IRQF_ONESHOT,
++					&bxtwc_regmap_irq_chip_chgr,
++					&pmic->irq_chip_data_chgr);
+ 	if (ret)
+-		return dev_err_probe(dev, ret, "Failed to add CHGR IRQ chip\n");
++		return ret;
+ 
+ 	/* Add chained IRQ handler for CRIT IRQs */
+ 	ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+diff --git a/drivers/usb/typec/tcpm/wcove.c b/drivers/usb/typec/tcpm/wcove.c
+index 87d4abde0ea27..e08244f555f03 100644
+--- a/drivers/usb/typec/tcpm/wcove.c
++++ b/drivers/usb/typec/tcpm/wcove.c
+@@ -621,10 +621,6 @@ static int wcove_typec_probe(struct platform_device *pdev)
+ 	if (irq < 0)
+ 		return irq;
+ 
+-	irq = regmap_irq_get_virq(pmic->irq_chip_data_chgr, irq);
+-	if (irq < 0)
+-		return irq;
+-
+ 	ret = guid_parse(WCOVE_DSM_UUID, &wcove->guid);
+ 	if (ret)
+ 		return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch b/queue-6.6/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch
new file mode 100644
index 00000000000..0e586c97d2e
--- /dev/null
+++ b/queue-6.6/mfd-rt5033-fix-missing-regmap_del_irq_chip.patch
@@ -0,0 +1,39 @@
+From 9388b6f51db30b278e37d53f9ce95523637793a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 23:41:06 +0800
+Subject: mfd: rt5033: Fix missing regmap_del_irq_chip()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit d256d612f47529ed0b332298e2d5ea981a4dd5b8 ]
+
+Fix missing call to regmap_del_irq_chip() in error handling path by
+using devm_regmap_add_irq_chip().
+
+Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.")
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1730302867-8391-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/rt5033.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c
+index 7e23ab3d5842c..84ebc96f58e48 100644
+--- a/drivers/mfd/rt5033.c
++++ b/drivers/mfd/rt5033.c
+@@ -81,8 +81,8 @@ static int rt5033_i2c_probe(struct i2c_client *i2c)
+ 	chip_rev = dev_id & RT5033_CHIP_REV_MASK;
+ 	dev_info(&i2c->dev, "Device found (rev. %d)\n", chip_rev);
+ 
+-	ret = regmap_add_irq_chip(rt5033->regmap, rt5033->irq,
+-			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
++	ret = devm_regmap_add_irq_chip(rt5033->dev, rt5033->regmap,
++			rt5033->irq, IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ 			0, &rt5033_irq_chip, &rt5033->irq_data);
+ 	if (ret) {
+ 		dev_err(&i2c->dev, "Failed to request IRQ %d: %d\n",
+-- 
+2.43.0
+
diff --git a/queue-6.6/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch b/queue-6.6/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch
new file mode 100644
index 00000000000..e8f8871f15e
--- /dev/null
+++ b/queue-6.6/mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch
@@ -0,0 +1,49 @@
+From 7264bcdf4ebdcdfab0fe95999517a756b24da55a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 11:15:30 +0800
+Subject: mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 2174f9a8c9db50f74df769edd5a4ab822c73b6d2 ]
+
+As the comment said, disable_irq() after request_irq() still has a
+time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN
+flag will disable IRQ auto-enable when request IRQ.
+
+Fixes: 72cd799544f2 ("[PATCH] I2C: add i2c driver for TPS6501x")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20240912031530.2211654-1-ruanjinjie@huawei.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tps65010.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mfd/tps65010.c b/drivers/mfd/tps65010.c
+index 2b9105295f301..710364435b6b9 100644
+--- a/drivers/mfd/tps65010.c
++++ b/drivers/mfd/tps65010.c
+@@ -544,17 +544,13 @@ static int tps65010_probe(struct i2c_client *client)
+ 	 */
+ 	if (client->irq > 0) {
+ 		status = request_irq(client->irq, tps65010_irq,
+-				     IRQF_TRIGGER_FALLING, DRIVER_NAME, tps);
++				     IRQF_TRIGGER_FALLING | IRQF_NO_AUTOEN,
++				     DRIVER_NAME, tps);
+ 		if (status < 0) {
+ 			dev_dbg(&client->dev, "can't get IRQ %d, err %d\n",
+ 					client->irq, status);
+ 			return status;
+ 		}
+-		/* annoying race here, ideally we'd have an option
+-		 * to claim the irq now and enable it later.
+-		 * FIXME genirq IRQF_NOAUTOEN now solves that ...
+-		 */
+-		disable_irq(client->irq);
+ 		set_bit(FLAG_IRQ_ENABLE, &tps->flags);
+ 	} else
+ 		dev_warn(&client->dev, "IRQ not configured!\n");
+-- 
+2.43.0
+
diff --git a/queue-6.6/microblaze-export-xmb_manager-functions.patch b/queue-6.6/microblaze-export-xmb_manager-functions.patch
new file mode 100644
index 00000000000..670900bf142
--- /dev/null
+++ b/queue-6.6/microblaze-export-xmb_manager-functions.patch
@@ -0,0 +1,58 @@
+From 63a119a9e4b1fb414e7fa12553ab0d26aa3d55d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 14:11:32 +0200
+Subject: microblaze: Export xmb_manager functions
+
+From: Michal Simek <michal.simek@amd.com>
+
+[ Upstream commit badf752b5e4b17d281f93f409d4718388ff912e6 ]
+
+When TMR_MANAGER is enabled as module there is a need to export functions
+which are present in architecture code.
+
+It has been found by running:
+make W=1 C=1 allmodconfig
+sed -i -e 's/WERROR=y/WERROR=n/g' .config
+make C=1 W=1
+
+which errors out like this:
+ERROR: modpost: "xmb_manager_register" [drivers/misc/xilinx_tmr_manager.ko] undefined!
+ERROR: modpost: "xmb_inject_err" [drivers/misc/xilinx_tmr_inject.ko] undefined!
+
+Fixes: a5e3aaa654c1 ("microblaze: Add xmb_manager_register function")
+Reported-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Link: https://lore.kernel.org/r/e322dbbbde0feef83f44304ea13249d365d1dc5f.1718799090.git.michal.simek@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/kernel/microblaze_ksyms.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/microblaze/kernel/microblaze_ksyms.c b/arch/microblaze/kernel/microblaze_ksyms.c
+index c892e173ec990..a8553f54152b7 100644
+--- a/arch/microblaze/kernel/microblaze_ksyms.c
++++ b/arch/microblaze/kernel/microblaze_ksyms.c
+@@ -16,6 +16,7 @@
+ #include <asm/page.h>
+ #include <linux/ftrace.h>
+ #include <linux/uaccess.h>
++#include <asm/xilinx_mb_manager.h>
+ 
+ #ifdef CONFIG_FUNCTION_TRACER
+ extern void _mcount(void);
+@@ -46,3 +47,12 @@ extern void __udivsi3(void);
+ EXPORT_SYMBOL(__udivsi3);
+ extern void __umodsi3(void);
+ EXPORT_SYMBOL(__umodsi3);
++
++#ifdef CONFIG_MB_MANAGER
++extern void xmb_manager_register(uintptr_t phys_baseaddr, u32 cr_val,
++				 void (*callback)(void *data),
++				 void *priv, void (*reset_callback)(void *data));
++EXPORT_SYMBOL(xmb_manager_register);
++extern asmlinkage void xmb_inject_err(void);
++EXPORT_SYMBOL(xmb_inject_err);
++#endif
+-- 
+2.43.0
+
diff --git a/queue-6.6/mips-asm-fix-warning-when-disabling-mips_fp_support.patch b/queue-6.6/mips-asm-fix-warning-when-disabling-mips_fp_support.patch
new file mode 100644
index 00000000000..d12ae28dafa
--- /dev/null
+++ b/queue-6.6/mips-asm-fix-warning-when-disabling-mips_fp_support.patch
@@ -0,0 +1,49 @@
+From bfb21584fd35a39072270326155e7b223b90a5c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 12:12:14 +0200
+Subject: mips: asm: fix warning when disabling MIPS_FP_SUPPORT
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit da09935975c8f8c90d6f57be2422dee5557206cd ]
+
+When MIPS_FP_SUPPORT is disabled, __sanitize_fcr31() is defined as
+nothing, which triggers a gcc warning:
+
+    In file included from kernel/sched/core.c:79:
+    kernel/sched/core.c: In function 'context_switch':
+    ./arch/mips/include/asm/switch_to.h:114:39: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
+      114 |                 __sanitize_fcr31(next);                                 \
+          |                                       ^
+    kernel/sched/core.c:5316:9: note: in expansion of macro 'switch_to'
+     5316 |         switch_to(prev, next, prev);
+          |         ^~~~~~~~~
+
+Fix this by providing an empty body for __sanitize_fcr31() like one is
+defined for __mips_mt_fpaff_switch_to().
+
+Fixes: 36a498035bd2 ("MIPS: Avoid FCSR sanitization when CONFIG_MIPS_FP_SUPPORT=n")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/switch_to.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/switch_to.h b/arch/mips/include/asm/switch_to.h
+index a4374b4cb88fd..d6ccd53440213 100644
+--- a/arch/mips/include/asm/switch_to.h
++++ b/arch/mips/include/asm/switch_to.h
+@@ -97,7 +97,7 @@ do {									\
+ 	}								\
+ } while (0)
+ #else
+-# define __sanitize_fcr31(next)
++# define __sanitize_fcr31(next) do { (void) (next); } while (0)
+ #endif
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.6/misc-apds990x-fix-missing-pm_runtime_disable.patch b/queue-6.6/misc-apds990x-fix-missing-pm_runtime_disable.patch
new file mode 100644
index 00000000000..8d017667d80
--- /dev/null
+++ b/queue-6.6/misc-apds990x-fix-missing-pm_runtime_disable.patch
@@ -0,0 +1,67 @@
+From d050f15c523cb6f117f0fb29a5ee2af55e4a2377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 11:55:56 +0800
+Subject: misc: apds990x: Fix missing pm_runtime_disable()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 3c5d8b819d27012264edd17e6ae7fffda382fe44 ]
+
+The pm_runtime_disable() is missing in probe error path,
+so add it to fix it.
+
+Fixes: 92b1f84d46b2 ("drivers/misc: driver for APDS990X ALS and proximity sensors")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20240923035556.3009105-1-ruanjinjie@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/apds990x.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/misc/apds990x.c b/drivers/misc/apds990x.c
+index 92b92be91d602..095344a312d2a 100644
+--- a/drivers/misc/apds990x.c
++++ b/drivers/misc/apds990x.c
+@@ -1147,7 +1147,7 @@ static int apds990x_probe(struct i2c_client *client)
+ 		err = chip->pdata->setup_resources();
+ 		if (err) {
+ 			err = -EINVAL;
+-			goto fail3;
++			goto fail4;
+ 		}
+ 	}
+ 
+@@ -1155,7 +1155,7 @@ static int apds990x_probe(struct i2c_client *client)
+ 				apds990x_attribute_group);
+ 	if (err < 0) {
+ 		dev_err(&chip->client->dev, "Sysfs registration failed\n");
+-		goto fail4;
++		goto fail5;
+ 	}
+ 
+ 	err = request_threaded_irq(client->irq, NULL,
+@@ -1166,15 +1166,17 @@ static int apds990x_probe(struct i2c_client *client)
+ 	if (err) {
+ 		dev_err(&client->dev, "could not get IRQ %d\n",
+ 			client->irq);
+-		goto fail5;
++		goto fail6;
+ 	}
+ 	return err;
+-fail5:
++fail6:
+ 	sysfs_remove_group(&chip->client->dev.kobj,
+ 			&apds990x_attribute_group[0]);
+-fail4:
++fail5:
+ 	if (chip->pdata && chip->pdata->release_resources)
+ 		chip->pdata->release_resources();
++fail4:
++	pm_runtime_disable(&client->dev);
+ fail3:
+ 	regulator_bulk_disable(ARRAY_SIZE(chip->regs), chip->regs);
+ fail2:
+-- 
+2.43.0
+
diff --git a/queue-6.6/mmc-mmc_spi-drop-buggy-snprintf.patch b/queue-6.6/mmc-mmc_spi-drop-buggy-snprintf.patch
new file mode 100644
index 00000000000..08b9b8d71ce
--- /dev/null
+++ b/queue-6.6/mmc-mmc_spi-drop-buggy-snprintf.patch
@@ -0,0 +1,66 @@
+From eb61bfb596087bc1854a1e32bf9338915d4e936c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 18:01:34 +0200
+Subject: mmc: mmc_spi: drop buggy snprintf()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 328bda09cc91b3d93bc64f4a4dadc44313dd8140 ]
+
+GCC 13 complains about the truncated output of snprintf():
+
+drivers/mmc/host/mmc_spi.c: In function ‘mmc_spi_response_get’:
+drivers/mmc/host/mmc_spi.c:227:64: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=]
+  227 |         snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
+      |                                                                ^
+drivers/mmc/host/mmc_spi.c:227:9: note: ‘snprintf’ output between 26 and 43 bytes into a destination of size 32
+  227 |         snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
+      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  228 |                 cmd->opcode, maptype(cmd));
+
+Drop it and fold the string it generates into the only place where it's
+emitted - the dev_dbg() call at the end of the function.
+
+Fixes: 15a0580ced08 ("mmc_spi host driver")
+Suggested-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20241008160134.69934-1-brgl@bgdev.pl
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mmc_spi.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
+index 2a99ffb61f8c0..30b93dc938f1a 100644
+--- a/drivers/mmc/host/mmc_spi.c
++++ b/drivers/mmc/host/mmc_spi.c
+@@ -223,10 +223,6 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,
+ 	u8 	leftover = 0;
+ 	unsigned short rotator;
+ 	int 	i;
+-	char	tag[32];
+-
+-	snprintf(tag, sizeof(tag), "  ... CMD%d response SPI_%s",
+-		cmd->opcode, maptype(cmd));
+ 
+ 	/* Except for data block reads, the whole response will already
+ 	 * be stored in the scratch buffer.  It's somewhere after the
+@@ -379,8 +375,9 @@ static int mmc_spi_response_get(struct mmc_spi_host *host,
+ 	}
+ 
+ 	if (value < 0)
+-		dev_dbg(&host->spi->dev, "%s: resp %04x %08x\n",
+-			tag, cmd->resp[0], cmd->resp[1]);
++		dev_dbg(&host->spi->dev,
++			"  ... CMD%d response SPI_%s: resp %04x %08x\n",
++			cmd->opcode, maptype(cmd), cmd->resp[0], cmd->resp[1]);
+ 
+ 	/* disable chipselect on errors and some success cases */
+ 	if (value >= 0 && cs_on)
+-- 
+2.43.0
+
diff --git a/queue-6.6/mtd-hyperbus-rpc-if-add-missing-module_device_table.patch b/queue-6.6/mtd-hyperbus-rpc-if-add-missing-module_device_table.patch
new file mode 100644
index 00000000000..5eaac6809ae
--- /dev/null
+++ b/queue-6.6/mtd-hyperbus-rpc-if-add-missing-module_device_table.patch
@@ -0,0 +1,48 @@
+From f8e6b0b18e68cc9e31ceb7650ada19614af3b55c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2024 09:08:40 +0100
+Subject: mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 7d189579a287d5c568db623c5fc2344cce98a887 ]
+
+The rpc-if-hyperflash driver can be compiled as a module, but lacks
+MODULE_DEVICE_TABLE() and will therefore not be loaded automatically.
+Fix this.
+
+Fixes: 5de15b610f78 ("mtd: hyperbus: add Renesas RPC-IF driver")
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240731080846.257139-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/hyperbus/rpc-if.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
+index b22aa57119f23..e7a28f3316c3f 100644
+--- a/drivers/mtd/hyperbus/rpc-if.c
++++ b/drivers/mtd/hyperbus/rpc-if.c
+@@ -163,9 +163,16 @@ static void rpcif_hb_remove(struct platform_device *pdev)
+ 	pm_runtime_disable(hyperbus->rpc.dev);
+ }
+ 
++static const struct platform_device_id rpc_if_hyperflash_id_table[] = {
++	{ .name = "rpc-if-hyperflash" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(platform, rpc_if_hyperflash_id_table);
++
+ static struct platform_driver rpcif_platform_driver = {
+ 	.probe	= rpcif_hb_probe,
+ 	.remove_new = rpcif_hb_remove,
++	.id_table = rpc_if_hyperflash_id_table,
+ 	.driver	= {
+ 		.name	= "rpc-if-hyperflash",
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-6.6/mtd-hyperbus-rpc-if-convert-to-platform-remove-callb.patch b/queue-6.6/mtd-hyperbus-rpc-if-convert-to-platform-remove-callb.patch
new file mode 100644
index 00000000000..9e34da20839
--- /dev/null
+++ b/queue-6.6/mtd-hyperbus-rpc-if-convert-to-platform-remove-callb.patch
@@ -0,0 +1,66 @@
+From d7be25ac04a9fdf4b1585432f42f5c1f692aa5c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Oct 2023 22:01:33 +0200
+Subject: mtd: hyperbus: rpc-if: Convert to platform remove callback returning
+ void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit baaa90c1c923ff2412fae0162eb66d036fd3be6b ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is ignored (apart
+from emitting a warning) and this typically results in resource leaks.
+
+To improve here there is a quest to make the remove callback return
+void. In the first step of this quest all drivers are converted to
+.remove_new(), which already returns void. Eventually after all drivers
+are converted, .remove_new() will be renamed to .remove().
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/linux-mtd/20231008200143.196369-11-u.kleine-koenig@pengutronix.de
+Stable-dep-of: 7d189579a287 ("mtd: hyperbus: rpc-if: Add missing MODULE_DEVICE_TABLE")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/hyperbus/rpc-if.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/hyperbus/rpc-if.c b/drivers/mtd/hyperbus/rpc-if.c
+index ef32fca5f785e..b22aa57119f23 100644
+--- a/drivers/mtd/hyperbus/rpc-if.c
++++ b/drivers/mtd/hyperbus/rpc-if.c
+@@ -154,20 +154,18 @@ static int rpcif_hb_probe(struct platform_device *pdev)
+ 	return error;
+ }
+ 
+-static int rpcif_hb_remove(struct platform_device *pdev)
++static void rpcif_hb_remove(struct platform_device *pdev)
+ {
+ 	struct rpcif_hyperbus *hyperbus = platform_get_drvdata(pdev);
+ 
+ 	hyperbus_unregister_device(&hyperbus->hbdev);
+ 
+ 	pm_runtime_disable(hyperbus->rpc.dev);
+-
+-	return 0;
+ }
+ 
+ static struct platform_driver rpcif_platform_driver = {
+ 	.probe	= rpcif_hb_probe,
+-	.remove	= rpcif_hb_remove,
++	.remove_new = rpcif_hb_remove,
+ 	.driver	= {
+ 		.name	= "rpc-if-hyperflash",
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-6.6/mtd-rawnand-atmel-fix-possible-memory-leak.patch b/queue-6.6/mtd-rawnand-atmel-fix-possible-memory-leak.patch
new file mode 100644
index 00000000000..37065370678
--- /dev/null
+++ b/queue-6.6/mtd-rawnand-atmel-fix-possible-memory-leak.patch
@@ -0,0 +1,70 @@
+From 6d6488e35fc8528c769e9f322ac66d2215914273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 22:31:49 +0200
+Subject: mtd: rawnand: atmel: Fix possible memory leak
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 6d734f1bfc336aaea91313a5632f2f197608fadd ]
+
+The pmecc "user" structure is allocated in atmel_pmecc_create_user() and
+was supposed to be freed with atmel_pmecc_destroy_user(), but this other
+helper is never called. One solution would be to find the proper
+location to call the destructor, but the trend today is to switch to
+device managed allocations, which in this case fits pretty well.
+
+Replace kzalloc() by devm_kzalloc() and drop the destructor entirely.
+
+Reported-by: "Dr. David Alan Gilbert" <linux@treblig.org>
+Closes: https://lore.kernel.org/all/ZvmIvRJCf6VhHvpo@gallifrey/
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20241001203149.387655-1-miquel.raynal@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/atmel/pmecc.c | 8 +-------
+ drivers/mtd/nand/raw/atmel/pmecc.h | 2 --
+ 2 files changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/atmel/pmecc.c b/drivers/mtd/nand/raw/atmel/pmecc.c
+index 4d7dc8a9c3738..a22aab4ed4e8a 100644
+--- a/drivers/mtd/nand/raw/atmel/pmecc.c
++++ b/drivers/mtd/nand/raw/atmel/pmecc.c
+@@ -362,7 +362,7 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
+ 	size = ALIGN(size, sizeof(s32));
+ 	size += (req->ecc.strength + 1) * sizeof(s32) * 3;
+ 
+-	user = kzalloc(size, GFP_KERNEL);
++	user = devm_kzalloc(pmecc->dev, size, GFP_KERNEL);
+ 	if (!user)
+ 		return ERR_PTR(-ENOMEM);
+ 
+@@ -408,12 +408,6 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
+ }
+ EXPORT_SYMBOL_GPL(atmel_pmecc_create_user);
+ 
+-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user)
+-{
+-	kfree(user);
+-}
+-EXPORT_SYMBOL_GPL(atmel_pmecc_destroy_user);
+-
+ static int get_strength(struct atmel_pmecc_user *user)
+ {
+ 	const int *strengths = user->pmecc->caps->strengths;
+diff --git a/drivers/mtd/nand/raw/atmel/pmecc.h b/drivers/mtd/nand/raw/atmel/pmecc.h
+index 7851c05126cf1..cc0c5af1f4f1a 100644
+--- a/drivers/mtd/nand/raw/atmel/pmecc.h
++++ b/drivers/mtd/nand/raw/atmel/pmecc.h
+@@ -55,8 +55,6 @@ struct atmel_pmecc *devm_atmel_pmecc_get(struct device *dev);
+ struct atmel_pmecc_user *
+ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
+ 			struct atmel_pmecc_user_req *req);
+-void atmel_pmecc_destroy_user(struct atmel_pmecc_user *user);
+-
+ void atmel_pmecc_reset(struct atmel_pmecc *pmecc);
+ int atmel_pmecc_enable(struct atmel_pmecc_user *user, int op);
+ void atmel_pmecc_disable(struct atmel_pmecc_user *user);
+-- 
+2.43.0
+
diff --git a/queue-6.6/mtd-spi-nor-spansion-use-nor-addr_nbytes-in-octal-dt.patch b/queue-6.6/mtd-spi-nor-spansion-use-nor-addr_nbytes-in-octal-dt.patch
new file mode 100644
index 00000000000..ff25fc7a4e2
--- /dev/null
+++ b/queue-6.6/mtd-spi-nor-spansion-use-nor-addr_nbytes-in-octal-dt.patch
@@ -0,0 +1,38 @@
+From 94140cc664925cc637faccdba15c00bd728acb7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 09:08:37 +0900
+Subject: mtd: spi-nor: spansion: Use nor->addr_nbytes in octal DTR mode in
+ RD_ANY_REG_OP
+
+From: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
+
+[ Upstream commit b61c35e3404557779ec427c077f7a9f057bb053d ]
+
+In octal DTR mode, RD_ANY_REG_OP needs to use 4-byte address regardless
+of flash's internal address mode. Use nor->addr_nbytes which is set to 4
+during setup.
+
+Fixes: eff9604390d6 ("mtd: spi-nor: spansion: add octal DTR support in RD_ANY_REG_OP")
+Signed-off-by: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
+Link: https://lore.kernel.org/r/20241016000837.17951-1-Takahiro.Kuwano@infineon.com
+Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/spansion.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mtd/spi-nor/spansion.c b/drivers/mtd/spi-nor/spansion.c
+index 709822fced867..828b442735ee8 100644
+--- a/drivers/mtd/spi-nor/spansion.c
++++ b/drivers/mtd/spi-nor/spansion.c
+@@ -105,6 +105,7 @@ static int cypress_nor_sr_ready_and_clear_reg(struct spi_nor *nor, u64 addr)
+ 	int ret;
+ 
+ 	if (nor->reg_proto == SNOR_PROTO_8_8_8_DTR) {
++		op.addr.nbytes = nor->addr_nbytes;
+ 		op.dummy.nbytes = params->rdsr_dummy;
+ 		op.data.nbytes = 2;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-hsr-fix-hsr_init_sk-vs-network-transport-headers.patch b/queue-6.6/net-hsr-fix-hsr_init_sk-vs-network-transport-headers.patch
new file mode 100644
index 00000000000..33c3913abb4
--- /dev/null
+++ b/queue-6.6/net-hsr-fix-hsr_init_sk-vs-network-transport-headers.patch
@@ -0,0 +1,61 @@
+From 8280fe2c00527e3473bb1c24a24a961319fc9bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 17:13:43 +0000
+Subject: net: hsr: fix hsr_init_sk() vs network/transport headers.
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9cfb5e7f0ded2bfaabc270ceb5f91d13f0e805b9 ]
+
+Following sequence in hsr_init_sk() is invalid :
+
+    skb_reset_mac_header(skb);
+    skb_reset_mac_len(skb);
+    skb_reset_network_header(skb);
+    skb_reset_transport_header(skb);
+
+It is invalid because skb_reset_mac_len() needs the correct
+network header, which should be after the mac header.
+
+This patch moves the skb_reset_network_header()
+and skb_reset_transport_header() before
+the call to dev_hard_header().
+
+As a result skb->mac_len is no longer set to a value
+close to 65535.
+
+Fixes: 48b491a5cc74 ("net: hsr: fix mac_len checks")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: George McCollister <george.mccollister@gmail.com>
+Link: https://patch.msgid.link/20241122171343.897551-1-edumazet@google.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
+index c5f7bd01379ce..906c38b9d66ff 100644
+--- a/net/hsr/hsr_device.c
++++ b/net/hsr/hsr_device.c
+@@ -253,6 +253,8 @@ static struct sk_buff *hsr_init_skb(struct hsr_port *master)
+ 	skb->dev = master->dev;
+ 	skb->priority = TC_PRIO_CONTROL;
+ 
++	skb_reset_network_header(skb);
++	skb_reset_transport_header(skb);
+ 	if (dev_hard_header(skb, skb->dev, ETH_P_PRP,
+ 			    hsr->sup_multicast_addr,
+ 			    skb->dev->dev_addr, skb->len) <= 0)
+@@ -260,8 +262,6 @@ static struct sk_buff *hsr_init_skb(struct hsr_port *master)
+ 
+ 	skb_reset_mac_header(skb);
+ 	skb_reset_mac_len(skb);
+-	skb_reset_network_header(skb);
+-	skb_reset_transport_header(skb);
+ 
+ 	return skb;
+ out:
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-ipv6-delete-temporary-address-if-mngtmpaddr-is-r.patch b/queue-6.6/net-ipv6-delete-temporary-address-if-mngtmpaddr-is-r.patch
new file mode 100644
index 00000000000..e57253ba673
--- /dev/null
+++ b/queue-6.6/net-ipv6-delete-temporary-address-if-mngtmpaddr-is-r.patch
@@ -0,0 +1,105 @@
+From 9b4c9e8c6c40c8f5ffb01aaeb68b333ec7cc70c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2024 09:51:07 +0000
+Subject: net/ipv6: delete temporary address if mngtmpaddr is removed or
+ unmanaged
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 00b5b7aab9e422d00d5a9d03d7e0760a76b5d57f ]
+
+RFC8981 section 3.4 says that existing temporary addresses must have their
+lifetimes adjusted so that no temporary addresses should ever remain "valid"
+or "preferred" longer than the incoming SLAAC Prefix Information. This would
+strongly imply in Linux's case that if the "mngtmpaddr" address is deleted or
+un-flagged as such, its corresponding temporary addresses must be cleared out
+right away.
+
+But now the temporary address is renewed even after ‘mngtmpaddr’ is removed
+or becomes unmanaged as manage_tempaddrs() set temporary addresses
+prefered/valid time to 0, and later in addrconf_verify_rtnl() all checkings
+failed to remove the addresses. Fix this by deleting the temporary address
+directly for these situations.
+
+Fixes: 778964f2fdf0 ("ipv6/addrconf: fix timing bug in tempaddr regen")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 41 +++++++++++++++++++++++++++++------------
+ 1 file changed, 29 insertions(+), 12 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index a9358c796a815..8360939acf85a 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2535,6 +2535,24 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
+ 	return idev;
+ }
+ 
++static void delete_tempaddrs(struct inet6_dev *idev,
++			     struct inet6_ifaddr *ifp)
++{
++	struct inet6_ifaddr *ift, *tmp;
++
++	write_lock_bh(&idev->lock);
++	list_for_each_entry_safe(ift, tmp, &idev->tempaddr_list, tmp_list) {
++		if (ift->ifpub != ifp)
++			continue;
++
++		in6_ifa_hold(ift);
++		write_unlock_bh(&idev->lock);
++		ipv6_del_addr(ift);
++		write_lock_bh(&idev->lock);
++	}
++	write_unlock_bh(&idev->lock);
++}
++
+ static void manage_tempaddrs(struct inet6_dev *idev,
+ 			     struct inet6_ifaddr *ifp,
+ 			     __u32 valid_lft, __u32 prefered_lft,
+@@ -3076,11 +3094,12 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
+ 			in6_ifa_hold(ifp);
+ 			read_unlock_bh(&idev->lock);
+ 
+-			if (!(ifp->flags & IFA_F_TEMPORARY) &&
+-			    (ifa_flags & IFA_F_MANAGETEMPADDR))
+-				manage_tempaddrs(idev, ifp, 0, 0, false,
+-						 jiffies);
+ 			ipv6_del_addr(ifp);
++
++			if (!(ifp->flags & IFA_F_TEMPORARY) &&
++			    (ifp->flags & IFA_F_MANAGETEMPADDR))
++				delete_tempaddrs(idev, ifp);
++
+ 			addrconf_verify_rtnl(net);
+ 			if (ipv6_addr_is_multicast(pfx)) {
+ 				ipv6_mc_config(net->ipv6.mc_autojoin_sk,
+@@ -4891,14 +4910,12 @@ static int inet6_addr_modify(struct net *net, struct inet6_ifaddr *ifp,
+ 	}
+ 
+ 	if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
+-		if (was_managetempaddr &&
+-		    !(ifp->flags & IFA_F_MANAGETEMPADDR)) {
+-			cfg->valid_lft = 0;
+-			cfg->preferred_lft = 0;
+-		}
+-		manage_tempaddrs(ifp->idev, ifp, cfg->valid_lft,
+-				 cfg->preferred_lft, !was_managetempaddr,
+-				 jiffies);
++		if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
++			delete_tempaddrs(ifp->idev, ifp);
++		else
++			manage_tempaddrs(ifp->idev, ifp, cfg->valid_lft,
++					 cfg->preferred_lft, !was_managetempaddr,
++					 jiffies);
+ 	}
+ 
+ 	addrconf_verify_rtnl(net);
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-mdio-ipq4019-add-missing-error-check.patch b/queue-6.6/net-mdio-ipq4019-add-missing-error-check.patch
new file mode 100644
index 00000000000..9d4cac743c5
--- /dev/null
+++ b/queue-6.6/net-mdio-ipq4019-add-missing-error-check.patch
@@ -0,0 +1,43 @@
+From 1eb72c8aeaa6e9f794ded41034d6ce5f456d4ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 11:31:52 -0800
+Subject: net: mdio-ipq4019: add missing error check
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit 9cc8d0ecdd2aad42e377e971e3bb114339df609e ]
+
+If an optional resource is found but fails to remap, return on failure.
+Avoids any potential problems when using the iomapped resource as the
+assumption is that it's available.
+
+Fixes: 23a890d493e3 ("net: mdio: Add the reset function for IPQ MDIO driver")
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20241121193152.8966-1-rosenp@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/mdio/mdio-ipq4019.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/mdio/mdio-ipq4019.c b/drivers/net/mdio/mdio-ipq4019.c
+index 78b93de636f57..0e13fca8731ab 100644
+--- a/drivers/net/mdio/mdio-ipq4019.c
++++ b/drivers/net/mdio/mdio-ipq4019.c
+@@ -255,8 +255,11 @@ static int ipq4019_mdio_probe(struct platform_device *pdev)
+ 	/* The platform resource is provided on the chipset IPQ5018 */
+ 	/* This resource is optional */
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+-	if (res)
++	if (res) {
+ 		priv->eth_ldo_rdy = devm_ioremap_resource(&pdev->dev, res);
++		if (IS_ERR(priv->eth_ldo_rdy))
++			return PTR_ERR(priv->eth_ldo_rdy);
++	}
+ 
+ 	bus->name = "ipq4019_mdio";
+ 	bus->read = ipq4019_mdio_read_c22;
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-microchip-vcap-add-typegroup-table-terminators-i.patch b/queue-6.6/net-microchip-vcap-add-typegroup-table-terminators-i.patch
new file mode 100644
index 00000000000..5c850820ef4
--- /dev/null
+++ b/queue-6.6/net-microchip-vcap-add-typegroup-table-terminators-i.patch
@@ -0,0 +1,134 @@
+From bd3eb79d1cb1ccb3afcc738605931f7aa0cdb915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 13:32:02 -0800
+Subject: net: microchip: vcap: Add typegroup table terminators in kunit tests
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f164b296638d1eb1fb1c537e93ab5c8b49966546 ]
+
+VCAP API unit tests fail randomly with errors such as
+
+   # vcap_api_iterator_init_test: EXPECTATION FAILED at drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c:387
+   Expected 134 + 7 == iter.offset, but
+       134 + 7 == 141 (0x8d)
+       iter.offset == 17214 (0x433e)
+   # vcap_api_iterator_init_test: EXPECTATION FAILED at drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c:388
+   Expected 5 == iter.reg_idx, but
+       iter.reg_idx == 702 (0x2be)
+   # vcap_api_iterator_init_test: EXPECTATION FAILED at drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c:389
+   Expected 11 == iter.reg_bitpos, but
+       iter.reg_bitpos == 15 (0xf)
+   # vcap_api_iterator_init_test: pass:0 fail:1 skip:0 total:1
+
+Comments in the code state that "A typegroup table ends with an all-zero
+terminator". Add the missing terminators.
+
+Some of the typegroups did have a terminator of ".offset = 0, .width = 0,
+.value = 0,". Replace those terminators with "{ }" (no trailing ',') for
+consistency and to excplicitly state "this is a terminator".
+
+Fixes: 67d637516fa9 ("net: microchip: sparx5: Adding KUNIT test for the VCAP API")
+Cc: Steen Hegelund <steen.hegelund@microchip.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20241119213202.2884639-1-linux@roeck-us.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/microchip/vcap/vcap_api_kunit.c    | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
+index 66ef14d95bf6f..88744ae652935 100644
+--- a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
++++ b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
+@@ -366,12 +366,13 @@ static void vcap_api_iterator_init_test(struct kunit *test)
+ 	struct vcap_typegroup typegroups[] = {
+ 		{ .offset = 0, .width = 2, .value = 2, },
+ 		{ .offset = 156, .width = 1, .value = 0, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 	struct vcap_typegroup typegroups2[] = {
+ 		{ .offset = 0, .width = 3, .value = 4, },
+ 		{ .offset = 49, .width = 2, .value = 0, },
+ 		{ .offset = 98, .width = 2, .value = 0, },
++		{ }
+ 	};
+ 
+ 	vcap_iter_init(&iter, 52, typegroups, 86);
+@@ -399,6 +400,7 @@ static void vcap_api_iterator_next_test(struct kunit *test)
+ 		{ .offset = 147, .width = 3, .value = 0, },
+ 		{ .offset = 196, .width = 2, .value = 0, },
+ 		{ .offset = 245, .width = 1, .value = 0, },
++		{ }
+ 	};
+ 	int idx;
+ 
+@@ -433,7 +435,7 @@ static void vcap_api_encode_typegroups_test(struct kunit *test)
+ 		{ .offset = 147, .width = 3, .value = 5, },
+ 		{ .offset = 196, .width = 2, .value = 2, },
+ 		{ .offset = 245, .width = 5, .value = 27, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 
+ 	vcap_encode_typegroups(stream, 49, typegroups, false);
+@@ -463,6 +465,7 @@ static void vcap_api_encode_bit_test(struct kunit *test)
+ 		{ .offset = 147, .width = 3, .value = 5, },
+ 		{ .offset = 196, .width = 2, .value = 2, },
+ 		{ .offset = 245, .width = 1, .value = 0, },
++		{ }
+ 	};
+ 
+ 	vcap_iter_init(&iter, 49, typegroups, 44);
+@@ -489,7 +492,7 @@ static void vcap_api_encode_field_test(struct kunit *test)
+ 		{ .offset = 147, .width = 3, .value = 5, },
+ 		{ .offset = 196, .width = 2, .value = 2, },
+ 		{ .offset = 245, .width = 5, .value = 27, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 	struct vcap_field rf = {
+ 		.type = VCAP_FIELD_U32,
+@@ -538,7 +541,7 @@ static void vcap_api_encode_short_field_test(struct kunit *test)
+ 		{ .offset = 0, .width = 3, .value = 7, },
+ 		{ .offset = 21, .width = 2, .value = 3, },
+ 		{ .offset = 42, .width = 1, .value = 1, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 	struct vcap_field rf = {
+ 		.type = VCAP_FIELD_U32,
+@@ -608,7 +611,7 @@ static void vcap_api_encode_keyfield_test(struct kunit *test)
+ 	struct vcap_typegroup tgt[] = {
+ 		{ .offset = 0, .width = 2, .value = 2, },
+ 		{ .offset = 156, .width = 1, .value = 1, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 
+ 	vcap_test_api_init(&admin);
+@@ -671,7 +674,7 @@ static void vcap_api_encode_max_keyfield_test(struct kunit *test)
+ 	struct vcap_typegroup tgt[] = {
+ 		{ .offset = 0, .width = 2, .value = 2, },
+ 		{ .offset = 156, .width = 1, .value = 1, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 	u32 keyres[] = {
+ 		0x928e8a84,
+@@ -732,7 +735,7 @@ static void vcap_api_encode_actionfield_test(struct kunit *test)
+ 		{ .offset = 0, .width = 2, .value = 2, },
+ 		{ .offset = 21, .width = 1, .value = 1, },
+ 		{ .offset = 42, .width = 1, .value = 0, },
+-		{ .offset = 0, .width = 0, .value = 0, },
++		{ }
+ 	};
+ 
+ 	vcap_encode_actionfield(&rule, &caf, &rf, tgt);
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-rfkill-gpio-add-check-for-clk_enable.patch b/queue-6.6/net-rfkill-gpio-add-check-for-clk_enable.patch
new file mode 100644
index 00000000000..7d387d9236b
--- /dev/null
+++ b/queue-6.6/net-rfkill-gpio-add-check-for-clk_enable.patch
@@ -0,0 +1,44 @@
+From 20bece2bf7de3363831ee450d9f832d9efc0fef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 14:53:41 -0500
+Subject: net: rfkill: gpio: Add check for clk_enable()
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ]
+
+Add check for the return value of clk_enable() to catch the potential
+error.
+
+Fixes: 7176ba23f8b5 ("net: rfkill: add generic gpio rfkill driver")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://patch.msgid.link/20241108195341.1853080-1-zmw12306@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rfkill/rfkill-gpio.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
+index 4e32d659524e0..b12edbe0ef45c 100644
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -31,8 +31,12 @@ static int rfkill_gpio_set_power(void *data, bool blocked)
+ {
+ 	struct rfkill_gpio_data *rfkill = data;
+ 
+-	if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled)
+-		clk_enable(rfkill->clk);
++	if (!blocked && !IS_ERR(rfkill->clk) && !rfkill->clk_enabled) {
++		int ret = clk_enable(rfkill->clk);
++
++		if (ret)
++			return ret;
++	}
+ 
+ 	gpiod_set_value_cansleep(rfkill->shutdown_gpio, !blocked);
+ 	gpiod_set_value_cansleep(rfkill->reset_gpio, !blocked);
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch b/queue-6.6/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch
new file mode 100644
index 00000000000..736af809233
--- /dev/null
+++ b/queue-6.6/net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch
@@ -0,0 +1,50 @@
+From c68e4fb0879537c9e6e92340fe3e5237855e2727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:12:55 +0100
+Subject: net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit 407618d66dba55e7db1278872e8be106808bbe91 ]
+
+On DWMAC3 and later, there's a RX Watchdog interrupt that's used for
+interrupt coalescing. It's known to be buggy on some platforms, and
+dwmac-socfpga appears to be one of them. Changing the interrupt
+coalescing from ethtool doesn't appear to have any effect here.
+
+Without disabling RIWT (Received Interrupt Watchdog Timer, I
+believe...), we observe latencies while receiving traffic that amount to
+around ~0.4ms. This was discovered with NTP but can be easily reproduced
+with a simple ping. Without this patch :
+
+64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.657 ms
+
+With this patch :
+
+64 bytes from 192.168.5.2: icmp_seq=1 ttl=64 time=0.254 ms
+
+Fixes: 801d233b7302 ("net: stmmac: Add SOCFPGA glue driver")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://patch.msgid.link/20241122141256.764578-1-maxime.chevallier@bootlin.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index 9bf102bbc6a00..5d20325a18dd3 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -429,6 +429,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
+ 	plat_dat->bsp_priv = dwmac;
+ 	plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed;
+ 
++	plat_dat->riwt_off = 1;
++
+ 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+ 	if (ret)
+ 		goto err_remove_config_dt;
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-usb-lan78xx-fix-double-free-issue-with-interrupt.patch b/queue-6.6/net-usb-lan78xx-fix-double-free-issue-with-interrupt.patch
new file mode 100644
index 00000000000..77c4266097e
--- /dev/null
+++ b/queue-6.6/net-usb-lan78xx-fix-double-free-issue-with-interrupt.patch
@@ -0,0 +1,101 @@
+From 435d4b2b8c6f6b4c6fbee755fa994f1d98b54848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 14:05:57 +0100
+Subject: net: usb: lan78xx: Fix double free issue with interrupt buffer
+ allocation
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 03819abbeb11117dcbba40bfe322b88c0c88a6b6 ]
+
+In lan78xx_probe(), the buffer `buf` was being freed twice: once
+implicitly through `usb_free_urb(dev->urb_intr)` with the
+`URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`. This caused
+a double free issue.
+
+To resolve this, reordered `kmalloc()` and `usb_alloc_urb()` calls to
+simplify the initialization sequence and removed the redundant
+`kfree(buf)`.  Now, `buf` is allocated after `usb_alloc_urb()`, ensuring
+it is correctly managed by  `usb_fill_int_urb()` and freed by
+`usb_free_urb()` as intended.
+
+Fixes: a6df95cae40b ("lan78xx: Fix memory allocation bug")
+Cc: John Efstathiades <john.efstathiades@pebblebay.com>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20241116130558.1352230-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 921ae046f8604..2ae33ecb67494 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -4414,29 +4414,30 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 
+ 	period = ep_intr->desc.bInterval;
+ 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
+-	buf = kmalloc(maxp, GFP_KERNEL);
+-	if (!buf) {
++
++	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
++	if (!dev->urb_intr) {
+ 		ret = -ENOMEM;
+ 		goto out5;
+ 	}
+ 
+-	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
+-	if (!dev->urb_intr) {
++	buf = kmalloc(maxp, GFP_KERNEL);
++	if (!buf) {
+ 		ret = -ENOMEM;
+-		goto out6;
+-	} else {
+-		usb_fill_int_urb(dev->urb_intr, dev->udev,
+-				 dev->pipe_intr, buf, maxp,
+-				 intr_complete, dev, period);
+-		dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
++		goto free_urbs;
+ 	}
+ 
++	usb_fill_int_urb(dev->urb_intr, dev->udev,
++			 dev->pipe_intr, buf, maxp,
++			 intr_complete, dev, period);
++	dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
++
+ 	dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out);
+ 
+ 	/* Reject broken descriptors. */
+ 	if (dev->maxpacket == 0) {
+ 		ret = -ENODEV;
+-		goto out6;
++		goto free_urbs;
+ 	}
+ 
+ 	/* driver requires remote-wakeup capability during autosuspend. */
+@@ -4444,7 +4445,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 
+ 	ret = lan78xx_phy_init(dev);
+ 	if (ret < 0)
+-		goto out7;
++		goto free_urbs;
+ 
+ 	ret = register_netdev(netdev);
+ 	if (ret != 0) {
+@@ -4466,10 +4467,8 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 
+ out8:
+ 	phy_disconnect(netdev->phydev);
+-out7:
++free_urbs:
+ 	usb_free_urb(dev->urb_intr);
+-out6:
+-	kfree(buf);
+ out5:
+ 	lan78xx_unbind(dev, intf);
+ out4:
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch b/queue-6.6/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch
new file mode 100644
index 00000000000..740fc93b316
--- /dev/null
+++ b/queue-6.6/net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch
@@ -0,0 +1,51 @@
+From fca9e4f8f3421256f5780a55e87e67cd2f590b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 14:05:58 +0100
+Subject: net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY
+ device
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit ae7370e61c5d8f5bcefc2d4fca724bd4e9bbf789 ]
+
+Add calls to `phy_device_free` after `fixed_phy_unregister` to fix a
+memory leak that occurs when the device is unplugged. This ensures
+proper cleanup of pseudo fixed-link PHYs.
+
+Fixes: 89b36fb5e532 ("lan78xx: Lan7801 Support for Fixed PHY")
+Cc: Raghuram Chary J <raghuramchary.jallipalli@microchip.com>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20241116130558.1352230-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 2ae33ecb67494..2e02f17beb09d 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2387,6 +2387,7 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
+ 		if (dev->chipid == ID_REV_CHIP_ID_7801_) {
+ 			if (phy_is_pseudo_fixed_link(phydev)) {
+ 				fixed_phy_unregister(phydev);
++				phy_device_free(phydev);
+ 			} else {
+ 				phy_unregister_fixup_for_uid(PHY_KSZ9031RNX,
+ 							     0xfffffff0);
+@@ -4246,8 +4247,10 @@ static void lan78xx_disconnect(struct usb_interface *intf)
+ 
+ 	phy_disconnect(net->phydev);
+ 
+-	if (phy_is_pseudo_fixed_link(phydev))
++	if (phy_is_pseudo_fixed_link(phydev)) {
+ 		fixed_phy_unregister(phydev);
++		phy_device_free(phydev);
++	}
+ 
+ 	usb_scuttle_anchored_urbs(&dev->deferred);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch b/queue-6.6/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch
new file mode 100644
index 00000000000..19c323cf1ba
--- /dev/null
+++ b/queue-6.6/net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch
@@ -0,0 +1,49 @@
+From 37f7000e6edd9776d98da636e3c8872336c0fccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 15:03:51 +0100
+Subject: net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL
+ configuration
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit e863ff806f72098bccaf8fa89c80d9ad6187c3b0 ]
+
+Validate Wake-on-LAN (WoL) options in `lan78xx_set_wol` before calling
+`usb_autopm_get_interface`. This prevents USB autopm refcounting issues
+and ensures the adapter can properly enter autosuspend when invalid WoL
+options are provided.
+
+Fixes: eb9ad088f966 ("lan78xx: Check for supported Wake-on-LAN modes")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://patch.msgid.link/20241118140351.2398166-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 2e02f17beb09d..09173d7b87ed5 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1657,13 +1657,13 @@ static int lan78xx_set_wol(struct net_device *netdev,
+ 	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
+ 	int ret;
+ 
++	if (wol->wolopts & ~WAKE_ALL)
++		return -EINVAL;
++
+ 	ret = usb_autopm_get_interface(dev->intf);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (wol->wolopts & ~WAKE_ALL)
+-		return -EINVAL;
+-
+ 	pdata->wol = wol->wolopts;
+ 
+ 	device_set_wakeup_enable(&dev->udev->dev, (bool)wol->wolopts);
+-- 
+2.43.0
+
diff --git a/queue-6.6/net-use-unrcu_pointer-helper.patch b/queue-6.6/net-use-unrcu_pointer-helper.patch
new file mode 100644
index 00000000000..ff6e7027aff
--- /dev/null
+++ b/queue-6.6/net-use-unrcu_pointer-helper.patch
@@ -0,0 +1,251 @@
+From e240ecf3092be3c37687d8b66d629ba0c9a9d38d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2024 11:16:03 +0000
+Subject: net: use unrcu_pointer() helper
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b4cb4a1391dcdc640c4ade003aaf0ee19cc8d509 ]
+
+Toke mentioned unrcu_pointer() existence, allowing
+to remove some of the ugly casts we have when using
+xchg() for rcu protected pointers.
+
+Also make inet_rcv_compat const.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20240604111603.45871-1-edumazet@google.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: eb02688c5c45 ("ipv6: release nexthop on device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h       | 2 +-
+ net/core/gen_estimator.c | 2 +-
+ net/core/sock_diag.c     | 8 +++-----
+ net/ipv4/cipso_ipv4.c    | 2 +-
+ net/ipv4/tcp.c           | 2 +-
+ net/ipv4/tcp_fastopen.c  | 7 ++++---
+ net/ipv4/udp.c           | 2 +-
+ net/ipv6/af_inet6.c      | 2 +-
+ net/ipv6/ip6_fib.c       | 2 +-
+ net/ipv6/ipv6_sockglue.c | 3 +--
+ net/ipv6/route.c         | 6 +++---
+ net/sched/act_api.c      | 2 +-
+ 12 files changed, 19 insertions(+), 21 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index e0be8bd983960..a6b795ec7c9cb 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -2219,7 +2219,7 @@ sk_dst_set(struct sock *sk, struct dst_entry *dst)
+ 
+ 	sk_tx_queue_clear(sk);
+ 	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
+-	old_dst = xchg((__force struct dst_entry **)&sk->sk_dst_cache, dst);
++	old_dst = unrcu_pointer(xchg(&sk->sk_dst_cache, RCU_INITIALIZER(dst)));
+ 	dst_release(old_dst);
+ }
+ 
+diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
+index fae9c4694186e..412816076b8bc 100644
+--- a/net/core/gen_estimator.c
++++ b/net/core/gen_estimator.c
+@@ -206,7 +206,7 @@ void gen_kill_estimator(struct net_rate_estimator __rcu **rate_est)
+ {
+ 	struct net_rate_estimator *est;
+ 
+-	est = xchg((__force struct net_rate_estimator **)rate_est, NULL);
++	est = unrcu_pointer(xchg(rate_est, NULL));
+ 	if (est) {
+ 		timer_shutdown_sync(&est->timer);
+ 		kfree_rcu(est, rcu);
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index 5c3666431df49..70007fc578a13 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -18,7 +18,7 @@
+ 
+ static const struct sock_diag_handler __rcu *sock_diag_handlers[AF_MAX];
+ 
+-static struct sock_diag_inet_compat __rcu *inet_rcv_compat;
++static const struct sock_diag_inet_compat __rcu *inet_rcv_compat;
+ 
+ static struct workqueue_struct *broadcast_wq;
+ 
+@@ -187,8 +187,7 @@ void sock_diag_broadcast_destroy(struct sock *sk)
+ 
+ void sock_diag_register_inet_compat(const struct sock_diag_inet_compat *ptr)
+ {
+-	xchg((__force const struct sock_diag_inet_compat **)&inet_rcv_compat,
+-	     ptr);
++	xchg(&inet_rcv_compat, RCU_INITIALIZER(ptr));
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_register_inet_compat);
+ 
+@@ -196,8 +195,7 @@ void sock_diag_unregister_inet_compat(const struct sock_diag_inet_compat *ptr)
+ {
+ 	const struct sock_diag_inet_compat *old;
+ 
+-	old = xchg((__force const struct sock_diag_inet_compat **)&inet_rcv_compat,
+-		   NULL);
++	old = unrcu_pointer(xchg(&inet_rcv_compat, NULL));
+ 	WARN_ON_ONCE(old != ptr);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat);
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 685474ef11c40..8daa6418e25a0 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1955,7 +1955,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
+ 	buf = NULL;
+ 
+ 	req_inet = inet_rsk(req);
+-	opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
++	opt = unrcu_pointer(xchg(&req_inet->ireq_opt, RCU_INITIALIZER(opt)));
+ 	if (opt)
+ 		kfree_rcu(opt, rcu);
+ 
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 75371928d94f6..5e6615f69f175 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3065,7 +3065,7 @@ int tcp_disconnect(struct sock *sk, int flags)
+ 	icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
+ 	memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
+ 	__sk_dst_reset(sk);
+-	dst_release(xchg((__force struct dst_entry **)&sk->sk_rx_dst, NULL));
++	dst_release(unrcu_pointer(xchg(&sk->sk_rx_dst, NULL)));
+ 	tcp_saved_syn_free(tp);
+ 	tp->compressed_ack = 0;
+ 	tp->segs_in = 0;
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 8ed54e7334a9c..0f523cbfe329e 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -49,7 +49,7 @@ void tcp_fastopen_ctx_destroy(struct net *net)
+ {
+ 	struct tcp_fastopen_context *ctxt;
+ 
+-	ctxt = xchg((__force struct tcp_fastopen_context **)&net->ipv4.tcp_fastopen_ctx, NULL);
++	ctxt = unrcu_pointer(xchg(&net->ipv4.tcp_fastopen_ctx, NULL));
+ 
+ 	if (ctxt)
+ 		call_rcu(&ctxt->rcu, tcp_fastopen_ctx_free);
+@@ -80,9 +80,10 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
+ 
+ 	if (sk) {
+ 		q = &inet_csk(sk)->icsk_accept_queue.fastopenq;
+-		octx = xchg((__force struct tcp_fastopen_context **)&q->ctx, ctx);
++		octx = unrcu_pointer(xchg(&q->ctx, RCU_INITIALIZER(ctx)));
+ 	} else {
+-		octx = xchg((__force struct tcp_fastopen_context **)&net->ipv4.tcp_fastopen_ctx, ctx);
++		octx = unrcu_pointer(xchg(&net->ipv4.tcp_fastopen_ctx,
++					  RCU_INITIALIZER(ctx)));
+ 	}
+ 
+ 	if (octx)
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 73fb814460b6b..2e4e535603948 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2232,7 +2232,7 @@ bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ 	struct dst_entry *old;
+ 
+ 	if (dst_hold_safe(dst)) {
+-		old = xchg((__force struct dst_entry **)&sk->sk_rx_dst, dst);
++		old = unrcu_pointer(xchg(&sk->sk_rx_dst, RCU_INITIALIZER(dst)));
+ 		dst_release(old);
+ 		return old != dst;
+ 	}
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index b9c50cceba568..99843eb4d49b9 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -507,7 +507,7 @@ void inet6_cleanup_sock(struct sock *sk)
+ 
+ 	/* Free tx options */
+ 
+-	opt = xchg((__force struct ipv6_txoptions **)&np->opt, NULL);
++	opt = unrcu_pointer(xchg(&np->opt, NULL));
+ 	if (opt) {
+ 		atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
+ 		txopt_put(opt);
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 4356806b52bd5..afa9073567dc4 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -982,7 +982,7 @@ static void __fib6_drop_pcpu_from(struct fib6_nh *fib6_nh,
+ 		if (pcpu_rt && rcu_access_pointer(pcpu_rt->from) == match) {
+ 			struct fib6_info *from;
+ 
+-			from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
++			from = unrcu_pointer(xchg(&pcpu_rt->from, NULL));
+ 			fib6_info_release(from);
+ 		}
+ 	}
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 0e2a0847b387f..f106b19b74dd7 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -111,8 +111,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
+ 			icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
+ 		}
+ 	}
+-	opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt,
+-		   opt);
++	opt = unrcu_pointer(xchg(&inet6_sk(sk)->opt, RCU_INITIALIZER(opt)));
+ 	sk_dst_reset(sk);
+ 
+ 	return opt;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index a9104c4c1c02d..341a42c2d6f14 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -368,7 +368,7 @@ static void ip6_dst_destroy(struct dst_entry *dst)
+ 		in6_dev_put(idev);
+ 	}
+ 
+-	from = xchg((__force struct fib6_info **)&rt->from, NULL);
++	from = unrcu_pointer(xchg(&rt->from, NULL));
+ 	fib6_info_release(from);
+ }
+ 
+@@ -1430,7 +1430,7 @@ static struct rt6_info *rt6_make_pcpu_route(struct net *net,
+ 	if (res->f6i->fib6_destroying) {
+ 		struct fib6_info *from;
+ 
+-		from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
++		from = unrcu_pointer(xchg(&pcpu_rt->from, NULL));
+ 		fib6_info_release(from);
+ 	}
+ 
+@@ -1459,7 +1459,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
+ 	/* purge completely the exception to allow releasing the held resources:
+ 	 * some [sk] cache may keep the dst around for unlimited time
+ 	 */
+-	from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
++	from = unrcu_pointer(xchg(&rt6_ex->rt6i->from, NULL));
+ 	fib6_info_release(from);
+ 	dst_dev_put(&rt6_ex->rt6i->dst);
+ 
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index 4572aa6e0273f..e509ac28c4929 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -62,7 +62,7 @@ static void tcf_set_action_cookie(struct tc_cookie __rcu **old_cookie,
+ {
+ 	struct tc_cookie *old;
+ 
+-	old = xchg((__force struct tc_cookie **)old_cookie, new_cookie);
++	old = unrcu_pointer(xchg(old_cookie, RCU_INITIALIZER(new_cookie)));
+ 	if (old)
+ 		call_rcu(&old->rcu, tcf_free_cookie_rcu);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/netdevsim-copy-addresses-for-both-in-and-out-paths.patch b/queue-6.6/netdevsim-copy-addresses-for-both-in-and-out-paths.patch
new file mode 100644
index 00000000000..6e542092365
--- /dev/null
+++ b/queue-6.6/netdevsim-copy-addresses-for-both-in-and-out-paths.patch
@@ -0,0 +1,70 @@
+From 6406c0c45a89620f890ab5e5b08c11ccdc2d8140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 04:00:26 +0000
+Subject: netdevsim: copy addresses for both in and out paths
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 2cf567f421dbfe7e53b7e5ddee9400da10efb75d ]
+
+The current code only copies the address for the in path, leaving the out
+path address set to 0. This patch corrects the issue by copying the addresses
+for both the in and out paths. Before this patch:
+
+  # cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec
+  SA count=2 tx=20
+  sa[0] tx ipaddr=0.0.0.0
+  sa[0]    spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
+  sa[0]    key=0x3167608a ca4f1397 43565909 941fa627
+  sa[1] rx ipaddr=192.168.0.1
+  sa[1]    spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
+  sa[1]    key=0x3167608a ca4f1397 43565909 941fa627
+
+After this patch:
+
+  = cat /sys/kernel/debug/netdevsim/netdevsim0/ports/0/ipsec
+  SA count=2 tx=20
+  sa[0] tx ipaddr=192.168.0.2
+  sa[0]    spi=0x00000100 proto=0x32 salt=0x0adecc3a crypt=1
+  sa[0]    key=0x3167608a ca4f1397 43565909 941fa627
+  sa[1] rx ipaddr=192.168.0.1
+  sa[1]    spi=0x00000101 proto=0x32 salt=0x0adecc3a crypt=1
+  sa[1]    key=0x3167608a ca4f1397 43565909 941fa627
+
+Fixes: 7699353da875 ("netdevsim: add ipsec offload testing")
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20241010040027.21440-3-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/ipsec.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/netdevsim/ipsec.c b/drivers/net/netdevsim/ipsec.c
+index f0d58092e7e96..3612b0633bd17 100644
+--- a/drivers/net/netdevsim/ipsec.c
++++ b/drivers/net/netdevsim/ipsec.c
+@@ -176,14 +176,13 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs,
+ 		return ret;
+ 	}
+ 
+-	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
++	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN)
+ 		sa.rx = true;
+ 
+-		if (xs->props.family == AF_INET6)
+-			memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
+-		else
+-			memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
+-	}
++	if (xs->props.family == AF_INET6)
++		memcpy(sa.ipaddr, &xs->id.daddr.a6, 16);
++	else
++		memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4);
+ 
+ 	/* the preparations worked, so save the info */
+ 	memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa));
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-avoid-false-positive-lockdep-spl.patch b/queue-6.6/netfilter-nf_tables-avoid-false-positive-lockdep-spl.patch
new file mode 100644
index 00000000000..23d63e08ecd
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-avoid-false-positive-lockdep-spl.patch
@@ -0,0 +1,133 @@
+From e6a9c45a23aed3309f906d580d8ac13da2fc0904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 10:41:13 +0100
+Subject: netfilter: nf_tables: avoid false-positive lockdep splat on rule
+ deletion
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9adbb4198bf6cf3634032871118a7052aeaa573f ]
+
+On rule delete we get:
+ WARNING: suspicious RCU usage
+ net/netfilter/nf_tables_api.c:3420 RCU-list traversed in non-reader section!!
+ 1 lock held by iptables/134:
+   #0: ffff888008c4fcc8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid (include/linux/jiffies.h:101) nf_tables
+
+Code is fine, no other CPU can change the list because we're holding
+transaction mutex.
+
+Pass the needed lockdep annotation to the iterator and fix
+two comments for functions that are no longer restricted to rcu-only
+context.
+
+This is enough to resolve rule delete, but there are several other
+missing annotations, added in followup-patches.
+
+Fixes: 28875945ba98 ("rcu: Add support for consolidated-RCU reader checking")
+Reported-by: Matthieu Baerts <matttbe@kernel.org>
+Tested-by: Matthieu Baerts <matttbe@kernel.org>
+Closes: https://lore.kernel.org/netfilter-devel/da27f17f-3145-47af-ad0f-7fd2a823623e@kernel.org/
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index a0eed189441e5..11fe424d9c93a 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3349,13 +3349,15 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
+  * Rules
+  */
+ 
+-static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
++static struct nft_rule *__nft_rule_lookup(const struct net *net,
++					  const struct nft_chain *chain,
+ 					  u64 handle)
+ {
+ 	struct nft_rule *rule;
+ 
+ 	// FIXME: this sucks
+-	list_for_each_entry_rcu(rule, &chain->rules, list) {
++	list_for_each_entry_rcu(rule, &chain->rules, list,
++				lockdep_commit_lock_is_held(net)) {
+ 		if (handle == rule->handle)
+ 			return rule;
+ 	}
+@@ -3363,13 +3365,14 @@ static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
+ 	return ERR_PTR(-ENOENT);
+ }
+ 
+-static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
++static struct nft_rule *nft_rule_lookup(const struct net *net,
++					const struct nft_chain *chain,
+ 					const struct nlattr *nla)
+ {
+ 	if (nla == NULL)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
++	return __nft_rule_lookup(net, chain, be64_to_cpu(nla_get_be64(nla)));
+ }
+ 
+ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
+@@ -3661,7 +3664,7 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)
+ 	return 0;
+ }
+ 
+-/* called with rcu_read_lock held */
++/* Caller must hold rcu read lock or transaction mutex */
+ static struct sk_buff *
+ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
+ 			 const struct nlattr * const nla[], bool reset)
+@@ -3688,7 +3691,7 @@ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
+ 		return ERR_CAST(chain);
+ 	}
+ 
+-	rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
++	rule = nft_rule_lookup(net, chain, nla[NFTA_RULE_HANDLE]);
+ 	if (IS_ERR(rule)) {
+ 		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
+ 		return ERR_CAST(rule);
+@@ -3961,7 +3964,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 
+ 	if (nla[NFTA_RULE_HANDLE]) {
+ 		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
+-		rule = __nft_rule_lookup(chain, handle);
++		rule = __nft_rule_lookup(net, chain, handle);
+ 		if (IS_ERR(rule)) {
+ 			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
+ 			return PTR_ERR(rule);
+@@ -3983,7 +3986,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 
+ 		if (nla[NFTA_RULE_POSITION]) {
+ 			pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+-			old_rule = __nft_rule_lookup(chain, pos_handle);
++			old_rule = __nft_rule_lookup(net, chain, pos_handle);
+ 			if (IS_ERR(old_rule)) {
+ 				NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
+ 				return PTR_ERR(old_rule);
+@@ -4200,7 +4203,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 
+ 	if (chain) {
+ 		if (nla[NFTA_RULE_HANDLE]) {
+-			rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
++			rule = nft_rule_lookup(info->net, chain, nla[NFTA_RULE_HANDLE]);
+ 			if (IS_ERR(rule)) {
+ 				if (PTR_ERR(rule) == -ENOENT &&
+ 				    NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE)
+@@ -7911,7 +7914,7 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
+ 	return 0;
+ }
+ 
+-/* called with rcu_read_lock held */
++/* Caller must hold rcu read lock or transaction mutex */
+ static struct sk_buff *
+ nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,
+ 			const struct nlattr * const nla[], bool reset)
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-introduce-nf_tables_getrule_sing.patch b/queue-6.6/netfilter-nf_tables-introduce-nf_tables_getrule_sing.patch
new file mode 100644
index 00000000000..3cbc74106a2
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-introduce-nf_tables_getrule_sing.patch
@@ -0,0 +1,147 @@
+From 0062fbca0f373b3bef7f4e15bd97cdca72f7691d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 16:03:35 +0200
+Subject: netfilter: nf_tables: Introduce nf_tables_getrule_single()
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 1578c32877191815f631af32ba5dfc1f1b20c1b4 ]
+
+Outsource the reply skb preparation for non-dump getrule requests into a
+distinct function. Prep work for rule reset locking.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: 9adbb4198bf6 ("netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 74 ++++++++++++++++++++---------------
+ 1 file changed, 43 insertions(+), 31 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index a75cab71426da..a0eed189441e5 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3662,65 +3662,81 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)
+ }
+ 
+ /* called with rcu_read_lock held */
+-static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
+-			     const struct nlattr * const nla[])
++static struct sk_buff *
++nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
++			 const struct nlattr * const nla[], bool reset)
+ {
+-	struct nftables_pernet *nft_net = nft_pernet(info->net);
+ 	struct netlink_ext_ack *extack = info->extack;
+ 	u8 genmask = nft_genmask_cur(info->net);
+ 	u8 family = info->nfmsg->nfgen_family;
+-	u32 portid = NETLINK_CB(skb).portid;
+ 	const struct nft_chain *chain;
+ 	const struct nft_rule *rule;
+ 	struct net *net = info->net;
+ 	struct nft_table *table;
+ 	struct sk_buff *skb2;
+-	bool reset = false;
+-	char *buf;
+ 	int err;
+ 
+-	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
+-		struct netlink_dump_control c = {
+-			.start= nf_tables_dump_rules_start,
+-			.dump = nf_tables_dump_rules,
+-			.done = nf_tables_dump_rules_done,
+-			.module = THIS_MODULE,
+-			.data = (void *)nla,
+-		};
+-
+-		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
+-	}
+-
+ 	table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0);
+ 	if (IS_ERR(table)) {
+ 		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
+-		return PTR_ERR(table);
++		return ERR_CAST(table);
+ 	}
+ 
+ 	chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
+ 	if (IS_ERR(chain)) {
+ 		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
+-		return PTR_ERR(chain);
++		return ERR_CAST(chain);
+ 	}
+ 
+ 	rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+ 	if (IS_ERR(rule)) {
+ 		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
+-		return PTR_ERR(rule);
++		return ERR_CAST(rule);
+ 	}
+ 
+ 	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
+ 	if (!skb2)
+-		return -ENOMEM;
+-
+-	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+-		reset = true;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	err = nf_tables_fill_rule_info(skb2, net, portid,
+ 				       info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
+ 				       family, table, chain, rule, 0, reset);
+-	if (err < 0)
+-		goto err_fill_rule_info;
++	if (err < 0) {
++		kfree_skb(skb2);
++		return ERR_PTR(err);
++	}
++
++	return skb2;
++}
++
++static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
++			     const struct nlattr * const nla[])
++{
++	struct nftables_pernet *nft_net = nft_pernet(info->net);
++	u32 portid = NETLINK_CB(skb).portid;
++	struct net *net = info->net;
++	struct sk_buff *skb2;
++	bool reset = false;
++	char *buf;
++
++	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
++		struct netlink_dump_control c = {
++			.start= nf_tables_dump_rules_start,
++			.dump = nf_tables_dump_rules,
++			.done = nf_tables_dump_rules_done,
++			.module = THIS_MODULE,
++			.data = (void *)nla,
++		};
++
++		return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
++	}
++
++	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
++		reset = true;
++
++	skb2 = nf_tables_getrule_single(portid, info, nla, reset);
++	if (IS_ERR(skb2))
++		return PTR_ERR(skb2);
+ 
+ 	if (!reset)
+ 		return nfnetlink_unicast(skb2, net, portid);
+@@ -3734,10 +3750,6 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 	kfree(buf);
+ 
+ 	return nfnetlink_unicast(skb2, net, portid);
+-
+-err_fill_rule_info:
+-	kfree_skb(skb2);
+-	return err;
+ }
+ 
+ void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule)
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch b/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch
new file mode 100644
index 00000000000..d5cf032f4cb
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch
@@ -0,0 +1,84 @@
+From a9862fdd020110fbd8adfa7717eb628a7139cf06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 10:41:18 +0100
+Subject: netfilter: nf_tables: must hold rcu read lock while iterating
+ expression type list
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit ee666a541ed957937454d50afa4757924508cd74 ]
+
+nft shell tests trigger:
+ WARNING: suspicious RCU usage
+ net/netfilter/nf_tables_api.c:3125 RCU-list traversed in non-reader section!!
+ 1 lock held by nft/2068:
+  #0: ffff888106c6f8c8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3c/0xf0
+
+But the transaction mutex doesn't protect this list, the nfnl subsystem
+mutex would, but we can't acquire it here without risk of ABBA
+deadlocks.
+
+Acquire the rcu read lock to avoid this issue.
+
+v3: add a comment that explains the ->inner_ops check implies
+expression is builtin and lack of a module owner reference is ok.
+
+Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 11fe424d9c93a..5c4cd9646e71c 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3231,25 +3231,37 @@ int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla,
+ 	if (!tb[NFTA_EXPR_DATA] || !tb[NFTA_EXPR_NAME])
+ 		return -EINVAL;
+ 
++	rcu_read_lock();
++
+ 	type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
+-	if (!type)
+-		return -ENOENT;
++	if (!type) {
++		err = -ENOENT;
++		goto out_unlock;
++	}
+ 
+-	if (!type->inner_ops)
+-		return -EOPNOTSUPP;
++	if (!type->inner_ops) {
++		err = -EOPNOTSUPP;
++		goto out_unlock;
++	}
+ 
+ 	err = nla_parse_nested_deprecated(info->tb, type->maxattr,
+ 					  tb[NFTA_EXPR_DATA],
+ 					  type->policy, NULL);
+ 	if (err < 0)
+-		goto err_nla_parse;
++		goto out_unlock;
+ 
+ 	info->attr = nla;
+ 	info->ops = type->inner_ops;
+ 
++	/* No module reference will be taken on type->owner.
++	 * Presence of type->inner_ops implies that the expression
++	 * is builtin, so it cannot go away.
++	 */
++	rcu_read_unlock();
+ 	return 0;
+ 
+-err_nla_parse:
++out_unlock:
++	rcu_read_unlock();
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch-562 b/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch-562
new file mode 100644
index 00000000000..e56af70c9dd
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch-562
@@ -0,0 +1,75 @@
+From 938f574aacdbb82f1500105e4498662da80c1170 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 10:41:19 +0100
+Subject: netfilter: nf_tables: must hold rcu read lock while iterating object
+ type list
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit cddc04275f95ca3b18da5c0fb111705ac173af89 ]
+
+Update of stateful object triggers:
+WARNING: suspicious RCU usage
+net/netfilter/nf_tables_api.c:7759 RCU-list traversed in non-reader section!!
+
+other info that might help us debug this:
+rcu_scheduler_active = 2, debug_locks = 1
+1 lock held by nft/3060:
+ #0: ffff88810f0578c8 (&nft_net->commit_mutex){+.+.}-{4:4}, [..]
+
+... but this list is not protected by the transaction mutex but the
+nfnl nftables subsystem mutex.
+
+Switch to nft_obj_type_get which will acquire rcu read lock,
+bump refcount, and returns the result.
+
+v3: Dan Carpenter points out nft_obj_type_get returns error pointer, not
+NULL, on error.
+
+Fixes: dad3bdeef45f ("netfilter: nf_tables: fix memory leak during stateful obj update").
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index abab78148c6c8..eee7997048fb9 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7615,9 +7615,7 @@ static int nf_tables_updobj(const struct nft_ctx *ctx,
+ 	struct nft_trans *trans;
+ 	int err = -ENOMEM;
+ 
+-	if (!try_module_get(type->owner))
+-		return -ENOENT;
+-
++	/* caller must have obtained type->owner reference. */
+ 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
+ 				sizeof(struct nft_trans_obj));
+ 	if (!trans)
+@@ -7685,15 +7683,16 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
+ 		if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
+ 			return -EOPNOTSUPP;
+ 
+-		type = __nft_obj_type_get(objtype, family);
+-		if (WARN_ON_ONCE(!type))
+-			return -ENOENT;
+-
+ 		if (!obj->ops->update)
+ 			return 0;
+ 
++		type = nft_obj_type_get(net, objtype, family);
++		if (WARN_ON_ONCE(IS_ERR(type)))
++			return PTR_ERR(type);
++
+ 		nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+ 
++		/* type->owner reference is put when transaction object is released. */
+ 		return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-open-code-audit-log-call-in-nf_t.patch b/queue-6.6/netfilter-nf_tables-open-code-audit-log-call-in-nf_t.patch
new file mode 100644
index 00000000000..7fcc236646e
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-open-code-audit-log-call-in-nf_t.patch
@@ -0,0 +1,77 @@
+From 5ad06128a0a121621571ae59a1e0ae5676099350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 16:03:34 +0200
+Subject: netfilter: nf_tables: Open-code audit log call in nf_tables_getrule()
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 8877393029e764036892d39614900987cbd21ca6 ]
+
+The table lookup will be dropped from that function, so remove that
+dependency from audit logging code. Using whatever is in
+nla[NFTA_RULE_TABLE] is sufficient as long as the previous rule info
+filling succeded.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: 9adbb4198bf6 ("netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 8a583e8f3c136..a75cab71426da 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3665,15 +3665,18 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)
+ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 			     const struct nlattr * const nla[])
+ {
++	struct nftables_pernet *nft_net = nft_pernet(info->net);
+ 	struct netlink_ext_ack *extack = info->extack;
+ 	u8 genmask = nft_genmask_cur(info->net);
+ 	u8 family = info->nfmsg->nfgen_family;
++	u32 portid = NETLINK_CB(skb).portid;
+ 	const struct nft_chain *chain;
+ 	const struct nft_rule *rule;
+ 	struct net *net = info->net;
+ 	struct nft_table *table;
+ 	struct sk_buff *skb2;
+ 	bool reset = false;
++	char *buf;
+ 	int err;
+ 
+ 	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
+@@ -3713,16 +3716,24 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
+ 	if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETRULE_RESET)
+ 		reset = true;
+ 
+-	err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
++	err = nf_tables_fill_rule_info(skb2, net, portid,
+ 				       info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
+ 				       family, table, chain, rule, 0, reset);
+ 	if (err < 0)
+ 		goto err_fill_rule_info;
+ 
+-	if (reset)
+-		audit_log_rule_reset(table, nft_pernet(net)->base_seq, 1);
++	if (!reset)
++		return nfnetlink_unicast(skb2, net, portid);
+ 
+-	return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
++	buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
++			nla_len(nla[NFTA_RULE_TABLE]),
++			(char *)nla_data(nla[NFTA_RULE_TABLE]),
++			nft_net->base_seq);
++	audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1,
++			AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC);
++	kfree(buf);
++
++	return nfnetlink_unicast(skb2, net, portid);
+ 
+ err_fill_rule_info:
+ 	kfree_skb(skb2);
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfilter-nf_tables-skip-transaction-if-update-objec.patch b/queue-6.6/netfilter-nf_tables-skip-transaction-if-update-objec.patch
new file mode 100644
index 00000000000..f3476984e0f
--- /dev/null
+++ b/queue-6.6/netfilter-nf_tables-skip-transaction-if-update-objec.patch
@@ -0,0 +1,54 @@
+From c908c535511f820e36b3d4346475ae6796b76140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 09:35:48 +0100
+Subject: netfilter: nf_tables: skip transaction if update object is not
+ implemented
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 84b1a0c0140a9a92ea108576c0002210f224ce59 ]
+
+Turn update into noop as a follow up for:
+
+  9fedd894b4e1 ("netfilter: nf_tables: fix unexpected EOPNOTSUPP error")
+
+instead of adding a transaction object which is simply discarded at a
+later stage of the commit protocol.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Stable-dep-of: cddc04275f95 ("netfilter: nf_tables: must hold rcu read lock while iterating object type list")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 5c4cd9646e71c..abab78148c6c8 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7689,6 +7689,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
+ 		if (WARN_ON_ONCE(!type))
+ 			return -ENOENT;
+ 
++		if (!obj->ops->update)
++			return 0;
++
+ 		nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
+ 
+ 		return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
+@@ -9432,9 +9435,10 @@ static void nft_obj_commit_update(struct nft_trans *trans)
+ 	obj = nft_trans_obj(trans);
+ 	newobj = nft_trans_obj_newobj(trans);
+ 
+-	if (obj->ops->update)
+-		obj->ops->update(obj, newobj);
++	if (WARN_ON_ONCE(!obj->ops->update))
++		return;
+ 
++	obj->ops->update(obj, newobj);
+ 	nft_obj_destroy(&trans->ctx, newobj);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch b/queue-6.6/netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch
new file mode 100644
index 00000000000..e7a5e9a9bfc
--- /dev/null
+++ b/queue-6.6/netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch
@@ -0,0 +1,67 @@
+From cc9ac343852bc1c63c437b680b310b8b0a69fd50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 19:06:49 +0800
+Subject: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING
+
+From: Zizhi Wo <wozizhi@huawei.com>
+
+[ Upstream commit 22f9400a6f3560629478e0a64247b8fcc811a24d ]
+
+In fscache_create_volume(), there is a missing memory barrier between the
+bit-clearing operation and the wake-up operation. This may cause a
+situation where, after a wake-up, the bit-clearing operation hasn't been
+detected yet, leading to an indefinite wait. The triggering process is as
+follows:
+
+  [cookie1]                [cookie2]                  [volume_work]
+fscache_perform_lookup
+  fscache_create_volume
+                        fscache_perform_lookup
+                          fscache_create_volume
+			                        fscache_create_volume_work
+                                                  cachefiles_acquire_volume
+                                                  clear_and_wake_up_bit
+    test_and_set_bit
+                            test_and_set_bit
+                              goto maybe_wait
+      goto no_wait
+
+In the above process, cookie1 and cookie2 has the same volume. When cookie1
+enters the -no_wait- process, it will clear the bit and wake up the waiting
+process. If a barrier is missing, it may cause cookie2 to remain in the
+-wait- process indefinitely.
+
+In commit 3288666c7256 ("fscache: Use clear_and_wake_up_bit() in
+fscache_create_volume_work()"), barriers were added to similar operations
+in fscache_create_volume_work(), but fscache_create_volume() was missed.
+
+By combining the clear and wake operations into clear_and_wake_up_bit() to
+fix this issue.
+
+Fixes: bfa22da3ed65 ("fscache: Provide and use cache methods to lookup/create/free a volume")
+Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
+Link: https://lore.kernel.org/r/20241107110649.3980193-6-wozizhi@huawei.com
+Acked-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fscache/volume.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/fscache/volume.c b/fs/fscache/volume.c
+index cb75c07b5281a..ced14ac78cc1c 100644
+--- a/fs/fscache/volume.c
++++ b/fs/fscache/volume.c
+@@ -322,8 +322,7 @@ void fscache_create_volume(struct fscache_volume *volume, bool wait)
+ 	}
+ 	return;
+ no_wait:
+-	clear_bit_unlock(FSCACHE_VOLUME_CREATING, &volume->flags);
+-	wake_up_bit(&volume->flags, FSCACHE_VOLUME_CREATING);
++	clear_and_wake_up_bit(FSCACHE_VOLUME_CREATING, &volume->flags);
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.6/netlink-typographical-error-in-nlmsg_type-constants-.patch b/queue-6.6/netlink-typographical-error-in-nlmsg_type-constants-.patch
new file mode 100644
index 00000000000..d1727935a3d
--- /dev/null
+++ b/queue-6.6/netlink-typographical-error-in-nlmsg_type-constants-.patch
@@ -0,0 +1,36 @@
+From bbaa06fbdb116397077cc3ab3cace7c05c62c297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 23:39:50 +0100
+Subject: netlink: typographical error in nlmsg_type constants definition
+
+From: Maurice Lambert <mauricelambert434@gmail.com>
+
+[ Upstream commit 84bfbfbbd32aee136afea4b6bf82581dce79c305 ]
+
+This commit fix a typographical error in netlink nlmsg_type constants definition in the include/uapi/linux/rtnetlink.h at line 177. The definition is RTM_NEWNVLAN RTM_NEWVLAN instead of RTM_NEWVLAN RTM_NEWVLAN.
+
+Signed-off-by: Maurice Lambert <mauricelambert434@gmail.com>
+Fixes: 8dcea187088b ("net: bridge: vlan: add rtm definitions and dump support")
+Link: https://patch.msgid.link/20241103223950.230300-1-mauricelambert434@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/rtnetlink.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
+index 51c13cf9c5aee..63a0922937e72 100644
+--- a/include/uapi/linux/rtnetlink.h
++++ b/include/uapi/linux/rtnetlink.h
+@@ -174,7 +174,7 @@ enum {
+ #define RTM_GETLINKPROP	RTM_GETLINKPROP
+ 
+ 	RTM_NEWVLAN = 112,
+-#define RTM_NEWNVLAN	RTM_NEWVLAN
++#define RTM_NEWVLAN	RTM_NEWVLAN
+ 	RTM_DELVLAN,
+ #define RTM_DELVLAN	RTM_DELVLAN
+ 	RTM_GETVLAN,
+-- 
+2.43.0
+
diff --git a/queue-6.6/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch b/queue-6.6/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch
new file mode 100644
index 00000000000..0693510a768
--- /dev/null
+++ b/queue-6.6/netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch
@@ -0,0 +1,45 @@
+From df18e2c0dc84d1207eb4871f4fe0428b95b69afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 03:15:18 -0800
+Subject: netpoll: Use rcu_access_pointer() in netpoll_poll_lock
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit a57d5a72f8dec7db8a79d0016fb0a3bdecc82b56 ]
+
+The ndev->npinfo pointer in netpoll_poll_lock() is RCU-protected but is
+being accessed directly for a NULL check. While no RCU read lock is held
+in this context, we should still use proper RCU primitives for
+consistency and correctness.
+
+Replace the direct NULL check with rcu_access_pointer(), which is the
+appropriate primitive when only checking for NULL without dereferencing
+the pointer. This function provides the necessary ordering guarantees
+without requiring RCU read-side protection.
+
+Fixes: bea3348eef27 ("[NET]: Make NAPI polling independent of struct net_device objects.")
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Link: https://patch.msgid.link/20241118-netpoll_rcu-v1-2-a1888dcb4a02@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netpoll.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
+index bd19c4b91e312..3ddf205b7e2c3 100644
+--- a/include/linux/netpoll.h
++++ b/include/linux/netpoll.h
+@@ -71,7 +71,7 @@ static inline void *netpoll_poll_lock(struct napi_struct *napi)
+ {
+ 	struct net_device *dev = napi->dev;
+ 
+-	if (dev && dev->npinfo) {
++	if (dev && rcu_access_pointer(dev->npinfo)) {
+ 		int owner = smp_processor_id();
+ 
+ 		while (cmpxchg(&napi->poll_owner, -1, owner) != -1)
+-- 
+2.43.0
+
diff --git a/queue-6.6/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch b/queue-6.6/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch
new file mode 100644
index 00000000000..8c32f0c10d1
--- /dev/null
+++ b/queue-6.6/nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch
@@ -0,0 +1,37 @@
+From 85a8a3c35f81bb1b3f024e66bbdc404da390292d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 11:03:56 -0400
+Subject: NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit f64ea4af43161bb86ffc77e6aeb5bcf5c3229df0 ]
+
+It's only current caller already length-checks the string, but let's
+be safe.
+
+Fixes: 0964a3d3f1aa ("[PATCH] knfsd: nfsd4 reboot dirname fix")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 4395577825a7f..892fecce18b80 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -658,7 +658,8 @@ nfs4_reset_recoverydir(char *recdir)
+ 		return status;
+ 	status = -ENOTDIR;
+ 	if (d_is_dir(path.dentry)) {
+-		strcpy(user_recovery_dirname, recdir);
++		strscpy(user_recovery_dirname, recdir,
++			sizeof(user_recovery_dirname));
+ 		status = 0;
+ 	}
+ 	path_put(&path);
+-- 
+2.43.0
+
diff --git a/queue-6.6/nfsd-fix-nfsd4_shutdown_copy.patch b/queue-6.6/nfsd-fix-nfsd4_shutdown_copy.patch
new file mode 100644
index 00000000000..88d821d52d3
--- /dev/null
+++ b/queue-6.6/nfsd-fix-nfsd4_shutdown_copy.patch
@@ -0,0 +1,73 @@
+From 4c0dc8447b45b339e78a66a7a0b81b231df3efca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 09:40:03 -0400
+Subject: NFSD: Fix nfsd4_shutdown_copy()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 62a8642ba00aa8ceb0a02ade942f5ec52e877c95 ]
+
+nfsd4_shutdown_copy() is just this:
+
+	while ((copy = nfsd4_get_copy(clp)) != NULL)
+		nfsd4_stop_copy(copy);
+
+nfsd4_get_copy() bumps @copy's reference count, preventing
+nfsd4_stop_copy() from releasing @copy.
+
+A while loop like this usually works by removing the first element
+of the list, but neither nfsd4_get_copy() nor nfsd4_stop_copy()
+alters the async_copies list.
+
+Best I can tell, then, is that nfsd4_shutdown_copy() continues to
+loop until other threads manage to remove all the items from this
+list. The spinning loop blocks shutdown until these items are gone.
+
+Possibly the reason we haven't seen this issue in the field is
+because client_has_state() prevents __destroy_client() from calling
+nfsd4_shutdown_copy() if there are any items on this list. In a
+subsequent patch I plan to remove that restriction.
+
+Fixes: e0639dc5805a ("NFSD introduce async copy feature")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index d64f792964e1a..b3eca08f15b13 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1285,7 +1285,7 @@ static void nfsd4_stop_copy(struct nfsd4_copy *copy)
+ 	nfs4_put_copy(copy);
+ }
+ 
+-static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
++static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp)
+ {
+ 	struct nfsd4_copy *copy = NULL;
+ 
+@@ -1294,6 +1294,9 @@ static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
+ 		copy = list_first_entry(&clp->async_copies, struct nfsd4_copy,
+ 					copies);
+ 		refcount_inc(&copy->refcount);
++		copy->cp_clp = NULL;
++		if (!list_empty(&copy->copies))
++			list_del_init(&copy->copies);
+ 	}
+ 	spin_unlock(&clp->async_lock);
+ 	return copy;
+@@ -1303,7 +1306,7 @@ void nfsd4_shutdown_copy(struct nfs4_client *clp)
+ {
+ 	struct nfsd4_copy *copy;
+ 
+-	while ((copy = nfsd4_get_copy(clp)) != NULL)
++	while ((copy = nfsd4_unhash_copy(clp)) != NULL)
+ 		nfsd4_stop_copy(copy);
+ }
+ #ifdef CONFIG_NFSD_V4_2_INTER_SSC
+-- 
+2.43.0
+
diff --git a/queue-6.6/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch b/queue-6.6/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch
new file mode 100644
index 00000000000..5c1cfe09939
--- /dev/null
+++ b/queue-6.6/nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch
@@ -0,0 +1,37 @@
+From 6d7fe2f21a426411f34ab75d454ba45254ae8283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 11:03:53 -0400
+Subject: NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 1e02c641c3a43c88cecc08402000418e15578d38 ]
+
+@ses is initialized to NULL. If __nfsd4_find_backchannel() finds no
+available backchannel session, setup_callback_client() will try to
+dereference @ses and segfault.
+
+Fixes: dcbeaa68dbbd ("nfsd4: allow backchannel recovery")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4callback.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 4039ffcf90ba5..bc2716c1bdeab 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -1379,6 +1379,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
+ 		ses = c->cn_session;
+ 	}
+ 	spin_unlock(&clp->cl_lock);
++	if (!c)
++		return;
+ 
+ 	err = setup_callback_client(clp, &conn, ses);
+ 	if (err) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/nfsd-release-svc_expkey-svc_export-with-rcu_work.patch b/queue-6.6/nfsd-release-svc_expkey-svc_export-with-rcu_work.patch
new file mode 100644
index 00000000000..a6856cedfb4
--- /dev/null
+++ b/queue-6.6/nfsd-release-svc_expkey-svc_export-with-rcu_work.patch
@@ -0,0 +1,199 @@
+From 82c0b38979b27db4f3590a532528629e1cdff3e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 22:23:43 +0800
+Subject: nfsd: release svc_expkey/svc_export with rcu_work
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+[ Upstream commit f8c989a0c89a75d30f899a7cabdc14d72522bb8d ]
+
+The last reference for `cache_head` can be reduced to zero in `c_show`
+and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently,
+`svc_export_put` and `expkey_put` will be invoked, leading to two
+issues:
+
+1. The `svc_export_put` will directly free ex_uuid. However,
+   `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can
+   trigger a use-after-free issue, shown below.
+
+   ==================================================================
+   BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd]
+   Read of size 1 at addr ff11000010fdc120 by task cat/870
+
+   CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1
+   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+   1.16.1-2.fc37 04/01/2014
+   Call Trace:
+    <TASK>
+    dump_stack_lvl+0x53/0x70
+    print_address_description.constprop.0+0x2c/0x3a0
+    print_report+0xb9/0x280
+    kasan_report+0xae/0xe0
+    svc_export_show+0x362/0x430 [nfsd]
+    c_show+0x161/0x390 [sunrpc]
+    seq_read_iter+0x589/0x770
+    seq_read+0x1e5/0x270
+    proc_reg_read+0xe1/0x140
+    vfs_read+0x125/0x530
+    ksys_read+0xc1/0x160
+    do_syscall_64+0x5f/0x170
+    entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+   Allocated by task 830:
+    kasan_save_stack+0x20/0x40
+    kasan_save_track+0x14/0x30
+    __kasan_kmalloc+0x8f/0xa0
+    __kmalloc_node_track_caller_noprof+0x1bc/0x400
+    kmemdup_noprof+0x22/0x50
+    svc_export_parse+0x8a9/0xb80 [nfsd]
+    cache_do_downcall+0x71/0xa0 [sunrpc]
+    cache_write_procfs+0x8e/0xd0 [sunrpc]
+    proc_reg_write+0xe1/0x140
+    vfs_write+0x1a5/0x6d0
+    ksys_write+0xc1/0x160
+    do_syscall_64+0x5f/0x170
+    entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+   Freed by task 868:
+    kasan_save_stack+0x20/0x40
+    kasan_save_track+0x14/0x30
+    kasan_save_free_info+0x3b/0x60
+    __kasan_slab_free+0x37/0x50
+    kfree+0xf3/0x3e0
+    svc_export_put+0x87/0xb0 [nfsd]
+    cache_purge+0x17f/0x1f0 [sunrpc]
+    nfsd_destroy_serv+0x226/0x2d0 [nfsd]
+    nfsd_svc+0x125/0x1e0 [nfsd]
+    write_threads+0x16a/0x2a0 [nfsd]
+    nfsctl_transaction_write+0x74/0xa0 [nfsd]
+    vfs_write+0x1a5/0x6d0
+    ksys_write+0xc1/0x160
+    do_syscall_64+0x5f/0x170
+    entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`.
+   However, `svc_export_put`/`expkey_put` will call path_put, which
+   subsequently triggers a sleeping operation due to the following
+   `dput`.
+
+   =============================
+   WARNING: suspicious RCU usage
+   5.10.0-dirty #141 Not tainted
+   -----------------------------
+   ...
+   Call Trace:
+   dump_stack+0x9a/0xd0
+   ___might_sleep+0x231/0x240
+   dput+0x39/0x600
+   path_put+0x1b/0x30
+   svc_export_put+0x17/0x80
+   e_show+0x1c9/0x200
+   seq_read_iter+0x63f/0x7c0
+   seq_read+0x226/0x2d0
+   vfs_read+0x113/0x2c0
+   ksys_read+0xc9/0x170
+   do_syscall_64+0x33/0x40
+   entry_SYSCALL_64_after_hwframe+0x67/0xd1
+
+Fix these issues by using `rcu_work` to help release
+`svc_expkey`/`svc_export`. This approach allows for an asynchronous
+context to invoke `path_put` and also facilitates the freeing of
+`uuid/exp/key` after an RCU grace period.
+
+Fixes: 9ceddd9da134 ("knfsd: Allow lockless lookups of the exports")
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/export.c | 31 +++++++++++++++++++++++++------
+ fs/nfsd/export.h |  4 ++--
+ 2 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index b7da17e530077..2964bdae6392d 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -40,15 +40,24 @@
+ #define	EXPKEY_HASHMAX		(1 << EXPKEY_HASHBITS)
+ #define	EXPKEY_HASHMASK		(EXPKEY_HASHMAX -1)
+ 
+-static void expkey_put(struct kref *ref)
++static void expkey_put_work(struct work_struct *work)
+ {
+-	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
++	struct svc_expkey *key =
++		container_of(to_rcu_work(work), struct svc_expkey, ek_rcu_work);
+ 
+ 	if (test_bit(CACHE_VALID, &key->h.flags) &&
+ 	    !test_bit(CACHE_NEGATIVE, &key->h.flags))
+ 		path_put(&key->ek_path);
+ 	auth_domain_put(key->ek_client);
+-	kfree_rcu(key, ek_rcu);
++	kfree(key);
++}
++
++static void expkey_put(struct kref *ref)
++{
++	struct svc_expkey *key = container_of(ref, struct svc_expkey, h.ref);
++
++	INIT_RCU_WORK(&key->ek_rcu_work, expkey_put_work);
++	queue_rcu_work(system_wq, &key->ek_rcu_work);
+ }
+ 
+ static int expkey_upcall(struct cache_detail *cd, struct cache_head *h)
+@@ -351,16 +360,26 @@ static void export_stats_destroy(struct export_stats *stats)
+ 					     EXP_STATS_COUNTERS_NUM);
+ }
+ 
+-static void svc_export_put(struct kref *ref)
++static void svc_export_put_work(struct work_struct *work)
+ {
+-	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
++	struct svc_export *exp =
++		container_of(to_rcu_work(work), struct svc_export, ex_rcu_work);
++
+ 	path_put(&exp->ex_path);
+ 	auth_domain_put(exp->ex_client);
+ 	nfsd4_fslocs_free(&exp->ex_fslocs);
+ 	export_stats_destroy(exp->ex_stats);
+ 	kfree(exp->ex_stats);
+ 	kfree(exp->ex_uuid);
+-	kfree_rcu(exp, ex_rcu);
++	kfree(exp);
++}
++
++static void svc_export_put(struct kref *ref)
++{
++	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
++
++	INIT_RCU_WORK(&exp->ex_rcu_work, svc_export_put_work);
++	queue_rcu_work(system_wq, &exp->ex_rcu_work);
+ }
+ 
+ static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
+diff --git a/fs/nfsd/export.h b/fs/nfsd/export.h
+index ca9dc230ae3d0..9d895570ceba0 100644
+--- a/fs/nfsd/export.h
++++ b/fs/nfsd/export.h
+@@ -75,7 +75,7 @@ struct svc_export {
+ 	u32			ex_layout_types;
+ 	struct nfsd4_deviceid_map *ex_devid_map;
+ 	struct cache_detail	*cd;
+-	struct rcu_head		ex_rcu;
++	struct rcu_work		ex_rcu_work;
+ 	unsigned long		ex_xprtsec_modes;
+ 	struct export_stats	*ex_stats;
+ };
+@@ -92,7 +92,7 @@ struct svc_expkey {
+ 	u32			ek_fsid[6];
+ 
+ 	struct path		ek_path;
+-	struct rcu_head		ek_rcu;
++	struct rcu_work		ek_rcu_work;
+ };
+ 
+ #define EX_ISSYNC(exp)		(!((exp)->ex_flags & NFSEXP_ASYNC))
+-- 
+2.43.0
+
diff --git a/queue-6.6/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch b/queue-6.6/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch
new file mode 100644
index 00000000000..88cbde2bdc5
--- /dev/null
+++ b/queue-6.6/nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch
@@ -0,0 +1,94 @@
+From 62219f7c2f47174d3955a48ed6749390e788a1fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 05:40:04 +0100
+Subject: nvme-pci: fix freeing of the HMB descriptor table
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 3c2fb1ca8086eb139b2a551358137525ae8e0d7a ]
+
+The HMB descriptor table is sized to the maximum number of descriptors
+that could be used for a given device, but __nvme_alloc_host_mem could
+break out of the loop earlier on memory allocation failure and end up
+using less descriptors than planned for, which leads to an incorrect
+size passed to dma_free_coherent.
+
+In practice this was not showing up because the number of descriptors
+tends to be low and the dma coherent allocator always allocates and
+frees at least a page.
+
+Fixes: 87ad72a59a38 ("nvme-pci: implement host memory buffer support")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index b701969cf1c2a..e0b502573b427 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -153,6 +153,7 @@ struct nvme_dev {
+ 	/* host memory buffer support: */
+ 	u64 host_mem_size;
+ 	u32 nr_host_mem_descs;
++	u32 host_mem_descs_size;
+ 	dma_addr_t host_mem_descs_dma;
+ 	struct nvme_host_mem_buf_desc *host_mem_descs;
+ 	void **host_mem_desc_bufs;
+@@ -1929,10 +1930,10 @@ static void nvme_free_host_mem(struct nvme_dev *dev)
+ 
+ 	kfree(dev->host_mem_desc_bufs);
+ 	dev->host_mem_desc_bufs = NULL;
+-	dma_free_coherent(dev->dev,
+-			dev->nr_host_mem_descs * sizeof(*dev->host_mem_descs),
++	dma_free_coherent(dev->dev, dev->host_mem_descs_size,
+ 			dev->host_mem_descs, dev->host_mem_descs_dma);
+ 	dev->host_mem_descs = NULL;
++	dev->host_mem_descs_size = 0;
+ 	dev->nr_host_mem_descs = 0;
+ }
+ 
+@@ -1940,7 +1941,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 		u32 chunk_size)
+ {
+ 	struct nvme_host_mem_buf_desc *descs;
+-	u32 max_entries, len;
++	u32 max_entries, len, descs_size;
+ 	dma_addr_t descs_dma;
+ 	int i = 0;
+ 	void **bufs;
+@@ -1953,8 +1954,9 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 	if (dev->ctrl.hmmaxd && dev->ctrl.hmmaxd < max_entries)
+ 		max_entries = dev->ctrl.hmmaxd;
+ 
+-	descs = dma_alloc_coherent(dev->dev, max_entries * sizeof(*descs),
+-				   &descs_dma, GFP_KERNEL);
++	descs_size = max_entries * sizeof(*descs);
++	descs = dma_alloc_coherent(dev->dev, descs_size, &descs_dma,
++			GFP_KERNEL);
+ 	if (!descs)
+ 		goto out;
+ 
+@@ -1983,6 +1985,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 	dev->host_mem_size = size;
+ 	dev->host_mem_descs = descs;
+ 	dev->host_mem_descs_dma = descs_dma;
++	dev->host_mem_descs_size = descs_size;
+ 	dev->host_mem_desc_bufs = bufs;
+ 	return 0;
+ 
+@@ -1997,8 +2000,7 @@ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 
+ 	kfree(bufs);
+ out_free_descs:
+-	dma_free_coherent(dev->dev, max_entries * sizeof(*descs), descs,
+-			descs_dma);
++	dma_free_coherent(dev->dev, descs_size, descs, descs_dma);
+ out:
+ 	dev->host_mem_descs = NULL;
+ 	return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.6/nvme-pci-reverse-request-order-in-nvme_queue_rqs.patch b/queue-6.6/nvme-pci-reverse-request-order-in-nvme_queue_rqs.patch
new file mode 100644
index 00000000000..851de286a85
--- /dev/null
+++ b/queue-6.6/nvme-pci-reverse-request-order-in-nvme_queue_rqs.patch
@@ -0,0 +1,93 @@
+From 62d348b5a956fee854ed6a7ddc5d0fc384cbede2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 16:20:41 +0100
+Subject: nvme-pci: reverse request order in nvme_queue_rqs
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit beadf0088501d9dcf2454b05d90d5d31ea3ba55f ]
+
+blk_mq_flush_plug_list submits requests in the reverse order that they
+were submitted, which leads to a rather suboptimal I/O pattern especially
+in rotational devices.  Fix this by rewriting nvme_queue_rqs so that it
+always pops the requests from the passed in request list, and then adds
+them to the head of a local submit list.  This actually simplifies the
+code a bit as it removes the complicated list splicing, at the cost of
+extra updates of the rq_next pointer.  As that should be cache hot
+anyway it should be an easy price to pay.
+
+Fixes: d62cbcf62f2f ("nvme: add support for mq_ops->queue_rqs()")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241113152050.157179-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 39 +++++++++++++++++----------------------
+ 1 file changed, 17 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index e0b502573b427..d525fa1229d79 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -905,9 +905,10 @@ static blk_status_t nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
+ 
+ static void nvme_submit_cmds(struct nvme_queue *nvmeq, struct request **rqlist)
+ {
++	struct request *req;
++
+ 	spin_lock(&nvmeq->sq_lock);
+-	while (!rq_list_empty(*rqlist)) {
+-		struct request *req = rq_list_pop(rqlist);
++	while ((req = rq_list_pop(rqlist))) {
+ 		struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+ 
+ 		nvme_sq_copy_cmd(nvmeq, &iod->cmd);
+@@ -933,31 +934,25 @@ static bool nvme_prep_rq_batch(struct nvme_queue *nvmeq, struct request *req)
+ 
+ static void nvme_queue_rqs(struct request **rqlist)
+ {
+-	struct request *req, *next, *prev = NULL;
++	struct request *submit_list = NULL;
+ 	struct request *requeue_list = NULL;
++	struct request **requeue_lastp = &requeue_list;
++	struct nvme_queue *nvmeq = NULL;
++	struct request *req;
+ 
+-	rq_list_for_each_safe(rqlist, req, next) {
+-		struct nvme_queue *nvmeq = req->mq_hctx->driver_data;
+-
+-		if (!nvme_prep_rq_batch(nvmeq, req)) {
+-			/* detach 'req' and add to remainder list */
+-			rq_list_move(rqlist, &requeue_list, req, prev);
+-
+-			req = prev;
+-			if (!req)
+-				continue;
+-		}
++	while ((req = rq_list_pop(rqlist))) {
++		if (nvmeq && nvmeq != req->mq_hctx->driver_data)
++			nvme_submit_cmds(nvmeq, &submit_list);
++		nvmeq = req->mq_hctx->driver_data;
+ 
+-		if (!next || req->mq_hctx != next->mq_hctx) {
+-			/* detach rest of list, and submit */
+-			req->rq_next = NULL;
+-			nvme_submit_cmds(nvmeq, rqlist);
+-			*rqlist = next;
+-			prev = NULL;
+-		} else
+-			prev = req;
++		if (nvme_prep_rq_batch(nvmeq, req))
++			rq_list_add(&submit_list, req); /* reverse order */
++		else
++			rq_list_add_tail(&requeue_lastp, req);
+ 	}
+ 
++	if (nvmeq)
++		nvme_submit_cmds(nvmeq, &submit_list);
+ 	*rqlist = requeue_list;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch b/queue-6.6/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch
new file mode 100644
index 00000000000..95fc1692d57
--- /dev/null
+++ b/queue-6.6/ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch
@@ -0,0 +1,98 @@
+From f8ec8d7589dba519c10f5553fb0189428731e673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 12:17:36 +0300
+Subject: ocfs2: fix uninitialized value in ocfs2_file_read_iter()
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ]
+
+Syzbot has reported the following KMSAN splat:
+
+BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80
+ ocfs2_file_read_iter+0x9a4/0xf80
+ __io_read+0x8d4/0x20f0
+ io_read+0x3e/0xf0
+ io_issue_sqe+0x42b/0x22c0
+ io_wq_submit_work+0xaf9/0xdc0
+ io_worker_handle_work+0xd13/0x2110
+ io_wq_worker+0x447/0x1410
+ ret_from_fork+0x6f/0x90
+ ret_from_fork_asm+0x1a/0x30
+
+Uninit was created at:
+ __alloc_pages_noprof+0x9a7/0xe00
+ alloc_pages_mpol_noprof+0x299/0x990
+ alloc_pages_noprof+0x1bf/0x1e0
+ allocate_slab+0x33a/0x1250
+ ___slab_alloc+0x12ef/0x35e0
+ kmem_cache_alloc_bulk_noprof+0x486/0x1330
+ __io_alloc_req_refill+0x84/0x560
+ io_submit_sqes+0x172f/0x2f30
+ __se_sys_io_uring_enter+0x406/0x41c0
+ __x64_sys_io_uring_enter+0x11f/0x1a0
+ x64_sys_call+0x2b54/0x3ba0
+ do_syscall_64+0xcd/0x1e0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Since an instance of 'struct kiocb' may be passed from the block layer
+with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'
+and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in
+'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.
+
+Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru
+Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/aops.h | 2 ++
+ fs/ocfs2/file.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h
+index 3a520117fa59f..a9ce7947228c8 100644
+--- a/fs/ocfs2/aops.h
++++ b/fs/ocfs2/aops.h
+@@ -70,6 +70,8 @@ enum ocfs2_iocb_lock_bits {
+ 	OCFS2_IOCB_NUM_LOCKS
+ };
+ 
++#define ocfs2_iocb_init_rw_locked(iocb) \
++	(iocb->private = NULL)
+ #define ocfs2_iocb_clear_rw_locked(iocb) \
+ 	clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)
+ #define ocfs2_iocb_rw_locked_level(iocb) \
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index e4acb795d1190..0585f281ff62f 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2397,6 +2397,8 @@ static ssize_t ocfs2_file_write_iter(struct kiocb *iocb,
+ 	} else
+ 		inode_lock(inode);
+ 
++	ocfs2_iocb_init_rw_locked(iocb);
++
+ 	/*
+ 	 * Concurrent O_DIRECT writes are allowed with
+ 	 * mount_option "coherency=buffered".
+@@ -2543,6 +2545,8 @@ static ssize_t ocfs2_file_read_iter(struct kiocb *iocb,
+ 	if (!direct_io && nowait)
+ 		return -EOPNOTSUPP;
+ 
++	ocfs2_iocb_init_rw_locked(iocb);
++
+ 	/*
+ 	 * buffered reads protect themselves in ->read_folio().  O_DIRECT reads
+ 	 * need locks to protect pending reads from racing with truncate.
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-af-quiesce-traffic-before-nix-block-reset.patch b/queue-6.6/octeontx2-af-quiesce-traffic-before-nix-block-reset.patch
new file mode 100644
index 00000000000..a0f21ef933b
--- /dev/null
+++ b/queue-6.6/octeontx2-af-quiesce-traffic-before-nix-block-reset.patch
@@ -0,0 +1,337 @@
+From 45182340d120521486e552a6e83ce69a2f479e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 21:50:35 +0530
+Subject: octeontx2-af: Quiesce traffic before NIX block reset
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 762ca6eed026346d9d41ed5ac633083c4f1e5071 ]
+
+During initialization, the AF driver resets all blocks. The RPM (MAC)
+block and NIX block operate on a credit-based model. When the NIX block
+resets during active traffic flow, it doesn't release credits to the RPM
+block. This causes the RPM FIFO to overflow, leading to receive traffic
+struck.
+
+To address this issue, the patch introduces the following changes:
+1. Stop receiving traffic at the MAC level during AF driver
+   initialization.
+2. Perform an X2P reset (prevents RXFIFO of all LMACS from pushing data)
+3. Reset the NIX block.
+4. Clear the X2P reset and re-enable receiving traffic.
+
+Fixes: 54d557815e15 ("octeontx2-af: Reset all RVU blocks")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/cgx.c   | 61 +++++++++++++++++++
+ .../net/ethernet/marvell/octeontx2/af/cgx.h   |  4 ++
+ .../marvell/octeontx2/af/lmac_common.h        |  2 +
+ .../net/ethernet/marvell/octeontx2/af/rpm.c   | 42 +++++++++++++
+ .../net/ethernet/marvell/octeontx2/af/rpm.h   |  4 ++
+ .../net/ethernet/marvell/octeontx2/af/rvu.c   |  1 +
+ .../net/ethernet/marvell/octeontx2/af/rvu.h   |  1 +
+ .../ethernet/marvell/octeontx2/af/rvu_cgx.c   | 36 +++++++++--
+ 8 files changed, 145 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 2e77911cbbe34..52792546fe00d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -214,6 +214,24 @@ u8 cgx_lmac_get_p2x(int cgx_id, int lmac_id)
+ 	return (cfg & CMR_P2X_SEL_MASK) >> CMR_P2X_SEL_SHIFT;
+ }
+ 
++static u8 cgx_get_nix_resetbit(struct cgx *cgx)
++{
++	int first_lmac;
++	u8 p2x;
++
++	/* non 98XX silicons supports only NIX0 block */
++	if (cgx->pdev->subsystem_device != PCI_SUBSYS_DEVID_98XX)
++		return CGX_NIX0_RESET;
++
++	first_lmac = find_first_bit(&cgx->lmac_bmap, cgx->max_lmac_per_mac);
++	p2x = cgx_lmac_get_p2x(cgx->cgx_id, first_lmac);
++
++	if (p2x == CMR_P2X_SEL_NIX1)
++		return CGX_NIX1_RESET;
++	else
++		return CGX_NIX0_RESET;
++}
++
+ /* Ensure the required lock for event queue(where asynchronous events are
+  * posted) is acquired before calling this API. Else an asynchronous event(with
+  * latest link status) can reach the destination before this function returns
+@@ -1726,6 +1744,8 @@ static int cgx_lmac_init(struct cgx *cgx)
+ 		lmac->lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac->lmac_id);
+ 	}
+ 
++	/* Start X2P reset on given MAC block */
++	cgx->mac_ops->mac_x2p_reset(cgx, true);
+ 	return cgx_lmac_verify_fwi_version(cgx);
+ 
+ err_bitmap_free:
+@@ -1791,6 +1811,45 @@ static u8 cgx_get_rxid_mapoffset(struct cgx *cgx)
+ 		return 0x60;
+ }
+ 
++static void cgx_x2p_reset(void *cgxd, bool enable)
++{
++	struct cgx *cgx = cgxd;
++	int lmac_id;
++	u64 cfg;
++
++	if (enable) {
++		for_each_set_bit(lmac_id, &cgx->lmac_bmap, cgx->max_lmac_per_mac)
++			cgx->mac_ops->mac_enadis_rx(cgx, lmac_id, false);
++
++		usleep_range(1000, 2000);
++
++		cfg = cgx_read(cgx, 0, CGXX_CMR_GLOBAL_CONFIG);
++		cfg |= cgx_get_nix_resetbit(cgx) | CGX_NSCI_DROP;
++		cgx_write(cgx, 0, CGXX_CMR_GLOBAL_CONFIG, cfg);
++	} else {
++		cfg = cgx_read(cgx, 0, CGXX_CMR_GLOBAL_CONFIG);
++		cfg &= ~(cgx_get_nix_resetbit(cgx) | CGX_NSCI_DROP);
++		cgx_write(cgx, 0, CGXX_CMR_GLOBAL_CONFIG, cfg);
++	}
++}
++
++static int cgx_enadis_rx(void *cgxd, int lmac_id, bool enable)
++{
++	struct cgx *cgx = cgxd;
++	u64 cfg;
++
++	if (!is_lmac_valid(cgx, lmac_id))
++		return -ENODEV;
++
++	cfg = cgx_read(cgx, lmac_id, CGXX_CMRX_CFG);
++	if (enable)
++		cfg |= DATA_PKT_RX_EN;
++	else
++		cfg &= ~DATA_PKT_RX_EN;
++	cgx_write(cgx, lmac_id, CGXX_CMRX_CFG, cfg);
++	return 0;
++}
++
+ static struct mac_ops	cgx_mac_ops    = {
+ 	.name		=       "cgx",
+ 	.csr_offset	=       0,
+@@ -1822,6 +1881,8 @@ static struct mac_ops	cgx_mac_ops    = {
+ 	.mac_get_pfc_frm_cfg   =        cgx_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			cgx_lmac_reset,
+ 	.mac_stats_reset       =	cgx_stats_reset,
++	.mac_x2p_reset                   =      cgx_x2p_reset,
++	.mac_enadis_rx			 =      cgx_enadis_rx,
+ };
+ 
+ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+index f9cd4b58f0c02..1cf12e5c7da87 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+@@ -32,6 +32,10 @@
+ #define CGX_LMAC_TYPE_MASK		0xF
+ #define CGXX_CMRX_INT			0x040
+ #define FW_CGX_INT			BIT_ULL(1)
++#define CGXX_CMR_GLOBAL_CONFIG          0x08
++#define CGX_NIX0_RESET			BIT_ULL(2)
++#define CGX_NIX1_RESET			BIT_ULL(3)
++#define CGX_NSCI_DROP			BIT_ULL(9)
+ #define CGXX_CMRX_INT_ENA_W1S		0x058
+ #define CGXX_CMRX_RX_ID_MAP		0x060
+ #define CGXX_CMRX_RX_STAT0		0x070
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+index c43ff68ef1408..6180e68e1765a 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+@@ -132,6 +132,8 @@ struct mac_ops {
+ 	int			(*get_fec_stats)(void *cgxd, int lmac_id,
+ 						 struct cgx_fec_stats_rsp *rsp);
+ 	int			(*mac_stats_reset)(void *cgxd, int lmac_id);
++	void                    (*mac_x2p_reset)(void *cgxd, bool enable);
++	int			(*mac_enadis_rx)(void *cgxd, int lmac_id, bool enable);
+ };
+ 
+ struct cgx {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index e97fcc51d7f24..2e9945446199e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -39,6 +39,8 @@ static struct mac_ops		rpm_mac_ops   = {
+ 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			rpm_lmac_reset,
+ 	.mac_stats_reset		 =	  rpm_stats_reset,
++	.mac_x2p_reset                   =        rpm_x2p_reset,
++	.mac_enadis_rx			 =        rpm_enadis_rx,
+ };
+ 
+ static struct mac_ops		rpm2_mac_ops   = {
+@@ -72,6 +74,8 @@ static struct mac_ops		rpm2_mac_ops   = {
+ 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			rpm_lmac_reset,
+ 	.mac_stats_reset	    =	rpm_stats_reset,
++	.mac_x2p_reset              =   rpm_x2p_reset,
++	.mac_enadis_rx		    =   rpm_enadis_rx,
+ };
+ 
+ bool is_dev_rpm2(void *rpmd)
+@@ -768,3 +772,41 @@ int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr)
+ 
+ 	return 0;
+ }
++
++void rpm_x2p_reset(void *rpmd, bool enable)
++{
++	rpm_t *rpm = rpmd;
++	int lmac_id;
++	u64 cfg;
++
++	if (enable) {
++		for_each_set_bit(lmac_id, &rpm->lmac_bmap, rpm->max_lmac_per_mac)
++			rpm->mac_ops->mac_enadis_rx(rpm, lmac_id, false);
++
++		usleep_range(1000, 2000);
++
++		cfg = rpm_read(rpm, 0, RPMX_CMR_GLOBAL_CFG);
++		rpm_write(rpm, 0, RPMX_CMR_GLOBAL_CFG, cfg | RPM_NIX0_RESET);
++	} else {
++		cfg = rpm_read(rpm, 0, RPMX_CMR_GLOBAL_CFG);
++		cfg &= ~RPM_NIX0_RESET;
++		rpm_write(rpm, 0, RPMX_CMR_GLOBAL_CFG, cfg);
++	}
++}
++
++int rpm_enadis_rx(void *rpmd, int lmac_id, bool enable)
++{
++	rpm_t *rpm = rpmd;
++	u64 cfg;
++
++	if (!is_lmac_valid(rpm, lmac_id))
++		return -ENODEV;
++
++	cfg = rpm_read(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG);
++	if (enable)
++		cfg |= RPM_RX_EN;
++	else
++		cfg &= ~RPM_RX_EN;
++	rpm_write(rpm, lmac_id, RPMX_MTI_MAC100X_COMMAND_CONFIG, cfg);
++	return 0;
++}
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index 5194fec4c3b8e..b8d3972e096ae 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -17,6 +17,8 @@
+ 
+ /* Registers */
+ #define RPMX_CMRX_CFG			0x00
++#define RPMX_CMR_GLOBAL_CFG		0x08
++#define RPM_NIX0_RESET			BIT_ULL(3)
+ #define RPMX_RX_TS_PREPEND              BIT_ULL(22)
+ #define RPMX_TX_PTP_1S_SUPPORT          BIT_ULL(17)
+ #define RPMX_CMRX_RX_ID_MAP		0x80
+@@ -139,4 +141,6 @@ bool is_dev_rpm2(void *rpmd);
+ int rpm_get_fec_stats(void *cgxd, int lmac_id, struct cgx_fec_stats_rsp *rsp);
+ int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr);
+ int rpm_stats_reset(void *rpmd, int lmac_id);
++void rpm_x2p_reset(void *rpmd, bool enable);
++int rpm_enadis_rx(void *rpmd, int lmac_id, bool enable);
+ #endif /* RPM_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index 5906f5f8d1904..5241737222236 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -1157,6 +1157,7 @@ static int rvu_setup_hw_resources(struct rvu *rvu)
+ 	}
+ 
+ 	rvu_program_channels(rvu);
++	cgx_start_linkup(rvu);
+ 
+ 	err = rvu_mcs_init(rvu);
+ 	if (err) {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index e81cfcaf9ce4f..a607c7294b0c5 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -912,6 +912,7 @@ int rvu_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_
+ int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause);
+ void rvu_mac_reset(struct rvu *rvu, u16 pcifunc);
+ u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac);
++void cgx_start_linkup(struct rvu *rvu);
+ int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf,
+ 			     int type);
+ bool is_mcam_entry_enabled(struct rvu *rvu, struct npc_mcam *mcam, int blkaddr,
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 7fc094419ef2b..d14cf2a9d207e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -349,6 +349,7 @@ static void rvu_cgx_wq_destroy(struct rvu *rvu)
+ 
+ int rvu_cgx_init(struct rvu *rvu)
+ {
++	struct mac_ops *mac_ops;
+ 	int cgx, err;
+ 	void *cgxd;
+ 
+@@ -375,6 +376,15 @@ int rvu_cgx_init(struct rvu *rvu)
+ 	if (err)
+ 		return err;
+ 
++	/* Clear X2P reset on all MAC blocks */
++	for (cgx = 0; cgx < rvu->cgx_cnt_max; cgx++) {
++		cgxd = rvu_cgx_pdata(cgx, rvu);
++		if (!cgxd)
++			continue;
++		mac_ops = get_mac_ops(cgxd);
++		mac_ops->mac_x2p_reset(cgxd, false);
++	}
++
+ 	/* Register for CGX events */
+ 	err = cgx_lmac_event_handler_init(rvu);
+ 	if (err)
+@@ -382,10 +392,26 @@ int rvu_cgx_init(struct rvu *rvu)
+ 
+ 	mutex_init(&rvu->cgx_cfg_lock);
+ 
+-	/* Ensure event handler registration is completed, before
+-	 * we turn on the links
+-	 */
+-	mb();
++	return 0;
++}
++
++void cgx_start_linkup(struct rvu *rvu)
++{
++	unsigned long lmac_bmap;
++	struct mac_ops *mac_ops;
++	int cgx, lmac, err;
++	void *cgxd;
++
++	/* Enable receive on all LMACS */
++	for (cgx = 0; cgx <= rvu->cgx_cnt_max; cgx++) {
++		cgxd = rvu_cgx_pdata(cgx, rvu);
++		if (!cgxd)
++			continue;
++		mac_ops = get_mac_ops(cgxd);
++		lmac_bmap = cgx_get_lmac_bmap(cgxd);
++		for_each_set_bit(lmac, &lmac_bmap, rvu->hw->lmac_per_cgx)
++			mac_ops->mac_enadis_rx(cgxd, lmac, true);
++	}
+ 
+ 	/* Do link up for all CGX ports */
+ 	for (cgx = 0; cgx <= rvu->cgx_cnt_max; cgx++) {
+@@ -398,8 +424,6 @@ int rvu_cgx_init(struct rvu *rvu)
+ 				"Link up process failed to start on cgx %d\n",
+ 				cgx);
+ 	}
+-
+-	return 0;
+ }
+ 
+ int rvu_cgx_exit(struct rvu *rvu)
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-af-rpm-fix-low-network-performance.patch b/queue-6.6/octeontx2-af-rpm-fix-low-network-performance.patch
new file mode 100644
index 00000000000..64babfb782a
--- /dev/null
+++ b/queue-6.6/octeontx2-af-rpm-fix-low-network-performance.patch
@@ -0,0 +1,157 @@
+From 27e1e02c19aaef9cefaf0961246bb5094907c986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 21:50:32 +0530
+Subject: octeontx2-af: RPM: Fix low network performance
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit d1e8884e050c1255a9ceb477f5ff926ee9214a23 ]
+
+Low network performance is observed even on RPMs with larger
+FIFO lengths.
+
+The cn10kb silicon has three RPM blocks with the following
+FIFO sizes:
+
+         --------------------
+         | RPM0  |   256KB  |
+         | RPM1  |   256KB  |
+         | RPM2  |   128KB  |
+         --------------------
+
+The current design stores the FIFO length in a common structure for all
+RPMs (mac_ops). As a result, the FIFO length of the last RPM is applied
+to all RPMs, leading to reduced network performance.
+
+This patch resolved the problem by storing the fifo length in per MAC
+structure (cgx).
+
+Fixes: b9d0fedc6234 ("octeontx2-af: cn10kb: Add RPM_USX MAC support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c         | 9 +++++++--
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.h         | 1 +
+ drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h | 5 ++++-
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.c         | 6 +++---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c     | 9 ++++-----
+ 5 files changed, 19 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index 2539c985f695a..aea963017d261 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -110,6 +110,11 @@ struct mac_ops *get_mac_ops(void *cgxd)
+ 	return ((struct cgx *)cgxd)->mac_ops;
+ }
+ 
++u32 cgx_get_fifo_len(void *cgxd)
++{
++	return ((struct cgx *)cgxd)->fifo_len;
++}
++
+ void cgx_write(struct cgx *cgx, u64 lmac, u64 offset, u64 val)
+ {
+ 	writeq(val, cgx->reg_base + (lmac << cgx->mac_ops->lmac_offset) +
+@@ -499,7 +504,7 @@ static u32 cgx_get_lmac_fifo_len(void *cgxd, int lmac_id)
+ 	u8 num_lmacs;
+ 	u32 fifo_len;
+ 
+-	fifo_len = cgx->mac_ops->fifo_len;
++	fifo_len = cgx->fifo_len;
+ 	num_lmacs = cgx->mac_ops->get_nr_lmacs(cgx);
+ 
+ 	switch (num_lmacs) {
+@@ -1740,7 +1745,7 @@ static void cgx_populate_features(struct cgx *cgx)
+ 	u64 cfg;
+ 
+ 	cfg = cgx_read(cgx, 0, CGX_CONST);
+-	cgx->mac_ops->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg);
++	cgx->fifo_len = FIELD_GET(CGX_CONST_RXFIFO_SIZE, cfg);
+ 	cgx->max_lmac_per_mac = FIELD_GET(CGX_CONST_MAX_LMACS, cfg);
+ 
+ 	if (is_dev_rpm(cgx))
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+index 6f7d1dee58308..226ff7f0df52a 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+@@ -184,4 +184,5 @@ int cgx_lmac_get_pfc_frm_cfg(void *cgxd, int lmac_id, u8 *tx_pause,
+ int verify_lmac_fc_cfg(void *cgxd, int lmac_id, u8 tx_pause, u8 rx_pause,
+ 		       int pfvf_idx);
+ int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr);
++u32 cgx_get_fifo_len(void *cgxd);
+ #endif /* CGX_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+index 0b4cba03f2e83..50fcc436d8a79 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+@@ -72,7 +72,6 @@ struct mac_ops {
+ 	u8			irq_offset;
+ 	u8			int_ena_bit;
+ 	u8			lmac_fwi;
+-	u32			fifo_len;
+ 	bool			non_contiguous_serdes_lane;
+ 	/* RPM & CGX differs in number of Receive/transmit stats */
+ 	u8			rx_stats_cnt;
+@@ -141,6 +140,10 @@ struct cgx {
+ 	u8			lmac_count;
+ 	/* number of LMACs per MAC could be 4 or 8 */
+ 	u8			max_lmac_per_mac;
++	/* length of fifo varies depending on the number
++	 * of LMACS
++	 */
++	u32			fifo_len;
+ #define MAX_LMAC_COUNT		8
+ 	struct lmac             *lmac_idmap[MAX_LMAC_COUNT];
+ 	struct			work_struct cgx_cmd_work;
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index ce584b6aa6d65..4d2d15834f9df 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -463,7 +463,7 @@ u32 rpm_get_lmac_fifo_len(void *rpmd, int lmac_id)
+ 	u8 num_lmacs;
+ 	u32 fifo_len;
+ 
+-	fifo_len = rpm->mac_ops->fifo_len;
++	fifo_len = rpm->fifo_len;
+ 	num_lmacs = rpm->mac_ops->get_nr_lmacs(rpm);
+ 
+ 	switch (num_lmacs) {
+@@ -516,9 +516,9 @@ u32 rpm2_get_lmac_fifo_len(void *rpmd, int lmac_id)
+ 	 */
+ 	max_lmac = (rpm_read(rpm, 0, CGX_CONST) >> 24) & 0xFF;
+ 	if (max_lmac > 4)
+-		fifo_len = rpm->mac_ops->fifo_len / 2;
++		fifo_len = rpm->fifo_len / 2;
+ 	else
+-		fifo_len = rpm->mac_ops->fifo_len;
++		fifo_len = rpm->fifo_len;
+ 
+ 	if (lmac_id < 4) {
+ 		num_lmacs = hweight8(lmac_info & 0xF);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 19075f217d00c..898584b1aa608 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -895,13 +895,12 @@ int rvu_mbox_handler_cgx_features_get(struct rvu *rvu,
+ 
+ u32 rvu_cgx_get_fifolen(struct rvu *rvu)
+ {
+-	struct mac_ops *mac_ops;
+-	u32 fifo_len;
++	void *cgxd = rvu_first_cgx_pdata(rvu);
+ 
+-	mac_ops = get_mac_ops(rvu_first_cgx_pdata(rvu));
+-	fifo_len = mac_ops ? mac_ops->fifo_len : 0;
++	if (!cgxd)
++		return 0;
+ 
+-	return fifo_len;
++	return cgx_get_fifo_len(cgxd);
+ }
+ 
+ u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac)
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-af-rpm-fix-mismatch-in-lmac-type.patch b/queue-6.6/octeontx2-af-rpm-fix-mismatch-in-lmac-type.patch
new file mode 100644
index 00000000000..7860c080b59
--- /dev/null
+++ b/queue-6.6/octeontx2-af-rpm-fix-mismatch-in-lmac-type.patch
@@ -0,0 +1,37 @@
+From 42985b33e634ab62c6828db1d8f3d4020eeee83c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 21:50:31 +0530
+Subject: octeontx2-af: RPM: Fix mismatch in lmac type
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 7ebbbb23ea5b6d051509cb11399afac5042c9266 ]
+
+Due to a bug in the previous patch, there is a mismatch
+between the lmac type reported by the driver and the actual
+hardware configuration.
+
+Fixes: 3ad3f8f93c81 ("octeontx2-af: cn10k: MAC internal loopback support")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index 76218f1cb4595..ce584b6aa6d65 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -450,7 +450,7 @@ u8 rpm_get_lmac_type(void *rpmd, int lmac_id)
+ 	int err;
+ 
+ 	req = FIELD_SET(CMDREG_ID, CGX_CMD_GET_LINK_STS, req);
+-	err = cgx_fwi_cmd_generic(req, &resp, rpm, 0);
++	err = cgx_fwi_cmd_generic(req, &resp, rpm, lmac_id);
+ 	if (!err)
+ 		return FIELD_GET(RESP_LINKSTAT_LMAC_TYPE, resp);
+ 	return err;
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-af-rpm-fix-stale-fcfec-counters.patch b/queue-6.6/octeontx2-af-rpm-fix-stale-fcfec-counters.patch
new file mode 100644
index 00000000000..5464c60e77b
--- /dev/null
+++ b/queue-6.6/octeontx2-af-rpm-fix-stale-fcfec-counters.patch
@@ -0,0 +1,90 @@
+From e75a32814181f61c859727f66285b3b18ab6b78c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 21:50:34 +0530
+Subject: octeontx2-af: RPM: fix stale FCFEC counters
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 6fc2164108462b913a1290fa2c44054c70b060ef ]
+
+The corrected words register(FCFECX_VL0_CCW_LO)/Uncorrected words
+register (FCFECX_VL0_NCCW_LO) of FCFEC counter has different LMAC
+offset which needs to be accessed differently.
+
+Fixes: 84ad3642115d ("octeontx2-af: Add FEC stats for RPM/RPM_USX block")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/rpm.c   | 24 +++++++++----------
+ .../net/ethernet/marvell/octeontx2/af/rpm.h   | 10 ++++----
+ 2 files changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index 70629f94c27ef..e97fcc51d7f24 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -704,27 +704,27 @@ int rpm_get_fec_stats(void *rpmd, int lmac_id, struct cgx_fec_stats_rsp *rsp)
+ 	 */
+ 	mutex_lock(&rpm->lock);
+ 	if (rpm->lmac_idmap[lmac_id]->link_info.fec == OTX2_FEC_BASER) {
+-		val_lo = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_VL0_CCW_LO);
+-		val_hi = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_CW_HI);
++		val_lo = rpm_read(rpm, 0, RPMX_MTI_FCFECX_VL0_CCW_LO(lmac_id));
++		val_hi = rpm_read(rpm, 0, RPMX_MTI_FCFECX_CW_HI(lmac_id));
+ 		rsp->fec_corr_blks = (val_hi << 16 | val_lo);
+ 
+-		val_lo = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_VL0_NCCW_LO);
+-		val_hi = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_CW_HI);
++		val_lo = rpm_read(rpm, 0, RPMX_MTI_FCFECX_VL0_NCCW_LO(lmac_id));
++		val_hi = rpm_read(rpm, 0, RPMX_MTI_FCFECX_CW_HI(lmac_id));
+ 		rsp->fec_uncorr_blks = (val_hi << 16 | val_lo);
+ 
+ 		/* 50G uses 2 Physical serdes lines */
+ 		if (rpm->lmac_idmap[lmac_id]->link_info.lmac_type_id ==
+ 		    LMAC_MODE_50G_R) {
+-			val_lo = rpm_read(rpm, lmac_id,
+-					  RPMX_MTI_FCFECX_VL1_CCW_LO);
+-			val_hi = rpm_read(rpm, lmac_id,
+-					  RPMX_MTI_FCFECX_CW_HI);
++			val_lo = rpm_read(rpm, 0,
++					  RPMX_MTI_FCFECX_VL1_CCW_LO(lmac_id));
++			val_hi = rpm_read(rpm, 0,
++					  RPMX_MTI_FCFECX_CW_HI(lmac_id));
+ 			rsp->fec_corr_blks += (val_hi << 16 | val_lo);
+ 
+-			val_lo = rpm_read(rpm, lmac_id,
+-					  RPMX_MTI_FCFECX_VL1_NCCW_LO);
+-			val_hi = rpm_read(rpm, lmac_id,
+-					  RPMX_MTI_FCFECX_CW_HI);
++			val_lo = rpm_read(rpm, 0,
++					  RPMX_MTI_FCFECX_VL1_NCCW_LO(lmac_id));
++			val_hi = rpm_read(rpm, 0,
++					  RPMX_MTI_FCFECX_CW_HI(lmac_id));
+ 			rsp->fec_uncorr_blks += (val_hi << 16 | val_lo);
+ 		}
+ 	} else {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index a5773fbacaff8..5194fec4c3b8e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -91,11 +91,11 @@
+ #define RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC            0x40000
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2		0x40050
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3		0x40058
+-#define RPMX_MTI_FCFECX_VL0_CCW_LO			0x38618
+-#define RPMX_MTI_FCFECX_VL0_NCCW_LO			0x38620
+-#define RPMX_MTI_FCFECX_VL1_CCW_LO			0x38628
+-#define RPMX_MTI_FCFECX_VL1_NCCW_LO			0x38630
+-#define RPMX_MTI_FCFECX_CW_HI				0x38638
++#define RPMX_MTI_FCFECX_VL0_CCW_LO(a)			(0x38618 + ((a) * 0x40))
++#define RPMX_MTI_FCFECX_VL0_NCCW_LO(a)			(0x38620 + ((a) * 0x40))
++#define RPMX_MTI_FCFECX_VL1_CCW_LO(a)			(0x38628 + ((a) * 0x40))
++#define RPMX_MTI_FCFECX_VL1_NCCW_LO(a)			(0x38630 + ((a) * 0x40))
++#define RPMX_MTI_FCFECX_CW_HI(a)			(0x38638 + ((a) * 0x40))
+ 
+ /* CN10KB CSR Declaration */
+ #define  RPM2_CMRX_SW_INT				0x1b0
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-af-rpm-fix-stale-rsfec-counters.patch b/queue-6.6/octeontx2-af-rpm-fix-stale-rsfec-counters.patch
new file mode 100644
index 00000000000..e9976fd0b3e
--- /dev/null
+++ b/queue-6.6/octeontx2-af-rpm-fix-stale-rsfec-counters.patch
@@ -0,0 +1,83 @@
+From 8457e5ccbee1c0006622d42ca0a6246a1c71930d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 21:50:33 +0530
+Subject: octeontx2-af: RPM: fix stale RSFEC counters
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit 07cd1eb166a3fa7244afa74d48bd13c9df7c559d ]
+
+The earlier patch sets the 'Stats control register' for RPM
+receive/transmit statistics instead of RSFEC statistics,
+causing the driver to return stale FEC counters.
+
+Fixes: 84ad3642115d ("octeontx2-af: Add FEC stats for RPM/RPM_USX block")
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 13 +++++++++----
+ drivers/net/ethernet/marvell/octeontx2/af/rpm.h |  4 +++-
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index 22dd50a3fcd3a..70629f94c27ef 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -699,6 +699,10 @@ int rpm_get_fec_stats(void *rpmd, int lmac_id, struct cgx_fec_stats_rsp *rsp)
+ 	if (rpm->lmac_idmap[lmac_id]->link_info.fec == OTX2_FEC_NONE)
+ 		return 0;
+ 
++	/* latched registers FCFECX_CW_HI/RSFEC_STAT_FAST_DATA_HI_CDC are common
++	 * for all counters. Acquire lock to ensure serialized reads
++	 */
++	mutex_lock(&rpm->lock);
+ 	if (rpm->lmac_idmap[lmac_id]->link_info.fec == OTX2_FEC_BASER) {
+ 		val_lo = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_VL0_CCW_LO);
+ 		val_hi = rpm_read(rpm, lmac_id, RPMX_MTI_FCFECX_CW_HI);
+@@ -725,20 +729,21 @@ int rpm_get_fec_stats(void *rpmd, int lmac_id, struct cgx_fec_stats_rsp *rsp)
+ 		}
+ 	} else {
+ 		/* enable RS-FEC capture */
+-		cfg = rpm_read(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL);
++		cfg = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_STATN_CONTROL);
+ 		cfg |= RPMX_RSFEC_RX_CAPTURE | BIT(lmac_id);
+-		rpm_write(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL, cfg);
++		rpm_write(rpm, 0, RPMX_MTI_RSFEC_STAT_STATN_CONTROL, cfg);
+ 
+ 		val_lo = rpm_read(rpm, 0,
+ 				  RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2);
+-		val_hi = rpm_read(rpm, 0, RPMX_MTI_STAT_DATA_HI_CDC);
++		val_hi = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC);
+ 		rsp->fec_corr_blks = (val_hi << 32 | val_lo);
+ 
+ 		val_lo = rpm_read(rpm, 0,
+ 				  RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3);
+-		val_hi = rpm_read(rpm, 0, RPMX_MTI_STAT_DATA_HI_CDC);
++		val_hi = rpm_read(rpm, 0, RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC);
+ 		rsp->fec_uncorr_blks = (val_hi << 32 | val_lo);
+ 	}
++	mutex_unlock(&rpm->lock);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index 34b11deb0f3c1..a5773fbacaff8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -84,9 +84,11 @@
+ /* FEC stats */
+ #define RPMX_MTI_STAT_STATN_CONTROL			0x10018
+ #define RPMX_MTI_STAT_DATA_HI_CDC			0x10038
+-#define RPMX_RSFEC_RX_CAPTURE				BIT_ULL(27)
++#define RPMX_RSFEC_RX_CAPTURE				BIT_ULL(28)
+ #define RPMX_CMD_CLEAR_RX				BIT_ULL(30)
+ #define RPMX_CMD_CLEAR_TX				BIT_ULL(31)
++#define RPMX_MTI_RSFEC_STAT_STATN_CONTROL               0x40018
++#define RPMX_MTI_RSFEC_STAT_FAST_DATA_HI_CDC            0x40000
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2		0x40050
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3		0x40058
+ #define RPMX_MTI_FCFECX_VL0_CCW_LO			0x38618
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-cn10.patch b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-cn10.patch
new file mode 100644
index 00000000000..6552bae31e8
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-cn10.patch
@@ -0,0 +1,39 @@
+From a44e76dfa5da5a2be1731b294d4fd5706cf35bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 19:10:36 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit ac9183023b6a9c09467516abd8aab04f9a2f9564 ]
+
+Add error pointer check after calling otx2_mbox_get_rsp().
+
+Fixes: 2ca89a2c3752 ("octeontx2-pf: TC_MATCHALL ingress ratelimiting offload")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+index c1c99d7054f87..7417087b6db59 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k.c
+@@ -203,6 +203,11 @@ int cn10k_alloc_leaf_profile(struct otx2_nic *pfvf, u16 *leaf)
+ 
+ 	rsp = (struct  nix_bandprof_alloc_rsp *)
+ 	       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
++	if (IS_ERR(rsp)) {
++		rc = PTR_ERR(rsp);
++		goto out;
++	}
++
+ 	if (!rsp->prof_count[BAND_PROF_LEAF_LAYER]) {
+ 		rc = -EIO;
+ 		goto out;
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch
new file mode 100644
index 00000000000..dfd1d0cc5fe
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch
@@ -0,0 +1,38 @@
+From 9c297647534aaa8f7612b2fcd2a8357421a848f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 18:56:33 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit 0fbc7a5027c6f7f2c785adae3dcec22b2f2b69b3 ]
+
+Add error pointer check after calling otx2_mbox_get_rsp().
+
+Fixes: ab58a416c93f ("octeontx2-pf: cn10k: Get max mtu supported from admin function")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index b3064377510ed..47adccf7a7776 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -1837,6 +1837,10 @@ u16 otx2_get_max_mtu(struct otx2_nic *pfvf)
+ 	if (!rc) {
+ 		rsp = (struct nix_hw_info *)
+ 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
++		if (IS_ERR(rsp)) {
++			rc = PTR_ERR(rsp);
++			goto out;
++		}
+ 
+ 		/* HW counts VLAN insertion bytes (8 for double tag)
+ 		 * irrespective of whether SQE is requesting to insert VLAN
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-1819 b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-1819
new file mode 100644
index 00000000000..b84e996391c
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-1819
@@ -0,0 +1,60 @@
+From ded3ceda0e2d1f15c592796926ea58aed91caa2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 19:08:44 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit bd3110bc102ab6292656b8118be819faa0de8dd0 ]
+
+Adding error pointer check after calling otx2_mbox_get_rsp().
+
+Fixes: 9917060fc30a ("octeontx2-pf: Cleanup flow rule management")
+Fixes: f0a1913f8a6f ("octeontx2-pf: Add support for ethtool ntuple filters")
+Fixes: 674b3e164238 ("octeontx2-pf: Add additional checks while configuring ucast/bcast/mcast rules")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+index 97a71e9b85637..e6082f90f57a5 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+@@ -121,6 +121,8 @@ int otx2_alloc_mcam_entries(struct otx2_nic *pfvf, u16 count)
+ 
+ 		rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp
+ 			(&pfvf->mbox.mbox, 0, &req->hdr);
++		if (IS_ERR(rsp))
++			goto exit;
+ 
+ 		for (ent = 0; ent < rsp->count; ent++)
+ 			flow_cfg->flow_ent[ent + allocated] = rsp->entry_list[ent];
+@@ -199,6 +201,10 @@ static int otx2_mcam_entry_init(struct otx2_nic *pfvf)
+ 
+ 	rsp = (struct npc_mcam_alloc_entry_rsp *)otx2_mbox_get_rsp
+ 	       (&pfvf->mbox.mbox, 0, &req->hdr);
++	if (IS_ERR(rsp)) {
++		mutex_unlock(&pfvf->mbox.lock);
++		return PTR_ERR(rsp);
++	}
+ 
+ 	if (rsp->count != req->count) {
+ 		netdev_info(pfvf->netdev,
+@@ -234,6 +240,10 @@ static int otx2_mcam_entry_init(struct otx2_nic *pfvf)
+ 
+ 	frsp = (struct npc_get_field_status_rsp *)otx2_mbox_get_rsp
+ 	       (&pfvf->mbox.mbox, 0, &freq->hdr);
++	if (IS_ERR(frsp)) {
++		mutex_unlock(&pfvf->mbox.lock);
++		return PTR_ERR(frsp);
++	}
+ 
+ 	if (frsp->enable) {
+ 		pfvf->flags |= OTX2_FLAG_RX_VLAN_SUPPORT;
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-18928 b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-18928
new file mode 100644
index 00000000000..047eefdd2c6
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-18928
@@ -0,0 +1,52 @@
+From 8cc13a3b144011fae225e125a8c72c6f5c22a772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 19:02:29 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ]
+
+Add error pointer check after calling otx2_mbox_get_rsp().
+
+Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool")
+Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c  | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+index 8b7fc0af91ced..532e84bc38c73 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c
+@@ -343,6 +343,11 @@ static void otx2_get_pauseparam(struct net_device *netdev,
+ 	if (!otx2_sync_mbox_msg(&pfvf->mbox)) {
+ 		rsp = (struct cgx_pause_frm_cfg *)
+ 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
++		if (IS_ERR(rsp)) {
++			mutex_unlock(&pfvf->mbox.lock);
++			return;
++		}
++
+ 		pause->rx_pause = rsp->rx_pause;
+ 		pause->tx_pause = rsp->tx_pause;
+ 	}
+@@ -1082,6 +1087,11 @@ static int otx2_set_fecparam(struct net_device *netdev,
+ 
+ 	rsp = (struct fec_mode *)otx2_mbox_get_rsp(&pfvf->mbox.mbox,
+ 						   0, &req->hdr);
++	if (IS_ERR(rsp)) {
++		err = PTR_ERR(rsp);
++		goto end;
++	}
++
+ 	if (rsp->fec >= 0)
+ 		pfvf->linfo.fec = rsp->fec;
+ 	else
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-5160 b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-5160
new file mode 100644
index 00000000000..2b4cb0211f3
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-5160
@@ -0,0 +1,39 @@
+From fb2ae5a183b1ac3e7a6726ccac4fbab277ca7338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 19:16:16 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit 69297b0d3369488af259e3a7cf53d69157938ea1 ]
+
+Add error pointer check after calling otx2_mbox_get_rsp().
+
+Fixes: 8e67558177f8 ("octeontx2-pf: PFC config support with DCBx")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
+index aa01110f04a33..294fba58b6709 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
+@@ -315,6 +315,11 @@ int otx2_config_priority_flow_ctrl(struct otx2_nic *pfvf)
+ 	if (!otx2_sync_mbox_msg(&pfvf->mbox)) {
+ 		rsp = (struct cgx_pfc_rsp *)
+ 		       otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
++		if (IS_ERR(rsp)) {
++			err = PTR_ERR(rsp);
++			goto unlock;
++		}
++
+ 		if (req->rx_pause != rsp->rx_pause || req->tx_pause != rsp->tx_pause) {
+ 			dev_warn(pfvf->dev,
+ 				 "Failed to config PFC\n");
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-921 b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-921
new file mode 100644
index 00000000000..a67b6b5ad9f
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-921
@@ -0,0 +1,51 @@
+From 294c979d0f876680488337bf05435f1b70667bfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 19:13:54 +0000
+Subject: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c
+
+From: Dipendra Khadka <kdipendra88@gmail.com>
+
+[ Upstream commit f5b942e6c54b13246ee49d42dcfb71b7f29e3c64 ]
+
+Add error pointer checks after calling otx2_mbox_get_rsp().
+
+Fixes: 79d2be385e9e ("octeontx2-pf: offload DMAC filters to CGX/RPM block")
+Fixes: fa5e0ccb8f3a ("octeontx2-pf: Add support for exact match table.")
+Signed-off-by: Dipendra Khadka <kdipendra88@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c   | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c
+index 80d853b343f98..2046dd0da00d8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dmac_flt.c
+@@ -28,6 +28,11 @@ static int otx2_dmacflt_do_add(struct otx2_nic *pf, const u8 *mac,
+ 	if (!err) {
+ 		rsp = (struct cgx_mac_addr_add_rsp *)
+ 			 otx2_mbox_get_rsp(&pf->mbox.mbox, 0, &req->hdr);
++		if (IS_ERR(rsp)) {
++			mutex_unlock(&pf->mbox.lock);
++			return PTR_ERR(rsp);
++		}
++
+ 		*dmac_index = rsp->index;
+ 	}
+ 
+@@ -200,6 +205,10 @@ int otx2_dmacflt_update(struct otx2_nic *pf, u8 *mac, u32 bit_pos)
+ 
+ 	rsp = (struct cgx_mac_addr_update_rsp *)
+ 		otx2_mbox_get_rsp(&pf->mbox.mbox, 0, &req->hdr);
++	if (IS_ERR(rsp)) {
++		rc = PTR_ERR(rsp);
++		goto out;
++	}
+ 
+ 	pf->flow_cfg->bmap_to_dmacindex[bit_pos] = rsp->index;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/octeontx2-pf-reset-mac-stats-during-probe.patch b/queue-6.6/octeontx2-pf-reset-mac-stats-during-probe.patch
new file mode 100644
index 00000000000..a6d0ee4566e
--- /dev/null
+++ b/queue-6.6/octeontx2-pf-reset-mac-stats-during-probe.patch
@@ -0,0 +1,270 @@
+From 124f4c1eddf7e574916214999b2484cadeb3185a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Mar 2024 18:18:19 +0530
+Subject: octeontx2-pf: Reset MAC stats during probe
+
+From: Sai Krishna <saikrishnag@marvell.com>
+
+[ Upstream commit 4c6ce450a8bb4bdf71959fd226414b079f0f0e02 ]
+
+Reset CGX/RPM MAC HW statistics at the time of driver probe()
+
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: 07cd1eb166a3 ("octeontx2-af: RPM: fix stale RSFEC counters")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/af/cgx.c   | 27 +++++++++++++++++
+ .../net/ethernet/marvell/octeontx2/af/cgx.h   |  1 +
+ .../marvell/octeontx2/af/lmac_common.h        |  1 +
+ .../net/ethernet/marvell/octeontx2/af/mbox.h  |  1 +
+ .../net/ethernet/marvell/octeontx2/af/rpm.c   | 17 +++++++++++
+ .../net/ethernet/marvell/octeontx2/af/rpm.h   |  3 ++
+ .../ethernet/marvell/octeontx2/af/rvu_cgx.c   | 29 +++++++++++++++++++
+ .../marvell/octeontx2/nic/otx2_common.h       |  1 +
+ .../ethernet/marvell/octeontx2/nic/otx2_pf.c  | 20 +++++++++++++
+ 9 files changed, 100 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index aea963017d261..2e77911cbbe34 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -24,6 +24,8 @@
+ #define DRV_NAME	"Marvell-CGX/RPM"
+ #define DRV_STRING      "Marvell CGX/RPM Driver"
+ 
++#define CGX_RX_STAT_GLOBAL_INDEX	9
++
+ static LIST_HEAD(cgx_list);
+ 
+ /* Convert firmware speed encoding to user format(Mbps) */
+@@ -706,6 +708,30 @@ u64 cgx_features_get(void *cgxd)
+ 	return ((struct cgx *)cgxd)->hw_features;
+ }
+ 
++int cgx_stats_reset(void *cgxd, int lmac_id)
++{
++	struct cgx *cgx = cgxd;
++	int stat_id;
++
++	if (!is_lmac_valid(cgx, lmac_id))
++		return -ENODEV;
++
++	for (stat_id = 0 ; stat_id < CGX_RX_STATS_COUNT; stat_id++) {
++		if (stat_id >= CGX_RX_STAT_GLOBAL_INDEX)
++		/* pass lmac as 0 for CGX_CMR_RX_STAT9-12 */
++			cgx_write(cgx, 0,
++				  (CGXX_CMRX_RX_STAT0 + (stat_id * 8)), 0);
++		else
++			cgx_write(cgx, lmac_id,
++				  (CGXX_CMRX_RX_STAT0 + (stat_id * 8)), 0);
++	}
++
++	for (stat_id = 0 ; stat_id < CGX_TX_STATS_COUNT; stat_id++)
++		cgx_write(cgx, lmac_id, CGXX_CMRX_TX_STAT0 + (stat_id * 8), 0);
++
++	return 0;
++}
++
+ static int cgx_set_fec_stats_count(struct cgx_link_user_info *linfo)
+ {
+ 	if (!linfo->fec)
+@@ -1795,6 +1821,7 @@ static struct mac_ops	cgx_mac_ops    = {
+ 	.pfc_config =                   cgx_lmac_pfc_config,
+ 	.mac_get_pfc_frm_cfg   =        cgx_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			cgx_lmac_reset,
++	.mac_stats_reset       =	cgx_stats_reset,
+ };
+ 
+ static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+index 226ff7f0df52a..f9cd4b58f0c02 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h
+@@ -141,6 +141,7 @@ int cgx_lmac_evh_register(struct cgx_event_cb *cb, void *cgxd, int lmac_id);
+ int cgx_lmac_evh_unregister(void *cgxd, int lmac_id);
+ int cgx_get_tx_stats(void *cgxd, int lmac_id, int idx, u64 *tx_stat);
+ int cgx_get_rx_stats(void *cgxd, int lmac_id, int idx, u64 *rx_stat);
++int cgx_stats_reset(void *cgxd, int lmac_id);
+ int cgx_lmac_rx_tx_enable(void *cgxd, int lmac_id, bool enable);
+ int cgx_lmac_tx_enable(void *cgxd, int lmac_id, bool enable);
+ int cgx_lmac_addr_set(u8 cgx_id, u8 lmac_id, u8 *mac_addr);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+index 50fcc436d8a79..c43ff68ef1408 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h
+@@ -131,6 +131,7 @@ struct mac_ops {
+ 	/* FEC stats */
+ 	int			(*get_fec_stats)(void *cgxd, int lmac_id,
+ 						 struct cgx_fec_stats_rsp *rsp);
++	int			(*mac_stats_reset)(void *cgxd, int lmac_id);
+ };
+ 
+ struct cgx {
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+index e883c0929b1a9..b4b23e475c95f 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/mbox.h
+@@ -174,6 +174,7 @@ M(CGX_FEC_STATS,	0x217, cgx_fec_stats, msg_req, cgx_fec_stats_rsp) \
+ M(CGX_SET_LINK_MODE,	0x218, cgx_set_link_mode, cgx_set_link_mode_req,\
+ 			       cgx_set_link_mode_rsp)	\
+ M(CGX_GET_PHY_FEC_STATS, 0x219, cgx_get_phy_fec_stats, msg_req, msg_rsp) \
++M(CGX_STATS_RST,	0x21A, cgx_stats_rst, msg_req, msg_rsp)		\
+ M(CGX_FEATURES_GET,	0x21B, cgx_features_get, msg_req,		\
+ 			       cgx_features_info_msg)			\
+ M(RPM_STATS,		0x21C, rpm_stats, msg_req, rpm_stats_rsp)	\
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+index 4d2d15834f9df..22dd50a3fcd3a 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c
+@@ -38,6 +38,7 @@ static struct mac_ops		rpm_mac_ops   = {
+ 	.pfc_config =                   rpm_lmac_pfc_config,
+ 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			rpm_lmac_reset,
++	.mac_stats_reset		 =	  rpm_stats_reset,
+ };
+ 
+ static struct mac_ops		rpm2_mac_ops   = {
+@@ -70,6 +71,7 @@ static struct mac_ops		rpm2_mac_ops   = {
+ 	.pfc_config =                   rpm_lmac_pfc_config,
+ 	.mac_get_pfc_frm_cfg   =        rpm_lmac_get_pfc_frm_cfg,
+ 	.mac_reset   =			rpm_lmac_reset,
++	.mac_stats_reset	    =	rpm_stats_reset,
+ };
+ 
+ bool is_dev_rpm2(void *rpmd)
+@@ -443,6 +445,21 @@ int rpm_get_tx_stats(void *rpmd, int lmac_id, int idx, u64 *tx_stat)
+ 	return 0;
+ }
+ 
++int rpm_stats_reset(void *rpmd, int lmac_id)
++{
++	rpm_t *rpm = rpmd;
++	u64 cfg;
++
++	if (!is_lmac_valid(rpm, lmac_id))
++		return -ENODEV;
++
++	cfg = rpm_read(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL);
++	cfg |= RPMX_CMD_CLEAR_TX | RPMX_CMD_CLEAR_RX | BIT_ULL(lmac_id);
++	rpm_write(rpm, 0, RPMX_MTI_STAT_STATN_CONTROL, cfg);
++
++	return 0;
++}
++
+ u8 rpm_get_lmac_type(void *rpmd, int lmac_id)
+ {
+ 	rpm_t *rpm = rpmd;
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+index b79cfbc6f8770..34b11deb0f3c1 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h
+@@ -85,6 +85,8 @@
+ #define RPMX_MTI_STAT_STATN_CONTROL			0x10018
+ #define RPMX_MTI_STAT_DATA_HI_CDC			0x10038
+ #define RPMX_RSFEC_RX_CAPTURE				BIT_ULL(27)
++#define RPMX_CMD_CLEAR_RX				BIT_ULL(30)
++#define RPMX_CMD_CLEAR_TX				BIT_ULL(31)
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_2		0x40050
+ #define RPMX_MTI_RSFEC_STAT_COUNTER_CAPTURE_3		0x40058
+ #define RPMX_MTI_FCFECX_VL0_CCW_LO			0x38618
+@@ -134,4 +136,5 @@ int rpm2_get_nr_lmacs(void *rpmd);
+ bool is_dev_rpm2(void *rpmd);
+ int rpm_get_fec_stats(void *cgxd, int lmac_id, struct cgx_fec_stats_rsp *rsp);
+ int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr);
++int rpm_stats_reset(void *rpmd, int lmac_id);
+ #endif /* RPM_H */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+index 898584b1aa608..7fc094419ef2b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -604,6 +604,35 @@ int rvu_mbox_handler_rpm_stats(struct rvu *rvu, struct msg_req *req,
+ 	return rvu_lmac_get_stats(rvu, req, (void *)rsp);
+ }
+ 
++int rvu_mbox_handler_cgx_stats_rst(struct rvu *rvu, struct msg_req *req,
++				   struct msg_rsp *rsp)
++{
++	int pf = rvu_get_pf(req->hdr.pcifunc);
++	struct rvu_pfvf	*parent_pf;
++	struct mac_ops *mac_ops;
++	u8 cgx_idx, lmac;
++	void *cgxd;
++
++	if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc))
++		return LMAC_AF_ERR_PERM_DENIED;
++
++	parent_pf = &rvu->pf[pf];
++	/* To ensure reset cgx stats won't affect VF stats,
++	 *  check if it used by only PF interface.
++	 *  If not, return
++	 */
++	if (parent_pf->cgx_users > 1) {
++		dev_info(rvu->dev, "CGX busy, could not reset statistics\n");
++		return 0;
++	}
++
++	rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_idx, &lmac);
++	cgxd = rvu_cgx_pdata(cgx_idx, rvu);
++	mac_ops = get_mac_ops(cgxd);
++
++	return mac_ops->mac_stats_reset(cgxd, lmac);
++}
++
+ int rvu_mbox_handler_cgx_fec_stats(struct rvu *rvu,
+ 				   struct msg_req *req,
+ 				   struct cgx_fec_stats_rsp *rsp)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index 7e16a341ec588..c5de3ba33e2f0 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -961,6 +961,7 @@ void otx2_get_mac_from_af(struct net_device *netdev);
+ void otx2_config_irq_coalescing(struct otx2_nic *pfvf, int qidx);
+ int otx2_config_pause_frm(struct otx2_nic *pfvf);
+ void otx2_setup_segmentation(struct otx2_nic *pfvf);
++int otx2_reset_mac_stats(struct otx2_nic *pfvf);
+ 
+ /* RVU block related APIs */
+ int otx2_attach_npa_nix(struct otx2_nic *pfvf);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index 3f46d5e0fb2ec..b4194ec2a1f2d 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -1150,6 +1150,23 @@ static int otx2_cgx_config_linkevents(struct otx2_nic *pf, bool enable)
+ 	return err;
+ }
+ 
++int otx2_reset_mac_stats(struct otx2_nic *pfvf)
++{
++	struct msg_req *req;
++	int err;
++
++	mutex_lock(&pfvf->mbox.lock);
++	req = otx2_mbox_alloc_msg_cgx_stats_rst(&pfvf->mbox);
++	if (!req) {
++		mutex_unlock(&pfvf->mbox.lock);
++		return -ENOMEM;
++	}
++
++	err = otx2_sync_mbox_msg(&pfvf->mbox);
++	mutex_unlock(&pfvf->mbox.lock);
++	return err;
++}
++
+ static int otx2_cgx_config_loopback(struct otx2_nic *pf, bool enable)
+ {
+ 	struct msg_req *msg;
+@@ -3038,6 +3055,9 @@ static int otx2_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	netdev->min_mtu = OTX2_MIN_MTU;
+ 	netdev->max_mtu = otx2_get_max_mtu(pf);
+ 
++	/* reset CGX/RPM MAC stats */
++	otx2_reset_mac_stats(pf);
++
+ 	err = register_netdev(netdev);
+ 	if (err) {
+ 		dev_err(dev, "Failed to register netdevice\n");
+-- 
+2.43.0
+
diff --git a/queue-6.6/of-fdt-add-dt_phys-arg-to-early_init_dt_scan-and-ear.patch b/queue-6.6/of-fdt-add-dt_phys-arg-to-early_init_dt_scan-and-ear.patch
new file mode 100644
index 00000000000..261c4a03ec6
--- /dev/null
+++ b/queue-6.6/of-fdt-add-dt_phys-arg-to-early_init_dt_scan-and-ear.patch
@@ -0,0 +1,385 @@
+From 47ed9d45969b63a45bd79a689ca0e6e710465aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 18:14:26 +0100
+Subject: of/fdt: add dt_phys arg to early_init_dt_scan and
+ early_init_dt_verify
+
+From: Usama Arif <usamaarif642@gmail.com>
+
+[ Upstream commit b2473a359763e27567993e7d8f37de82f57a0829 ]
+
+ __pa() is only intended to be used for linear map addresses and using
+it for initial_boot_params which is in fixmap for arm64 will give an
+incorrect value. Hence save the physical address when it is known at
+boot time when calling early_init_dt_scan for arm64 and use it at kexec
+time instead of converting the virtual address using __pa().
+
+Note that arm64 doesn't need the FDT region reserved in the DT as the
+kernel explicitly reserves the passed in FDT. Therefore, only a debug
+warning is fixed with this change.
+
+Reported-by: Breno Leitao <leitao@debian.org>
+Suggested-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Usama Arif <usamaarif642@gmail.com>
+Fixes: ac10be5cdbfa ("arm64: Use common of_kexec_alloc_and_setup_fdt()")
+Link: https://lore.kernel.org/r/20241023171426.452688-1-usamaarif642@gmail.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/devtree.c              |  2 +-
+ arch/arm/kernel/devtree.c              |  2 +-
+ arch/arm64/kernel/setup.c              |  6 +++++-
+ arch/csky/kernel/setup.c               |  4 ++--
+ arch/loongarch/kernel/setup.c          |  2 +-
+ arch/microblaze/kernel/prom.c          |  2 +-
+ arch/mips/kernel/prom.c                |  2 +-
+ arch/mips/kernel/relocate.c            |  2 +-
+ arch/nios2/kernel/prom.c               |  4 ++--
+ arch/openrisc/kernel/prom.c            |  2 +-
+ arch/powerpc/kernel/dt_cpu_ftrs.c      |  2 +-
+ arch/powerpc/kernel/prom.c             |  2 +-
+ arch/powerpc/platforms/pseries/plpks.c |  2 +-
+ arch/riscv/kernel/setup.c              |  2 +-
+ arch/sh/kernel/setup.c                 |  2 +-
+ arch/um/kernel/dtb.c                   |  2 +-
+ arch/x86/kernel/devicetree.c           |  2 +-
+ arch/xtensa/kernel/setup.c             |  2 +-
+ drivers/of/fdt.c                       | 14 ++++++++------
+ drivers/of/kexec.c                     |  2 +-
+ include/linux/of_fdt.h                 |  5 +++--
+ 21 files changed, 36 insertions(+), 29 deletions(-)
+
+diff --git a/arch/arc/kernel/devtree.c b/arch/arc/kernel/devtree.c
+index 4c9e61457b2f6..cc6ac7d128aa1 100644
+--- a/arch/arc/kernel/devtree.c
++++ b/arch/arc/kernel/devtree.c
+@@ -62,7 +62,7 @@ const struct machine_desc * __init setup_machine_fdt(void *dt)
+ 	const struct machine_desc *mdesc;
+ 	unsigned long dt_root;
+ 
+-	if (!early_init_dt_scan(dt))
++	if (!early_init_dt_scan(dt, __pa(dt)))
+ 		return NULL;
+ 
+ 	mdesc = of_flat_dt_match_machine(NULL, arch_get_next_mach);
+diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
+index 264827281113b..abf13b21ba76f 100644
+--- a/arch/arm/kernel/devtree.c
++++ b/arch/arm/kernel/devtree.c
+@@ -201,7 +201,7 @@ const struct machine_desc * __init setup_machine_fdt(void *dt_virt)
+ 
+ 	mdesc_best = &__mach_desc_GENERIC_DT;
+ 
+-	if (!dt_virt || !early_init_dt_verify(dt_virt))
++	if (!dt_virt || !early_init_dt_verify(dt_virt, __pa(dt_virt)))
+ 		return NULL;
+ 
+ 	mdesc = of_flat_dt_match_machine(mdesc_best, arch_get_next_mach);
+diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
+index c583d1f335f8c..040b0175334c0 100644
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -190,7 +190,11 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
+ 	if (dt_virt)
+ 		memblock_reserve(dt_phys, size);
+ 
+-	if (!dt_virt || !early_init_dt_scan(dt_virt)) {
++	/*
++	 * dt_virt is a fixmap address, hence __pa(dt_virt) can't be used.
++	 * Pass dt_phys directly.
++	 */
++	if (!early_init_dt_scan(dt_virt, dt_phys)) {
+ 		pr_crit("\n"
+ 			"Error: invalid device tree blob at physical address %pa (virtual address 0x%px)\n"
+ 			"The dtb must be 8-byte aligned and must not exceed 2 MB in size\n"
+diff --git a/arch/csky/kernel/setup.c b/arch/csky/kernel/setup.c
+index 106fbf0b6f3b4..2d85484ae0e7e 100644
+--- a/arch/csky/kernel/setup.c
++++ b/arch/csky/kernel/setup.c
+@@ -124,9 +124,9 @@ asmlinkage __visible void __init csky_start(unsigned int unused,
+ 	pre_trap_init();
+ 
+ 	if (dtb_start == NULL)
+-		early_init_dt_scan(__dtb_start);
++		early_init_dt_scan(__dtb_start, __pa(dtb_start));
+ 	else
+-		early_init_dt_scan(dtb_start);
++		early_init_dt_scan(dtb_start, __pa(dtb_start));
+ 
+ 	start_kernel();
+ 
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 065f2db57c099..7ef1c1ff1fc44 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -304,7 +304,7 @@ static void __init fdt_setup(void)
+ 	if (!fdt_pointer || fdt_check_header(fdt_pointer))
+ 		return;
+ 
+-	early_init_dt_scan(fdt_pointer);
++	early_init_dt_scan(fdt_pointer, __pa(fdt_pointer));
+ 	early_init_fdt_reserve_self();
+ 
+ 	max_low_pfn = PFN_PHYS(memblock_end_of_DRAM());
+diff --git a/arch/microblaze/kernel/prom.c b/arch/microblaze/kernel/prom.c
+index e424c796e297c..76ac4cfdfb42c 100644
+--- a/arch/microblaze/kernel/prom.c
++++ b/arch/microblaze/kernel/prom.c
+@@ -18,7 +18,7 @@ void __init early_init_devtree(void *params)
+ {
+ 	pr_debug(" -> early_init_devtree(%p)\n", params);
+ 
+-	early_init_dt_scan(params);
++	early_init_dt_scan(params, __pa(params));
+ 	if (!strlen(boot_command_line))
+ 		strscpy(boot_command_line, cmd_line, COMMAND_LINE_SIZE);
+ 
+diff --git a/arch/mips/kernel/prom.c b/arch/mips/kernel/prom.c
+index f88ce78e13e3a..474dc1eec3bb5 100644
+--- a/arch/mips/kernel/prom.c
++++ b/arch/mips/kernel/prom.c
+@@ -39,7 +39,7 @@ char *mips_get_machine_name(void)
+ 
+ void __init __dt_setup_arch(void *bph)
+ {
+-	if (!early_init_dt_scan(bph))
++	if (!early_init_dt_scan(bph, __pa(bph)))
+ 		return;
+ 
+ 	mips_set_machine_name(of_flat_dt_get_machine_name());
+diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
+index 58fc8d089402b..6d35d4f7ebe19 100644
+--- a/arch/mips/kernel/relocate.c
++++ b/arch/mips/kernel/relocate.c
+@@ -337,7 +337,7 @@ void *__init relocate_kernel(void)
+ #if defined(CONFIG_USE_OF)
+ 	/* Deal with the device tree */
+ 	fdt = plat_get_fdt();
+-	early_init_dt_scan(fdt);
++	early_init_dt_scan(fdt, __pa(fdt));
+ 	if (boot_command_line[0]) {
+ 		/* Boot command line was passed in device tree */
+ 		strscpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+diff --git a/arch/nios2/kernel/prom.c b/arch/nios2/kernel/prom.c
+index 8d98af5c7201b..15bbdd78e9bf2 100644
+--- a/arch/nios2/kernel/prom.c
++++ b/arch/nios2/kernel/prom.c
+@@ -26,12 +26,12 @@ void __init early_init_devtree(void *params)
+ 	if (be32_to_cpup((__be32 *)CONFIG_NIOS2_DTB_PHYS_ADDR) ==
+ 		 OF_DT_HEADER) {
+ 		params = (void *)CONFIG_NIOS2_DTB_PHYS_ADDR;
+-		early_init_dt_scan(params);
++		early_init_dt_scan(params, __pa(params));
+ 		return;
+ 	}
+ #endif
+ 	if (be32_to_cpu((__be32) *dtb) == OF_DT_HEADER)
+ 		params = (void *)__dtb_start;
+ 
+-	early_init_dt_scan(params);
++	early_init_dt_scan(params, __pa(params));
+ }
+diff --git a/arch/openrisc/kernel/prom.c b/arch/openrisc/kernel/prom.c
+index 19e6008bf114c..e424e9bd12a79 100644
+--- a/arch/openrisc/kernel/prom.c
++++ b/arch/openrisc/kernel/prom.c
+@@ -22,6 +22,6 @@
+ 
+ void __init early_init_devtree(void *params)
+ {
+-	early_init_dt_scan(params);
++	early_init_dt_scan(params, __pa(params));
+ 	memblock_allow_resize();
+ }
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index c3fb9fdf5bd78..a84e75fff1dfe 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -857,7 +857,7 @@ bool __init dt_cpu_ftrs_init(void *fdt)
+ 	using_dt_cpu_ftrs = false;
+ 
+ 	/* Setup and verify the FDT, if it fails we just bail */
+-	if (!early_init_dt_verify(fdt))
++	if (!early_init_dt_verify(fdt, __pa(fdt)))
+ 		return false;
+ 
+ 	if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index bf6d8ad3819e9..7d5eccf3f80d9 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -781,7 +781,7 @@ void __init early_init_devtree(void *params)
+ 	DBG(" -> early_init_devtree(%px)\n", params);
+ 
+ 	/* Too early to BUG_ON(), do it by hand */
+-	if (!early_init_dt_verify(params))
++	if (!early_init_dt_verify(params, __pa(params)))
+ 		panic("BUG: Failed verifying flat device tree, bad version?");
+ 
+ 	of_scan_flat_dt(early_init_dt_scan_model, NULL);
+diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
+index ed492d38f6ad6..fe7a43a8a1f46 100644
+--- a/arch/powerpc/platforms/pseries/plpks.c
++++ b/arch/powerpc/platforms/pseries/plpks.c
+@@ -683,7 +683,7 @@ void __init plpks_early_init_devtree(void)
+ out:
+ 	fdt_nop_property(fdt, chosen_node, "ibm,plpks-pw");
+ 	// Since we've cleared the password, we must update the FDT checksum
+-	early_init_dt_verify(fdt);
++	early_init_dt_verify(fdt, __pa(fdt));
+ }
+ 
+ static __init int pseries_plpks_init(void)
+diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
+index ddadee6621f0d..1fa501b7d0c86 100644
+--- a/arch/riscv/kernel/setup.c
++++ b/arch/riscv/kernel/setup.c
+@@ -246,7 +246,7 @@ static void __init init_resources(void)
+ static void __init parse_dtb(void)
+ {
+ 	/* Early scan of device tree from init memory */
+-	if (early_init_dt_scan(dtb_early_va)) {
++	if (early_init_dt_scan(dtb_early_va, __pa(dtb_early_va))) {
+ 		const char *name = of_flat_dt_get_machine_name();
+ 
+ 		if (name) {
+diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
+index b3da2757faaf3..1fb59c69b97c8 100644
+--- a/arch/sh/kernel/setup.c
++++ b/arch/sh/kernel/setup.c
+@@ -260,7 +260,7 @@ void __ref sh_fdt_init(phys_addr_t dt_phys)
+ 	dt_virt = phys_to_virt(dt_phys);
+ #endif
+ 
+-	if (!dt_virt || !early_init_dt_scan(dt_virt)) {
++	if (!dt_virt || !early_init_dt_scan(dt_virt, __pa(dt_virt))) {
+ 		pr_crit("Error: invalid device tree blob"
+ 			" at physical address %p\n", (void *)dt_phys);
+ 
+diff --git a/arch/um/kernel/dtb.c b/arch/um/kernel/dtb.c
+index 4954188a6a090..8d78ced9e08f6 100644
+--- a/arch/um/kernel/dtb.c
++++ b/arch/um/kernel/dtb.c
+@@ -17,7 +17,7 @@ void uml_dtb_init(void)
+ 
+ 	area = uml_load_file(dtb, &size);
+ 	if (area) {
+-		if (!early_init_dt_scan(area)) {
++		if (!early_init_dt_scan(area, __pa(area))) {
+ 			pr_err("invalid DTB %s\n", dtb);
+ 			memblock_free(area, size);
+ 			return;
+diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
+index 47fe7de1575dd..37ca25d82bbcd 100644
+--- a/arch/x86/kernel/devicetree.c
++++ b/arch/x86/kernel/devicetree.c
+@@ -294,7 +294,7 @@ static void __init x86_flattree_get_config(void)
+ 			map_len = size;
+ 		}
+ 
+-		early_init_dt_verify(dt);
++		early_init_dt_verify(dt, __pa(dt));
+ 	}
+ 
+ 	unflatten_and_copy_device_tree();
+diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
+index 52d6e4870a04c..124e84fd9a296 100644
+--- a/arch/xtensa/kernel/setup.c
++++ b/arch/xtensa/kernel/setup.c
+@@ -228,7 +228,7 @@ static int __init xtensa_dt_io_area(unsigned long node, const char *uname,
+ 
+ void __init early_init_devtree(void *params)
+ {
+-	early_init_dt_scan(params);
++	early_init_dt_scan(params, __pa(params));
+ 	of_scan_flat_dt(xtensa_dt_io_area, NULL);
+ 
+ 	if (!command_line[0])
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index bf502ba8da958..366fbdc56dec1 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -471,6 +471,7 @@ int __initdata dt_root_addr_cells;
+ int __initdata dt_root_size_cells;
+ 
+ void *initial_boot_params __ro_after_init;
++phys_addr_t initial_boot_params_pa __ro_after_init;
+ 
+ #ifdef CONFIG_OF_EARLY_FLATTREE
+ 
+@@ -1270,17 +1271,18 @@ static void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
+ 	return ptr;
+ }
+ 
+-bool __init early_init_dt_verify(void *params)
++bool __init early_init_dt_verify(void *dt_virt, phys_addr_t dt_phys)
+ {
+-	if (!params)
++	if (!dt_virt)
+ 		return false;
+ 
+ 	/* check device tree validity */
+-	if (fdt_check_header(params))
++	if (fdt_check_header(dt_virt))
+ 		return false;
+ 
+ 	/* Setup flat device-tree pointer */
+-	initial_boot_params = params;
++	initial_boot_params = dt_virt;
++	initial_boot_params_pa = dt_phys;
+ 	of_fdt_crc32 = crc32_be(~0, initial_boot_params,
+ 				fdt_totalsize(initial_boot_params));
+ 	return true;
+@@ -1306,11 +1308,11 @@ void __init early_init_dt_scan_nodes(void)
+ 	early_init_dt_check_for_usable_mem_range();
+ }
+ 
+-bool __init early_init_dt_scan(void *params)
++bool __init early_init_dt_scan(void *dt_virt, phys_addr_t dt_phys)
+ {
+ 	bool status;
+ 
+-	status = early_init_dt_verify(params);
++	status = early_init_dt_verify(dt_virt, dt_phys);
+ 	if (!status)
+ 		return false;
+ 
+diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
+index 68278340cecfe..3b98a57f1f074 100644
+--- a/drivers/of/kexec.c
++++ b/drivers/of/kexec.c
+@@ -301,7 +301,7 @@ void *of_kexec_alloc_and_setup_fdt(const struct kimage *image,
+ 	}
+ 
+ 	/* Remove memory reservation for the current device tree. */
+-	ret = fdt_find_and_del_mem_rsv(fdt, __pa(initial_boot_params),
++	ret = fdt_find_and_del_mem_rsv(fdt, initial_boot_params_pa,
+ 				       fdt_totalsize(initial_boot_params));
+ 	if (ret == -EINVAL) {
+ 		pr_err("Error removing memory reservation.\n");
+diff --git a/include/linux/of_fdt.h b/include/linux/of_fdt.h
+index d69ad5bb1eb1e..b8d6c0c208760 100644
+--- a/include/linux/of_fdt.h
++++ b/include/linux/of_fdt.h
+@@ -31,6 +31,7 @@ extern void *of_fdt_unflatten_tree(const unsigned long *blob,
+ extern int __initdata dt_root_addr_cells;
+ extern int __initdata dt_root_size_cells;
+ extern void *initial_boot_params;
++extern phys_addr_t initial_boot_params_pa;
+ 
+ extern char __dtb_start[];
+ extern char __dtb_end[];
+@@ -70,8 +71,8 @@ extern u64 dt_mem_next_cell(int s, const __be32 **cellp);
+ /* Early flat tree scan hooks */
+ extern int early_init_dt_scan_root(void);
+ 
+-extern bool early_init_dt_scan(void *params);
+-extern bool early_init_dt_verify(void *params);
++extern bool early_init_dt_scan(void *dt_virt, phys_addr_t dt_phys);
++extern bool early_init_dt_verify(void *dt_virt, phys_addr_t dt_phys);
+ extern void early_init_dt_scan_nodes(void);
+ 
+ extern const char *of_flat_dt_get_machine_name(void);
+-- 
+2.43.0
+
diff --git a/queue-6.6/openrisc-implement-fixmap-to-fix-earlycon.patch b/queue-6.6/openrisc-implement-fixmap-to-fix-earlycon.patch
new file mode 100644
index 00000000000..b888eb2a48f
--- /dev/null
+++ b/queue-6.6/openrisc-implement-fixmap-to-fix-earlycon.patch
@@ -0,0 +1,164 @@
+From 593d2ce5167598802b35ae022183843983eeae3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 15:26:40 +0100
+Subject: openrisc: Implement fixmap to fix earlycon
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 1037d186edfc551fa7ba2d4336e74e7575a07a65 ]
+
+With commit 53c98e35dcbc ("openrisc: mm: remove unneeded early ioremap
+code") it was commented that early ioremap was not used in OpenRISC.  I
+acked this but was wrong, earlycon was using it.  Earlycon setup now
+fails with the below trace:
+
+    Kernel command line: earlycon
+    ------------[ cut here ]------------
+    WARNING: CPU: 0 PID: 0 at mm/ioremap.c:23
+    generic_ioremap_prot+0x118/0x130
+    Modules linked in:
+    CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted
+    6.11.0-rc5-00001-gce02fd891c38-dirty #141
+    Call trace:
+    [<(ptrval)>] dump_stack_lvl+0x7c/0x9c
+    [<(ptrval)>] dump_stack+0x1c/0x2c
+    [<(ptrval)>] __warn+0xb4/0x108
+    [<(ptrval)>] ? generic_ioremap_prot+0x118/0x130
+    [<(ptrval)>] warn_slowpath_fmt+0x60/0x98
+    [<(ptrval)>] generic_ioremap_prot+0x118/0x130
+    [<(ptrval)>] ioremap_prot+0x20/0x30
+    [<(ptrval)>] of_setup_earlycon+0xd4/0x2e0
+    [<(ptrval)>] early_init_dt_scan_chosen_stdout+0x18c/0x1c8
+    [<(ptrval)>] param_setup_earlycon+0x3c/0x60
+    [<(ptrval)>] do_early_param+0xb0/0x118
+    [<(ptrval)>] parse_args+0x184/0x4b8
+    [<(ptrval)>] ? start_kernel+0x0/0x78c
+    [<(ptrval)>] parse_early_options+0x40/0x50
+    [<(ptrval)>] ? do_early_param+0x0/0x118
+    [<(ptrval)>] parse_early_param+0x48/0x68
+    [<(ptrval)>] ? start_kernel+0x318/0x78c
+    [<(ptrval)>] ? start_kernel+0x0/0x78c
+    ---[ end trace 0000000000000000 ]---
+
+To fix this we could either implement early_ioremap again or implement
+fixmap.  In this patch we choose the later option of implementing basic
+fixmap support.
+
+While fixing this we also remove the old FIX_IOREMAP slots that were
+used by early ioremap code.  That code was also removed by commit
+53c98e35dcbc ("openrisc: mm: remove unneeded early ioremap code") but
+these definitions were not cleaned up.
+
+Fixes: 53c98e35dcbc ("openrisc: mm: remove unneeded early ioremap code")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/Kconfig              |  3 +++
+ arch/openrisc/include/asm/fixmap.h | 21 ++++-------------
+ arch/openrisc/mm/init.c            | 37 ++++++++++++++++++++++++++++++
+ 3 files changed, 45 insertions(+), 16 deletions(-)
+
+diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
+index fd9bb76a610bf..206a6da4f31b0 100644
+--- a/arch/openrisc/Kconfig
++++ b/arch/openrisc/Kconfig
+@@ -64,6 +64,9 @@ config STACKTRACE_SUPPORT
+ config LOCKDEP_SUPPORT
+ 	def_bool  y
+ 
++config FIX_EARLYCON_MEM
++	def_bool y
++
+ menu "Processor type and features"
+ 
+ choice
+diff --git a/arch/openrisc/include/asm/fixmap.h b/arch/openrisc/include/asm/fixmap.h
+index ad78e50b7ba32..aece6013fead1 100644
+--- a/arch/openrisc/include/asm/fixmap.h
++++ b/arch/openrisc/include/asm/fixmap.h
+@@ -26,29 +26,18 @@
+ #include <linux/bug.h>
+ #include <asm/page.h>
+ 
+-/*
+- * On OpenRISC we use these special fixed_addresses for doing ioremap
+- * early in the boot process before memory initialization is complete.
+- * This is used, in particular, by the early serial console code.
+- *
+- * It's not really 'fixmap', per se, but fits loosely into the same
+- * paradigm.
+- */
+ enum fixed_addresses {
+-	/*
+-	 * FIX_IOREMAP entries are useful for mapping physical address
+-	 * space before ioremap() is useable, e.g. really early in boot
+-	 * before kmalloc() is working.
+-	 */
+-#define FIX_N_IOREMAPS  32
+-	FIX_IOREMAP_BEGIN,
+-	FIX_IOREMAP_END = FIX_IOREMAP_BEGIN + FIX_N_IOREMAPS - 1,
++	FIX_EARLYCON_MEM_BASE,
+ 	__end_of_fixed_addresses
+ };
+ 
+ #define FIXADDR_SIZE		(__end_of_fixed_addresses << PAGE_SHIFT)
+ /* FIXADDR_BOTTOM might be a better name here... */
+ #define FIXADDR_START		(FIXADDR_TOP - FIXADDR_SIZE)
++#define FIXMAP_PAGE_IO		PAGE_KERNEL_NOCACHE
++
++extern void __set_fixmap(enum fixed_addresses idx,
++			 phys_addr_t phys, pgprot_t flags);
+ 
+ #define __fix_to_virt(x)	(FIXADDR_TOP - ((x) << PAGE_SHIFT))
+ #define __virt_to_fix(x)	((FIXADDR_TOP - ((x)&PAGE_MASK)) >> PAGE_SHIFT)
+diff --git a/arch/openrisc/mm/init.c b/arch/openrisc/mm/init.c
+index 1dcd78c8f0e99..d0cb1a0126f95 100644
+--- a/arch/openrisc/mm/init.c
++++ b/arch/openrisc/mm/init.c
+@@ -207,6 +207,43 @@ void __init mem_init(void)
+ 	return;
+ }
+ 
++static int __init map_page(unsigned long va, phys_addr_t pa, pgprot_t prot)
++{
++	p4d_t *p4d;
++	pud_t *pud;
++	pmd_t *pmd;
++	pte_t *pte;
++
++	p4d = p4d_offset(pgd_offset_k(va), va);
++	pud = pud_offset(p4d, va);
++	pmd = pmd_offset(pud, va);
++	pte = pte_alloc_kernel(pmd, va);
++
++	if (pte == NULL)
++		return -ENOMEM;
++
++	if (pgprot_val(prot))
++		set_pte_at(&init_mm, va, pte, pfn_pte(pa >> PAGE_SHIFT, prot));
++	else
++		pte_clear(&init_mm, va, pte);
++
++	local_flush_tlb_page(NULL, va);
++	return 0;
++}
++
++void __init __set_fixmap(enum fixed_addresses idx,
++			 phys_addr_t phys, pgprot_t prot)
++{
++	unsigned long address = __fix_to_virt(idx);
++
++	if (idx >= __end_of_fixed_addresses) {
++		BUG();
++		return;
++	}
++
++	map_page(address, phys, prot);
++}
++
+ static const pgprot_t protection_map[16] = {
+ 	[VM_NONE]					= PAGE_NONE,
+ 	[VM_READ]					= PAGE_READONLY_X,
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-add-t_pvperl-macro.patch b/queue-6.6/pci-add-t_pvperl-macro.patch
new file mode 100644
index 00000000000..036f79a788b
--- /dev/null
+++ b/queue-6.6/pci-add-t_pvperl-macro.patch
@@ -0,0 +1,44 @@
+From 16ab83feef7b0d3a860c7e40747cb7932d70405b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 17:56:17 +0900
+Subject: PCI: Add T_PVPERL macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 164f66be0c2523e65df41b755c41b7c9ff58035a ]
+
+According to the PCIe CEM r5.0, sec 2.9.2, Power stable to PERST#
+inactive interval is 100 ms as minimum. Add a macro so that the PCIe
+controller drivers can make use of it.
+
+Link: https://lore.kernel.org/linux-pci/20231018085631.1121289-2-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index d5e9010a135a1..67ec4cf2fdb4c 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -13,6 +13,9 @@
+ 
+ #define PCIE_LINK_RETRAIN_TIMEOUT_MS	1000
+ 
++/* Power stable to PERST# inactive from PCIe card Electromechanical Spec */
++#define PCIE_T_PVPERL_MS		100
++
+ /*
+  * PCIe r6.0, sec 5.3.3.2.1 <PME Synchronization>
+  * Recommends 1ms to 10ms timeout to check L2 ready.
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-cadence-extract-link-setup-sequence-from-cdns_pc.patch b/queue-6.6/pci-cadence-extract-link-setup-sequence-from-cdns_pc.patch
new file mode 100644
index 00000000000..e40bbf614c6
--- /dev/null
+++ b/queue-6.6/pci-cadence-extract-link-setup-sequence-from-cdns_pc.patch
@@ -0,0 +1,110 @@
+From ad9fa5947f91f7f433eb930cb7f89549c34f1a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 12:15:09 +0200
+Subject: PCI: cadence: Extract link setup sequence from cdns_pcie_host_setup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Richard <thomas.richard@bootlin.com>
+
+[ Upstream commit d1b6f2e2ce4d8b17d9f3558c98a1517b864bfd03 ]
+
+The function cdns_pcie_host_setup() mixes probe structure and link setup.
+
+The link setup must be done during the resume sequence. So extract it from
+cdns_pcie_host_setup() and create a dedicated function.
+
+Link: https://lore.kernel.org/linux-pci/20240102-j7200-pcie-s2r-v7-1-a2f9156da6c3@bootlin.com
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../controller/cadence/pcie-cadence-host.c    | 39 ++++++++++++-------
+ drivers/pci/controller/cadence/pcie-cadence.h |  6 +++
+ 2 files changed, 32 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 5b14f7ee3c798..93d9922730af5 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -497,6 +497,30 @@ static int cdns_pcie_host_init(struct device *dev,
+ 	return cdns_pcie_host_init_address_translation(rc);
+ }
+ 
++int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc)
++{
++	struct cdns_pcie *pcie = &rc->pcie;
++	struct device *dev = rc->pcie.dev;
++	int ret;
++
++	if (rc->quirk_detect_quiet_flag)
++		cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
++
++	cdns_pcie_host_enable_ptm_response(pcie);
++
++	ret = cdns_pcie_start_link(pcie);
++	if (ret) {
++		dev_err(dev, "Failed to start link\n");
++		return ret;
++	}
++
++	ret = cdns_pcie_host_start_link(rc);
++	if (ret)
++		dev_dbg(dev, "PCIe link never came up\n");
++
++	return 0;
++}
++
+ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ {
+ 	struct device *dev = rc->pcie.dev;
+@@ -533,20 +557,9 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ 		return PTR_ERR(rc->cfg_base);
+ 	rc->cfg_res = res;
+ 
+-	if (rc->quirk_detect_quiet_flag)
+-		cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
+-
+-	cdns_pcie_host_enable_ptm_response(pcie);
+-
+-	ret = cdns_pcie_start_link(pcie);
+-	if (ret) {
+-		dev_err(dev, "Failed to start link\n");
+-		return ret;
+-	}
+-
+-	ret = cdns_pcie_host_start_link(rc);
++	ret = cdns_pcie_host_link_setup(rc);
+ 	if (ret)
+-		dev_dbg(dev, "PCIe link never came up\n");
++		return ret;
+ 
+ 	for (bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
+ 		rc->avail_ib_bar[bar] = true;
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 373cb50fcd159..4c687aeb810e8 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -515,10 +515,16 @@ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ }
+ 
+ #ifdef CONFIG_PCIE_CADENCE_HOST
++int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc);
+ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc);
+ void __iomem *cdns_pci_map_bus(struct pci_bus *bus, unsigned int devfn,
+ 			       int where);
+ #else
++static inline int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc)
++{
++	return 0;
++}
++
+ static inline int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ {
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-cadence-set-cdns_pcie_host_init-global.patch b/queue-6.6/pci-cadence-set-cdns_pcie_host_init-global.patch
new file mode 100644
index 00000000000..8f017c45f84
--- /dev/null
+++ b/queue-6.6/pci-cadence-set-cdns_pcie_host_init-global.patch
@@ -0,0 +1,78 @@
+From 68dd71250dbbfd57678156042d72843018fb37ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 12:15:10 +0200
+Subject: PCI: cadence: Set cdns_pcie_host_init() global
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Richard <thomas.richard@bootlin.com>
+
+[ Upstream commit 063c938928dc80c2bfd66f34df48344db22e009b ]
+
+During the resume sequence of the host, cdns_pcie_host_init() needs to be
+called, so set it global.
+
+The dev function parameter is removed, as it isn't used.
+
+Link: https://lore.kernel.org/linux-pci/20240102-j7200-pcie-s2r-v7-2-a2f9156da6c3@bootlin.com
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 5 ++---
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 ++++++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 93d9922730af5..8af95e9da7cec 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -485,8 +485,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	return cdns_pcie_host_map_dma_ranges(rc);
+ }
+ 
+-static int cdns_pcie_host_init(struct device *dev,
+-			       struct cdns_pcie_rc *rc)
++int cdns_pcie_host_init(struct cdns_pcie_rc *rc)
+ {
+ 	int err;
+ 
+@@ -564,7 +563,7 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ 	for (bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
+ 		rc->avail_ib_bar[bar] = true;
+ 
+-	ret = cdns_pcie_host_init(dev, rc);
++	ret = cdns_pcie_host_init(rc);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 4c687aeb810e8..d55dfd173f228 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -516,6 +516,7 @@ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ 
+ #ifdef CONFIG_PCIE_CADENCE_HOST
+ int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc);
++int cdns_pcie_host_init(struct cdns_pcie_rc *rc);
+ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc);
+ void __iomem *cdns_pci_map_bus(struct pci_bus *bus, unsigned int devfn,
+ 			       int where);
+@@ -525,6 +526,11 @@ static inline int cdns_pcie_host_link_setup(struct cdns_pcie_rc *rc)
+ 	return 0;
+ }
+ 
++static inline int cdns_pcie_host_init(struct cdns_pcie_rc *rc)
++{
++	return 0;
++}
++
+ static inline int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ {
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-cpqphp-fix-pcibios_-return-value-confusion.patch b/queue-6.6/pci-cpqphp-fix-pcibios_-return-value-confusion.patch
new file mode 100644
index 00000000000..98d96067621
--- /dev/null
+++ b/queue-6.6/pci-cpqphp-fix-pcibios_-return-value-confusion.patch
@@ -0,0 +1,85 @@
+From a474cbaf4323bb678f98ae4780ef83e16af3e803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 12:11:37 +0300
+Subject: PCI: cpqphp: Fix PCIBIOS_* return value confusion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit e2226dbc4a4919d9c8bd9293299b532090bdf020 ]
+
+Code in and related to PCI_RefinedAccessConfig() has three types of return
+type confusion:
+
+ - PCI_RefinedAccessConfig() tests pci_bus_read_config_dword() return value
+   against -1.
+
+ - PCI_RefinedAccessConfig() returns both -1 and PCIBIOS_* return codes.
+
+ - Callers of PCI_RefinedAccessConfig() only test for -1.
+
+Make PCI_RefinedAccessConfig() return PCIBIOS_* codes consistently and
+adapt callers accordingly.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/20241022091140.3504-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/cpqphp_pci.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c
+index ae95307e6ece3..a35af42d6a3d8 100644
+--- a/drivers/pci/hotplug/cpqphp_pci.c
++++ b/drivers/pci/hotplug/cpqphp_pci.c
+@@ -135,11 +135,13 @@ int cpqhp_unconfigure_device(struct pci_func *func)
+ static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 offset, u32 *value)
+ {
+ 	u32 vendID = 0;
++	int ret;
+ 
+-	if (pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID) == -1)
+-		return -1;
++	ret = pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID);
++	if (ret != PCIBIOS_SUCCESSFUL)
++		return PCIBIOS_DEVICE_NOT_FOUND;
+ 	if (PCI_POSSIBLE_ERROR(vendID))
+-		return -1;
++		return PCIBIOS_DEVICE_NOT_FOUND;
+ 	return pci_bus_read_config_dword(bus, devfn, offset, value);
+ }
+ 
+@@ -202,13 +204,15 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_
+ {
+ 	u16 tdevice;
+ 	u32 work;
++	int ret;
+ 	u8 tbus;
+ 
+ 	ctrl->pci_bus->number = bus_num;
+ 
+ 	for (tdevice = 0; tdevice < 0xFF; tdevice++) {
+ 		/* Scan for access first */
+-		if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1)
++		ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work);
++		if (ret)
+ 			continue;
+ 		dbg("Looking for nonbridge bus_num %d dev_num %d\n", bus_num, tdevice);
+ 		/* Yep we got one. Not a bridge ? */
+@@ -220,7 +224,8 @@ static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 *dev_
+ 	}
+ 	for (tdevice = 0; tdevice < 0xFF; tdevice++) {
+ 		/* Scan for access first */
+-		if (PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work) == -1)
++		ret = PCI_RefinedAccessConfig(ctrl->pci_bus, tdevice, 0x08, &work);
++		if (ret)
+ 			continue;
+ 		dbg("Looking for bridge bus_num %d dev_num %d\n", bus_num, tdevice);
+ 		/* Yep we got one. bridge ? */
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch b/queue-6.6/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch
new file mode 100644
index 00000000000..64024258120
--- /dev/null
+++ b/queue-6.6/pci-cpqphp-use-pci_possible_error-to-check-config-re.patch
@@ -0,0 +1,47 @@
+From 6c6585f18f68fde8c7e9f5e170b8a545331742da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 14:50:50 +0800
+Subject: PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
+
+From: weiyufeng <weiyufeng@kylinos.cn>
+
+[ Upstream commit 87d5403378cccc557af9e02a8a2c8587ad8b7e9a ]
+
+Use PCI_POSSIBLE_ERROR() to check the response we get when we read data
+from hardware.  This unifies PCI error response checking and makes error
+checks consistent and easier to find.
+
+Link: https://lore.kernel.org/r/20240806065050.28725-1-412574090@163.com
+Signed-off-by: weiyufeng <weiyufeng@kylinos.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Stable-dep-of: e2226dbc4a49 ("PCI: cpqphp: Fix PCIBIOS_* return value confusion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/cpqphp_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c
+index 3b248426a9f42..ae95307e6ece3 100644
+--- a/drivers/pci/hotplug/cpqphp_pci.c
++++ b/drivers/pci/hotplug/cpqphp_pci.c
+@@ -138,7 +138,7 @@ static int PCI_RefinedAccessConfig(struct pci_bus *bus, unsigned int devfn, u8 o
+ 
+ 	if (pci_bus_read_config_dword(bus, devfn, PCI_VENDOR_ID, &vendID) == -1)
+ 		return -1;
+-	if (vendID == 0xffffffff)
++	if (PCI_POSSIBLE_ERROR(vendID))
+ 		return -1;
+ 	return pci_bus_read_config_dword(bus, devfn, offset, value);
+ }
+@@ -253,7 +253,7 @@ static int PCI_GetBusDevHelper(struct controller *ctrl, u8 *bus_num, u8 *dev_num
+ 			*dev_num = tdevice;
+ 			ctrl->pci_bus->number = tbus;
+ 			pci_bus_read_config_dword(ctrl->pci_bus, *dev_num, PCI_VENDOR_ID, &work);
+-			if (!nobridge || (work == 0xffffffff))
++			if (!nobridge || PCI_POSSIBLE_ERROR(work))
+ 				return 0;
+ 
+ 			dbg("bus_num %d devfn %d\n", *bus_num, *dev_num);
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-endpoint-epf-mhi-avoid-null-dereference-if-dt-la.patch b/queue-6.6/pci-endpoint-epf-mhi-avoid-null-dereference-if-dt-la.patch
new file mode 100644
index 00000000000..5aa61494e22
--- /dev/null
+++ b/queue-6.6/pci-endpoint-epf-mhi-avoid-null-dereference-if-dt-la.patch
@@ -0,0 +1,55 @@
+From 5760add911751ecc65bf39bf06690b4dd2d9b098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 20:07:35 +0800
+Subject: PCI: endpoint: epf-mhi: Avoid NULL dereference if DT lacks 'mmio'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit 5089b3d874e9933d9842e90410d3af1520494757 ]
+
+If platform_get_resource_byname() fails and returns NULL because DT lacks
+an 'mmio' property for the MHI endpoint, dereferencing res->start will
+cause a NULL pointer access. Add a check to prevent it.
+
+Fixes: 1bf5f25324f7 ("PCI: endpoint: Add PCI Endpoint function driver for MHI bus")
+Link: https://lore.kernel.org/r/20241105120735.1240728-1-quic_zhonhan@quicinc.com
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+[kwilczynski: error message update per the review feedback]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-mhi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-mhi.c b/drivers/pci/endpoint/functions/pci-epf-mhi.c
+index 34e7191f95086..87154992ea11b 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-mhi.c
++++ b/drivers/pci/endpoint/functions/pci-epf-mhi.c
+@@ -600,12 +600,18 @@ static int pci_epf_mhi_bind(struct pci_epf *epf)
+ {
+ 	struct pci_epf_mhi *epf_mhi = epf_get_drvdata(epf);
+ 	struct pci_epc *epc = epf->epc;
++	struct device *dev = &epf->dev;
+ 	struct platform_device *pdev = to_platform_device(epc->dev.parent);
+ 	struct resource *res;
+ 	int ret;
+ 
+ 	/* Get MMIO base address from Endpoint controller */
+ 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "mmio");
++	if (!res) {
++		dev_err(dev, "Failed to get \"mmio\" resource\n");
++		return -ENODEV;
++	}
++
+ 	epf_mhi->mmio_phys = res->start;
+ 	epf_mhi->mmio_size = resource_size(res);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-fix-reset_method_store-memory-leak.patch b/queue-6.6/pci-fix-reset_method_store-memory-leak.patch
new file mode 100644
index 00000000000..6177ee23b5b
--- /dev/null
+++ b/queue-6.6/pci-fix-reset_method_store-memory-leak.patch
@@ -0,0 +1,57 @@
+From 57253df7a320e5d47951bdd5f87082b3152f4341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 23:11:47 +0000
+Subject: PCI: Fix reset_method_store() memory leak
+
+From: Todd Kjos <tkjos@google.com>
+
+[ Upstream commit 2985b1844f3f3447f2d938eff1ef6762592065a5 ]
+
+In reset_method_store(), a string is allocated via kstrndup() and assigned
+to the local "options". options is then used in with strsep() to find
+spaces:
+
+  while ((name = strsep(&options, " ")) != NULL) {
+
+If there are no remaining spaces, then options is set to NULL by strsep(),
+so the subsequent kfree(options) doesn't free the memory allocated via
+kstrndup().
+
+Fix by using a separate tmp_options to iterate with strsep() so options is
+preserved.
+
+Link: https://lore.kernel.org/r/20241001231147.3583649-1-tkjos@google.com
+Fixes: d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism")
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 93f2f4dcf6d69..830877efe5059 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5444,7 +5444,7 @@ static ssize_t reset_method_store(struct device *dev,
+ 				  const char *buf, size_t count)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(dev);
+-	char *options, *name;
++	char *options, *tmp_options, *name;
+ 	int m, n;
+ 	u8 reset_methods[PCI_NUM_RESET_METHODS] = { 0 };
+ 
+@@ -5464,7 +5464,8 @@ static ssize_t reset_method_store(struct device *dev,
+ 		return -ENOMEM;
+ 
+ 	n = 0;
+-	while ((name = strsep(&options, " ")) != NULL) {
++	tmp_options = options;
++	while ((name = strsep(&tmp_options, " ")) != NULL) {
+ 		if (sysfs_streq(name, ""))
+ 			continue;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-add-pcie-4x-lane-selection-support.patch b/queue-6.6/pci-j721e-add-pcie-4x-lane-selection-support.patch
new file mode 100644
index 00000000000..b71df748c85
--- /dev/null
+++ b/queue-6.6/pci-j721e-add-pcie-4x-lane-selection-support.patch
@@ -0,0 +1,78 @@
+From c182ee859bb7b55e1bffacca11cce428d0629681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 11:14:01 +0530
+Subject: PCI: j721e: Add PCIe 4x lane selection support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matt Ranostay <mranostay@ti.com>
+
+[ Upstream commit 4490f559f75514d5a6f0e729e85235a7be6216bf ]
+
+Add support for setting of two-bit field that allows selection of 4x lane
+PCIe which was previously limited to only 2x lanes.
+
+Link: https://lore.kernel.org/linux-pci/20231128054402.2155183-5-s-vadapalli@ti.com
+Signed-off-by: Matt Ranostay <mranostay@ti.com>
+Signed-off-by: Achal Verma <a-verma1@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 63c758b14314d..645597856a1d9 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -42,7 +42,6 @@ enum link_status {
+ };
+ 
+ #define J721E_MODE_RC			BIT(7)
+-#define LANE_COUNT_MASK			BIT(8)
+ #define LANE_COUNT(n)			((n) << 8)
+ 
+ #define GENERATION_SEL_MASK		GENMASK(1, 0)
+@@ -52,6 +51,7 @@ struct j721e_pcie {
+ 	struct clk		*refclk;
+ 	u32			mode;
+ 	u32			num_lanes;
++	u32			max_lanes;
+ 	void __iomem		*user_cfg_base;
+ 	void __iomem		*intd_cfg_base;
+ 	u32			linkdown_irq_regfield;
+@@ -205,11 +205,15 @@ static int j721e_pcie_set_lane_count(struct j721e_pcie *pcie,
+ {
+ 	struct device *dev = pcie->cdns_pcie->dev;
+ 	u32 lanes = pcie->num_lanes;
++	u32 mask = BIT(8);
+ 	u32 val = 0;
+ 	int ret;
+ 
++	if (pcie->max_lanes == 4)
++		mask = GENMASK(9, 8);
++
+ 	val = LANE_COUNT(lanes - 1);
+-	ret = regmap_update_bits(syscon, offset, LANE_COUNT_MASK, val);
++	ret = regmap_update_bits(syscon, offset, mask, val);
+ 	if (ret)
+ 		dev_err(dev, "failed to set link count\n");
+ 
+@@ -441,7 +445,9 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 		dev_warn(dev, "num-lanes property not provided or invalid, setting num-lanes to 1\n");
+ 		num_lanes = 1;
+ 	}
++
+ 	pcie->num_lanes = num_lanes;
++	pcie->max_lanes = data->max_lanes;
+ 
+ 	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(48)))
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-add-per-platform-maximum-lane-settings.patch b/queue-6.6/pci-j721e-add-per-platform-maximum-lane-settings.patch
new file mode 100644
index 00000000000..d2b0b5977b9
--- /dev/null
+++ b/queue-6.6/pci-j721e-add-per-platform-maximum-lane-settings.patch
@@ -0,0 +1,107 @@
+From 9d8518a93c0f86e32c64901fa328b5a22b0cd88f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 11:14:00 +0530
+Subject: PCI: j721e: Add per platform maximum lane settings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matt Ranostay <mranostay@ti.com>
+
+[ Upstream commit 3ac7f14084f54bff9c31573d1ed59d047a34fe03 ]
+
+Various platforms have different maximum amount of lanes that can be
+selected. Add max_lanes to struct j721e_pcie to allow for detection of this
+which is needed to calculate the needed bitmask size for the possible lane
+count.
+
+Link: https://lore.kernel.org/linux-pci/20231128054402.2155183-4-s-vadapalli@ti.com
+Signed-off-by: Matt Ranostay <mranostay@ti.com>
+Signed-off-by: Achal Verma <a-verma1@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Ravi Gunasekaran <r-gunasekaran@ti.com>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 2c87e7728a653..63c758b14314d 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -47,8 +47,6 @@ enum link_status {
+ 
+ #define GENERATION_SEL_MASK		GENMASK(1, 0)
+ 
+-#define MAX_LANES			2
+-
+ struct j721e_pcie {
+ 	struct cdns_pcie	*cdns_pcie;
+ 	struct clk		*refclk;
+@@ -71,6 +69,7 @@ struct j721e_pcie_data {
+ 	unsigned int		quirk_disable_flr:1;
+ 	u32			linkdown_irq_regfield;
+ 	unsigned int		byte_access_allowed:1;
++	unsigned int		max_lanes;
+ };
+ 
+ static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset)
+@@ -290,11 +289,13 @@ static const struct j721e_pcie_data j721e_pcie_rc_data = {
+ 	.quirk_retrain_flag = true,
+ 	.byte_access_allowed = false,
+ 	.linkdown_irq_regfield = LINK_DOWN,
++	.max_lanes = 2,
+ };
+ 
+ static const struct j721e_pcie_data j721e_pcie_ep_data = {
+ 	.mode = PCI_MODE_EP,
+ 	.linkdown_irq_regfield = LINK_DOWN,
++	.max_lanes = 2,
+ };
+ 
+ static const struct j721e_pcie_data j7200_pcie_rc_data = {
+@@ -302,23 +303,27 @@ static const struct j721e_pcie_data j7200_pcie_rc_data = {
+ 	.quirk_detect_quiet_flag = true,
+ 	.linkdown_irq_regfield = J7200_LINK_DOWN,
+ 	.byte_access_allowed = true,
++	.max_lanes = 2,
+ };
+ 
+ static const struct j721e_pcie_data j7200_pcie_ep_data = {
+ 	.mode = PCI_MODE_EP,
+ 	.quirk_detect_quiet_flag = true,
+ 	.quirk_disable_flr = true,
++	.max_lanes = 2,
+ };
+ 
+ static const struct j721e_pcie_data am64_pcie_rc_data = {
+ 	.mode = PCI_MODE_RC,
+ 	.linkdown_irq_regfield = J7200_LINK_DOWN,
+ 	.byte_access_allowed = true,
++	.max_lanes = 1,
+ };
+ 
+ static const struct j721e_pcie_data am64_pcie_ep_data = {
+ 	.mode = PCI_MODE_EP,
+ 	.linkdown_irq_regfield = J7200_LINK_DOWN,
++	.max_lanes = 1,
+ };
+ 
+ static const struct of_device_id of_j721e_pcie_match[] = {
+@@ -432,8 +437,10 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 	pcie->user_cfg_base = base;
+ 
+ 	ret = of_property_read_u32(node, "num-lanes", &num_lanes);
+-	if (ret || num_lanes > MAX_LANES)
++	if (ret || num_lanes > data->max_lanes) {
++		dev_warn(dev, "num-lanes property not provided or invalid, setting num-lanes to 1\n");
+ 		num_lanes = 1;
++	}
+ 	pcie->num_lanes = num_lanes;
+ 
+ 	if (dma_set_mask_and_coherent(dev, DMA_BIT_MASK(48)))
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-add-reset-gpio-to-struct-j721e_pcie.patch b/queue-6.6/pci-j721e-add-reset-gpio-to-struct-j721e_pcie.patch
new file mode 100644
index 00000000000..8c91fd7d8c2
--- /dev/null
+++ b/queue-6.6/pci-j721e-add-reset-gpio-to-struct-j721e_pcie.patch
@@ -0,0 +1,48 @@
+From fc93c28b2a9d14145511b42931420dba295902ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 12:15:12 +0200
+Subject: PCI: j721e: Add reset GPIO to struct j721e_pcie
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit b8600b8791cb2b7c8be894846b1ecddba7291680 ]
+
+Add reset GPIO to struct j721e_pcie, so it can be used at suspend and
+resume stages.
+
+Link: https://lore.kernel.org/linux-pci/20240102-j7200-pcie-s2r-v7-4-a2f9156da6c3@bootlin.com
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 645597856a1d9..82f8c3a701c2f 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -52,6 +52,7 @@ struct j721e_pcie {
+ 	u32			mode;
+ 	u32			num_lanes;
+ 	u32			max_lanes;
++	struct gpio_desc	*reset_gpio;
+ 	void __iomem		*user_cfg_base;
+ 	void __iomem		*intd_cfg_base;
+ 	u32			linkdown_irq_regfield;
+@@ -488,6 +489,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 				dev_err(dev, "Failed to get reset GPIO\n");
+ 			goto err_get_sync;
+ 		}
++		pcie->reset_gpio = gpiod;
+ 
+ 		ret = cdns_pcie_init_phy(dev, cdns_pcie);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-add-suspend-and-resume-support.patch b/queue-6.6/pci-j721e-add-suspend-and-resume-support.patch
new file mode 100644
index 00000000000..be3f0060fb8
--- /dev/null
+++ b/queue-6.6/pci-j721e-add-suspend-and-resume-support.patch
@@ -0,0 +1,169 @@
+From 53a3a5fdf5696315455538c63017af99ed3c1b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 12:15:15 +0200
+Subject: PCI: j721e: Add suspend and resume support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit c538d40f365b5b6d7433d371710f58e8b266fb19 ]
+
+Add suspend and resume support. Only the Root Complex mode is supported.
+
+During the suspend stage PERST# is asserted, then deasserted during the
+resume stage.
+
+Link: https://lore.kernel.org/linux-pci/20240102-j7200-pcie-s2r-v7-7-a2f9156da6c3@bootlin.com
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+[kwilczynski: commit log, update references to the PCI SIG specification]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 98 ++++++++++++++++++++--
+ 1 file changed, 92 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index b83ae35a210fe..212b11c3145d8 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -7,6 +7,8 @@
+  */
+ 
+ #include <linux/clk.h>
++#include <linux/clk-provider.h>
++#include <linux/container_of.h>
+ #include <linux/delay.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/io.h>
+@@ -22,6 +24,8 @@
+ #include "../../pci.h"
+ #include "pcie-cadence.h"
+ 
++#define cdns_pcie_to_rc(p) container_of(p, struct cdns_pcie_rc, pcie)
++
+ #define ENABLE_REG_SYS_2	0x108
+ #define STATUS_REG_SYS_2	0x508
+ #define STATUS_CLR_REG_SYS_2	0x708
+@@ -512,12 +516,12 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 		pcie->refclk = clk;
+ 
+ 		/*
+-		 * "Power Sequencing and Reset Signal Timings" table in
+-		 * PCI EXPRESS CARD ELECTROMECHANICAL SPECIFICATION, REV. 3.0
+-		 * indicates PERST# should be deasserted after minimum of 100us
+-		 * once REFCLK is stable. The REFCLK to the connector in RC
+-		 * mode is selected while enabling the PHY. So deassert PERST#
+-		 * after 100 us.
++		 * The "Power Sequencing and Reset Signal Timings" table of the
++		 * PCI Express Card Electromechanical Specification, Revision
++		 * 5.1, Section 2.9.2, Symbol "T_PERST-CLK", indicates PERST#
++		 * should be deasserted after minimum of 100us once REFCLK is
++		 * stable. The REFCLK to the connector in RC mode is selected
++		 * while enabling the PHY. So deassert PERST# after 100 us.
+ 		 */
+ 		if (gpiod) {
+ 			fsleep(PCIE_T_PERST_CLK_US);
+@@ -569,6 +573,87 @@ static void j721e_pcie_remove(struct platform_device *pdev)
+ 	pm_runtime_disable(dev);
+ }
+ 
++static int j721e_pcie_suspend_noirq(struct device *dev)
++{
++	struct j721e_pcie *pcie = dev_get_drvdata(dev);
++
++	if (pcie->mode == PCI_MODE_RC) {
++		gpiod_set_value_cansleep(pcie->reset_gpio, 0);
++		clk_disable_unprepare(pcie->refclk);
++	}
++
++	cdns_pcie_disable_phy(pcie->cdns_pcie);
++
++	return 0;
++}
++
++static int j721e_pcie_resume_noirq(struct device *dev)
++{
++	struct j721e_pcie *pcie = dev_get_drvdata(dev);
++	struct cdns_pcie *cdns_pcie = pcie->cdns_pcie;
++	int ret;
++
++	ret = j721e_pcie_ctrl_init(pcie);
++	if (ret < 0)
++		return ret;
++
++	j721e_pcie_config_link_irq(pcie);
++
++	/*
++	 * This is not called explicitly in the probe, it is called by
++	 * cdns_pcie_init_phy().
++	 */
++	ret = cdns_pcie_enable_phy(pcie->cdns_pcie);
++	if (ret < 0)
++		return ret;
++
++	if (pcie->mode == PCI_MODE_RC) {
++		struct cdns_pcie_rc *rc = cdns_pcie_to_rc(cdns_pcie);
++
++		ret = clk_prepare_enable(pcie->refclk);
++		if (ret < 0)
++			return ret;
++
++		/*
++		 * The "Power Sequencing and Reset Signal Timings" table of the
++		 * PCI Express Card Electromechanical Specification, Revision
++		 * 5.1, Section 2.9.2, Symbol "T_PERST-CLK", indicates PERST#
++		 * should be deasserted after minimum of 100us once REFCLK is
++		 * stable. The REFCLK to the connector in RC mode is selected
++		 * while enabling the PHY. So deassert PERST# after 100 us.
++		 */
++		if (pcie->reset_gpio) {
++			fsleep(PCIE_T_PERST_CLK_US);
++			gpiod_set_value_cansleep(pcie->reset_gpio, 1);
++		}
++
++		ret = cdns_pcie_host_link_setup(rc);
++		if (ret < 0) {
++			clk_disable_unprepare(pcie->refclk);
++			return ret;
++		}
++
++		/*
++		 * Reset internal status of BARs to force reinitialization in
++		 * cdns_pcie_host_init().
++		 */
++		for (enum cdns_pcie_rp_bar bar = RP_BAR0; bar <= RP_NO_BAR; bar++)
++			rc->avail_ib_bar[bar] = true;
++
++		ret = cdns_pcie_host_init(rc);
++		if (ret) {
++			clk_disable_unprepare(pcie->refclk);
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++static DEFINE_NOIRQ_DEV_PM_OPS(j721e_pcie_pm_ops,
++			       j721e_pcie_suspend_noirq,
++			       j721e_pcie_resume_noirq);
++
+ static struct platform_driver j721e_pcie_driver = {
+ 	.probe  = j721e_pcie_probe,
+ 	.remove_new = j721e_pcie_remove,
+@@ -576,6 +661,7 @@ static struct platform_driver j721e_pcie_driver = {
+ 		.name	= "j721e-pcie",
+ 		.of_match_table = of_j721e_pcie_match,
+ 		.suppress_bind_attrs = true,
++		.pm	= pm_sleep_ptr(&j721e_pcie_pm_ops),
+ 	},
+ };
+ builtin_platform_driver(j721e_pcie_driver);
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-deassert-perst-after-a-delay-of-pcie_t_pvp.patch b/queue-6.6/pci-j721e-deassert-perst-after-a-delay-of-pcie_t_pvp.patch
new file mode 100644
index 00000000000..84b42e64024
--- /dev/null
+++ b/queue-6.6/pci-j721e-deassert-perst-after-a-delay-of-pcie_t_pvp.patch
@@ -0,0 +1,85 @@
+From 76b8e2b56fc598747a6fb52eb6a89d649040b27c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 13:14:20 +0530
+Subject: PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS
+ milliseconds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Siddharth Vadapalli <s-vadapalli@ti.com>
+
+[ Upstream commit 22a9120479a40a56c13c5e473a0100fad2e017c0 ]
+
+According to Section 2.2 of the PCI Express Card Electromechanical
+Specification (Revision 5.1), in order to ensure that the power and the
+reference clock are stable, PERST# has to be deasserted after a delay of
+100 milliseconds (TPVPERL).
+
+Currently, it is being assumed that the power is already stable, which
+is not necessarily true.
+
+Hence, change the delay to PCIE_T_PVPERL_MS to guarantee that power and
+reference clock are stable.
+
+Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
+Fixes: f96b69713733 ("PCI: j721e: Use T_PERST_CLK_US macro")
+Link: https://lore.kernel.org/r/20241104074420.1862932-1-s-vadapalli@ti.com
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 26 ++++++++++------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 212b11c3145d8..f76a358e2b5b6 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -516,15 +516,14 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 		pcie->refclk = clk;
+ 
+ 		/*
+-		 * The "Power Sequencing and Reset Signal Timings" table of the
+-		 * PCI Express Card Electromechanical Specification, Revision
+-		 * 5.1, Section 2.9.2, Symbol "T_PERST-CLK", indicates PERST#
+-		 * should be deasserted after minimum of 100us once REFCLK is
+-		 * stable. The REFCLK to the connector in RC mode is selected
+-		 * while enabling the PHY. So deassert PERST# after 100 us.
++		 * Section 2.2 of the PCI Express Card Electromechanical
++		 * Specification (Revision 5.1) mandates that the deassertion
++		 * of the PERST# signal should be delayed by 100 ms (TPVPERL).
++		 * This shall ensure that the power and the reference clock
++		 * are stable.
+ 		 */
+ 		if (gpiod) {
+-			fsleep(PCIE_T_PERST_CLK_US);
++			msleep(PCIE_T_PVPERL_MS);
+ 			gpiod_set_value_cansleep(gpiod, 1);
+ 		}
+ 
+@@ -615,15 +614,14 @@ static int j721e_pcie_resume_noirq(struct device *dev)
+ 			return ret;
+ 
+ 		/*
+-		 * The "Power Sequencing and Reset Signal Timings" table of the
+-		 * PCI Express Card Electromechanical Specification, Revision
+-		 * 5.1, Section 2.9.2, Symbol "T_PERST-CLK", indicates PERST#
+-		 * should be deasserted after minimum of 100us once REFCLK is
+-		 * stable. The REFCLK to the connector in RC mode is selected
+-		 * while enabling the PHY. So deassert PERST# after 100 us.
++		 * Section 2.2 of the PCI Express Card Electromechanical
++		 * Specification (Revision 5.1) mandates that the deassertion
++		 * of the PERST# signal should be delayed by 100 ms (TPVPERL).
++		 * This shall ensure that the power and the reference clock
++		 * are stable.
+ 		 */
+ 		if (pcie->reset_gpio) {
+-			fsleep(PCIE_T_PERST_CLK_US);
++			msleep(PCIE_T_PVPERL_MS);
+ 			gpiod_set_value_cansleep(pcie->reset_gpio, 1);
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/pci-j721e-use-t_perst_clk_us-macro.patch b/queue-6.6/pci-j721e-use-t_perst_clk_us-macro.patch
new file mode 100644
index 00000000000..e2c50610203
--- /dev/null
+++ b/queue-6.6/pci-j721e-use-t_perst_clk_us-macro.patch
@@ -0,0 +1,40 @@
+From acacf12692b0ba64dce1d143afbc0f1282788e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2024 12:15:14 +0200
+Subject: PCI: j721e: Use T_PERST_CLK_US macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Richard <thomas.richard@bootlin.com>
+
+[ Upstream commit f96b6971373382855bc964f1c067bd6dc41cf0ab ]
+
+Use the T_PERST_CLK_US macro, and the fsleep() function instead of
+usleep_range().
+
+Link: https://lore.kernel.org/linux-pci/20240102-j7200-pcie-s2r-v7-6-a2f9156da6c3@bootlin.com
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Stable-dep-of: 22a9120479a4 ("PCI: j721e: Deassert PERST# after a delay of PCIE_T_PVPERL_MS milliseconds")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 82f8c3a701c2f..b83ae35a210fe 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -520,7 +520,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ 		 * after 100 us.
+ 		 */
+ 		if (gpiod) {
+-			usleep_range(100, 200);
++			fsleep(PCIE_T_PERST_CLK_US);
+ 			gpiod_set_value_cansleep(gpiod, 1);
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch b/queue-6.6/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch
new file mode 100644
index 00000000000..8651e695198
--- /dev/null
+++ b/queue-6.6/perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch
@@ -0,0 +1,121 @@
+From 0fe79043dc0598981f6459c0419dafb643779b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 14:57:32 +0100
+Subject: perf cs-etm: Don't flush when packet_queue fills up
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit 5afd032961e8465808c4bc385c06e7676fbe1951 ]
+
+cs_etm__flush(), like cs_etm__sample() is an operation that generates a
+sample and then swaps the current with the previous packet. Calling
+flush after processing the queues results in two swaps which corrupts
+the next sample. Therefore it wasn't appropriate to call flush here so
+remove it.
+
+Flushing is still done on a discontinuity to explicitly clear the last
+branch buffer, but when the packet_queue fills up before reaching a
+timestamp, that's not a discontinuity and the call to
+cs_etm__process_traceid_queue() already generated samples and drained
+the buffers correctly.
+
+This is visible by looking for a branch that has the same target as the
+previous branch and the following source is before the address of the
+last target, which is impossible as execution would have had to have
+gone backwards:
+
+  ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94
+   (packet_queue fills here before a timestamp, resulting in a flush and
+    branch target ffff80008011cadc is duplicated.)
+  ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff80008011cadc update_sg_lb_stats+0x94
+  ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34
+
+After removing the flush the correct branch target is used for the
+second sample, and ffff8000801117c4 is no longer before the previous
+address:
+
+  ffff800080849d40 _find_next_and_bit+0x78 => ffff80008011cadc update_sg_lb_stats+0x94
+  ffff80008011cb1c update_sg_lb_stats+0xd4 => ffff8000801117a0 cpu_util+0x0
+  ffff8000801117c4 cpu_util+0x24 => ffff8000801117d4 cpu_util+0x34
+
+Make sure that a final branch stack is output at the end of the trace
+by calling cs_etm__end_block(). This is already done for both the
+timeless decode paths.
+
+Fixes: 21fe8dc1191a ("perf cs-etm: Add support for CPU-wide trace scenarios")
+Reported-by: Ganapatrao Kulkarni <gankulkarni@os.amperecomputing.com>
+Closes: https://lore.kernel.org/all/20240719092619.274730-1-gankulkarni@os.amperecomputing.com/
+Reviewed-by: Leo Yan <leo.yan@arm.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Tested-by: Ganapatrao Kulkarni <gankulkarni@os.amperecomputing.com>
+Cc: Ben Gainey <ben.gainey@arm.com>
+Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Ruidong Tian <tianruidong@linux.alibaba.com>
+Cc: Benjamin Gray <bgray@linux.ibm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: coresight@lists.linaro.org
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: scclevenger@os.amperecomputing.com
+Link: https://lore.kernel.org/r/20240916135743.1490403-2-james.clark@linaro.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cs-etm.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 9729d006550d9..799c104901b4f 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -2412,12 +2412,6 @@ static void cs_etm__clear_all_traceid_queues(struct cs_etm_queue *etmq)
+ 
+ 		/* Ignore return value */
+ 		cs_etm__process_traceid_queue(etmq, tidq);
+-
+-		/*
+-		 * Generate an instruction sample with the remaining
+-		 * branchstack entries.
+-		 */
+-		cs_etm__flush(etmq, tidq);
+ 	}
+ }
+ 
+@@ -2560,7 +2554,7 @@ static int cs_etm__process_timestamped_queues(struct cs_etm_auxtrace *etm)
+ 
+ 	while (1) {
+ 		if (!etm->heap.heap_cnt)
+-			goto out;
++			break;
+ 
+ 		/* Take the entry at the top of the min heap */
+ 		cs_queue_nr = etm->heap.heap_array[0].queue_nr;
+@@ -2643,6 +2637,23 @@ static int cs_etm__process_timestamped_queues(struct cs_etm_auxtrace *etm)
+ 		ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, cs_timestamp);
+ 	}
+ 
++	for (i = 0; i < etm->queues.nr_queues; i++) {
++		struct int_node *inode;
++
++		etmq = etm->queues.queue_array[i].priv;
++		if (!etmq)
++			continue;
++
++		intlist__for_each_entry(inode, etmq->traceid_queues_list) {
++			int idx = (int)(intptr_t)inode->priv;
++
++			/* Flush any remaining branch stack entries */
++			tidq = etmq->traceid_queues[idx];
++			ret = cs_etm__end_block(etmq, tidq);
++			if (ret)
++				return ret;
++		}
++	}
+ out:
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-ftrace-latency-fix-unit-on-histogram-first-entr.patch b/queue-6.6/perf-ftrace-latency-fix-unit-on-histogram-first-entr.patch
new file mode 100644
index 00000000000..94422da4e27
--- /dev/null
+++ b/queue-6.6/perf-ftrace-latency-fix-unit-on-histogram-first-entr.patch
@@ -0,0 +1,93 @@
+From 568367bac960d15a71c7de11abb491e473036416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 16:29:02 -0300
+Subject: perf ftrace latency: Fix unit on histogram first entry when using
+ --use-nsec
+
+From: Arnaldo Carvalho de Melo <acme@kernel.org>
+
+[ Upstream commit 064d569e20e82c065b1dec9d20c29c7087bb1a00 ]
+
+The use_nsec arg wasn't being taken into account when printing the first
+histogram entry, fix it:
+
+  root@number:~# perf ftrace latency --use-nsec -T switch_mm_irqs_off -a sleep 2
+  #   DURATION     |      COUNT | GRAPH                                          |
+       0 - 1    us |          0 |                                                |
+       1 - 2    ns |          0 |                                                |
+       2 - 4    ns |          0 |                                                |
+       4 - 8    ns |          0 |                                                |
+       8 - 16   ns |          0 |                                                |
+      16 - 32   ns |          0 |                                                |
+      32 - 64   ns |        125 |                                                |
+      64 - 128  ns |        335 |                                                |
+     128 - 256  ns |       2155 | ####                                           |
+     256 - 512  ns |       9996 | ###################                            |
+     512 - 1024 ns |       4958 | #########                                      |
+       1 - 2    us |       4636 | #########                                      |
+       2 - 4    us |       1053 | ##                                             |
+       4 - 8    us |         15 |                                                |
+       8 - 16   us |          1 |                                                |
+      16 - 32   us |          0 |                                                |
+      32 - 64   us |          0 |                                                |
+      64 - 128  us |          0 |                                                |
+     128 - 256  us |          0 |                                                |
+     256 - 512  us |          0 |                                                |
+     512 - 1024 us |          0 |                                                |
+       1 - ...  ms |          0 |                                                |
+  root@number:~#
+
+After:
+
+  root@number:~# perf ftrace latency --use-nsec -T switch_mm_irqs_off -a sleep 2
+  #   DURATION     |      COUNT | GRAPH                                          |
+       0 - 1    ns |          0 |                                                |
+       1 - 2    ns |          0 |                                                |
+       2 - 4    ns |          0 |                                                |
+       4 - 8    ns |          0 |                                                |
+       8 - 16   ns |          0 |                                                |
+      16 - 32   ns |          0 |                                                |
+      32 - 64   ns |         19 |                                                |
+      64 - 128  ns |         94 |                                                |
+     128 - 256  ns |       2191 | ####                                           |
+     256 - 512  ns |       9719 | ####################                           |
+     512 - 1024 ns |       5330 | ###########                                    |
+       1 - 2    us |       4104 | ########                                       |
+       2 - 4    us |        807 | #                                              |
+       4 - 8    us |          9 |                                                |
+       8 - 16   us |          0 |                                                |
+      16 - 32   us |          0 |                                                |
+      32 - 64   us |          0 |                                                |
+      64 - 128  us |          0 |                                                |
+     128 - 256  us |          0 |                                                |
+     256 - 512  us |          0 |                                                |
+     512 - 1024 us |          0 |                                                |
+       1 - ...  ms |          0 |                                                |
+  root@number:~#
+
+Fixes: 84005bb6148618cc ("perf ftrace latency: Add -n/--use-nsec option")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Gabriele Monaco <gmonaco@redhat.com>
+Link: https://lore.kernel.org/r/ZyE3frB-hMXHCnMO@x1
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index ac2e6c75f9120..a1971703e49cb 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -771,7 +771,7 @@ static void display_histogram(int buckets[], bool use_nsec)
+ 
+ 	bar_len = buckets[0] * bar_total / total;
+ 	printf("  %4d - %-4d %s | %10d | %.*s%*s |\n",
+-	       0, 1, "us", buckets[0], bar_len, bar, bar_total - bar_len, "");
++	       0, 1, use_nsec ? "ns" : "us", buckets[0], bar_len, bar, bar_total - bar_len, "");
+ 
+ 	for (i = 1; i < NUM_BUCKET - 1; i++) {
+ 		int start = (1 << (i - 1));
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-list-fix-topic-and-pmu_name-argument-order.patch b/queue-6.6/perf-list-fix-topic-and-pmu_name-argument-order.patch
new file mode 100644
index 00000000000..229ff1a0163
--- /dev/null
+++ b/queue-6.6/perf-list-fix-topic-and-pmu_name-argument-order.patch
@@ -0,0 +1,171 @@
+From 1da188b944ad564e4d8333b6f5fb886e156a425d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 18:58:01 -0800
+Subject: perf list: Fix topic and pmu_name argument order
+
+From: Jean-Philippe Romain <jean-philippe.romain@foss.st.com>
+
+[ Upstream commit d99b3125726aade4f5ec4aae04805134ab4b0abd ]
+
+Fix function definitions to match header file declaration. Fix two
+callers to pass the arguments in the right order.
+
+On Intel Tigerlake, before:
+```
+$ perf list -j|grep "\"Topic\""|sort|uniq
+        "Topic": "cache",
+        "Topic": "cpu",
+        "Topic": "floating point",
+        "Topic": "frontend",
+        "Topic": "memory",
+        "Topic": "other",
+        "Topic": "pfm icl",
+        "Topic": "pfm ix86arch",
+        "Topic": "pfm perf_raw",
+        "Topic": "pipeline",
+        "Topic": "tool",
+        "Topic": "uncore interconnect",
+        "Topic": "uncore memory",
+        "Topic": "uncore other",
+        "Topic": "virtual memory",
+$ perf list -j|grep "\"Unit\""|sort|uniq
+        "Unit": "cache",
+        "Unit": "cpu",
+        "Unit": "cstate_core",
+        "Unit": "cstate_pkg",
+        "Unit": "i915",
+        "Unit": "icl",
+        "Unit": "intel_bts",
+        "Unit": "intel_pt",
+        "Unit": "ix86arch",
+        "Unit": "msr",
+        "Unit": "perf_raw",
+        "Unit": "power",
+        "Unit": "tool",
+        "Unit": "uncore_arb",
+        "Unit": "uncore_clock",
+        "Unit": "uncore_imc_free_running_0",
+        "Unit": "uncore_imc_free_running_1",
+```
+
+After:
+```
+$ perf list -j|grep "\"Topic\""|sort|uniq
+        "Topic": "cache",
+        "Topic": "floating point",
+        "Topic": "frontend",
+        "Topic": "memory",
+        "Topic": "other",
+        "Topic": "pfm icl",
+        "Topic": "pfm ix86arch",
+        "Topic": "pfm perf_raw",
+        "Topic": "pipeline",
+        "Topic": "tool",
+        "Topic": "uncore interconnect",
+        "Topic": "uncore memory",
+        "Topic": "uncore other",
+        "Topic": "virtual memory",
+$ perf list -j|grep "\"Unit\""|sort|uniq
+        "Unit": "cpu",
+        "Unit": "cstate_core",
+        "Unit": "cstate_pkg",
+        "Unit": "i915",
+        "Unit": "icl",
+        "Unit": "intel_bts",
+        "Unit": "intel_pt",
+        "Unit": "ix86arch",
+        "Unit": "msr",
+        "Unit": "perf_raw",
+        "Unit": "power",
+        "Unit": "tool",
+        "Unit": "uncore_arb",
+        "Unit": "uncore_clock",
+        "Unit": "uncore_imc_free_running_0",
+        "Unit": "uncore_imc_free_running_1",
+```
+
+Fixes: e5c6109f4813246a ("perf list: Reorganize to use callbacks to allow honouring command line options")
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Jean-Philippe Romain <jean-philippe.romain@foss.st.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Junhao He <hejunhao3@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241109025801.560378-1-irogers@google.com
+[ I fixed the two callers and added it to Jean-Phillippe's original change. ]
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-list.c | 4 ++--
+ tools/perf/util/pfm.c     | 4 ++--
+ tools/perf/util/pmus.c    | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
+index 61c2c96cc0701..c8c72fcf37e11 100644
+--- a/tools/perf/builtin-list.c
++++ b/tools/perf/builtin-list.c
+@@ -95,7 +95,7 @@ static void wordwrap(const char *s, int start, int max, int corr)
+ 	}
+ }
+ 
+-static void default_print_event(void *ps, const char *pmu_name, const char *topic,
++static void default_print_event(void *ps, const char *topic, const char *pmu_name,
+ 				const char *event_name, const char *event_alias,
+ 				const char *scale_unit __maybe_unused,
+ 				bool deprecated, const char *event_type_desc,
+@@ -321,7 +321,7 @@ static void fix_escape_printf(struct strbuf *buf, const char *fmt, ...)
+ 	fputs(buf->buf, stdout);
+ }
+ 
+-static void json_print_event(void *ps, const char *pmu_name, const char *topic,
++static void json_print_event(void *ps, const char *topic, const char *pmu_name,
+ 			     const char *event_name, const char *event_alias,
+ 			     const char *scale_unit,
+ 			     bool deprecated, const char *event_type_desc,
+diff --git a/tools/perf/util/pfm.c b/tools/perf/util/pfm.c
+index 862e4a689868b..54421fceef5c7 100644
+--- a/tools/perf/util/pfm.c
++++ b/tools/perf/util/pfm.c
+@@ -220,7 +220,7 @@ print_libpfm_event(const struct print_callbacks *print_cb, void *print_state,
+ 	}
+ 
+ 	if (is_libpfm_event_supported(name, cpus, threads)) {
+-		print_cb->print_event(print_state, pinfo->name, topic,
++		print_cb->print_event(print_state, topic, pinfo->name,
+ 				      name, info->equiv,
+ 				      /*scale_unit=*/NULL,
+ 				      /*deprecated=*/NULL, "PFM event",
+@@ -254,8 +254,8 @@ print_libpfm_event(const struct print_callbacks *print_cb, void *print_state,
+ 				continue;
+ 
+ 			print_cb->print_event(print_state,
+-					pinfo->name,
+ 					topic,
++					pinfo->name,
+ 					name, /*alias=*/NULL,
+ 					/*scale_unit=*/NULL,
+ 					/*deprecated=*/NULL, "PFM event",
+diff --git a/tools/perf/util/pmus.c b/tools/perf/util/pmus.c
+index 54a237b2b8538..f0577aa7eca88 100644
+--- a/tools/perf/util/pmus.c
++++ b/tools/perf/util/pmus.c
+@@ -474,8 +474,8 @@ void perf_pmus__print_pmu_events(const struct print_callbacks *print_cb, void *p
+ 			goto free;
+ 
+ 		print_cb->print_event(print_state,
+-				aliases[j].pmu_name,
+ 				aliases[j].topic,
++				aliases[j].pmu_name,
+ 				aliases[j].name,
+ 				aliases[j].alias,
+ 				aliases[j].scale_unit,
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-probe-correct-demangled-symbols-in-c-program.patch b/queue-6.6/perf-probe-correct-demangled-symbols-in-c-program.patch
new file mode 100644
index 00000000000..fdb7abf43b8
--- /dev/null
+++ b/queue-6.6/perf-probe-correct-demangled-symbols-in-c-program.patch
@@ -0,0 +1,141 @@
+From 4e903f37e5313fae6afb9ad32f941f2edca9c5a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 15:14:32 +0100
+Subject: perf probe: Correct demangled symbols in C++ program
+
+From: Leo Yan <leo.yan@arm.com>
+
+[ Upstream commit 314909f13cc12d47c468602c37dace512d225eeb ]
+
+An issue can be observed when probe C++ demangled symbol with steps:
+
+  # nm test_cpp_mangle | grep print_data
+    0000000000000c94 t _GLOBAL__sub_I__Z10print_datai
+    0000000000000afc T _Z10print_datai
+    0000000000000b38 T _Z10print_dataR5Point
+
+  # perf probe -x /home/niayan01/test_cpp_mangle -F --demangle
+    ...
+    print_data(Point&)
+    print_data(int)
+    ...
+
+  # perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)"
+    probe-definition(0): test=print_data(int)
+    symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null)
+    0 arguments
+    Open Debuginfo file: /home/niayan01/test_cpp_mangle
+    Try to find probe point from debuginfo.
+    Symbol print_data(int) address found : afc
+    Matched function: print_data [2ccf]
+    Probe point found: print_data+0
+    Found 1 probe_trace_events.
+    Opening /sys/kernel/tracing//uprobe_events write=1
+    Opening /sys/kernel/tracing//README write=0
+    Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xb38
+    ...
+
+When tried to probe symbol "print_data(int)", the log shows:
+
+    Symbol print_data(int) address found : afc
+
+The found address is 0xafc - which is right with verifying the output
+result from nm. Afterwards when write event, the command uses offset
+0xb38 in the last log, which is a wrong address.
+
+The dwarf_diename() gets a common function name, in above case, it
+returns string "print_data". As a result, the tool parses the offset
+based on the common name. This leads to probe at the wrong symbol
+"print_data(Point&)".
+
+To fix the issue, use the die_get_linkage_name() function to retrieve
+the distinct linkage name - this is the mangled name for the C++ case.
+Based on this unique name, the tool can get a correct offset for
+probing. Based on DWARF doc, it is possible the linkage name is missed
+in the DIE, it rolls back to use dwarf_diename().
+
+After:
+
+  # perf --debug verbose=3 probe -x test_cpp_mangle --add "test=print_data(int)"
+    probe-definition(0): test=print_data(int)
+    symbol:print_data(int) file:(null) line:0 offset:0 return:0 lazy:(null)
+    0 arguments
+    Open Debuginfo file: /home/niayan01/test_cpp_mangle
+    Try to find probe point from debuginfo.
+    Symbol print_data(int) address found : afc
+    Matched function: print_data [2d06]
+    Probe point found: print_data+0
+    Found 1 probe_trace_events.
+    Opening /sys/kernel/tracing//uprobe_events write=1
+    Opening /sys/kernel/tracing//README write=0
+    Writing event: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0xafc
+    Added new event:
+      probe_test_cpp_mangle:test (on print_data(int) in /home/niayan01/test_cpp_mangle)
+
+    You can now use it in all perf tools, such as:
+
+            perf record -e probe_test_cpp_mangle:test -aR sleep 1
+
+  # perf --debug verbose=3 probe -x test_cpp_mangle --add "test2=print_data(Point&)"
+    probe-definition(0): test2=print_data(Point&)
+    symbol:print_data(Point&) file:(null) line:0 offset:0 return:0 lazy:(null)
+    0 arguments
+    Open Debuginfo file: /home/niayan01/test_cpp_mangle
+    Try to find probe point from debuginfo.
+    Symbol print_data(Point&) address found : b38
+    Matched function: print_data [2ccf]
+    Probe point found: print_data+0
+    Found 1 probe_trace_events.
+    Opening /sys/kernel/tracing//uprobe_events write=1
+    Parsing probe_events: p:probe_test_cpp_mangle/test /home/niayan01/test_cpp_mangle:0x0000000000000afc
+    Group:probe_test_cpp_mangle Event:test probe:p
+    Opening /sys/kernel/tracing//README write=0
+    Writing event: p:probe_test_cpp_mangle/test2 /home/niayan01/test_cpp_mangle:0xb38
+    Added new event:
+      probe_test_cpp_mangle:test2 (on print_data(Point&) in /home/niayan01/test_cpp_mangle)
+
+    You can now use it in all perf tools, such as:
+
+            perf record -e probe_test_cpp_mangle:test2 -aR sleep 1
+
+Fixes: fb1587d869a3 ("perf probe: List probes with line number and file name")
+Signed-off-by: Leo Yan <leo.yan@arm.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Link: https://lore.kernel.org/r/20241012141432.877894-1-leo.yan@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index c816191564bdf..c0c8d7f9514b0 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -1745,8 +1745,21 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, u64 addr,
+ 
+ 	/* Find a corresponding function (name, baseline and baseaddr) */
+ 	if (die_find_realfunc(&cudie, (Dwarf_Addr)addr, &spdie)) {
+-		/* Get function entry information */
+-		func = basefunc = dwarf_diename(&spdie);
++		/*
++		 * Get function entry information.
++		 *
++		 * As described in the document DWARF Debugging Information
++		 * Format Version 5, section 2.22 Linkage Names, "mangled names,
++		 * are used in various ways, ... to distinguish multiple
++		 * entities that have the same name".
++		 *
++		 * Firstly try to get distinct linkage name, if fail then
++		 * rollback to get associated name in DIE.
++		 */
++		func = basefunc = die_get_linkage_name(&spdie);
++		if (!func)
++			func = basefunc = dwarf_diename(&spdie);
++
+ 		if (!func ||
+ 		    die_entrypc(&spdie, &baseaddr) != 0 ||
+ 		    dwarf_decl_line(&spdie, &baseline) != 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-probe-fix-libdw-memory-leak.patch b/queue-6.6/perf-probe-fix-libdw-memory-leak.patch
new file mode 100644
index 00000000000..0d17ac04437
--- /dev/null
+++ b/queue-6.6/perf-probe-fix-libdw-memory-leak.patch
@@ -0,0 +1,69 @@
+From 2310df1e1859d34d4ced90bfc72d4c85e15dcdf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 16:56:22 -0700
+Subject: perf probe: Fix libdw memory leak
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 4585038b8e186252141ef86e9f0d8e97f11dce8d ]
+
+Add missing dwarf_cfi_end to free memory associated with probe_finder
+cfi_eh which is allocated and owned via a call to
+dwarf_getcfi_elf. Confusingly cfi_dbg shouldn't be freed as its memory
+is owned by the passed in debuginfo struct. Add comments to highlight
+this.
+
+This addresses leak sanitizer issues seen in:
+tools/perf/tests/shell/test_uprobe_from_different_cu.sh
+
+Fixes: 270bde1e76f4 ("perf probe: Search both .eh_frame and .debug_frame sections for probe location")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Steinar H. Gunderson <sesse@google.com>
+Cc: Alexander Lobakin <aleksander.lobakin@intel.com>
+Cc: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Hemant Kumar <hemant@linux.vnet.ibm.com>
+Link: https://lore.kernel.org/r/20241016235622.52166-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 4 ++++
+ tools/perf/util/probe-finder.h | 4 ++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index f171360b0ef4d..c816191564bdf 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -1499,6 +1499,10 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
+ 	if (ret >= 0 && tf.pf.skip_empty_arg)
+ 		ret = fill_empty_trace_arg(pev, tf.tevs, tf.ntevs);
+ 
++#if _ELFUTILS_PREREQ(0, 142)
++	dwarf_cfi_end(tf.pf.cfi_eh);
++#endif
++
+ 	if (ret < 0 || tf.ntevs == 0) {
+ 		for (i = 0; i < tf.ntevs; i++)
+ 			clear_probe_trace_event(&tf.tevs[i]);
+diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
+index 8bc1c80d3c1c0..1f4650b955094 100644
+--- a/tools/perf/util/probe-finder.h
++++ b/tools/perf/util/probe-finder.h
+@@ -81,9 +81,9 @@ struct probe_finder {
+ 
+ 	/* For variable searching */
+ #if _ELFUTILS_PREREQ(0, 142)
+-	/* Call Frame Information from .eh_frame */
++	/* Call Frame Information from .eh_frame. Owned by this struct. */
+ 	Dwarf_CFI		*cfi_eh;
+-	/* Call Frame Information from .debug_frame */
++	/* Call Frame Information from .debug_frame. Not owned. */
+ 	Dwarf_CFI		*cfi_dbg;
+ #endif
+ 	Dwarf_Op		*fb_ops;	/* Frame base attribute */
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-stat-close-cork_fd-when-create_perf_stat_counte.patch b/queue-6.6/perf-stat-close-cork_fd-when-create_perf_stat_counte.patch
new file mode 100644
index 00000000000..0963902cc29
--- /dev/null
+++ b/queue-6.6/perf-stat-close-cork_fd-when-create_perf_stat_counte.patch
@@ -0,0 +1,236 @@
+From da96621372adaac3afeb302dfe9b744825b6dad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 14:20:21 +0100
+Subject: perf stat: Close cork_fd when create_perf_stat_counter() failed
+
+From: Levi Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit e880a70f8046df0dd9089fa60dcb866a2cc69194 ]
+
+When create_perf_stat_counter() failed, it doesn't close workload.cork_fd
+open in evlist__prepare_workload(). This could make too many open file
+error while __run_perf_stat() repeats.
+
+Introduce evlist__cancel_workload to close workload.cork_fd and
+wait workload.child_pid until exit to clear child process
+when create_perf_stat_counter() is failed.
+
+Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: nd@arm.com
+Cc: howardchu95@gmail.com
+Link: https://lore.kernel.org/r/20240925132022.2650180-2-yeoreum.yun@arm.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 7f6ccb70e465 ("perf stat: Fix affinity memory leaks on error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 50 +++++++++++++++++++++++++++------------
+ tools/perf/util/evlist.c  | 19 +++++++++++++--
+ tools/perf/util/evlist.h  |  1 +
+ 3 files changed, 53 insertions(+), 17 deletions(-)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 78c1049221810..8bc526e1cb5f4 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -712,15 +712,19 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 	}
+ 
+ 	if (!cpu_map__is_dummy(evsel_list->core.user_requested_cpus)) {
+-		if (affinity__setup(&saved_affinity) < 0)
+-			return -1;
++		if (affinity__setup(&saved_affinity) < 0) {
++			err = -1;
++			goto err_out;
++		}
+ 		affinity = &saved_affinity;
+ 	}
+ 
+ 	evlist__for_each_entry(evsel_list, counter) {
+ 		counter->reset_group = false;
+-		if (bpf_counter__load(counter, &target))
+-			return -1;
++		if (bpf_counter__load(counter, &target)) {
++			err = -1;
++			goto err_out;
++		}
+ 		if (!(evsel__is_bperf(counter)))
+ 			all_counters_use_bpf = false;
+ 	}
+@@ -763,7 +767,8 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 
+ 			switch (stat_handle_error(counter)) {
+ 			case COUNTER_FATAL:
+-				return -1;
++				err = -1;
++				goto err_out;
+ 			case COUNTER_RETRY:
+ 				goto try_again;
+ 			case COUNTER_SKIP:
+@@ -804,7 +809,8 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 
+ 				switch (stat_handle_error(counter)) {
+ 				case COUNTER_FATAL:
+-					return -1;
++					err = -1;
++					goto err_out;
+ 				case COUNTER_RETRY:
+ 					goto try_again_reset;
+ 				case COUNTER_SKIP:
+@@ -829,8 +835,10 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 			stat_config.unit_width = l;
+ 
+ 		if (evsel__should_store_id(counter) &&
+-		    evsel__store_ids(counter, evsel_list))
+-			return -1;
++		    evsel__store_ids(counter, evsel_list)) {
++			err = -1;
++			goto err_out;
++		}
+ 	}
+ 
+ 	if (evlist__apply_filters(evsel_list, &counter)) {
+@@ -851,20 +859,23 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 		}
+ 
+ 		if (err < 0)
+-			return err;
++			goto err_out;
+ 
+ 		err = perf_event__synthesize_stat_events(&stat_config, NULL, evsel_list,
+ 							 process_synthesized_event, is_pipe);
+ 		if (err < 0)
+-			return err;
++			goto err_out;
++
+ 	}
+ 
+ 	if (target.initial_delay) {
+ 		pr_info(EVLIST_DISABLED_MSG);
+ 	} else {
+ 		err = enable_counters();
+-		if (err)
+-			return -1;
++		if (err) {
++			err = -1;
++			goto err_out;
++		}
+ 	}
+ 
+ 	/* Exec the command, if any */
+@@ -874,8 +885,10 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 	if (target.initial_delay > 0) {
+ 		usleep(target.initial_delay * USEC_PER_MSEC);
+ 		err = enable_counters();
+-		if (err)
+-			return -1;
++		if (err) {
++			err = -1;
++			goto err_out;
++		}
+ 
+ 		pr_info(EVLIST_ENABLED_MSG);
+ 	}
+@@ -895,7 +908,8 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 		if (workload_exec_errno) {
+ 			const char *emsg = str_error_r(workload_exec_errno, msg, sizeof(msg));
+ 			pr_err("Workload failed: %s\n", emsg);
+-			return -1;
++			err = -1;
++			goto err_out;
+ 		}
+ 
+ 		if (WIFSIGNALED(status))
+@@ -942,6 +956,12 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 		evlist__close(evsel_list);
+ 
+ 	return WEXITSTATUS(status);
++
++err_out:
++	if (forks)
++		evlist__cancel_workload(evsel_list);
++
++	return err;
+ }
+ 
+ static int run_perf_stat(int argc, const char **argv, int run_idx)
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index eb1dd29c538d5..1eadb4f7c1b9d 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -46,6 +46,7 @@
+ #include <sys/mman.h>
+ #include <sys/prctl.h>
+ #include <sys/timerfd.h>
++#include <sys/wait.h>
+ 
+ #include <linux/bitops.h>
+ #include <linux/hash.h>
+@@ -1412,6 +1413,8 @@ int evlist__prepare_workload(struct evlist *evlist, struct target *target, const
+ 	int child_ready_pipe[2], go_pipe[2];
+ 	char bf;
+ 
++	evlist->workload.cork_fd = -1;
++
+ 	if (pipe(child_ready_pipe) < 0) {
+ 		perror("failed to create 'ready' pipe");
+ 		return -1;
+@@ -1464,7 +1467,7 @@ int evlist__prepare_workload(struct evlist *evlist, struct target *target, const
+ 		 * For cancelling the workload without actually running it,
+ 		 * the parent will just close workload.cork_fd, without writing
+ 		 * anything, i.e. read will return zero and we just exit()
+-		 * here.
++		 * here (See evlist__cancel_workload()).
+ 		 */
+ 		if (ret != 1) {
+ 			if (ret == -1)
+@@ -1528,7 +1531,7 @@ int evlist__prepare_workload(struct evlist *evlist, struct target *target, const
+ 
+ int evlist__start_workload(struct evlist *evlist)
+ {
+-	if (evlist->workload.cork_fd > 0) {
++	if (evlist->workload.cork_fd >= 0) {
+ 		char bf = 0;
+ 		int ret;
+ 		/*
+@@ -1539,12 +1542,24 @@ int evlist__start_workload(struct evlist *evlist)
+ 			perror("unable to write to pipe");
+ 
+ 		close(evlist->workload.cork_fd);
++		evlist->workload.cork_fd = -1;
+ 		return ret;
+ 	}
+ 
+ 	return 0;
+ }
+ 
++void evlist__cancel_workload(struct evlist *evlist)
++{
++	int status;
++
++	if (evlist->workload.cork_fd >= 0) {
++		close(evlist->workload.cork_fd);
++		evlist->workload.cork_fd = -1;
++		waitpid(evlist->workload.pid, &status, WNOHANG);
++	}
++}
++
+ int evlist__parse_sample(struct evlist *evlist, union perf_event *event, struct perf_sample *sample)
+ {
+ 	struct evsel *evsel = evlist__event2evsel(evlist, event);
+diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
+index cb91dc9117a27..12f929ffdf920 100644
+--- a/tools/perf/util/evlist.h
++++ b/tools/perf/util/evlist.h
+@@ -184,6 +184,7 @@ int evlist__prepare_workload(struct evlist *evlist, struct target *target,
+ 			     const char *argv[], bool pipe_output,
+ 			     void (*exec_error)(int signo, siginfo_t *info, void *ucontext));
+ int evlist__start_workload(struct evlist *evlist);
++void evlist__cancel_workload(struct evlist *evlist);
+ 
+ struct option;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-stat-fix-affinity-memory-leaks-on-error-path.patch b/queue-6.6/perf-stat-fix-affinity-memory-leaks-on-error-path.patch
new file mode 100644
index 00000000000..84e1c0c70c5
--- /dev/null
+++ b/queue-6.6/perf-stat-fix-affinity-memory-leaks-on-error-path.patch
@@ -0,0 +1,43 @@
+From 6b7b7bd844be7f95f96ea84d13e8df2fc0d04764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 22:23:24 -0700
+Subject: perf stat: Fix affinity memory leaks on error path
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 7f6ccb70e465bd8c9cf8973aee1c01224e4bdb3c ]
+
+Missed cleanup when an error occurs.
+
+Fixes: 49de179577e7 ("perf stat: No need to setup affinities when starting a workload")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20241001052327.7052-2-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-stat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
+index 8bc526e1cb5f4..9692ebdd7f11e 100644
+--- a/tools/perf/builtin-stat.c
++++ b/tools/perf/builtin-stat.c
+@@ -823,6 +823,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 		}
+ 	}
+ 	affinity__cleanup(affinity);
++	affinity = NULL;
+ 
+ 	evlist__for_each_entry(evsel_list, counter) {
+ 		if (!counter->supported) {
+@@ -961,6 +962,7 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
+ 	if (forks)
+ 		evlist__cancel_workload(evsel_list);
+ 
++	affinity__cleanup(affinity);
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-test-attr-add-back-missing-topdown-events.patch b/queue-6.6/perf-test-attr-add-back-missing-topdown-events.patch
new file mode 100644
index 00000000000..a51a3de28b9
--- /dev/null
+++ b/queue-6.6/perf-test-attr-add-back-missing-topdown-events.patch
@@ -0,0 +1,1005 @@
+From 149277360f95481132aa2c111a8dfa1e27e0057b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 09:16:11 +0100
+Subject: perf test attr: Add back missing topdown events
+
+From: Veronika Molnarova <vmolnaro@redhat.com>
+
+[ Upstream commit 6bff76af9635411214ca44ea38fc2781e78064b6 ]
+
+With the patch 0b6c5371c03c "Add missing topdown metrics events" eight
+topdown metric events with numbers ranging from 0x8000 to 0x8700 were
+added to the test since they were added as 'perf stat' default events.
+Later the patch 951efb9976ce "Update no event/metric expectations" kept
+only 4 of those events(0x8000-0x8300).
+
+Currently, the topdown events with numbers 0x8400 to 0x8700 are missing
+from the list of expected events resulting in a failure. Add back the
+missing topdown events.
+
+Fixes: 951efb9976ce ("perf test attr: Update no event/metric expectations")
+Signed-off-by: Veronika Molnarova <vmolnaro@redhat.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Cc: mpetlan@redhat.com
+Link: https://lore.kernel.org/r/20240311081611.7835-1-vmolnaro@redhat.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/attr/test-stat-default    |  90 ++++++++++----
+ tools/perf/tests/attr/test-stat-detailed-1 | 106 +++++++++++-----
+ tools/perf/tests/attr/test-stat-detailed-2 | 130 ++++++++++++-------
+ tools/perf/tests/attr/test-stat-detailed-3 | 138 ++++++++++++++-------
+ 4 files changed, 320 insertions(+), 144 deletions(-)
+
+diff --git a/tools/perf/tests/attr/test-stat-default b/tools/perf/tests/attr/test-stat-default
+index a1e2da0a9a6dd..e47fb49446799 100644
+--- a/tools/perf/tests/attr/test-stat-default
++++ b/tools/perf/tests/attr/test-stat-default
+@@ -88,98 +88,142 @@ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
++# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+ [event13:base-stat]
+ fd=13
+ group_fd=11
+ type=4
+-config=33280
++config=33024
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
++# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+ [event14:base-stat]
+ fd=14
+ group_fd=11
+ type=4
+-config=33536
++config=33280
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
++# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+ [event15:base-stat]
+ fd=15
+ group_fd=11
+ type=4
+-config=33024
++config=33536
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
++# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
+ [event16:base-stat]
+ fd=16
++group_fd=11
+ type=4
+-config=4109
++config=33792
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
++# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
+ [event17:base-stat]
+ fd=17
++group_fd=11
+ type=4
+-config=17039629
++config=34048
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
++# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
+ [event18:base-stat]
+ fd=18
++group_fd=11
+ type=4
+-config=60
++config=34304
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
++# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
+ [event19:base-stat]
+ fd=19
++group_fd=11
+ type=4
+-config=2097421
++config=34560
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
++# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+ [event20:base-stat]
+ fd=20
+ type=4
+-config=316
++config=4109
+ optional=1
+ 
+-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+ [event21:base-stat]
+ fd=21
+ type=4
+-config=412
++config=17039629
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+ [event22:base-stat]
+ fd=22
+ type=4
+-config=572
++config=60
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+ [event23:base-stat]
+ fd=23
+ type=4
+-config=706
++config=2097421
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+ [event24:base-stat]
+ fd=24
+ type=4
++config=316
++optional=1
++
++# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++[event25:base-stat]
++fd=25
++type=4
++config=412
++optional=1
++
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++[event26:base-stat]
++fd=26
++type=4
++config=572
++optional=1
++
++# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++[event27:base-stat]
++fd=27
++type=4
++config=706
++optional=1
++
++# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++[event28:base-stat]
++fd=28
++type=4
+ config=270
+ optional=1
+diff --git a/tools/perf/tests/attr/test-stat-detailed-1 b/tools/perf/tests/attr/test-stat-detailed-1
+index 1c52cb05c900d..3d500d3e0c5c8 100644
+--- a/tools/perf/tests/attr/test-stat-detailed-1
++++ b/tools/perf/tests/attr/test-stat-detailed-1
+@@ -90,99 +90,143 @@ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
++# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+ [event13:base-stat]
+ fd=13
+ group_fd=11
+ type=4
+-config=33280
++config=33024
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
++# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+ [event14:base-stat]
+ fd=14
+ group_fd=11
+ type=4
+-config=33536
++config=33280
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
++# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+ [event15:base-stat]
+ fd=15
+ group_fd=11
+ type=4
+-config=33024
++config=33536
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
++# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
+ [event16:base-stat]
+ fd=16
++group_fd=11
+ type=4
+-config=4109
++config=33792
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
++# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
+ [event17:base-stat]
+ fd=17
++group_fd=11
+ type=4
+-config=17039629
++config=34048
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
++# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
+ [event18:base-stat]
+ fd=18
++group_fd=11
+ type=4
+-config=60
++config=34304
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
++# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
+ [event19:base-stat]
+ fd=19
++group_fd=11
+ type=4
+-config=2097421
++config=34560
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
++# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+ [event20:base-stat]
+ fd=20
+ type=4
+-config=316
++config=4109
+ optional=1
+ 
+-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+ [event21:base-stat]
+ fd=21
+ type=4
+-config=412
++config=17039629
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+ [event22:base-stat]
+ fd=22
+ type=4
+-config=572
++config=60
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+ [event23:base-stat]
+ fd=23
+ type=4
+-config=706
++config=2097421
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+ [event24:base-stat]
+ fd=24
+ type=4
++config=316
++optional=1
++
++# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++[event25:base-stat]
++fd=25
++type=4
++config=412
++optional=1
++
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++[event26:base-stat]
++fd=26
++type=4
++config=572
++optional=1
++
++# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++[event27:base-stat]
++fd=27
++type=4
++config=706
++optional=1
++
++# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++[event28:base-stat]
++fd=28
++type=4
+ config=270
+ optional=1
+ 
+@@ -190,8 +234,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event25:base-stat]
+-fd=25
++[event29:base-stat]
++fd=29
+ type=3
+ config=0
+ optional=1
+@@ -200,8 +244,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event26:base-stat]
+-fd=26
++[event30:base-stat]
++fd=30
+ type=3
+ config=65536
+ optional=1
+@@ -210,8 +254,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event27:base-stat]
+-fd=27
++[event31:base-stat]
++fd=31
+ type=3
+ config=2
+ optional=1
+@@ -220,8 +264,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event28:base-stat]
+-fd=28
++[event32:base-stat]
++fd=32
+ type=3
+ config=65538
+ optional=1
+diff --git a/tools/perf/tests/attr/test-stat-detailed-2 b/tools/perf/tests/attr/test-stat-detailed-2
+index 7e961d24a885a..01777a63752fe 100644
+--- a/tools/perf/tests/attr/test-stat-detailed-2
++++ b/tools/perf/tests/attr/test-stat-detailed-2
+@@ -90,99 +90,143 @@ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
++# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+ [event13:base-stat]
+ fd=13
+ group_fd=11
+ type=4
+-config=33280
++config=33024
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
++# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+ [event14:base-stat]
+ fd=14
+ group_fd=11
+ type=4
+-config=33536
++config=33280
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
++# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+ [event15:base-stat]
+ fd=15
+ group_fd=11
+ type=4
+-config=33024
++config=33536
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
++# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
+ [event16:base-stat]
+ fd=16
++group_fd=11
+ type=4
+-config=4109
++config=33792
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
++# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
+ [event17:base-stat]
+ fd=17
++group_fd=11
+ type=4
+-config=17039629
++config=34048
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
++# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
+ [event18:base-stat]
+ fd=18
++group_fd=11
+ type=4
+-config=60
++config=34304
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
++# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
+ [event19:base-stat]
+ fd=19
++group_fd=11
+ type=4
+-config=2097421
++config=34560
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
++# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+ [event20:base-stat]
+ fd=20
+ type=4
+-config=316
++config=4109
+ optional=1
+ 
+-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+ [event21:base-stat]
+ fd=21
+ type=4
+-config=412
++config=17039629
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+ [event22:base-stat]
+ fd=22
+ type=4
+-config=572
++config=60
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+ [event23:base-stat]
+ fd=23
+ type=4
+-config=706
++config=2097421
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+ [event24:base-stat]
+ fd=24
+ type=4
++config=316
++optional=1
++
++# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++[event25:base-stat]
++fd=25
++type=4
++config=412
++optional=1
++
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++[event26:base-stat]
++fd=26
++type=4
++config=572
++optional=1
++
++# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++[event27:base-stat]
++fd=27
++type=4
++config=706
++optional=1
++
++# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++[event28:base-stat]
++fd=28
++type=4
+ config=270
+ optional=1
+ 
+@@ -190,8 +234,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event25:base-stat]
+-fd=25
++[event29:base-stat]
++fd=29
+ type=3
+ config=0
+ optional=1
+@@ -200,8 +244,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event26:base-stat]
+-fd=26
++[event30:base-stat]
++fd=30
+ type=3
+ config=65536
+ optional=1
+@@ -210,8 +254,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event27:base-stat]
+-fd=27
++[event31:base-stat]
++fd=31
+ type=3
+ config=2
+ optional=1
+@@ -220,8 +264,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event28:base-stat]
+-fd=28
++[event32:base-stat]
++fd=32
+ type=3
+ config=65538
+ optional=1
+@@ -230,8 +274,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event29:base-stat]
+-fd=29
++[event33:base-stat]
++fd=33
+ type=3
+ config=1
+ optional=1
+@@ -240,8 +284,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event30:base-stat]
+-fd=30
++[event34:base-stat]
++fd=34
+ type=3
+ config=65537
+ optional=1
+@@ -250,8 +294,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event31:base-stat]
+-fd=31
++[event35:base-stat]
++fd=35
+ type=3
+ config=3
+ optional=1
+@@ -260,8 +304,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event32:base-stat]
+-fd=32
++[event36:base-stat]
++fd=36
+ type=3
+ config=65539
+ optional=1
+@@ -270,8 +314,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event33:base-stat]
+-fd=33
++[event37:base-stat]
++fd=37
+ type=3
+ config=4
+ optional=1
+@@ -280,8 +324,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event34:base-stat]
+-fd=34
++[event38:base-stat]
++fd=38
+ type=3
+ config=65540
+ optional=1
+diff --git a/tools/perf/tests/attr/test-stat-detailed-3 b/tools/perf/tests/attr/test-stat-detailed-3
+index e50535f45977c..8400abd7e1e48 100644
+--- a/tools/perf/tests/attr/test-stat-detailed-3
++++ b/tools/perf/tests/attr/test-stat-detailed-3
+@@ -90,99 +90,143 @@ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
++# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
+ [event13:base-stat]
+ fd=13
+ group_fd=11
+ type=4
+-config=33280
++config=33024
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-be-bound (0x8300)
++# PERF_TYPE_RAW / topdown-fe-bound (0x8200)
+ [event14:base-stat]
+ fd=14
+ group_fd=11
+ type=4
+-config=33536
++config=33280
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / topdown-bad-spec (0x8100)
++# PERF_TYPE_RAW / topdown-be-bound (0x8300)
+ [event15:base-stat]
+ fd=15
+ group_fd=11
+ type=4
+-config=33024
++config=33536
+ disabled=0
+ enable_on_exec=0
+ read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
++# PERF_TYPE_RAW / topdown-heavy-ops (0x8400)
+ [event16:base-stat]
+ fd=16
++group_fd=11
+ type=4
+-config=4109
++config=33792
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
++# PERF_TYPE_RAW / topdown-br-mispredict (0x8500)
+ [event17:base-stat]
+ fd=17
++group_fd=11
+ type=4
+-config=17039629
++config=34048
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
++# PERF_TYPE_RAW / topdown-fetch-lat (0x8600)
+ [event18:base-stat]
+ fd=18
++group_fd=11
+ type=4
+-config=60
++config=34304
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
++# PERF_TYPE_RAW / topdown-mem-bound (0x8700)
+ [event19:base-stat]
+ fd=19
++group_fd=11
+ type=4
+-config=2097421
++config=34560
++disabled=0
++enable_on_exec=0
++read_format=15
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
++# PERF_TYPE_RAW / INT_MISC.UOP_DROPPING
+ [event20:base-stat]
+ fd=20
+ type=4
+-config=316
++config=4109
+ optional=1
+ 
+-# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++# PERF_TYPE_RAW / cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/
+ [event21:base-stat]
+ fd=21
+ type=4
+-config=412
++config=17039629
+ optional=1
+ 
+-# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.THREAD
+ [event22:base-stat]
+ fd=22
+ type=4
+-config=572
++config=60
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++# PERF_TYPE_RAW / INT_MISC.RECOVERY_CYCLES_ANY
+ [event23:base-stat]
+ fd=23
+ type=4
+-config=706
++config=2097421
+ optional=1
+ 
+-# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.REF_XCLK
+ [event24:base-stat]
+ fd=24
+ type=4
++config=316
++optional=1
++
++# PERF_TYPE_RAW / IDQ_UOPS_NOT_DELIVERED.CORE
++[event25:base-stat]
++fd=25
++type=4
++config=412
++optional=1
++
++# PERF_TYPE_RAW / CPU_CLK_UNHALTED.ONE_THREAD_ACTIVE
++[event26:base-stat]
++fd=26
++type=4
++config=572
++optional=1
++
++# PERF_TYPE_RAW / UOPS_RETIRED.RETIRE_SLOTS
++[event27:base-stat]
++fd=27
++type=4
++config=706
++optional=1
++
++# PERF_TYPE_RAW / UOPS_ISSUED.ANY
++[event28:base-stat]
++fd=28
++type=4
+ config=270
+ optional=1
+ 
+@@ -190,8 +234,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event25:base-stat]
+-fd=25
++[event29:base-stat]
++fd=29
+ type=3
+ config=0
+ optional=1
+@@ -200,8 +244,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event26:base-stat]
+-fd=26
++[event30:base-stat]
++fd=30
+ type=3
+ config=65536
+ optional=1
+@@ -210,8 +254,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event27:base-stat]
+-fd=27
++[event31:base-stat]
++fd=31
+ type=3
+ config=2
+ optional=1
+@@ -220,8 +264,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_LL                 <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event28:base-stat]
+-fd=28
++[event32:base-stat]
++fd=32
+ type=3
+ config=65538
+ optional=1
+@@ -230,8 +274,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event29:base-stat]
+-fd=29
++[event33:base-stat]
++fd=33
+ type=3
+ config=1
+ optional=1
+@@ -240,8 +284,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1I                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event30:base-stat]
+-fd=30
++[event34:base-stat]
++fd=34
+ type=3
+ config=65537
+ optional=1
+@@ -250,8 +294,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event31:base-stat]
+-fd=31
++[event35:base-stat]
++fd=35
+ type=3
+ config=3
+ optional=1
+@@ -260,8 +304,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_DTLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event32:base-stat]
+-fd=32
++[event36:base-stat]
++fd=36
+ type=3
+ config=65539
+ optional=1
+@@ -270,8 +314,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event33:base-stat]
+-fd=33
++[event37:base-stat]
++fd=37
+ type=3
+ config=4
+ optional=1
+@@ -280,8 +324,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_ITLB               <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_READ            <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event34:base-stat]
+-fd=34
++[event38:base-stat]
++fd=38
+ type=3
+ config=65540
+ optional=1
+@@ -290,8 +334,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_PREFETCH        <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_ACCESS      << 16)
+-[event35:base-stat]
+-fd=35
++[event39:base-stat]
++fd=39
+ type=3
+ config=512
+ optional=1
+@@ -300,8 +344,8 @@ optional=1
+ #  PERF_COUNT_HW_CACHE_L1D                <<  0  |
+ # (PERF_COUNT_HW_CACHE_OP_PREFETCH        <<  8) |
+ # (PERF_COUNT_HW_CACHE_RESULT_MISS        << 16)
+-[event36:base-stat]
+-fd=36
++[event40:base-stat]
++fd=40
+ type=3
+ config=66048
+ optional=1
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch b/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch
new file mode 100644
index 00000000000..8b44fe921a5
--- /dev/null
+++ b/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-syscall.patch
@@ -0,0 +1,63 @@
+From 7d6f4db120a860c6c04870d126746c6aa8e34954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 23:21:27 +0000
+Subject: perf trace: Avoid garbage when not printing a syscall's arguments
+
+From: Benjamin Peterson <benjamin@engflow.com>
+
+[ Upstream commit 1302e352b26f34991b619b5d0b621b76d20a3883 ]
+
+syscall__scnprintf_args may not place anything in the output buffer
+(e.g., because the arguments are all zero). If that happened in
+trace__fprintf_sys_enter, its fprintf would receive an unitialized
+buffer leading to garbage output.
+
+Fix the problem by passing the (possibly zero) bounds of the argument
+buffer to the output fprintf.
+
+Fixes: a98392bb1e169a04 ("perf trace: Use beautifiers on syscalls:sys_enter_ handlers")
+Signed-off-by: Benjamin Peterson <benjamin@engflow.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Howard Chu <howardchu95@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241107232128.108981-2-benjamin@engflow.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index af8480ec53136..3ecd6868be2d6 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2414,6 +2414,7 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,
+ 	char msg[1024];
+ 	void *args, *augmented_args = NULL;
+ 	int augmented_args_size;
++	size_t printed = 0;
+ 
+ 	if (sc == NULL)
+ 		return -1;
+@@ -2429,8 +2430,8 @@ static int trace__fprintf_sys_enter(struct trace *trace, struct evsel *evsel,
+ 
+ 	args = perf_evsel__sc_tp_ptr(evsel, args, sample);
+ 	augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
+-	syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
+-	fprintf(trace->output, "%s", msg);
++	printed += syscall__scnprintf_args(sc, msg, sizeof(msg), args, augmented_args, augmented_args_size, trace, thread);
++	fprintf(trace->output, "%.*s", (int)printed, msg);
+ 	err = 0;
+ out_put:
+ 	thread__put(thread);
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-trace-e.patch b/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-trace-e.patch
new file mode 100644
index 00000000000..71aaa93e3de
--- /dev/null
+++ b/queue-6.6/perf-trace-avoid-garbage-when-not-printing-a-trace-e.patch
@@ -0,0 +1,41 @@
+From bd7eff97568d3ca55967e84a4aebae629920a540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2024 20:48:16 +0000
+Subject: perf trace: avoid garbage when not printing a trace event's arguments
+
+From: Benjamin Peterson <benjamin@engflow.com>
+
+[ Upstream commit 5fb8e56542a3cf469fdf25d77f50e21cbff3ae7e ]
+
+trace__fprintf_tp_fields may not print any tracepoint arguments. E.g., if the
+argument values are all zero. Previously, this would result in a totally
+uninitialized buffer being passed to fprintf, which could lead to garbage on the
+console. Fix the problem by passing the number of initialized bytes fprintf.
+
+Fixes: f11b2803bb88 ("perf trace: Allow choosing how to augment the tracepoint arguments")
+Signed-off-by: Benjamin Peterson <benjamin@engflow.com>
+Tested-by: Howard Chu <howardchu95@gmail.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: https://lore.kernel.org/r/20241103204816.7834-1-benjamin@engflow.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index 6fd30bddf0de9..916d2f6a6d79a 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2803,7 +2803,7 @@ static size_t trace__fprintf_tp_fields(struct trace *trace, struct evsel *evsel,
+ 		printed += syscall_arg_fmt__scnprintf_val(arg, bf + printed, size - printed, &syscall_arg, val);
+ 	}
+ 
+-	return printed + fprintf(trace->output, "%s", bf);
++	return printed + fprintf(trace->output, "%.*s", (int)printed, bf);
+ }
+ 
+ static int trace__event_handler(struct trace *trace, struct evsel *evsel,
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-trace-do-not-lose-last-events-in-a-race.patch b/queue-6.6/perf-trace-do-not-lose-last-events-in-a-race.patch
new file mode 100644
index 00000000000..9489811c3c6
--- /dev/null
+++ b/queue-6.6/perf-trace-do-not-lose-last-events-in-a-race.patch
@@ -0,0 +1,74 @@
+From 5c16e0122de6859da509d7b4fad0cc13f4a5437c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 23:21:26 +0000
+Subject: perf trace: Do not lose last events in a race
+
+From: Benjamin Peterson <benjamin@engflow.com>
+
+[ Upstream commit 3fd7c36973a250e17a4ee305a31545a9426021f4 ]
+
+If a perf trace event selector specifies a maximum number of events to output
+(i.e., "/nr=N/" syntax), the event printing handler, trace__event_handler,
+disables the event selector after the maximum number events are
+printed.
+
+Furthermore, trace__event_handler checked if the event selector was
+disabled before doing any work. This avoided exceeding the maximum
+number of events to print if more events were in the buffer before the
+selector was disabled.
+
+However, the event selector can be disabled for reasons other than
+exceeding the maximum number of events. In particular, when the traced
+subprocess exits, the main loop disables all event selectors. This meant
+the last events of a traced subprocess might be lost to the printing
+handler's short-circuiting logic.
+
+This nondeterministic problem could be seen by running the following many times:
+
+  $ perf trace -e syscalls:sys_enter_exit_group true
+
+trace__event_handler should simply check for exceeding the maximum number of
+events to print rather than the state of the event selector.
+
+Fixes: a9c5e6c1e9bff42c ("perf trace: Introduce per-event maximum number of events property")
+Signed-off-by: Benjamin Peterson <benjamin@engflow.com>
+Tested-by: Howard Chu <howardchu95@gmail.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241107232128.108981-1-benjamin@engflow.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index cdf9c8bf5fb6c..af8480ec53136 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2812,13 +2812,8 @@ static int trace__event_handler(struct trace *trace, struct evsel *evsel,
+ {
+ 	struct thread *thread;
+ 	int callchain_ret = 0;
+-	/*
+-	 * Check if we called perf_evsel__disable(evsel) due to, for instance,
+-	 * this event's max_events having been hit and this is an entry coming
+-	 * from the ring buffer that we should discard, since the max events
+-	 * have already been considered/printed.
+-	 */
+-	if (evsel->disabled)
++
++	if (evsel->nr_events_printed >= evsel->max_events)
+ 		return 0;
+ 
+ 	thread = machine__findnew_thread(trace->host, sample->pid, sample->tid);
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-trace-fix-tracing-itself-creating-feedback-loop.patch b/queue-6.6/perf-trace-fix-tracing-itself-creating-feedback-loop.patch
new file mode 100644
index 00000000000..faf009e2db6
--- /dev/null
+++ b/queue-6.6/perf-trace-fix-tracing-itself-creating-feedback-loop.patch
@@ -0,0 +1,219 @@
+From be227a9378fae8da876ba290dfcc6d17c890a075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 22:24:31 -0700
+Subject: perf trace: Fix tracing itself, creating feedback loops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Howard Chu <howardchu95@gmail.com>
+
+[ Upstream commit fe4f9b4124967ffb75d66994520831231b779550 ]
+
+There exists a pids_filtered map in augmented_raw_syscalls.bpf.c that
+ceases to provide functionality after the BPF skeleton migration done
+in:
+
+5e6da6be3082f77b ("perf trace: Migrate BPF augmentation to use a skeleton")
+
+Before the migration, pid_filtered map works, courtesy of Arnaldo
+Carvalho de Melo <acme@kernel.org>:
+
+  ⬢ [acme@toolbox perf-tools]$ git log --oneline -5
+  6f769c3458b6cf2d (HEAD) perf tests trace+probe_vfs_getname.sh: Accept quotes surrounding the filename
+  7777ac3dfe29f55d perf test trace+probe_vfs_getname.sh: Remove stray \ before /
+  33d9c5062113a4bd perf script python: Add stub for PMU symbol to the python binding
+  e59fea47f83e8a9a perf symbols: Fix DSO kernel load and symbol process to correctly map DSO to its long_name, type and adjust_symbols
+  878460e8d0ff84a0 perf build: Remove -Wno-unused-but-set-variable from the flex flags when building with clang < 13.0.0
+
+  root@x1:/home/acme/git/perf-tools# perf trace -e /tmp/augmented_raw_syscalls.o -e write* --max-events=30  &
+  [1] 180632
+  root@x1:/home/acme/git/perf-tools#      0.000 ( 0.051 ms): NetworkManager/1127 write(fd: 3, buf: 0x7ffeb508ef70, count: 8)                           = 8
+       0.115 ( 0.010 ms): NetworkManager/1127 write(fd: 3, buf: 0x7ffeb508ef70, count: 8)                           = 8
+       0.916 ( 0.068 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 246)                         = 246
+       1.699 ( 0.047 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       2.167 ( 0.041 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       2.739 ( 0.042 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       3.138 ( 0.027 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       3.477 ( 0.027 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       3.738 ( 0.023 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       3.946 ( 0.024 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       4.195 ( 0.024 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 121)                         = 121
+       4.212 ( 0.026 ms): NetworkManager/1127 write(fd: 3, buf: 0x7ffeb508ef70, count: 8)                           = 8
+       4.285 ( 0.006 ms): NetworkManager/1127 write(fd: 3, buf: 0x7ffeb508ef70, count: 8)                           = 8
+       4.445 ( 0.018 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 260)                         = 260
+       4.508 ( 0.009 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 124)                         = 124
+       4.592 ( 0.010 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 116)                         = 116
+       4.666 ( 0.009 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 130)                         = 130
+       4.715 ( 0.010 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 95)                          = 95
+       4.765 ( 0.007 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 102)                         = 102
+       4.815 ( 0.009 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 79)                          = 79
+       4.890 ( 0.008 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 57)                          = 57
+       4.937 ( 0.007 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 89)                          = 89
+       5.009 ( 0.010 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 112)                         = 112
+       5.059 ( 0.010 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 112)                         = 112
+       5.116 ( 0.007 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 79)                          = 79
+       5.152 ( 0.009 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 33)                          = 33
+       5.215 ( 0.008 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 37)                          = 37
+       5.293 ( 0.010 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 128)                         = 128
+       5.339 ( 0.009 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 89)                          = 89
+       5.384 ( 0.008 ms): sudo/156867 write(fd: 8, buf: 0x55cb4cd2f650, count: 100)                         = 100
+
+  [1]+  Done                    perf trace -e /tmp/augmented_raw_syscalls.o -e write* --max-events=30
+  root@x1:/home/acme/git/perf-tools#
+
+No events for the 'perf trace' (pid 180632), i.e. no feedback loop.
+
+If we leave it running:
+
+  root@x1:/home/acme/git/perf-tools# perf trace -e /tmp/augmented_raw_syscalls.o -e landlock_add_rule &
+  [1] 181068
+  root@x1:/home/acme/git/perf-tools#
+
+  And then look at what maps it sets up:
+
+  root@x1:/home/acme/git/perf-tools# bpftool map | grep pids_filtered -A3
+  1190: hash  name pids_filtered  flags 0x0
+          key 4B  value 1B  max_entries 64  memlock 7264B
+          btf_id 1613
+          pids perf(181068)
+  root@x1:/home/acme/git/perf-tools#
+
+  And ask for dumping its contents:
+
+  We see that we are _also_ setting it to filter those:
+
+  root@x1:/home/acme/git/perf-tools# bpftool map dump id 1190
+  [{
+          "key": 181068,
+          "value": 1
+      },{
+          "key": 156801,
+          "value": 1
+      }
+  ]
+
+Now testing the migration commit:
+
+  perf $ git log
+  commit 5e6da6be3082f77be06894a1a94d52a90b4007dc (HEAD)
+  Author: Ian Rogers <irogers@google.com>
+  Date:   Thu Aug 10 11:48:51 2023 -0700
+
+      perf trace: Migrate BPF augmentation to use a skeleton
+
+  perf $ ./perf trace -e write --max-events=10 & echo #!
+  [1] 1808653
+  perf $
+       0.000 ( 0.010 ms): :1808671/1808671 write(fd: 1, buf: 0x6003f5b26fc0, count: 11) = 11
+       0.162 (         ): perf/1808653 write(fd: 2, buf: 0x7fffc2174e50, count: 11)     ...
+       0.174 (         ): perf/1808653 write(fd: 2, buf: 0x74ce21804563, count: 1)      ...
+       0.184 (         ): perf/1808653 write(fd: 2, buf: 0x57b936589052, count: 5)
+
+The feedback loop is there.
+
+Keep it running, look into the bpf map:
+
+  perf $ bpftool map | grep pids_filtered
+  10675: hash  name pids_filtered  flags 0x0
+
+  perf $ bpftool map dump id 10675
+  []
+
+The map is empty.
+
+Now, this commit:
+
+  64917f4df048a064 ("perf trace: Use heuristic when deciding if a syscall tracepoint "const char *" field is really a string")
+
+Temporarily fixed the feedback loop for perf trace -e write, that's
+because before using the heuristic, write is hooked to sys_enter_openat:
+
+  perf $ git log
+  commit 83a0943b1870944612a8aa0049f910826ebfd4f7 (HEAD)
+  Author: Arnaldo Carvalho de Melo <acme@redhat.com>
+  Date:   Thu Aug 17 12:11:51 2023 -0300
+
+      perf trace: Use the augmented_raw_syscall BPF skel only for tracing syscalls
+
+  perf $ ./perf trace -e write --max-events=10 -v 2>&1 | grep Reusing
+  Reusing "openat" BPF sys_enter augmenter for "write"
+
+And after the heuristic fix, it's unaugmented:
+
+  perf $ git log
+  commit 64917f4df048a0649ea7901c2321f020e71e6f24 (HEAD)
+  Author: Arnaldo Carvalho de Melo <acme@redhat.com>
+  Date:   Thu Aug 17 15:14:21 2023 -0300
+
+      perf trace: Use heuristic when deciding if a syscall tracepoint "const char *" field is really a string
+
+  perf $ ./perf trace -e write --max-events=10 -v 2>&1 | grep Reusing
+  perf $
+
+After using the heuristic, write is hooked to syscall_unaugmented, which
+returns 1.
+
+  SEC("tp/raw_syscalls/sys_enter")
+  int syscall_unaugmented(struct syscall_enter_args *args)
+  {
+  	return 1;
+  }
+
+If the BPF program returns 1, the tracepoint filter will filter it
+(since the tracepoint filter for perf is correctly set), but before the
+heuristic, when it was hooked to a sys_enter_openat(), which is a BPF
+program that calls bpf_perf_event_output() and writes to the buffer, it
+didn't get filtered, thus creating feedback loop. So switching write to
+unaugmented accidentally fixed the problem.
+
+But some syscalls are not so lucky, for example newfstatat:
+perf $ ./perf trace -e newfstatat --max-events=100 & echo #!
+[1] 2166948
+
+   457.718 (         ): perf/2166948 newfstatat(dfd: CWD, filename: "/proc/self/ns/mnt", statbuf: 0x7fff0132a9f0) ...
+   457.749 (         ): perf/2166948 newfstatat(dfd: CWD, filename: "/proc/2166950/ns/mnt", statbuf: 0x7fff0132aa80) ...
+   457.962 (         ): perf/2166948 newfstatat(dfd: CWD, filename: "/proc/self/ns/mnt", statbuf: 0x7fff0132a9f0) ...
+
+Currently, write is augmented by the new BTF general augmenter (which
+calls bpf_perf_event_output()). The problem, which luckily got fixed,
+resurfaced, and that’s how it was discovered.
+
+Fixes: 5e6da6be3082f77b ("perf trace: Migrate BPF augmentation to use a skeleton")
+Signed-off-by: Howard Chu <howardchu95@gmail.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241030052431.2220130-1-howardchu95@gmail.com
+[ Check if trace->skel is non-NULL, as it is only initialized if trace->trace_syscalls is set ]
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index 916d2f6a6d79a..cdf9c8bf5fb6c 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -3923,6 +3923,9 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
+ 					sizeof(__u32), BPF_ANY);
+ 		}
+ 	}
++
++	if (trace->skel)
++		trace->filter_pids.map = trace->skel->maps.pids_filtered;
+ #endif
+ 	err = trace__set_filter_pids(trace);
+ 	if (err < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.6/perf-trace-keep-exited-threads-for-summary.patch b/queue-6.6/perf-trace-keep-exited-threads-for-summary.patch
new file mode 100644
index 00000000000..487c3a88b30
--- /dev/null
+++ b/queue-6.6/perf-trace-keep-exited-threads-for-summary.patch
@@ -0,0 +1,77 @@
+From 43b474ff9bb6ca938482882548e0860f972eee8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 17:19:26 +0200
+Subject: perf trace: Keep exited threads for summary
+
+From: Michael Petlan <mpetlan@redhat.com>
+
+[ Upstream commit d29d92df410e2fb523f640478b18f70c1823e55e ]
+
+Since 9ffa6c7512ca ("perf machine thread: Remove exited threads by
+default") perf cleans exited threads up, but as said, sometimes they
+are necessary to be kept. The mentioned commit does not cover all the
+cases, we also need the information to construct the summary table in
+perf-trace.
+
+Before:
+    # perf trace -s true
+
+     Summary of events:
+
+After:
+    # perf trace -s -- true
+
+     Summary of events:
+
+     true (383382), 64 events, 91.4%
+
+       syscall            calls  errors  total       min       avg       max       stddev
+                                         (msec)    (msec)    (msec)    (msec)        (%)
+       --------------- --------  ------ -------- --------- --------- ---------     ------
+       mmap                   8      0     0.150     0.013     0.019     0.031     11.90%
+       mprotect               3      0     0.045     0.014     0.015     0.017      6.47%
+       openat                 2      0     0.014     0.006     0.007     0.007      9.73%
+       munmap                 1      0     0.009     0.009     0.009     0.009      0.00%
+       access                 1      1     0.009     0.009     0.009     0.009      0.00%
+       pread64                4      0     0.006     0.001     0.001     0.002      4.53%
+       fstat                  2      0     0.005     0.001     0.002     0.003     37.59%
+       arch_prctl             2      1     0.003     0.001     0.002     0.002     25.91%
+       read                   1      0     0.003     0.003     0.003     0.003      0.00%
+       close                  2      0     0.003     0.001     0.001     0.001      3.86%
+       brk                    1      0     0.002     0.002     0.002     0.002      0.00%
+       rseq                   1      0     0.001     0.001     0.001     0.001      0.00%
+       prlimit64              1      0     0.001     0.001     0.001     0.001      0.00%
+       set_robust_list        1      0     0.001     0.001     0.001     0.001      0.00%
+       set_tid_address        1      0     0.001     0.001     0.001     0.001      0.00%
+       execve                 1      0     0.000     0.000     0.000     0.000      0.00%
+
+[namhyung: simplified the condition]
+
+Fixes: 9ffa6c7512ca ("perf machine thread: Remove exited threads by default")
+Reported-by: Veronika Molnarova <vmolnaro@redhat.com>
+Signed-off-by: Michael Petlan <mpetlan@redhat.com>
+Link: https://lore.kernel.org/r/20240927151926.399474-1-mpetlan@redhat.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index e541d0e2777ab..6fd30bddf0de9 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -5031,6 +5031,10 @@ int cmd_trace(int argc, const char **argv)
+ 	if (trace.summary_only)
+ 		trace.summary = trace.summary_only;
+ 
++	/* Keep exited threads, otherwise information might be lost for summary */
++	if (trace.summary)
++		symbol_conf.keep_exited_threads = true;
++
+ 	if (output_name != NULL) {
+ 		err = trace__open_output(&trace, output_name);
+ 		if (err < 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/pinctrl-k210-undef-k210_pc_default.patch b/queue-6.6/pinctrl-k210-undef-k210_pc_default.patch
new file mode 100644
index 00000000000..8174b38a2af
--- /dev/null
+++ b/queue-6.6/pinctrl-k210-undef-k210_pc_default.patch
@@ -0,0 +1,39 @@
+From 9cb676f41329ecaabb5bbd1edefca2bc5205f4ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 15:12:01 +0800
+Subject: pinctrl: k210: Undef K210_PC_DEFAULT
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 7e86490c5dee5c41a55f32d0dc34269e200e6909 ]
+
+When the temporary macro K210_PC_DEFAULT is not needed anymore,
+use its name in the #undef statement instead of
+the incorrect "DEFAULT" name.
+
+Fixes: d4c34d09ab03 ("pinctrl: Add RISC-V Canaan Kendryte K210 FPIOA driver")
+Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/20241113071201.5440-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-k210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-k210.c b/drivers/pinctrl/pinctrl-k210.c
+index b6d1ed9ec9a3c..7c05dbf533e7a 100644
+--- a/drivers/pinctrl/pinctrl-k210.c
++++ b/drivers/pinctrl/pinctrl-k210.c
+@@ -183,7 +183,7 @@ static const u32 k210_pinconf_mode_id_to_mode[] = {
+ 	[K210_PC_DEFAULT_INT13] = K210_PC_MODE_IN | K210_PC_PU,
+ };
+ 
+-#undef DEFAULT
++#undef K210_PC_DEFAULT
+ 
+ /*
+  * Pin functions configuration information.
+-- 
+2.43.0
+
diff --git a/queue-6.6/pinctrl-zynqmp-drop-excess-struct-member-description.patch b/queue-6.6/pinctrl-zynqmp-drop-excess-struct-member-description.patch
new file mode 100644
index 00000000000..df7be25f59a
--- /dev/null
+++ b/queue-6.6/pinctrl-zynqmp-drop-excess-struct-member-description.patch
@@ -0,0 +1,36 @@
+From 9232ccafe93480c26bdac588ada4f43caebc7138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 10:04:32 +0200
+Subject: pinctrl: zynqmp: drop excess struct member description
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 2a85fc7044987d751f27d7f1e4423eebbcecc2c6 ]
+
+The 'node' member has never been part of this structure so drop its
+description.
+
+Fixes: 8b242ca700f8 ("pinctrl: Add Xilinx ZynqMP pinctrl driver support")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/20241010080432.7781-1-brgl@bgdev.pl
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-zynqmp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-zynqmp.c b/drivers/pinctrl/pinctrl-zynqmp.c
+index f2be341f73e13..1528f4097ff8a 100644
+--- a/drivers/pinctrl/pinctrl-zynqmp.c
++++ b/drivers/pinctrl/pinctrl-zynqmp.c
+@@ -48,7 +48,6 @@
+  * @name:	Name of the pin mux function
+  * @groups:	List of pin groups for this function
+  * @ngroups:	Number of entries in @groups
+- * @node:	Firmware node matching with the function
+  *
+  * This structure holds information about pin control function
+  * and function group names supporting that function.
+-- 
+2.43.0
+
diff --git a/queue-6.6/platform-x86-panasonic-laptop-return-errno-correctly.patch b/queue-6.6/platform-x86-panasonic-laptop-return-errno-correctly.patch
new file mode 100644
index 00000000000..bcbb6d1ec76
--- /dev/null
+++ b/queue-6.6/platform-x86-panasonic-laptop-return-errno-correctly.patch
@@ -0,0 +1,60 @@
+From d2859b6b31e95a86250e4d3d0bdfa5e797bdbcd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 06:46:39 +0000
+Subject: platform/x86: panasonic-laptop: Return errno correctly in show
+ callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yao Zi <ziyao@disroot.org>
+
+[ Upstream commit 5c7bebc1a3f0661db558d60e14dde27fc216d9dc ]
+
+When an error occurs in sysfs show callback, we should return the errno
+directly instead of formatting it as the result, which produces
+meaningless output and doesn't inform the userspace of the error.
+
+Fixes: 468f96bfa3a0 ("platform/x86: panasonic-laptop: Add support for battery charging threshold (eco mode)")
+Fixes: d5a81d8e864b ("platform/x86: panasonic-laptop: Add support for optical driver power in Y and W series")
+Signed-off-by: Yao Zi <ziyao@disroot.org>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241118064637.61832-3-ziyao@disroot.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/panasonic-laptop.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
+index ebd81846e2d56..7365286f6d2dc 100644
+--- a/drivers/platform/x86/panasonic-laptop.c
++++ b/drivers/platform/x86/panasonic-laptop.c
+@@ -602,8 +602,7 @@ static ssize_t eco_mode_show(struct device *dev, struct device_attribute *attr,
+ 		result = 1;
+ 		break;
+ 	default:
+-		result = -EIO;
+-		break;
++		return -EIO;
+ 	}
+ 	return sysfs_emit(buf, "%u\n", result);
+ }
+@@ -749,7 +748,12 @@ static ssize_t current_brightness_store(struct device *dev, struct device_attrib
+ static ssize_t cdpower_show(struct device *dev, struct device_attribute *attr,
+ 			    char *buf)
+ {
+-	return sysfs_emit(buf, "%d\n", get_optd_power_state());
++	int state = get_optd_power_state();
++
++	if (state < 0)
++		return state;
++
++	return sysfs_emit(buf, "%d\n", state);
+ }
+ 
+ static ssize_t cdpower_store(struct device *dev, struct device_attribute *attr,
+-- 
+2.43.0
+
diff --git a/queue-6.6/pmdomain-ti-sci-add-missing-of_node_put-for-args.np.patch b/queue-6.6/pmdomain-ti-sci-add-missing-of_node_put-for-args.np.patch
new file mode 100644
index 00000000000..f867fde3ad1
--- /dev/null
+++ b/queue-6.6/pmdomain-ti-sci-add-missing-of_node_put-for-args.np.patch
@@ -0,0 +1,48 @@
+From d815276ddf5c85a0c1584cb8996a1fd7159a7166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 11:04:41 +0800
+Subject: pmdomain: ti-sci: Add missing of_node_put() for args.np
+
+From: Zhang Zekun <zhangzekun11@huawei.com>
+
+[ Upstream commit afc2331ef81657493c074592c409dac7c3cb8ccc ]
+
+of_parse_phandle_with_args() needs to call of_node_put() to decrement
+the refcount of args.np. So, Add the missing of_node_put() in the loop.
+
+Fixes: efa5c01cd7ee ("soc: ti: ti_sci_pm_domains: switch to use multiple genpds instead of one")
+Signed-off-by: Zhang Zekun <zhangzekun11@huawei.com>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Message-ID: <20241024030442.119506-2-zhangzekun11@huawei.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/ti/ti_sci_pm_domains.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pmdomain/ti/ti_sci_pm_domains.c b/drivers/pmdomain/ti/ti_sci_pm_domains.c
+index f520228e1b6ae..4449d36042c22 100644
+--- a/drivers/pmdomain/ti/ti_sci_pm_domains.c
++++ b/drivers/pmdomain/ti/ti_sci_pm_domains.c
+@@ -161,6 +161,7 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
+ 				break;
+ 
+ 			if (args.args_count >= 1 && args.np == dev->of_node) {
++				of_node_put(args.np);
+ 				if (args.args[0] > max_id) {
+ 					max_id = args.args[0];
+ 				} else {
+@@ -188,7 +189,10 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
+ 				pm_genpd_init(&pd->pd, NULL, true);
+ 
+ 				list_add(&pd->node, &pd_provider->pd_list);
++			} else {
++				of_node_put(args.np);
+ 			}
++
+ 			index++;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/power-supply-bq27xxx-fix-registers-of-bq27426.patch b/queue-6.6/power-supply-bq27xxx-fix-registers-of-bq27426.patch
new file mode 100644
index 00000000000..8b4bfa7f4a2
--- /dev/null
+++ b/queue-6.6/power-supply-bq27xxx-fix-registers-of-bq27426.patch
@@ -0,0 +1,88 @@
+From 46d57b463f926e127563ced470dfaa12a714a9f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 20:54:05 +0200
+Subject: power: supply: bq27xxx: Fix registers of bq27426
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 34f99d3b706a519e556841f405c224ca708b1f54 ]
+
+Correct bq27426 registers, according to technical reference manual
+it does not have Design Capacity register so it is not register
+compatible with bq27421.
+
+Fixes: 5ef6a16033b47 ("power: supply: bq27xxx: Add support for BQ27426")
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Link: https://lore.kernel.org/r/20241016-fix_bq27426-v2-1-aa6c0f51a9f6@mainlining.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq27xxx_battery.c | 37 ++++++++++++++++++++++++--
+ 1 file changed, 35 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 4296600e8912a..23c8736567574 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -449,9 +449,29 @@ static u8
+ 		[BQ27XXX_REG_AP] = 0x18,
+ 		BQ27XXX_DM_REG_ROWS,
+ 	},
++	bq27426_regs[BQ27XXX_REG_MAX] = {
++		[BQ27XXX_REG_CTRL] = 0x00,
++		[BQ27XXX_REG_TEMP] = 0x02,
++		[BQ27XXX_REG_INT_TEMP] = 0x1e,
++		[BQ27XXX_REG_VOLT] = 0x04,
++		[BQ27XXX_REG_AI] = 0x10,
++		[BQ27XXX_REG_FLAGS] = 0x06,
++		[BQ27XXX_REG_TTE] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_TTF] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_TTES] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_TTECP] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_NAC] = 0x08,
++		[BQ27XXX_REG_RC] = 0x0c,
++		[BQ27XXX_REG_FCC] = 0x0e,
++		[BQ27XXX_REG_CYCT] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_AE] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_SOC] = 0x1c,
++		[BQ27XXX_REG_DCAP] = INVALID_REG_ADDR,
++		[BQ27XXX_REG_AP] = 0x18,
++		BQ27XXX_DM_REG_ROWS,
++	},
+ #define bq27411_regs bq27421_regs
+ #define bq27425_regs bq27421_regs
+-#define bq27426_regs bq27421_regs
+ #define bq27441_regs bq27421_regs
+ #define bq27621_regs bq27421_regs
+ 	bq27z561_regs[BQ27XXX_REG_MAX] = {
+@@ -769,10 +789,23 @@ static enum power_supply_property bq27421_props[] = {
+ };
+ #define bq27411_props bq27421_props
+ #define bq27425_props bq27421_props
+-#define bq27426_props bq27421_props
+ #define bq27441_props bq27421_props
+ #define bq27621_props bq27421_props
+ 
++static enum power_supply_property bq27426_props[] = {
++	POWER_SUPPLY_PROP_STATUS,
++	POWER_SUPPLY_PROP_PRESENT,
++	POWER_SUPPLY_PROP_VOLTAGE_NOW,
++	POWER_SUPPLY_PROP_CURRENT_NOW,
++	POWER_SUPPLY_PROP_CAPACITY,
++	POWER_SUPPLY_PROP_CAPACITY_LEVEL,
++	POWER_SUPPLY_PROP_TEMP,
++	POWER_SUPPLY_PROP_TECHNOLOGY,
++	POWER_SUPPLY_PROP_CHARGE_FULL,
++	POWER_SUPPLY_PROP_CHARGE_NOW,
++	POWER_SUPPLY_PROP_MANUFACTURER,
++};
++
+ static enum power_supply_property bq27z561_props[] = {
+ 	POWER_SUPPLY_PROP_STATUS,
+ 	POWER_SUPPLY_PROP_PRESENT,
+-- 
+2.43.0
+
diff --git a/queue-6.6/power-supply-core-remove-might_sleep-from-power_supp.patch b/queue-6.6/power-supply-core-remove-might_sleep-from-power_supp.patch
new file mode 100644
index 00000000000..d9b42f7d8e7
--- /dev/null
+++ b/queue-6.6/power-supply-core-remove-might_sleep-from-power_supp.patch
@@ -0,0 +1,44 @@
+From 817d43f96b8f3ff89634c3c0395cc7e14e332888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2024 12:39:14 -0700
+Subject: power: supply: core: Remove might_sleep() from power_supply_put()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit f6da4553ff24a5d1c959c9627c965323adc3d307 ]
+
+The put_device() call in power_supply_put() may call
+power_supply_dev_release(). The latter function does not sleep so
+power_supply_put() doesn't sleep either. Hence, remove the might_sleep()
+call from power_supply_put(). This patch suppresses false positive
+complaints about calling a sleeping function from atomic context if
+power_supply_put() is called from atomic context.
+
+Cc: Kyle Tso <kyletso@google.com>
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 1a352462b537 ("power_supply: Add power_supply_put for decrementing device reference counter")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240917193914.47566-1-bvanassche@acm.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/power_supply_core.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 416409e2fd6da..1893d37dd575d 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(power_supply_get_by_name);
+  */
+ void power_supply_put(struct power_supply *psy)
+ {
+-	might_sleep();
+-
+ 	atomic_dec(&psy->use_cnt);
+ 	put_device(&psy->dev);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/power-supply-rt9471-fix-wrong-wdt-function-regfield-.patch b/queue-6.6/power-supply-rt9471-fix-wrong-wdt-function-regfield-.patch
new file mode 100644
index 00000000000..5e9a23c144d
--- /dev/null
+++ b/queue-6.6/power-supply-rt9471-fix-wrong-wdt-function-regfield-.patch
@@ -0,0 +1,39 @@
+From 462e0024abb2423015e9089cf30c53081e358286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 16:32:58 +0800
+Subject: power: supply: rt9471: Fix wrong WDT function regfield declaration
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+[ Upstream commit d10ff07dd2b933e3864c592ca932996b07bbf22a ]
+
+Fix F_WDT and F_WDT_RST wrong regfield declaration.
+
+Fixes: 4a1a5f6781d8 ("power: supply: rt9471: Add Richtek RT9471 charger driver")
+Reported-by: Lucas Tsai <lucas_tsai@richtek.com>
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Link: https://lore.kernel.org/r/f862e23f220612f01fabb6d8e76cfaf63756c22b.1727252762.git.cy_huang@richtek.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/rt9471.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/rt9471.c b/drivers/power/supply/rt9471.c
+index 868b0703d15c5..f62154d929028 100644
+--- a/drivers/power/supply/rt9471.c
++++ b/drivers/power/supply/rt9471.c
+@@ -153,8 +153,8 @@ struct rt9471_chip {
+ };
+ 
+ static const struct reg_field rt9471_reg_fields[F_MAX_FIELDS] = {
+-	[F_WDT]		= REG_FIELD(RT9471_REG_TOP, 0, 0),
+-	[F_WDT_RST]	= REG_FIELD(RT9471_REG_TOP, 1, 1),
++	[F_WDT]		= REG_FIELD(RT9471_REG_TOP, 0, 1),
++	[F_WDT_RST]	= REG_FIELD(RT9471_REG_TOP, 2, 2),
+ 	[F_CHG_EN]	= REG_FIELD(RT9471_REG_FUNC, 0, 0),
+ 	[F_HZ]		= REG_FIELD(RT9471_REG_FUNC, 5, 5),
+ 	[F_BATFET_DIS]	= REG_FIELD(RT9471_REG_FUNC, 7, 7),
+-- 
+2.43.0
+
diff --git a/queue-6.6/power-supply-rt9471-use-ic-status-regfield-to-report.patch b/queue-6.6/power-supply-rt9471-use-ic-status-regfield-to-report.patch
new file mode 100644
index 00000000000..48561615014
--- /dev/null
+++ b/queue-6.6/power-supply-rt9471-use-ic-status-regfield-to-report.patch
@@ -0,0 +1,100 @@
+From b1ff3a17f9f35e7517016033b58d1869fe0c5090 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2024 16:32:59 +0800
+Subject: power: supply: rt9471: Use IC status regfield to report real charger
+ status
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+[ Upstream commit c46a9ee5c6210682611d3d4276436c23a95e1996 ]
+
+Use IC status regfield to rewrite the 'get_staus' function. The original
+one cannot cover some special scenario like as charger OTG or JEITA case.
+
+Fixes: 4a1a5f6781d8 ("power: supply: rt9471: Add Richtek RT9471 charger driver")
+Reported-by: Lucas Tsai <lucas_tsai@richtek.com>
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Link: https://lore.kernel.org/r/67ba92bb4a9c51d9cafadab30b788a3a2c3048e1.1727252762.git.cy_huang@richtek.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/rt9471.c | 48 ++++++++++++++++++++++-------------
+ 1 file changed, 31 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/power/supply/rt9471.c b/drivers/power/supply/rt9471.c
+index f62154d929028..522a67736fa5a 100644
+--- a/drivers/power/supply/rt9471.c
++++ b/drivers/power/supply/rt9471.c
+@@ -139,6 +139,19 @@ enum {
+ 	RT9471_PORTSTAT_DCP,
+ };
+ 
++enum {
++	RT9471_ICSTAT_SLEEP = 0,
++	RT9471_ICSTAT_VBUSRDY,
++	RT9471_ICSTAT_TRICKLECHG,
++	RT9471_ICSTAT_PRECHG,
++	RT9471_ICSTAT_FASTCHG,
++	RT9471_ICSTAT_IEOC,
++	RT9471_ICSTAT_BGCHG,
++	RT9471_ICSTAT_CHGDONE,
++	RT9471_ICSTAT_CHGFAULT,
++	RT9471_ICSTAT_OTG = 15,
++};
++
+ struct rt9471_chip {
+ 	struct device *dev;
+ 	struct regmap *regmap;
+@@ -255,31 +268,32 @@ static int rt9471_get_ieoc(struct rt9471_chip *chip, int *microamp)
+ 
+ static int rt9471_get_status(struct rt9471_chip *chip, int *status)
+ {
+-	unsigned int chg_ready, chg_done, fault_stat;
++	unsigned int ic_stat;
+ 	int ret;
+ 
+-	ret = regmap_field_read(chip->rm_fields[F_ST_CHG_RDY], &chg_ready);
+-	if (ret)
+-		return ret;
+-
+-	ret = regmap_field_read(chip->rm_fields[F_ST_CHG_DONE], &chg_done);
++	ret = regmap_field_read(chip->rm_fields[F_IC_STAT], &ic_stat);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = regmap_read(chip->regmap, RT9471_REG_STAT1, &fault_stat);
+-	if (ret)
+-		return ret;
+-
+-	fault_stat &= RT9471_CHGFAULT_MASK;
+-
+-	if (chg_ready && chg_done)
+-		*status = POWER_SUPPLY_STATUS_FULL;
+-	else if (chg_ready && fault_stat)
++	switch (ic_stat) {
++	case RT9471_ICSTAT_VBUSRDY:
++	case RT9471_ICSTAT_CHGFAULT:
+ 		*status = POWER_SUPPLY_STATUS_NOT_CHARGING;
+-	else if (chg_ready && !fault_stat)
++		break;
++	case RT9471_ICSTAT_TRICKLECHG ... RT9471_ICSTAT_BGCHG:
+ 		*status = POWER_SUPPLY_STATUS_CHARGING;
+-	else
++		break;
++	case RT9471_ICSTAT_CHGDONE:
++		*status = POWER_SUPPLY_STATUS_FULL;
++		break;
++	case RT9471_ICSTAT_SLEEP:
++	case RT9471_ICSTAT_OTG:
+ 		*status = POWER_SUPPLY_STATUS_DISCHARGING;
++		break;
++	default:
++		*status = POWER_SUPPLY_STATUS_UNKNOWN;
++		break;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-fadump-move-fadump_cma_init-to-setup_arch-af.patch b/queue-6.6/powerpc-fadump-move-fadump_cma_init-to-setup_arch-af.patch
new file mode 100644
index 00000000000..56b4150ea86
--- /dev/null
+++ b/queue-6.6/powerpc-fadump-move-fadump_cma_init-to-setup_arch-af.patch
@@ -0,0 +1,131 @@
+From 6f5ac4aafe3d4bec1813a3d6ea44c2126b5d4ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 21:47:57 +0530
+Subject: powerpc/fadump: Move fadump_cma_init to setup_arch() after
+ initmem_init()
+
+From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+
+[ Upstream commit 05b94cae1c47f94588c3e7096963c1007c4d9c1d ]
+
+During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,
+since pageblock_order is still zero and it gets initialized
+later during initmem_init() e.g.
+setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order()
+
+One such use case where this causes issue is -
+early_setup() -> early_init_devtree() -> fadump_reserve_mem() -> fadump_cma_init()
+
+This causes CMA memory alignment check to be bypassed in
+cma_init_reserved_mem(). Then later cma_activate_area() can hit
+a VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory
+area was not pageblock_order aligned.
+
+Fix it by moving the fadump_cma_init() after initmem_init(),
+where other such cma reservations also gets called.
+
+<stack trace>
+==============
+page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010
+flags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA
+raw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000
+raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
+page dumped because: VM_BUG_ON_PAGE(pfn & ((1 << order) - 1))
+------------[ cut here ]------------
+kernel BUG at mm/page_alloc.c:778!
+
+Call Trace:
+__free_one_page+0x57c/0x7b0 (unreliable)
+free_pcppages_bulk+0x1a8/0x2c8
+free_unref_page_commit+0x3d4/0x4e4
+free_unref_page+0x458/0x6d0
+init_cma_reserved_pageblock+0x114/0x198
+cma_init_reserved_areas+0x270/0x3e0
+do_one_initcall+0x80/0x2f8
+kernel_init_freeable+0x33c/0x530
+kernel_init+0x34/0x26c
+ret_from_kernel_user_thread+0x14/0x1c
+
+Fixes: 11ac3e87ce09 ("mm: cma: use pageblock_order as the single alignment")
+Suggested-by: David Hildenbrand <david@redhat.com>
+Reported-by: Sachin P Bappalige <sachinpb@linux.ibm.com>
+Acked-by: Hari Bathini <hbathini@linux.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/3ae208e48c0d9cefe53d2dc4f593388067405b7d.1729146153.git.ritesh.list@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/fadump.h  | 7 +++++++
+ arch/powerpc/kernel/fadump.c       | 6 +-----
+ arch/powerpc/kernel/setup-common.c | 6 ++++--
+ 3 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h
+index 526a6a6473128..daa44b2ef35ad 100644
+--- a/arch/powerpc/include/asm/fadump.h
++++ b/arch/powerpc/include/asm/fadump.h
+@@ -32,4 +32,11 @@ extern int early_init_dt_scan_fw_dump(unsigned long node, const char *uname,
+ 				      int depth, void *data);
+ extern int fadump_reserve_mem(void);
+ #endif
++
++#if defined(CONFIG_FA_DUMP) && defined(CONFIG_CMA)
++void fadump_cma_init(void);
++#else
++static inline void fadump_cma_init(void) { }
++#endif
++
+ #endif /* _ASM_POWERPC_FADUMP_H */
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 4722a9e606e61..1866bac234000 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -80,7 +80,7 @@ static struct cma *fadump_cma;
+  * But for some reason even if it fails we still have the memory reservation
+  * with us and we can still continue doing fadump.
+  */
+-static void __init fadump_cma_init(void)
++void __init fadump_cma_init(void)
+ {
+ 	unsigned long long base, size;
+ 	int rc;
+@@ -124,8 +124,6 @@ static void __init fadump_cma_init(void)
+ 		(unsigned long)cma_get_base(fadump_cma) >> 20,
+ 		fw_dump.reserve_dump_area_size);
+ }
+-#else
+-static void __init fadump_cma_init(void) { }
+ #endif /* CONFIG_CMA */
+ 
+ /* Scan the Firmware Assisted dump configuration details. */
+@@ -642,8 +640,6 @@ int __init fadump_reserve_mem(void)
+ 
+ 		pr_info("Reserved %lldMB of memory at %#016llx (System RAM: %lldMB)\n",
+ 			(size >> 20), base, (memblock_phys_mem_size() >> 20));
+-
+-		fadump_cma_init();
+ 	}
+ 
+ 	return ret;
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 03eaad5949f14..d43db8150767b 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -988,9 +988,11 @@ void __init setup_arch(char **cmdline_p)
+ 	initmem_init();
+ 
+ 	/*
+-	 * Reserve large chunks of memory for use by CMA for KVM and hugetlb. These must
+-	 * be called after initmem_init(), so that pageblock_order is initialised.
++	 * Reserve large chunks of memory for use by CMA for fadump, KVM and
++	 * hugetlb. These must be called after initmem_init(), so that
++	 * pageblock_order is initialised.
+ 	 */
++	fadump_cma_init();
+ 	kvm_cma_reserve();
+ 	gigantic_hugetlb_cma_reserve();
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-fadump-refactor-and-prepare-fadump_cma_init-.patch b/queue-6.6/powerpc-fadump-refactor-and-prepare-fadump_cma_init-.patch
new file mode 100644
index 00000000000..96b8ae49d3d
--- /dev/null
+++ b/queue-6.6/powerpc-fadump-refactor-and-prepare-fadump_cma_init-.patch
@@ -0,0 +1,99 @@
+From 924a6a585edb4ae1ac9701fc9c68109c52544605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 21:47:55 +0530
+Subject: powerpc/fadump: Refactor and prepare fadump_cma_init for late init
+
+From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+
+[ Upstream commit adfaec30ffaceecd565e06adae367aa944acc3c9 ]
+
+We anyway don't use any return values from fadump_cma_init(). Since
+fadump_reserve_mem() from where fadump_cma_init() gets called today,
+already has the required checks.
+This patch makes this function return type as void. Let's also handle
+extra cases like return if fadump_supported is false or dump_active, so
+that in later patches we can call fadump_cma_init() separately from
+setup_arch().
+
+Acked-by: Hari Bathini <hbathini@linux.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/a2afc3d6481a87a305e89cfc4a3f3d2a0b8ceab3.1729146153.git.ritesh.list@gmail.com
+Stable-dep-of: 05b94cae1c47 ("powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/fadump.c | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 3ff2da7b120b5..4722a9e606e61 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -80,27 +80,23 @@ static struct cma *fadump_cma;
+  * But for some reason even if it fails we still have the memory reservation
+  * with us and we can still continue doing fadump.
+  */
+-static int __init fadump_cma_init(void)
++static void __init fadump_cma_init(void)
+ {
+ 	unsigned long long base, size;
+ 	int rc;
+ 
+-	if (!fw_dump.fadump_enabled)
+-		return 0;
+-
++	if (!fw_dump.fadump_supported || !fw_dump.fadump_enabled ||
++			fw_dump.dump_active)
++		return;
+ 	/*
+ 	 * Do not use CMA if user has provided fadump=nocma kernel parameter.
+-	 * Return 1 to continue with fadump old behaviour.
+ 	 */
+-	if (fw_dump.nocma)
+-		return 1;
++	if (fw_dump.nocma || !fw_dump.boot_memory_size)
++		return;
+ 
+ 	base = fw_dump.reserve_dump_area_start;
+ 	size = fw_dump.boot_memory_size;
+ 
+-	if (!size)
+-		return 0;
+-
+ 	rc = cma_init_reserved_mem(base, size, 0, "fadump_cma", &fadump_cma);
+ 	if (rc) {
+ 		pr_err("Failed to init cma area for firmware-assisted dump,%d\n", rc);
+@@ -110,7 +106,7 @@ static int __init fadump_cma_init(void)
+ 		 * blocked from production system usage.  Hence return 1,
+ 		 * so that we can continue with fadump.
+ 		 */
+-		return 1;
++		return;
+ 	}
+ 
+ 	/*
+@@ -127,10 +123,9 @@ static int __init fadump_cma_init(void)
+ 		cma_get_size(fadump_cma),
+ 		(unsigned long)cma_get_base(fadump_cma) >> 20,
+ 		fw_dump.reserve_dump_area_size);
+-	return 1;
+ }
+ #else
+-static int __init fadump_cma_init(void) { return 1; }
++static void __init fadump_cma_init(void) { }
+ #endif /* CONFIG_CMA */
+ 
+ /* Scan the Firmware Assisted dump configuration details. */
+@@ -648,7 +643,7 @@ int __init fadump_reserve_mem(void)
+ 		pr_info("Reserved %lldMB of memory at %#016llx (System RAM: %lldMB)\n",
+ 			(size >> 20), base, (memblock_phys_mem_size() >> 20));
+ 
+-		ret = fadump_cma_init();
++		fadump_cma_init();
+ 	}
+ 
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-kexec-fix-return-of-uninitialized-variable.patch b/queue-6.6/powerpc-kexec-fix-return-of-uninitialized-variable.patch
new file mode 100644
index 00000000000..7a103a7b371
--- /dev/null
+++ b/queue-6.6/powerpc-kexec-fix-return-of-uninitialized-variable.patch
@@ -0,0 +1,49 @@
+From 5eee1f63b3348f43f24ef0a4c3b347ad55a1a4ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 15:56:28 +0800
+Subject: powerpc/kexec: Fix return of uninitialized variable
+
+From: Zhang Zekun <zhangzekun11@huawei.com>
+
+[ Upstream commit 83b5a407fbb73e6965adfb4bd0a803724bf87f96 ]
+
+of_property_read_u64() can fail and leave the variable uninitialized,
+which will then be used. Return error if reading the property failed.
+
+Fixes: 2e6bd221d96f ("powerpc/kexec_file: Enable early kernel OPAL calls")
+Signed-off-by: Zhang Zekun <zhangzekun11@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/20240930075628.125138-1-zhangzekun11@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kexec/file_load_64.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c
+index a3de5369d22c2..7b71737ae24cc 100644
+--- a/arch/powerpc/kexec/file_load_64.c
++++ b/arch/powerpc/kexec/file_load_64.c
+@@ -916,13 +916,18 @@ int setup_purgatory_ppc64(struct kimage *image, const void *slave_code,
+ 	if (dn) {
+ 		u64 val;
+ 
+-		of_property_read_u64(dn, "opal-base-address", &val);
++		ret = of_property_read_u64(dn, "opal-base-address", &val);
++		if (ret)
++			goto out;
++
+ 		ret = kexec_purgatory_get_set_symbol(image, "opal_base", &val,
+ 						     sizeof(val), false);
+ 		if (ret)
+ 			goto out;
+ 
+-		of_property_read_u64(dn, "opal-entry-address", &val);
++		ret = of_property_read_u64(dn, "opal-entry-address", &val);
++		if (ret)
++			goto out;
+ 		ret = kexec_purgatory_get_set_symbol(image, "opal_entry", &val,
+ 						     sizeof(val), false);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-mm-fault-fix-kfence-page-fault-reporting.patch b/queue-6.6/powerpc-mm-fault-fix-kfence-page-fault-reporting.patch
new file mode 100644
index 00000000000..7e0b262c1ce
--- /dev/null
+++ b/queue-6.6/powerpc-mm-fault-fix-kfence-page-fault-reporting.patch
@@ -0,0 +1,85 @@
+From 84a8ab9073c1638d38e626798e979705965339ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 22:59:42 +0530
+Subject: powerpc/mm/fault: Fix kfence page fault reporting
+
+From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+
+[ Upstream commit 06dbbb4d5f7126b6307ab807cbf04ecfc459b933 ]
+
+copy_from_kernel_nofault() can be called when doing read of /proc/kcore.
+/proc/kcore can have some unmapped kfence objects which when read via
+copy_from_kernel_nofault() can cause page faults. Since *_nofault()
+functions define their own fixup table for handling fault, use that
+instead of asking kfence to handle such faults.
+
+Hence we search the exception tables for the nip which generated the
+fault. If there is an entry then we let the fixup table handler handle the
+page fault by returning an error from within ___do_page_fault().
+
+This can be easily triggered if someone tries to do dd from /proc/kcore.
+eg. dd if=/proc/kcore of=/dev/null bs=1M
+
+Some example false negatives:
+
+  ===============================
+  BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x9c/0x1a0
+  Invalid read at 0xc0000000fdff0000:
+   copy_from_kernel_nofault+0x9c/0x1a0
+   0xc00000000665f950
+   read_kcore_iter+0x57c/0xa04
+   proc_reg_read_iter+0xe4/0x16c
+   vfs_read+0x320/0x3ec
+   ksys_read+0x90/0x154
+   system_call_exception+0x120/0x310
+   system_call_vectored_common+0x15c/0x2ec
+
+  BUG: KFENCE: use-after-free read in copy_from_kernel_nofault+0x9c/0x1a0
+  Use-after-free read at 0xc0000000fe050000 (in kfence-#2):
+   copy_from_kernel_nofault+0x9c/0x1a0
+   0xc00000000665f950
+   read_kcore_iter+0x57c/0xa04
+   proc_reg_read_iter+0xe4/0x16c
+   vfs_read+0x320/0x3ec
+   ksys_read+0x90/0x154
+   system_call_exception+0x120/0x310
+   system_call_vectored_common+0x15c/0x2ec
+
+Fixes: 90cbac0e995d ("powerpc: Enable KFENCE for PPC32")
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reported-by: Disha Goel <disgoel@linux.ibm.com>
+Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/a411788081d50e3b136c6270471e35aba3dfafa3.1729271995.git.ritesh.list@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index b1723094d464c..d3e0f5b3ecc74 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -431,10 +431,16 @@ static int ___do_page_fault(struct pt_regs *regs, unsigned long address,
+ 	/*
+ 	 * The kernel should never take an execute fault nor should it
+ 	 * take a page fault to a kernel address or a page fault to a user
+-	 * address outside of dedicated places
++	 * address outside of dedicated places.
++	 *
++	 * Rather than kfence directly reporting false negatives, search whether
++	 * the NIP belongs to the fixup table for cases where fault could come
++	 * from functions like copy_from_kernel_nofault().
+ 	 */
+ 	if (unlikely(!is_user && bad_kernel_fault(regs, error_code, address, is_write))) {
+-		if (kfence_handle_page_fault(address, is_write, regs))
++		if (is_kfence_address((void *)address) &&
++		    !search_exception_tables(instruction_pointer(regs)) &&
++		    kfence_handle_page_fault(address, is_write, regs))
+ 			return 0;
+ 
+ 		return SIGSEGV;
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-pseries-fix-dtl_access_lock-to-be-a-rw_semap.patch b/queue-6.6/powerpc-pseries-fix-dtl_access_lock-to-be-a-rw_semap.patch
new file mode 100644
index 00000000000..3869d7dc8ab
--- /dev/null
+++ b/queue-6.6/powerpc-pseries-fix-dtl_access_lock-to-be-a-rw_semap.patch
@@ -0,0 +1,153 @@
+From ff324e60c0cb143942d157c419c31308a1d3f8fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 22:24:01 +1000
+Subject: powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit cadae3a45d23aa4f6485938a67cbc47aaaa25e38 ]
+
+The dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because
+the code calls kmalloc() while holding it, which can sleep:
+
+  # echo 1 > /proc/powerpc/vcpudispatch_stats
+  BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337
+  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 199, name: sh
+  preempt_count: 1, expected: 0
+  3 locks held by sh/199:
+   #0: c00000000a0743f8 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x324/0x438
+   #1: c0000000028c7058 (dtl_enable_mutex){+.+.}-{3:3}, at: vcpudispatch_stats_write+0xd4/0x5f4
+   #2: c0000000028c70b8 (dtl_access_lock){+.+.}-{2:2}, at: vcpudispatch_stats_write+0x220/0x5f4
+  CPU: 0 PID: 199 Comm: sh Not tainted 6.10.0-rc4 #152
+  Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries
+  Call Trace:
+    dump_stack_lvl+0x130/0x148 (unreliable)
+    __might_resched+0x174/0x410
+    kmem_cache_alloc_noprof+0x340/0x3d0
+    alloc_dtl_buffers+0x124/0x1ac
+    vcpudispatch_stats_write+0x2a8/0x5f4
+    proc_reg_write+0xf4/0x150
+    vfs_write+0xfc/0x438
+    ksys_write+0x88/0x148
+    system_call_exception+0x1c4/0x5a0
+    system_call_common+0xf4/0x258
+
+Fixes: 06220d78f24a ("powerpc/pseries: Introduce rwlock to gatekeep DTLB usage")
+Tested-by: Kajol Jain <kjain@linux.ibm.com>
+Reviewed-by: Nysal Jan K.A <nysal@linux.ibm.com>
+Reviewed-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/20240819122401.513203-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/dtl.h        | 4 ++--
+ arch/powerpc/platforms/pseries/dtl.c  | 8 ++++----
+ arch/powerpc/platforms/pseries/lpar.c | 8 ++++----
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/dtl.h b/arch/powerpc/include/asm/dtl.h
+index d6f43d149f8dc..a5c21bc623cb0 100644
+--- a/arch/powerpc/include/asm/dtl.h
++++ b/arch/powerpc/include/asm/dtl.h
+@@ -1,8 +1,8 @@
+ #ifndef _ASM_POWERPC_DTL_H
+ #define _ASM_POWERPC_DTL_H
+ 
++#include <linux/rwsem.h>
+ #include <asm/lppaca.h>
+-#include <linux/spinlock_types.h>
+ 
+ /*
+  * Layout of entries in the hypervisor's dispatch trace log buffer.
+@@ -35,7 +35,7 @@ struct dtl_entry {
+ #define DTL_LOG_ALL		(DTL_LOG_CEDE | DTL_LOG_PREEMPT | DTL_LOG_FAULT)
+ 
+ extern struct kmem_cache *dtl_cache;
+-extern rwlock_t dtl_access_lock;
++extern struct rw_semaphore dtl_access_lock;
+ 
+ extern void register_dtl_buffer(int cpu);
+ extern void alloc_dtl_buffers(unsigned long *time_limit);
+diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
+index 3f1cdccebc9c1..ecc04ef8c53e3 100644
+--- a/arch/powerpc/platforms/pseries/dtl.c
++++ b/arch/powerpc/platforms/pseries/dtl.c
+@@ -191,7 +191,7 @@ static int dtl_enable(struct dtl *dtl)
+ 		return -EBUSY;
+ 
+ 	/* ensure there are no other conflicting dtl users */
+-	if (!read_trylock(&dtl_access_lock))
++	if (!down_read_trylock(&dtl_access_lock))
+ 		return -EBUSY;
+ 
+ 	n_entries = dtl_buf_entries;
+@@ -199,7 +199,7 @@ static int dtl_enable(struct dtl *dtl)
+ 	if (!buf) {
+ 		printk(KERN_WARNING "%s: buffer alloc failed for cpu %d\n",
+ 				__func__, dtl->cpu);
+-		read_unlock(&dtl_access_lock);
++		up_read(&dtl_access_lock);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -217,7 +217,7 @@ static int dtl_enable(struct dtl *dtl)
+ 	spin_unlock(&dtl->lock);
+ 
+ 	if (rc) {
+-		read_unlock(&dtl_access_lock);
++		up_read(&dtl_access_lock);
+ 		kmem_cache_free(dtl_cache, buf);
+ 	}
+ 
+@@ -232,7 +232,7 @@ static void dtl_disable(struct dtl *dtl)
+ 	dtl->buf = NULL;
+ 	dtl->buf_entries = 0;
+ 	spin_unlock(&dtl->lock);
+-	read_unlock(&dtl_access_lock);
++	up_read(&dtl_access_lock);
+ }
+ 
+ /* file interface */
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index c3585e90c6db6..cade33aef4147 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -169,7 +169,7 @@ struct vcpu_dispatch_data {
+  */
+ #define NR_CPUS_H	NR_CPUS
+ 
+-DEFINE_RWLOCK(dtl_access_lock);
++DECLARE_RWSEM(dtl_access_lock);
+ static DEFINE_PER_CPU(struct vcpu_dispatch_data, vcpu_disp_data);
+ static DEFINE_PER_CPU(u64, dtl_entry_ridx);
+ static DEFINE_PER_CPU(struct dtl_worker, dtl_workers);
+@@ -463,7 +463,7 @@ static int dtl_worker_enable(unsigned long *time_limit)
+ {
+ 	int rc = 0, state;
+ 
+-	if (!write_trylock(&dtl_access_lock)) {
++	if (!down_write_trylock(&dtl_access_lock)) {
+ 		rc = -EBUSY;
+ 		goto out;
+ 	}
+@@ -479,7 +479,7 @@ static int dtl_worker_enable(unsigned long *time_limit)
+ 		pr_err("vcpudispatch_stats: unable to setup workqueue for DTL processing\n");
+ 		free_dtl_buffers(time_limit);
+ 		reset_global_dtl_mask();
+-		write_unlock(&dtl_access_lock);
++		up_write(&dtl_access_lock);
+ 		rc = -EINVAL;
+ 		goto out;
+ 	}
+@@ -494,7 +494,7 @@ static void dtl_worker_disable(unsigned long *time_limit)
+ 	cpuhp_remove_state(dtl_worker_state);
+ 	free_dtl_buffers(time_limit);
+ 	reset_global_dtl_mask();
+-	write_unlock(&dtl_access_lock);
++	up_write(&dtl_access_lock);
+ }
+ 
+ static ssize_t vcpudispatch_stats_write(struct file *file, const char __user *p,
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch b/queue-6.6/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch
new file mode 100644
index 00000000000..6012517bf02
--- /dev/null
+++ b/queue-6.6/powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch
@@ -0,0 +1,76 @@
+From a0d6ec4866aedd85e9c2529e07271d326ad2d54c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 15:03:49 +0200
+Subject: powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit a26c4dbb3d9c1821cb0fc11cb2dbc32d5bf3463b ]
+
+These functions are not used outside of sstep.c
+
+Fixes: 350779a29f11 ("powerpc: Handle most loads and stores in instruction emulation code")
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/20241001130356.14664-1-msuchanek@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/sstep.h |  5 -----
+ arch/powerpc/lib/sstep.c         | 12 ++++--------
+ 2 files changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/sstep.h b/arch/powerpc/include/asm/sstep.h
+index 50950deedb873..e3d0e714ff280 100644
+--- a/arch/powerpc/include/asm/sstep.h
++++ b/arch/powerpc/include/asm/sstep.h
+@@ -173,9 +173,4 @@ int emulate_step(struct pt_regs *regs, ppc_inst_t instr);
+  */
+ extern int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op);
+ 
+-extern void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+-			     const void *mem, bool cross_endian);
+-extern void emulate_vsx_store(struct instruction_op *op,
+-			      const union vsx_reg *reg, void *mem,
+-			      bool cross_endian);
+ extern int emulate_dcbz(unsigned long ea, struct pt_regs *regs);
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 6af97dc0f6d5a..efbf180788708 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -780,8 +780,8 @@ static nokprobe_inline int emulate_stq(struct pt_regs *regs, unsigned long ea,
+ #endif /* __powerpc64 */
+ 
+ #ifdef CONFIG_VSX
+-void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+-		      const void *mem, bool rev)
++static nokprobe_inline void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
++					     const void *mem, bool rev)
+ {
+ 	int size, read_size;
+ 	int i, j;
+@@ -863,11 +863,9 @@ void emulate_vsx_load(struct instruction_op *op, union vsx_reg *reg,
+ 		break;
+ 	}
+ }
+-EXPORT_SYMBOL_GPL(emulate_vsx_load);
+-NOKPROBE_SYMBOL(emulate_vsx_load);
+ 
+-void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
+-		       void *mem, bool rev)
++static nokprobe_inline void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
++					      void *mem, bool rev)
+ {
+ 	int size, write_size;
+ 	int i, j;
+@@ -955,8 +953,6 @@ void emulate_vsx_store(struct instruction_op *op, const union vsx_reg *reg,
+ 		break;
+ 	}
+ }
+-EXPORT_SYMBOL_GPL(emulate_vsx_store);
+-NOKPROBE_SYMBOL(emulate_vsx_store);
+ 
+ static nokprobe_inline int do_vsx_load(struct instruction_op *op,
+ 				       unsigned long ea, struct pt_regs *regs,
+-- 
+2.43.0
+
diff --git a/queue-6.6/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch b/queue-6.6/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch
new file mode 100644
index 00000000000..48921d46d8a
--- /dev/null
+++ b/queue-6.6/powerpc-vdso-flag-vdso64-entry-points-as-functions.patch
@@ -0,0 +1,112 @@
+From 65eddef34ce09ba1ad940187cb7a99505abe379e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 00:17:57 +0200
+Subject: powerpc/vdso: Flag VDSO64 entry points as functions
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 0161bd38c24312853ed5ae9a425a1c41c4ac674a ]
+
+On powerpc64 as shown below by readelf, vDSO functions symbols have
+type NOTYPE.
+
+$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg
+ELF Header:
+  Magic:   7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00
+  Class:                             ELF64
+  Data:                              2's complement, big endian
+  Version:                           1 (current)
+  OS/ABI:                            UNIX - System V
+  ABI Version:                       0
+  Type:                              DYN (Shared object file)
+  Machine:                           PowerPC64
+  Version:                           0x1
+...
+
+Symbol table '.dynsym' contains 12 entries:
+   Num:    Value          Size Type    Bind   Vis      Ndx Name
+...
+     1: 0000000000000524    84 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+...
+     4: 0000000000000000     0 OBJECT  GLOBAL DEFAULT  ABS LINUX_2.6.15
+     5: 00000000000006c0    48 NOTYPE  GLOBAL DEFAULT    8 __[...]@@LINUX_2.6.15
+
+Symbol table '.symtab' contains 56 entries:
+   Num:    Value          Size Type    Bind   Vis      Ndx Name
+...
+    45: 0000000000000000     0 OBJECT  GLOBAL DEFAULT  ABS LINUX_2.6.15
+    46: 00000000000006c0    48 NOTYPE  GLOBAL DEFAULT    8 __kernel_getcpu
+    47: 0000000000000524    84 NOTYPE  GLOBAL DEFAULT    8 __kernel_clock_getres
+
+To overcome that, commit ba83b3239e65 ("selftests: vDSO: fix vDSO
+symbols lookup for powerpc64") was applied to have selftests also
+look for NOTYPE symbols, but the correct fix should be to flag VDSO
+entry points as functions.
+
+The original commit that brought VDSO support into powerpc/64 has the
+following explanation:
+
+    Note that the symbols exposed by the vDSO aren't "normal" function symbols, apps
+    can't be expected to link against them directly, the vDSO's are both seen
+    as if they were linked at 0 and the symbols just contain offsets to the
+    various functions.  This is done on purpose to avoid a relocation step
+    (ppc64 functions normally have descriptors with abs addresses in them).
+    When glibc uses those functions, it's expected to use it's own trampolines
+    that know how to reach them.
+
+The descriptors it's talking about are the OPD function descriptors
+used on ABI v1 (big endian). But it would be more correct for a text
+symbol to have type function, even if there's no function descriptor
+for it.
+
+glibc has a special case already for handling the VDSO symbols which
+creates a fake opd pointing at the kernel symbol. So changing the VDSO
+symbol type to function shouldn't affect that.
+
+For ABI v2, there is no function descriptors and VDSO functions can
+safely have function type.
+
+So lets flag VDSO entry points as functions and revert the
+selftest change.
+
+Link: https://github.com/mpe/linux-fullhistory/commit/5f2dd691b62da9d9cc54b938f8b29c22c93cb805
+Fixes: ba83b3239e65 ("selftests: vDSO: fix vDSO symbols lookup for powerpc64")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Reviewed-By: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://patch.msgid.link/b6ad2f1ee9887af3ca5ecade2a56f4acda517a85.1728512263.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/vdso.h           | 1 +
+ tools/testing/selftests/vDSO/parse_vdso.c | 3 +--
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/vdso.h b/arch/powerpc/include/asm/vdso.h
+index 7650b6ce14c85..8d972bc98b55f 100644
+--- a/arch/powerpc/include/asm/vdso.h
++++ b/arch/powerpc/include/asm/vdso.h
+@@ -25,6 +25,7 @@ int vdso_getcpu_init(void);
+ #ifdef __VDSO64__
+ #define V_FUNCTION_BEGIN(name)		\
+ 	.globl name;			\
++	.type name,@function; 		\
+ 	name:				\
+ 
+ #define V_FUNCTION_END(name)		\
+diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c
+index 7dd5668ea8a6e..28f35620c4991 100644
+--- a/tools/testing/selftests/vDSO/parse_vdso.c
++++ b/tools/testing/selftests/vDSO/parse_vdso.c
+@@ -222,8 +222,7 @@ void *vdso_sym(const char *version, const char *name)
+ 		ELF(Sym) *sym = &vdso_info.symtab[chain];
+ 
+ 		/* Check for a defined global or weak function w/ right name. */
+-		if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC &&
+-		    ELF64_ST_TYPE(sym->st_info) != STT_NOTYPE)
++		if (ELF64_ST_TYPE(sym->st_info) != STT_FUNC)
+ 			continue;
+ 		if (ELF64_ST_BIND(sym->st_info) != STB_GLOBAL &&
+ 		    ELF64_ST_BIND(sym->st_info) != STB_WEAK)
+-- 
+2.43.0
+
diff --git a/queue-6.6/pwm-imx27-workaround-of-the-pwm-output-bug-when-decr.patch b/queue-6.6/pwm-imx27-workaround-of-the-pwm-output-bug-when-decr.patch
new file mode 100644
index 00000000000..285bed10534
--- /dev/null
+++ b/queue-6.6/pwm-imx27-workaround-of-the-pwm-output-bug-when-decr.patch
@@ -0,0 +1,190 @@
+From 88f455dd1b2ac78d09ce1d9544345c1491a59dcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 15:41:23 -0400
+Subject: pwm: imx27: Workaround of the pwm output bug when decrease the duty
+ cycle
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clark Wang <xiaoning.wang@nxp.com>
+
+[ Upstream commit a25351e4c7740eb22561a3ee4ef17611c6f410b0 ]
+
+Implement workaround for ERR051198
+(https://www.nxp.com/docs/en/errata/IMX8MN_0N14Y.pdf)
+
+PWM output may not function correctly if the FIFO is empty when a new SAR
+value is programmed.
+
+Description:
+  When the PWM FIFO is empty, a new value programmed to the PWM Sample
+  register (PWM_PWMSAR) will be directly applied even if the current timer
+  period has not expired. If the new SAMPLE value programmed in the
+  PWM_PWMSAR register is less than the previous value, and the PWM counter
+  register (PWM_PWMCNR) that contains the current COUNT value is greater
+  than the new programmed SAMPLE value, the current period will not flip
+  the level. This may result in an output pulse with a duty cycle of 100%.
+
+Workaround:
+  Program the current SAMPLE value in the PWM_PWMSAR register before
+  updating the new duty cycle to the SAMPLE value in the PWM_PWMSAR
+  register. This will ensure that the new SAMPLE value is modified during
+  a non-empty FIFO, and can be successfully updated after the period
+  expires.
+
+Write the old SAR value before updating the new duty cycle to SAR. This
+avoids writing the new value into an empty FIFO.
+
+This only resolves the issue when the PWM period is longer than 2us
+(or <500kHz) because write register is not quick enough when PWM period is
+very short.
+
+Reproduce steps:
+  cd /sys/class/pwm/pwmchip1/pwm0
+  echo 2000000000 > period     # It is easy to observe by using long period
+  echo 1000000000 > duty_cycle
+  echo 1 > enable
+  echo       8000 > duty_cycle # One full high pulse will be seen by scope
+
+Fixes: 166091b1894d ("[ARM] MXC: add pwm driver for i.MX SoCs")
+Reviewed-by: Jun Li <jun.li@nxp.com>
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20241008194123.1943141-1-Frank.Li@nxp.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-imx27.c | 98 ++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 96 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-imx27.c b/drivers/pwm/pwm-imx27.c
+index 29a3089c534cd..660a71b7263ce 100644
+--- a/drivers/pwm/pwm-imx27.c
++++ b/drivers/pwm/pwm-imx27.c
+@@ -26,6 +26,7 @@
+ #define MX3_PWMSR			0x04    /* PWM Status Register */
+ #define MX3_PWMSAR			0x0C    /* PWM Sample Register */
+ #define MX3_PWMPR			0x10    /* PWM Period Register */
++#define MX3_PWMCNR			0x14    /* PWM Counter Register */
+ 
+ #define MX3_PWMCR_FWM			GENMASK(27, 26)
+ #define MX3_PWMCR_STOPEN		BIT(25)
+@@ -217,11 +218,13 @@ static void pwm_imx27_wait_fifo_slot(struct pwm_chip *chip,
+ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 			   const struct pwm_state *state)
+ {
+-	unsigned long period_cycles, duty_cycles, prescale;
++	unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;
+ 	struct pwm_imx27_chip *imx = to_pwm_imx27_chip(chip);
+ 	struct pwm_state cstate;
+ 	unsigned long long c;
+ 	unsigned long long clkrate;
++	unsigned long flags;
++	int val;
+ 	int ret;
+ 	u32 cr;
+ 
+@@ -264,7 +267,98 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 		pwm_imx27_sw_reset(chip);
+ 	}
+ 
+-	writel(duty_cycles, imx->mmio_base + MX3_PWMSAR);
++	val = readl(imx->mmio_base + MX3_PWMPR);
++	val = val >= MX3_PWMPR_MAX ? MX3_PWMPR_MAX : val;
++	cr = readl(imx->mmio_base + MX3_PWMCR);
++	tmp = NSEC_PER_SEC * (u64)(val + 2) * MX3_PWMCR_PRESCALER_GET(cr);
++	tmp = DIV_ROUND_UP_ULL(tmp, clkrate);
++	period_us = DIV_ROUND_UP_ULL(tmp, 1000);
++
++	/*
++	 * ERR051198:
++	 * PWM: PWM output may not function correctly if the FIFO is empty when
++	 * a new SAR value is programmed
++	 *
++	 * Description:
++	 * When the PWM FIFO is empty, a new value programmed to the PWM Sample
++	 * register (PWM_PWMSAR) will be directly applied even if the current
++	 * timer period has not expired.
++	 *
++	 * If the new SAMPLE value programmed in the PWM_PWMSAR register is
++	 * less than the previous value, and the PWM counter register
++	 * (PWM_PWMCNR) that contains the current COUNT value is greater than
++	 * the new programmed SAMPLE value, the current period will not flip
++	 * the level. This may result in an output pulse with a duty cycle of
++	 * 100%.
++	 *
++	 * Consider a change from
++	 *     ________
++	 *    /        \______/
++	 *    ^      *        ^
++	 * to
++	 *     ____
++	 *    /    \__________/
++	 *    ^               ^
++	 * At the time marked by *, the new write value will be directly applied
++	 * to SAR even the current period is not over if FIFO is empty.
++	 *
++	 *     ________        ____________________
++	 *    /        \______/                    \__________/
++	 *    ^               ^      *        ^               ^
++	 *    |<-- old SAR -->|               |<-- new SAR -->|
++	 *
++	 * That is the output is active for a whole period.
++	 *
++	 * Workaround:
++	 * Check new SAR less than old SAR and current counter is in errata
++	 * windows, write extra old SAR into FIFO and new SAR will effect at
++	 * next period.
++	 *
++	 * Sometime period is quite long, such as over 1 second. If add old SAR
++	 * into FIFO unconditional, new SAR have to wait for next period. It
++	 * may be too long.
++	 *
++	 * Turn off the interrupt to ensure that not IRQ and schedule happen
++	 * during above operations. If any irq and schedule happen, counter
++	 * in PWM will be out of data and take wrong action.
++	 *
++	 * Add a safety margin 1.5us because it needs some time to complete
++	 * IO write.
++	 *
++	 * Use writel_relaxed() to minimize the interval between two writes to
++	 * the SAR register to increase the fastest PWM frequency supported.
++	 *
++	 * When the PWM period is longer than 2us(or <500kHz), this workaround
++	 * can solve this problem. No software workaround is available if PWM
++	 * period is shorter than IO write. Just try best to fill old data
++	 * into FIFO.
++	 */
++	c = clkrate * 1500;
++	do_div(c, NSEC_PER_SEC);
++
++	local_irq_save(flags);
++	val = FIELD_GET(MX3_PWMSR_FIFOAV, readl_relaxed(imx->mmio_base + MX3_PWMSR));
++
++	if (duty_cycles < imx->duty_cycle && (cr & MX3_PWMCR_EN)) {
++		if (period_us < 2) { /* 2us = 500 kHz */
++			/* Best effort attempt to fix up >500 kHz case */
++			udelay(3 * period_us);
++			writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
++			writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
++		} else if (val < MX3_PWMSR_FIFOAV_2WORDS) {
++			val = readl_relaxed(imx->mmio_base + MX3_PWMCNR);
++			/*
++			 * If counter is close to period, controller may roll over when
++			 * next IO write.
++			 */
++			if ((val + c >= duty_cycles && val < imx->duty_cycle) ||
++			    val + c >= period_cycles)
++				writel_relaxed(imx->duty_cycle, imx->mmio_base + MX3_PWMSAR);
++		}
++	}
++	writel_relaxed(duty_cycles, imx->mmio_base + MX3_PWMSAR);
++	local_irq_restore(flags);
++
+ 	writel(period_cycles, imx->mmio_base + MX3_PWMPR);
+ 
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.6/rcu-kvfree-fix-data-race-in-__mod_timer-kvfree_call_.patch b/queue-6.6/rcu-kvfree-fix-data-race-in-__mod_timer-kvfree_call_.patch
new file mode 100644
index 00000000000..f9f4a33d872
--- /dev/null
+++ b/queue-6.6/rcu-kvfree-fix-data-race-in-__mod_timer-kvfree_call_.patch
@@ -0,0 +1,112 @@
+From a87855848b334e214daad283598846456d375acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 12:53:07 +0200
+Subject: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+[ Upstream commit a23da88c6c80e41e0503e0b481a22c9eea63f263 ]
+
+KCSAN reports a data race when access the krcp->monitor_work.timer.expires
+variable in the schedule_delayed_monitor_work() function:
+
+<snip>
+BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu
+
+read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1:
+ schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline]
+ kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839
+ trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441
+ bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203
+ generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849
+ bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143
+ __sys_bpf+0x2e5/0x7a0
+ __do_sys_bpf kernel/bpf/syscall.c:5741 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5739 [inline]
+ __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739
+ x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0:
+ __mod_timer+0x578/0x7f0 kernel/time/timer.c:1173
+ add_timer_global+0x51/0x70 kernel/time/timer.c:1330
+ __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523
+ queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552
+ queue_delayed_work include/linux/workqueue.h:677 [inline]
+ schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline]
+ kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643
+ process_one_work kernel/workqueue.c:3229 [inline]
+ process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310
+ worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391
+ kthread+0x1d1/0x210 kernel/kthread.c:389
+ ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+Workqueue: events_unbound kfree_rcu_monitor
+<snip>
+
+kfree_rcu_monitor() rearms the work if a "krcp" has to be still
+offloaded and this is done without holding krcp->lock, whereas
+the kvfree_call_rcu() holds it.
+
+Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so
+both functions do not race anymore.
+
+Reported-by: syzbot+061d370693bdd99f9d34@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/lkml/ZxZ68KmHDQYU0yfD@pc636/T/
+Fixes: 8fc5494ad5fa ("rcu/kvfree: Move need_offload_krc() out of krcp->lock")
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Reviewed-by: Neeraj Upadhyay <Neeraj.Upadhyay@amd.com>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 3d7b119f6e2a3..fda08520c75c5 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -3150,7 +3150,7 @@ static int krc_count(struct kfree_rcu_cpu *krcp)
+ }
+ 
+ static void
+-schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
++__schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
+ {
+ 	long delay, delay_left;
+ 
+@@ -3164,6 +3164,16 @@ schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
+ 	queue_delayed_work(system_wq, &krcp->monitor_work, delay);
+ }
+ 
++static void
++schedule_delayed_monitor_work(struct kfree_rcu_cpu *krcp)
++{
++	unsigned long flags;
++
++	raw_spin_lock_irqsave(&krcp->lock, flags);
++	__schedule_delayed_monitor_work(krcp);
++	raw_spin_unlock_irqrestore(&krcp->lock, flags);
++}
++
+ static void
+ kvfree_rcu_drain_ready(struct kfree_rcu_cpu *krcp)
+ {
+@@ -3460,7 +3470,7 @@ void kvfree_call_rcu(struct rcu_head *head, void *ptr)
+ 
+ 	// Set timer to drain after KFREE_DRAIN_JIFFIES.
+ 	if (rcu_scheduler_active == RCU_SCHEDULER_RUNNING)
+-		schedule_delayed_monitor_work(krcp);
++		__schedule_delayed_monitor_work(krcp);
+ 
+ unlock_return:
+ 	krc_this_cpu_unlock(krcp, flags);
+-- 
+2.43.0
+
diff --git a/queue-6.6/rcuscale-do-a-proper-cleanup-if-kfree_scale_init-fai.patch b/queue-6.6/rcuscale-do-a-proper-cleanup-if-kfree_scale_init-fai.patch
new file mode 100644
index 00000000000..f4b3c5e379f
--- /dev/null
+++ b/queue-6.6/rcuscale-do-a-proper-cleanup-if-kfree_scale_init-fai.patch
@@ -0,0 +1,70 @@
+From 23053dbaa00bb2a8f1834b1d0d24c0476848f6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 12:00:08 +0100
+Subject: rcuscale: Do a proper cleanup if kfree_scale_init() fails
+
+From: Uladzislau Rezki (Sony) <urezki@gmail.com>
+
+[ Upstream commit 812a1c3b9f7c36d9255f0d29d0a3d324e2f52321 ]
+
+A static analyzer for C, Smatch, reports and triggers below
+warnings:
+
+   kernel/rcu/rcuscale.c:1215 rcu_scale_init()
+   warn: inconsistent returns 'global &fullstop_mutex'.
+
+The checker complains about, we do not unlock the "fullstop_mutex"
+mutex, in case of hitting below error path:
+
+<snip>
+...
+    if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start < 2 * HZ)) {
+        pr_alert("ERROR: call_rcu() CBs are not being lazy as expected!\n");
+        WARN_ON_ONCE(1);
+        return -1;
+        ^^^^^^^^^^
+...
+<snip>
+
+it happens because "-1" is returned right away instead of
+doing a proper unwinding.
+
+Fix it by jumping to "unwind" label instead of returning -1.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Neeraj Upadhyay <Neeraj.Upadhyay@amd.com>
+Closes: https://lore.kernel.org/rcu/ZxfTrHuEGtgnOYWp@pc636/T/
+Fixes: 084e04fff160 ("rcuscale: Add laziness and kfree tests")
+Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/rcuscale.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/rcu/rcuscale.c b/kernel/rcu/rcuscale.c
+index ed46d9e8c0e43..902575db9aec3 100644
+--- a/kernel/rcu/rcuscale.c
++++ b/kernel/rcu/rcuscale.c
+@@ -780,13 +780,15 @@ kfree_scale_init(void)
+ 		if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start < 2 * HZ)) {
+ 			pr_alert("ERROR: call_rcu() CBs are not being lazy as expected!\n");
+ 			WARN_ON_ONCE(1);
+-			return -1;
++			firsterr = -1;
++			goto unwind;
+ 		}
+ 
+ 		if (WARN_ON_ONCE(jiffies_at_lazy_cb - jif_start > 3 * HZ)) {
+ 			pr_alert("ERROR: call_rcu() CBs are being too lazy!\n");
+ 			WARN_ON_ONCE(1);
+-			return -1;
++			firsterr = -1;
++			goto unwind;
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch b/queue-6.6/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch
new file mode 100644
index 00000000000..690c96199f1
--- /dev/null
+++ b/queue-6.6/rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch
@@ -0,0 +1,80 @@
+From 33f37cb9e8d42c46f04d7bb1088aec286d52b352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2024 03:06:54 -0700
+Subject: RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+[ Upstream commit 808ca6de989c598bc5af1ae0ad971a66077efac0 ]
+
+Invalidate rkey is cpu endian and immediate data is in big endian format.
+Both immediate data and invalidate the remote key returned by
+HW is in little endian format.
+
+While handling the commit in fixes tag, the difference between
+immediate data and invalidate rkey endianness was not considered.
+
+Without changes of this patch, Kernel ULP was failing while processing
+inv_rkey.
+
+dmesg log snippet -
+nvme nvme0: Bogus remote invalidation for rkey 0x2000019Fix in this patch
+
+Do endianness conversion based on completion queue entry flag.
+Also, the HW completions are already converted to host endianness in
+bnxt_qplib_cq_process_res_rc and bnxt_qplib_cq_process_res_ud and there
+is no need to convert it again in bnxt_re_poll_cq. Modified the union to
+hold the correct data type.
+
+Fixes: 95b087f87b78 ("bnxt_re: Fix imm_data endianness")
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://patch.msgid.link/1730110014-20755-1-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++--
+ drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +-
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index f20da108fb297..df58972606014 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -3559,7 +3559,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp,
+ 	wc->byte_len = orig_cqe->length;
+ 	wc->qp = &gsi_qp->ib_qp;
+ 
+-	wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata));
++	wc->ex.imm_data = cpu_to_be32(orig_cqe->immdata);
+ 	wc->src_qp = orig_cqe->src_qp;
+ 	memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
+ 	if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
+@@ -3704,7 +3704,10 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
+ 				 (unsigned long)(cqe->qp_handle),
+ 				 struct bnxt_re_qp, qplib_qp);
+ 			wc->qp = &qp->ib_qp;
+-			wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata));
++			if (cqe->flags & CQ_RES_RC_FLAGS_IMM)
++				wc->ex.imm_data = cpu_to_be32(cqe->immdata);
++			else
++				wc->ex.invalidate_rkey = cqe->invrkey;
+ 			wc->src_qp = cqe->src_qp;
+ 			memcpy(wc->smac, cqe->smac, ETH_ALEN);
+ 			wc->port_num = 1;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+index 56ddff96b5083..5d4c49089a20f 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+@@ -389,7 +389,7 @@ struct bnxt_qplib_cqe {
+ 	u16				cfa_meta;
+ 	u64				wr_id;
+ 	union {
+-		__le32			immdata;
++		u32			immdata;
+ 		u32			invrkey;
+ 	};
+ 	u64				qp_handle;
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-hns-fix-an-aeqe-overflow-error-caused-by-untime.patch b/queue-6.6/rdma-hns-fix-an-aeqe-overflow-error-caused-by-untime.patch
new file mode 100644
index 00000000000..1af400b2638
--- /dev/null
+++ b/queue-6.6/rdma-hns-fix-an-aeqe-overflow-error-caused-by-untime.patch
@@ -0,0 +1,292 @@
+From 1ab43711ee1ac97f901fbe8c79fc2f61cda5ac6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 20:39:56 +0800
+Subject: RDMA/hns: Fix an AEQE overflow error caused by untimely update of
+ eq_db_ci
+
+From: wenglianfa <wenglianfa@huawei.com>
+
+[ Upstream commit 571e4ab8a45e530623ab129803f090a844dd3fe9 ]
+
+eq_db_ci is updated only after all AEQEs are processed in the AEQ
+interrupt handler, which is not timely enough and may result in
+AEQ overflow. Two optimization methods are proposed:
+1. Set an upper limit for AEQE processing.
+2. Move time-consuming operations such as printings to the bottom
+half of the interrupt.
+
+cmd events and flush_cqe events are still fully processed in the top half
+to ensure timely handling.
+
+Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08")
+Signed-off-by: wenglianfa <wenglianfa@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20241024124000.2931869-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h |  1 +
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 75 ++++++++++++++-------
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h  |  5 ++
+ drivers/infiniband/hw/hns/hns_roce_qp.c     | 54 +++++++++------
+ 4 files changed, 91 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index cd593d651e4ca..21ef00fdb6563 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -1236,6 +1236,7 @@ void hns_roce_cq_completion(struct hns_roce_dev *hr_dev, u32 cqn);
+ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type);
+ void flush_cqe(struct hns_roce_dev *dev, struct hns_roce_qp *qp);
+ void hns_roce_qp_event(struct hns_roce_dev *hr_dev, u32 qpn, int event_type);
++void hns_roce_flush_cqe(struct hns_roce_dev *hr_dev, u32 qpn);
+ void hns_roce_srq_event(struct hns_roce_dev *hr_dev, u32 srqn, int event_type);
+ void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev);
+ int hns_roce_init(struct hns_roce_dev *hr_dev);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 8066750afab90..3c3be860e8180 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5820,11 +5820,10 @@ static int hns_roce_v2_query_mpt(struct hns_roce_dev *hr_dev, u32 key,
+ 	return ret;
+ }
+ 
+-static void hns_roce_irq_work_handle(struct work_struct *work)
++static void dump_aeqe_log(struct hns_roce_work *irq_work)
+ {
+-	struct hns_roce_work *irq_work =
+-				container_of(work, struct hns_roce_work, work);
+-	struct ib_device *ibdev = &irq_work->hr_dev->ib_dev;
++	struct hns_roce_dev *hr_dev = irq_work->hr_dev;
++	struct ib_device *ibdev = &hr_dev->ib_dev;
+ 
+ 	switch (irq_work->event_type) {
+ 	case HNS_ROCE_EVENT_TYPE_PATH_MIG:
+@@ -5868,6 +5867,8 @@ static void hns_roce_irq_work_handle(struct work_struct *work)
+ 	case HNS_ROCE_EVENT_TYPE_DB_OVERFLOW:
+ 		ibdev_warn(ibdev, "DB overflow.\n");
+ 		break;
++	case HNS_ROCE_EVENT_TYPE_MB:
++		break;
+ 	case HNS_ROCE_EVENT_TYPE_FLR:
+ 		ibdev_warn(ibdev, "function level reset.\n");
+ 		break;
+@@ -5878,8 +5879,46 @@ static void hns_roce_irq_work_handle(struct work_struct *work)
+ 		ibdev_err(ibdev, "invalid xrceth error.\n");
+ 		break;
+ 	default:
++		ibdev_info(ibdev, "Undefined event %d.\n",
++			   irq_work->event_type);
+ 		break;
+ 	}
++}
++
++static void hns_roce_irq_work_handle(struct work_struct *work)
++{
++	struct hns_roce_work *irq_work =
++				container_of(work, struct hns_roce_work, work);
++	struct hns_roce_dev *hr_dev = irq_work->hr_dev;
++	int event_type = irq_work->event_type;
++	u32 queue_num = irq_work->queue_num;
++
++	switch (event_type) {
++	case HNS_ROCE_EVENT_TYPE_PATH_MIG:
++	case HNS_ROCE_EVENT_TYPE_PATH_MIG_FAILED:
++	case HNS_ROCE_EVENT_TYPE_COMM_EST:
++	case HNS_ROCE_EVENT_TYPE_SQ_DRAINED:
++	case HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR:
++	case HNS_ROCE_EVENT_TYPE_SRQ_LAST_WQE_REACH:
++	case HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR:
++	case HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR:
++	case HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION:
++	case HNS_ROCE_EVENT_TYPE_INVALID_XRCETH:
++		hns_roce_qp_event(hr_dev, queue_num, event_type);
++		break;
++	case HNS_ROCE_EVENT_TYPE_SRQ_LIMIT_REACH:
++	case HNS_ROCE_EVENT_TYPE_SRQ_CATAS_ERROR:
++		hns_roce_srq_event(hr_dev, queue_num, event_type);
++		break;
++	case HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR:
++	case HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW:
++		hns_roce_cq_event(hr_dev, queue_num, event_type);
++		break;
++	default:
++		break;
++	}
++
++	dump_aeqe_log(irq_work);
+ 
+ 	kfree(irq_work);
+ }
+@@ -5940,14 +5979,14 @@ static struct hns_roce_aeqe *next_aeqe_sw_v2(struct hns_roce_eq *eq)
+ static irqreturn_t hns_roce_v2_aeq_int(struct hns_roce_dev *hr_dev,
+ 				       struct hns_roce_eq *eq)
+ {
+-	struct device *dev = hr_dev->dev;
+ 	struct hns_roce_aeqe *aeqe = next_aeqe_sw_v2(eq);
+ 	irqreturn_t aeqe_found = IRQ_NONE;
++	int num_aeqes = 0;
+ 	int event_type;
+ 	u32 queue_num;
+ 	int sub_type;
+ 
+-	while (aeqe) {
++	while (aeqe && num_aeqes < HNS_AEQ_POLLING_BUDGET) {
+ 		/* Make sure we read AEQ entry after we have checked the
+ 		 * ownership bit
+ 		 */
+@@ -5958,25 +5997,12 @@ static irqreturn_t hns_roce_v2_aeq_int(struct hns_roce_dev *hr_dev,
+ 		queue_num = hr_reg_read(aeqe, AEQE_EVENT_QUEUE_NUM);
+ 
+ 		switch (event_type) {
+-		case HNS_ROCE_EVENT_TYPE_PATH_MIG:
+-		case HNS_ROCE_EVENT_TYPE_PATH_MIG_FAILED:
+-		case HNS_ROCE_EVENT_TYPE_COMM_EST:
+-		case HNS_ROCE_EVENT_TYPE_SQ_DRAINED:
+ 		case HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR:
+-		case HNS_ROCE_EVENT_TYPE_SRQ_LAST_WQE_REACH:
+ 		case HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR:
+ 		case HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR:
+ 		case HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION:
+ 		case HNS_ROCE_EVENT_TYPE_INVALID_XRCETH:
+-			hns_roce_qp_event(hr_dev, queue_num, event_type);
+-			break;
+-		case HNS_ROCE_EVENT_TYPE_SRQ_LIMIT_REACH:
+-		case HNS_ROCE_EVENT_TYPE_SRQ_CATAS_ERROR:
+-			hns_roce_srq_event(hr_dev, queue_num, event_type);
+-			break;
+-		case HNS_ROCE_EVENT_TYPE_CQ_ACCESS_ERROR:
+-		case HNS_ROCE_EVENT_TYPE_CQ_OVERFLOW:
+-			hns_roce_cq_event(hr_dev, queue_num, event_type);
++			hns_roce_flush_cqe(hr_dev, queue_num);
+ 			break;
+ 		case HNS_ROCE_EVENT_TYPE_MB:
+ 			hns_roce_cmd_event(hr_dev,
+@@ -5984,12 +6010,7 @@ static irqreturn_t hns_roce_v2_aeq_int(struct hns_roce_dev *hr_dev,
+ 					aeqe->event.cmd.status,
+ 					le64_to_cpu(aeqe->event.cmd.out_param));
+ 			break;
+-		case HNS_ROCE_EVENT_TYPE_DB_OVERFLOW:
+-		case HNS_ROCE_EVENT_TYPE_FLR:
+-			break;
+ 		default:
+-			dev_err(dev, "unhandled event %d on EQ %d at idx %u.\n",
+-				event_type, eq->eqn, eq->cons_index);
+ 			break;
+ 		}
+ 
+@@ -6001,6 +6022,7 @@ static irqreturn_t hns_roce_v2_aeq_int(struct hns_roce_dev *hr_dev,
+ 		hns_roce_v2_init_irq_work(hr_dev, eq, queue_num);
+ 
+ 		aeqe = next_aeqe_sw_v2(eq);
++		++num_aeqes;
+ 	}
+ 
+ 	update_eq_db(eq);
+@@ -6530,6 +6552,9 @@ static int hns_roce_v2_init_eq_table(struct hns_roce_dev *hr_dev)
+ 	int ret;
+ 	int i;
+ 
++	if (hr_dev->caps.aeqe_depth < HNS_AEQ_POLLING_BUDGET)
++		return -EINVAL;
++
+ 	other_num = hr_dev->caps.num_other_vectors;
+ 	comp_num = hr_dev->caps.num_comp_vectors;
+ 	aeq_num = hr_dev->caps.num_aeq_vectors;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index cd97cbee682a6..a401b607592b9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -85,6 +85,11 @@
+ 
+ #define HNS_ROCE_V2_TABLE_CHUNK_SIZE		(1 << 18)
+ 
++/* budget must be smaller than aeqe_depth to guarantee that we update
++ * the ci before we polled all the entries in the EQ.
++ */
++#define HNS_AEQ_POLLING_BUDGET 64
++
+ enum {
+ 	HNS_ROCE_CMD_FLAG_IN = BIT(0),
+ 	HNS_ROCE_CMD_FLAG_OUT = BIT(1),
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 04063cfacae5f..88a4777d29f8b 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -39,6 +39,25 @@
+ #include "hns_roce_device.h"
+ #include "hns_roce_hem.h"
+ 
++static struct hns_roce_qp *hns_roce_qp_lookup(struct hns_roce_dev *hr_dev,
++					      u32 qpn)
++{
++	struct device *dev = hr_dev->dev;
++	struct hns_roce_qp *qp;
++	unsigned long flags;
++
++	xa_lock_irqsave(&hr_dev->qp_table_xa, flags);
++	qp = __hns_roce_qp_lookup(hr_dev, qpn);
++	if (qp)
++		refcount_inc(&qp->refcount);
++	xa_unlock_irqrestore(&hr_dev->qp_table_xa, flags);
++
++	if (!qp)
++		dev_warn(dev, "async event for bogus QP %08x\n", qpn);
++
++	return qp;
++}
++
+ static void flush_work_handle(struct work_struct *work)
+ {
+ 	struct hns_roce_work *flush_work = container_of(work,
+@@ -95,31 +114,28 @@ void flush_cqe(struct hns_roce_dev *dev, struct hns_roce_qp *qp)
+ 
+ void hns_roce_qp_event(struct hns_roce_dev *hr_dev, u32 qpn, int event_type)
+ {
+-	struct device *dev = hr_dev->dev;
+ 	struct hns_roce_qp *qp;
+ 
+-	xa_lock(&hr_dev->qp_table_xa);
+-	qp = __hns_roce_qp_lookup(hr_dev, qpn);
+-	if (qp)
+-		refcount_inc(&qp->refcount);
+-	xa_unlock(&hr_dev->qp_table_xa);
+-
+-	if (!qp) {
+-		dev_warn(dev, "async event for bogus QP %08x\n", qpn);
++	qp = hns_roce_qp_lookup(hr_dev, qpn);
++	if (!qp)
+ 		return;
+-	}
+ 
+-	if (event_type == HNS_ROCE_EVENT_TYPE_WQ_CATAS_ERROR ||
+-	    event_type == HNS_ROCE_EVENT_TYPE_INV_REQ_LOCAL_WQ_ERROR ||
+-	    event_type == HNS_ROCE_EVENT_TYPE_LOCAL_WQ_ACCESS_ERROR ||
+-	    event_type == HNS_ROCE_EVENT_TYPE_XRCD_VIOLATION ||
+-	    event_type == HNS_ROCE_EVENT_TYPE_INVALID_XRCETH) {
+-		qp->state = IB_QPS_ERR;
++	qp->event(qp, (enum hns_roce_event)event_type);
+ 
+-		flush_cqe(hr_dev, qp);
+-	}
++	if (refcount_dec_and_test(&qp->refcount))
++		complete(&qp->free);
++}
+ 
+-	qp->event(qp, (enum hns_roce_event)event_type);
++void hns_roce_flush_cqe(struct hns_roce_dev *hr_dev, u32 qpn)
++{
++	struct hns_roce_qp *qp;
++
++	qp = hns_roce_qp_lookup(hr_dev, qpn);
++	if (!qp)
++		return;
++
++	qp->state = IB_QPS_ERR;
++	flush_cqe(hr_dev, qp);
+ 
+ 	if (refcount_dec_and_test(&qp->refcount))
+ 		complete(&qp->free);
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-hns-fix-cpu-stuck-caused-by-printings-during-re.patch b/queue-6.6/rdma-hns-fix-cpu-stuck-caused-by-printings-during-re.patch
new file mode 100644
index 00000000000..7615807bcd3
--- /dev/null
+++ b/queue-6.6/rdma-hns-fix-cpu-stuck-caused-by-printings-during-re.patch
@@ -0,0 +1,274 @@
+From ac951488f3996dbd827e1f57826eb36498cad189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 20:40:00 +0800
+Subject: RDMA/hns: Fix cpu stuck caused by printings during reset
+
+From: wenglianfa <wenglianfa@huawei.com>
+
+[ Upstream commit 323275ac2ff15b2b7b3eac391ae5d8c5a3c3a999 ]
+
+During reset, cmd to destroy resources such as qp, cq, and mr may fail,
+and error logs will be printed. When a large number of resources are
+destroyed, there will be lots of printings, and it may lead to a cpu
+stuck.
+
+Delete some unnecessary printings and replace other printing functions
+in these paths with the ratelimited version.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
+Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Signed-off-by: wenglianfa <wenglianfa@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20241024124000.2931869-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_cq.c    |  4 +-
+ drivers/infiniband/hw/hns/hns_roce_hem.c   |  4 +-
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 73 ++++++++++------------
+ drivers/infiniband/hw/hns/hns_roce_mr.c    |  4 +-
+ drivers/infiniband/hw/hns/hns_roce_srq.c   |  4 +-
+ 5 files changed, 41 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
+index ff177466de9b4..9b91731a62079 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
+@@ -180,8 +180,8 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
+ 	ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_CQC,
+ 				      hr_cq->cqn);
+ 	if (ret)
+-		dev_err(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n", ret,
+-			hr_cq->cqn);
++		dev_err_ratelimited(dev, "DESTROY_CQ failed (%d) for CQN %06lx\n",
++				    ret, hr_cq->cqn);
+ 
+ 	xa_erase_irq(&cq_table->array, hr_cq->cqn);
+ 
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index 65c5583e83412..0ab514c49d5e6 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -712,8 +712,8 @@ void hns_roce_table_put(struct hns_roce_dev *hr_dev,
+ 
+ 	ret = hr_dev->hw->clear_hem(hr_dev, table, obj, HEM_HOP_STEP_DIRECT);
+ 	if (ret)
+-		dev_warn(dev, "failed to clear HEM base address, ret = %d.\n",
+-			 ret);
++		dev_warn_ratelimited(dev, "failed to clear HEM base address, ret = %d.\n",
++				     ret);
+ 
+ 	hns_roce_free_hem(hr_dev, table->hem[i]);
+ 	table->hem[i] = NULL;
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 3c3be860e8180..b29c12e4e45c4 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -372,19 +372,12 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ static int check_send_valid(struct hns_roce_dev *hr_dev,
+ 			    struct hns_roce_qp *hr_qp)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
+-
+ 	if (unlikely(hr_qp->state == IB_QPS_RESET ||
+ 		     hr_qp->state == IB_QPS_INIT ||
+-		     hr_qp->state == IB_QPS_RTR)) {
+-		ibdev_err(ibdev, "failed to post WQE, QP state %u!\n",
+-			  hr_qp->state);
++		     hr_qp->state == IB_QPS_RTR))
+ 		return -EINVAL;
+-	} else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN)) {
+-		ibdev_err(ibdev, "failed to post WQE, dev state %d!\n",
+-			  hr_dev->state);
++	else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN))
+ 		return -EIO;
+-	}
+ 
+ 	return 0;
+ }
+@@ -2737,8 +2730,8 @@ static int free_mr_modify_rsv_qp(struct hns_roce_dev *hr_dev,
+ 	ret = hr_dev->hw->modify_qp(&hr_qp->ibqp, attr, mask, IB_QPS_INIT,
+ 				    IB_QPS_INIT, NULL);
+ 	if (ret) {
+-		ibdev_err(ibdev, "failed to modify qp to init, ret = %d.\n",
+-			  ret);
++		ibdev_err_ratelimited(ibdev, "failed to modify qp to init, ret = %d.\n",
++				      ret);
+ 		return ret;
+ 	}
+ 
+@@ -3384,8 +3377,8 @@ static int free_mr_post_send_lp_wqe(struct hns_roce_qp *hr_qp)
+ 
+ 	ret = hns_roce_v2_post_send(&hr_qp->ibqp, send_wr, &bad_wr);
+ 	if (ret) {
+-		ibdev_err(ibdev, "failed to post wqe for free mr, ret = %d.\n",
+-			  ret);
++		ibdev_err_ratelimited(ibdev, "failed to post wqe for free mr, ret = %d.\n",
++				      ret);
+ 		return ret;
+ 	}
+ 
+@@ -3424,9 +3417,9 @@ static void free_mr_send_cmd_to_hw(struct hns_roce_dev *hr_dev)
+ 
+ 		ret = free_mr_post_send_lp_wqe(hr_qp);
+ 		if (ret) {
+-			ibdev_err(ibdev,
+-				  "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n",
+-				  hr_qp->qpn, ret);
++			ibdev_err_ratelimited(ibdev,
++					      "failed to send wqe (qp:0x%lx) for free mr, ret = %d.\n",
++					      hr_qp->qpn, ret);
+ 			break;
+ 		}
+ 
+@@ -3437,16 +3430,16 @@ static void free_mr_send_cmd_to_hw(struct hns_roce_dev *hr_dev)
+ 	while (cqe_cnt) {
+ 		npolled = hns_roce_v2_poll_cq(&free_mr->rsv_cq->ib_cq, cqe_cnt, wc);
+ 		if (npolled < 0) {
+-			ibdev_err(ibdev,
+-				  "failed to poll cqe for free mr, remain %d cqe.\n",
+-				  cqe_cnt);
++			ibdev_err_ratelimited(ibdev,
++					      "failed to poll cqe for free mr, remain %d cqe.\n",
++					      cqe_cnt);
+ 			goto out;
+ 		}
+ 
+ 		if (time_after(jiffies, end)) {
+-			ibdev_err(ibdev,
+-				  "failed to poll cqe for free mr and timeout, remain %d cqe.\n",
+-				  cqe_cnt);
++			ibdev_err_ratelimited(ibdev,
++					      "failed to poll cqe for free mr and timeout, remain %d cqe.\n",
++					      cqe_cnt);
+ 			goto out;
+ 		}
+ 		cqe_cnt -= npolled;
+@@ -4986,10 +4979,8 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp,
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
+ 	int ret = 0;
+ 
+-	if (!check_qp_state(cur_state, new_state)) {
+-		ibdev_err(&hr_dev->ib_dev, "Illegal state for QP!\n");
++	if (!check_qp_state(cur_state, new_state))
+ 		return -EINVAL;
+-	}
+ 
+ 	if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
+ 		memset(qpc_mask, 0, hr_dev->caps.qpc_sz);
+@@ -5251,7 +5242,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ 	/* SW pass context to HW */
+ 	ret = hns_roce_v2_qp_modify(hr_dev, context, qpc_mask, hr_qp);
+ 	if (ret) {
+-		ibdev_err(ibdev, "failed to modify QP, ret = %d.\n", ret);
++		ibdev_err_ratelimited(ibdev, "failed to modify QP, ret = %d.\n", ret);
+ 		goto out;
+ 	}
+ 
+@@ -5341,7 +5332,9 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ 
+ 	ret = hns_roce_v2_query_qpc(hr_dev, hr_qp->qpn, &context);
+ 	if (ret) {
+-		ibdev_err(ibdev, "failed to query QPC, ret = %d.\n", ret);
++		ibdev_err_ratelimited(ibdev,
++				      "failed to query QPC, ret = %d.\n",
++				      ret);
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -5349,7 +5342,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ 	state = hr_reg_read(&context, QPC_QP_ST);
+ 	tmp_qp_state = to_ib_qp_st((enum hns_roce_v2_qp_state)state);
+ 	if (tmp_qp_state == -1) {
+-		ibdev_err(ibdev, "Illegal ib_qp_state\n");
++		ibdev_err_ratelimited(ibdev, "Illegal ib_qp_state\n");
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -5442,9 +5435,9 @@ static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev,
+ 		ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0,
+ 					    hr_qp->state, IB_QPS_RESET, udata);
+ 		if (ret)
+-			ibdev_err(ibdev,
+-				  "failed to modify QP to RST, ret = %d.\n",
+-				  ret);
++			ibdev_err_ratelimited(ibdev,
++					      "failed to modify QP to RST, ret = %d.\n",
++					      ret);
+ 	}
+ 
+ 	send_cq = hr_qp->ibqp.send_cq ? to_hr_cq(hr_qp->ibqp.send_cq) : NULL;
+@@ -5480,9 +5473,9 @@ int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
+ 
+ 	ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
+ 	if (ret)
+-		ibdev_err(&hr_dev->ib_dev,
+-			  "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n",
+-			  hr_qp->qpn, ret);
++		ibdev_err_ratelimited(&hr_dev->ib_dev,
++				      "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n",
++				      hr_qp->qpn, ret);
+ 
+ 	hns_roce_qp_destroy(hr_dev, hr_qp, udata);
+ 
+@@ -5755,9 +5748,9 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period)
+ 				HNS_ROCE_CMD_MODIFY_CQC, hr_cq->cqn);
+ 	hns_roce_free_cmd_mailbox(hr_dev, mailbox);
+ 	if (ret)
+-		ibdev_err(&hr_dev->ib_dev,
+-			  "failed to process cmd when modifying CQ, ret = %d.\n",
+-			  ret);
++		ibdev_err_ratelimited(&hr_dev->ib_dev,
++				      "failed to process cmd when modifying CQ, ret = %d.\n",
++				      ret);
+ 
+ 	return ret;
+ }
+@@ -5777,9 +5770,9 @@ static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn,
+ 	ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma,
+ 				HNS_ROCE_CMD_QUERY_CQC, cqn);
+ 	if (ret) {
+-		ibdev_err(&hr_dev->ib_dev,
+-			  "failed to process cmd when querying CQ, ret = %d.\n",
+-			  ret);
++		ibdev_err_ratelimited(&hr_dev->ib_dev,
++				      "failed to process cmd when querying CQ, ret = %d.\n",
++				      ret);
+ 		goto err_mailbox;
+ 	}
+ 
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 980261969b0c0..b053f2f43dacd 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -130,8 +130,8 @@ static void hns_roce_mr_free(struct hns_roce_dev *hr_dev, struct hns_roce_mr *mr
+ 					      key_to_hw_index(mr->key) &
+ 					      (hr_dev->caps.num_mtpts - 1));
+ 		if (ret)
+-			ibdev_warn(ibdev, "failed to destroy mpt, ret = %d.\n",
+-				   ret);
++			ibdev_warn_ratelimited(ibdev, "failed to destroy mpt, ret = %d.\n",
++					       ret);
+ 	}
+ 
+ 	free_mr_pbl(hr_dev, mr);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 727f926500712..652508b660a06 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -150,8 +150,8 @@ static void free_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)
+ 	ret = hns_roce_destroy_hw_ctx(hr_dev, HNS_ROCE_CMD_DESTROY_SRQ,
+ 				      srq->srqn);
+ 	if (ret)
+-		dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n",
+-			ret, srq->srqn);
++		dev_err_ratelimited(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n",
++				    ret, srq->srqn);
+ 
+ 	xa_erase_irq(&srq_table->xa, srq->srqn);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-hns-fix-null-pointer-derefernce-in-hns_roce_map.patch b/queue-6.6/rdma-hns-fix-null-pointer-derefernce-in-hns_roce_map.patch
new file mode 100644
index 00000000000..e007266456b
--- /dev/null
+++ b/queue-6.6/rdma-hns-fix-null-pointer-derefernce-in-hns_roce_map.patch
@@ -0,0 +1,57 @@
+From b4190569ea4bfa18a5eb87c0f4be043377968114 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 15:57:43 +0800
+Subject: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 6b526d17eed850352d880b93b9bf20b93006bd92 ]
+
+ib_map_mr_sg() allows ULPs to specify NULL as the sg_offset argument.
+The driver needs to check whether it is a NULL pointer before
+dereferencing it.
+
+Fixes: d387d4b54eb8 ("RDMA/hns: Fix missing pagesize and alignment check in FRMR")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20241108075743.2652258-3-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index b053f2f43dacd..7f29a55d378f0 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -415,15 +415,16 @@ static int hns_roce_set_page(struct ib_mr *ibmr, u64 addr)
+ }
+ 
+ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
+-		       unsigned int *sg_offset)
++		       unsigned int *sg_offset_p)
+ {
++	unsigned int sg_offset = sg_offset_p ? *sg_offset_p : 0;
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(ibmr->device);
+ 	struct ib_device *ibdev = &hr_dev->ib_dev;
+ 	struct hns_roce_mr *mr = to_hr_mr(ibmr);
+ 	struct hns_roce_mtr *mtr = &mr->pbl_mtr;
+ 	int ret, sg_num = 0;
+ 
+-	if (!IS_ALIGNED(*sg_offset, HNS_ROCE_FRMR_ALIGN_SIZE) ||
++	if (!IS_ALIGNED(sg_offset, HNS_ROCE_FRMR_ALIGN_SIZE) ||
+ 	    ibmr->page_size < HNS_HW_PAGE_SIZE ||
+ 	    ibmr->page_size > HNS_HW_MAX_PAGE_SIZE)
+ 		return sg_num;
+@@ -434,7 +435,7 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
+ 	if (!mr->page_list)
+ 		return sg_num;
+ 
+-	sg_num = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page);
++	sg_num = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset_p, hns_roce_set_page);
+ 	if (sg_num < 1) {
+ 		ibdev_err(ibdev, "failed to store sg pages %u %u, cnt = %d.\n",
+ 			  mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, sg_num);
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-hns-fix-out-of-order-issue-of-requester-when-se.patch b/queue-6.6/rdma-hns-fix-out-of-order-issue-of-requester-when-se.patch
new file mode 100644
index 00000000000..eccd4979005
--- /dev/null
+++ b/queue-6.6/rdma-hns-fix-out-of-order-issue-of-requester-when-se.patch
@@ -0,0 +1,58 @@
+From 12c500e250a1304901e0a363cd183806c21c0310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 15:57:42 +0800
+Subject: RDMA/hns: Fix out-of-order issue of requester when setting FENCE
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 5dbcb1c1900f45182b5651c89257c272f1f3ead7 ]
+
+The FENCE indicator in hns WQE doesn't ensure that response data from
+a previous Read/Atomic operation has been written to the requester's
+memory before the subsequent Send/Write operation is processed. This
+may result in the subsequent Send/Write operation accessing the original
+data in memory instead of the expected response data.
+
+Unlike FENCE, the SO (Strong Order) indicator blocks the subsequent
+operation until the previous response data is written to memory and a
+bresp is returned. Set the SO indicator instead of FENCE to maintain
+strict order.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20241108075743.2652258-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index b29c12e4e45c4..2824d390ec316 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -578,7 +578,7 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp,
+ 	if (WARN_ON(ret))
+ 		return ret;
+ 
+-	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_FENCE,
++	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SO,
+ 		     (wr->send_flags & IB_SEND_FENCE) ? 1 : 0);
+ 
+ 	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SE,
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index a401b607592b9..b8e17721f6fde 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -899,6 +899,7 @@ struct hns_roce_v2_rc_send_wqe {
+ #define RC_SEND_WQE_OWNER RC_SEND_WQE_FIELD_LOC(7, 7)
+ #define RC_SEND_WQE_CQE RC_SEND_WQE_FIELD_LOC(8, 8)
+ #define RC_SEND_WQE_FENCE RC_SEND_WQE_FIELD_LOC(9, 9)
++#define RC_SEND_WQE_SO RC_SEND_WQE_FIELD_LOC(10, 10)
+ #define RC_SEND_WQE_SE RC_SEND_WQE_FIELD_LOC(11, 11)
+ #define RC_SEND_WQE_INLINE RC_SEND_WQE_FIELD_LOC(12, 12)
+ #define RC_SEND_WQE_WQE_INDEX RC_SEND_WQE_FIELD_LOC(30, 15)
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-hns-use-dev_-printings-in-hem-code-instead-of-i.patch b/queue-6.6/rdma-hns-use-dev_-printings-in-hem-code-instead-of-i.patch
new file mode 100644
index 00000000000..126bcb5e006
--- /dev/null
+++ b/queue-6.6/rdma-hns-use-dev_-printings-in-hem-code-instead-of-i.patch
@@ -0,0 +1,182 @@
+From 287ccea4c1817a95df3a349de4f829b4fd597265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 20:39:59 +0800
+Subject: RDMA/hns: Use dev_* printings in hem code instead of ibdev_*
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit d81fb6511abf18591befaa5f4a972ffc838690ec ]
+
+The hem code is executed before ib_dev is registered, so use dev_*
+printing instead of ibdev_* to avoid log like this:
+
+(null): set HEM address to HW failed!
+
+Fixes: 2f49de21f3e9 ("RDMA/hns: Optimize mhop get flow for multi-hop addressing")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20241024124000.2931869-5-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 44 ++++++++++++------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index 7ebf80504fd12..65c5583e83412 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -337,7 +337,7 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
+ 			   struct hns_roce_hem_mhop *mhop,
+ 			   struct hns_roce_hem_index *index)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
++	struct device *dev = hr_dev->dev;
+ 	unsigned long mhop_obj = obj;
+ 	u32 l0_idx, l1_idx, l2_idx;
+ 	u32 chunk_ba_num;
+@@ -368,14 +368,14 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
+ 		index->buf = l0_idx;
+ 		break;
+ 	default:
+-		ibdev_err(ibdev, "table %u not support mhop.hop_num = %u!\n",
+-			  table->type, mhop->hop_num);
++		dev_err(dev, "table %u not support mhop.hop_num = %u!\n",
++			table->type, mhop->hop_num);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (unlikely(index->buf >= table->num_hem)) {
+-		ibdev_err(ibdev, "table %u exceed hem limt idx %llu, max %lu!\n",
+-			  table->type, index->buf, table->num_hem);
++		dev_err(dev, "table %u exceed hem limt idx %llu, max %lu!\n",
++			table->type, index->buf, table->num_hem);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -487,14 +487,14 @@ static int set_mhop_hem(struct hns_roce_dev *hr_dev,
+ 			struct hns_roce_hem_mhop *mhop,
+ 			struct hns_roce_hem_index *index)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
++	struct device *dev = hr_dev->dev;
+ 	u32 step_idx;
+ 	int ret = 0;
+ 
+ 	if (index->inited & HEM_INDEX_L0) {
+ 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, 0);
+ 		if (ret) {
+-			ibdev_err(ibdev, "set HEM step 0 failed!\n");
++			dev_err(dev, "set HEM step 0 failed!\n");
+ 			goto out;
+ 		}
+ 	}
+@@ -502,7 +502,7 @@ static int set_mhop_hem(struct hns_roce_dev *hr_dev,
+ 	if (index->inited & HEM_INDEX_L1) {
+ 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, 1);
+ 		if (ret) {
+-			ibdev_err(ibdev, "set HEM step 1 failed!\n");
++			dev_err(dev, "set HEM step 1 failed!\n");
+ 			goto out;
+ 		}
+ 	}
+@@ -514,7 +514,7 @@ static int set_mhop_hem(struct hns_roce_dev *hr_dev,
+ 			step_idx = mhop->hop_num;
+ 		ret = hr_dev->hw->set_hem(hr_dev, table, obj, step_idx);
+ 		if (ret)
+-			ibdev_err(ibdev, "set HEM step last failed!\n");
++			dev_err(dev, "set HEM step last failed!\n");
+ 	}
+ out:
+ 	return ret;
+@@ -524,14 +524,14 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
+ 				   struct hns_roce_hem_table *table,
+ 				   unsigned long obj)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
+ 	struct hns_roce_hem_index index = {};
+ 	struct hns_roce_hem_mhop mhop = {};
++	struct device *dev = hr_dev->dev;
+ 	int ret;
+ 
+ 	ret = calc_hem_config(hr_dev, table, obj, &mhop, &index);
+ 	if (ret) {
+-		ibdev_err(ibdev, "calc hem config failed!\n");
++		dev_err(dev, "calc hem config failed!\n");
+ 		return ret;
+ 	}
+ 
+@@ -543,7 +543,7 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
+ 
+ 	ret = alloc_mhop_hem(hr_dev, table, &mhop, &index);
+ 	if (ret) {
+-		ibdev_err(ibdev, "alloc mhop hem failed!\n");
++		dev_err(dev, "alloc mhop hem failed!\n");
+ 		goto out;
+ 	}
+ 
+@@ -551,7 +551,7 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
+ 	if (table->type < HEM_TYPE_MTT) {
+ 		ret = set_mhop_hem(hr_dev, table, obj, &mhop, &index);
+ 		if (ret) {
+-			ibdev_err(ibdev, "set HEM address to HW failed!\n");
++			dev_err(dev, "set HEM address to HW failed!\n");
+ 			goto err_alloc;
+ 		}
+ 	}
+@@ -615,7 +615,7 @@ static void clear_mhop_hem(struct hns_roce_dev *hr_dev,
+ 			   struct hns_roce_hem_mhop *mhop,
+ 			   struct hns_roce_hem_index *index)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
++	struct device *dev = hr_dev->dev;
+ 	u32 hop_num = mhop->hop_num;
+ 	u32 chunk_ba_num;
+ 	u32 step_idx;
+@@ -645,21 +645,21 @@ static void clear_mhop_hem(struct hns_roce_dev *hr_dev,
+ 
+ 		ret = hr_dev->hw->clear_hem(hr_dev, table, obj, step_idx);
+ 		if (ret)
+-			ibdev_warn(ibdev, "failed to clear hop%u HEM, ret = %d.\n",
+-				   hop_num, ret);
++			dev_warn(dev, "failed to clear hop%u HEM, ret = %d.\n",
++				 hop_num, ret);
+ 
+ 		if (index->inited & HEM_INDEX_L1) {
+ 			ret = hr_dev->hw->clear_hem(hr_dev, table, obj, 1);
+ 			if (ret)
+-				ibdev_warn(ibdev, "failed to clear HEM step 1, ret = %d.\n",
+-					   ret);
++				dev_warn(dev, "failed to clear HEM step 1, ret = %d.\n",
++					 ret);
+ 		}
+ 
+ 		if (index->inited & HEM_INDEX_L0) {
+ 			ret = hr_dev->hw->clear_hem(hr_dev, table, obj, 0);
+ 			if (ret)
+-				ibdev_warn(ibdev, "failed to clear HEM step 0, ret = %d.\n",
+-					   ret);
++				dev_warn(dev, "failed to clear HEM step 0, ret = %d.\n",
++					 ret);
+ 		}
+ 	}
+ }
+@@ -669,14 +669,14 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
+ 				    unsigned long obj,
+ 				    int check_refcount)
+ {
+-	struct ib_device *ibdev = &hr_dev->ib_dev;
+ 	struct hns_roce_hem_index index = {};
+ 	struct hns_roce_hem_mhop mhop = {};
++	struct device *dev = hr_dev->dev;
+ 	int ret;
+ 
+ 	ret = calc_hem_config(hr_dev, table, obj, &mhop, &index);
+ 	if (ret) {
+-		ibdev_err(ibdev, "calc hem config failed!\n");
++		dev_err(dev, "calc hem config failed!\n");
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-mlx5-move-events-notifier-registration-to-be-af.patch b/queue-6.6/rdma-mlx5-move-events-notifier-registration-to-be-af.patch
new file mode 100644
index 00000000000..5cbf2e8722e
--- /dev/null
+++ b/queue-6.6/rdma-mlx5-move-events-notifier-registration-to-be-af.patch
@@ -0,0 +1,194 @@
+From b82ce08d089771ab5d11df0bdfe89c39be74ebd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 13:23:19 +0200
+Subject: RDMA/mlx5: Move events notifier registration to be after device
+ registration
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit ede132a5cf559f3ab35a4c28bac4f4a6c20334d8 ]
+
+Move pkey change work initialization and cleanup from device resources
+stage to notifier stage, since this is the stage which handles this work
+events.
+
+Fix a race between the device deregistration and pkey change work by moving
+MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to
+ensure that the notifier is deregistered before the device during cleanup.
+Which ensures there are no works that are being executed after the
+device has already unregistered which can cause the panic below.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+PGD 0 P4D 0
+Oops: 0000 [#1] PREEMPT SMP PTI
+CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1
+Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023
+Workqueue: events pkey_change_handler [mlx5_ib]
+RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib]
+Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40
+RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36
+RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128
+RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001
+R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000
+R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905
+FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib]
+process_one_work+0x1e8/0x3c0
+worker_thread+0x50/0x3b0
+? rescuer_thread+0x380/0x380
+kthread+0x149/0x170
+? set_kthread_struct+0x50/0x50
+ret_from_fork+0x22/0x30
+Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core]
+CR2: 0000000000000000
+---[ end trace f6f8be4eae12f7bc ]---
+
+Fixes: 7722f47e71e5 ("IB/mlx5: Create GSI transmission QPs when P_Key table is changed")
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
+Link: https://patch.msgid.link/d271ceeff0c08431b3cbbbb3e2d416f09b6d1621.1731496944.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c    | 40 +++++++++++++---------------
+ drivers/infiniband/hw/mlx5/mlx5_ib.h |  2 +-
+ 2 files changed, 20 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index bc38af6cda6ee..c510484e024b1 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2899,7 +2899,6 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev)
+ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+ {
+ 	struct mlx5_ib_resources *devr = &dev->devr;
+-	int port;
+ 	int ret;
+ 
+ 	if (!MLX5_CAP_GEN(dev->mdev, xrc))
+@@ -2915,10 +2914,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+ 		return ret;
+ 	}
+ 
+-	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+-		INIT_WORK(&devr->ports[port].pkey_change_work,
+-			  pkey_change_handler);
+-
+ 	mutex_init(&devr->cq_lock);
+ 	mutex_init(&devr->srq_lock);
+ 
+@@ -2928,16 +2923,6 @@ static int mlx5_ib_dev_res_init(struct mlx5_ib_dev *dev)
+ static void mlx5_ib_dev_res_cleanup(struct mlx5_ib_dev *dev)
+ {
+ 	struct mlx5_ib_resources *devr = &dev->devr;
+-	int port;
+-
+-	/*
+-	 * Make sure no change P_Key work items are still executing.
+-	 *
+-	 * At this stage, the mlx5_ib_event should be unregistered
+-	 * and it ensures that no new works are added.
+-	 */
+-	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
+-		cancel_work_sync(&devr->ports[port].pkey_change_work);
+ 
+ 	/* After s0/s1 init, they are not unset during the device lifetime. */
+ 	if (devr->s1) {
+@@ -4201,6 +4186,13 @@ static void mlx5_ib_stage_delay_drop_cleanup(struct mlx5_ib_dev *dev)
+ 
+ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev)
+ {
++	struct mlx5_ib_resources *devr = &dev->devr;
++	int port;
++
++	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
++		INIT_WORK(&devr->ports[port].pkey_change_work,
++			  pkey_change_handler);
++
+ 	dev->mdev_events.notifier_call = mlx5_ib_event;
+ 	mlx5_notifier_register(dev->mdev, &dev->mdev_events);
+ 
+@@ -4211,8 +4203,14 @@ static int mlx5_ib_stage_dev_notifier_init(struct mlx5_ib_dev *dev)
+ 
+ static void mlx5_ib_stage_dev_notifier_cleanup(struct mlx5_ib_dev *dev)
+ {
++	struct mlx5_ib_resources *devr = &dev->devr;
++	int port;
++
+ 	mlx5r_macsec_event_unregister(dev);
+ 	mlx5_notifier_unregister(dev->mdev, &dev->mdev_events);
++
++	for (port = 0; port < ARRAY_SIZE(devr->ports); ++port)
++		cancel_work_sync(&devr->ports[port].pkey_change_work);
+ }
+ 
+ void __mlx5_ib_remove(struct mlx5_ib_dev *dev,
+@@ -4286,9 +4284,6 @@ static const struct mlx5_ib_profile pf_profile = {
+ 	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES,
+ 		     mlx5_ib_dev_res_init,
+ 		     mlx5_ib_dev_res_cleanup),
+-	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
+-		     mlx5_ib_stage_dev_notifier_init,
+-		     mlx5_ib_stage_dev_notifier_cleanup),
+ 	STAGE_CREATE(MLX5_IB_STAGE_ODP,
+ 		     mlx5_ib_odp_init_one,
+ 		     mlx5_ib_odp_cleanup_one),
+@@ -4313,6 +4308,9 @@ static const struct mlx5_ib_profile pf_profile = {
+ 	STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
+ 		     mlx5_ib_stage_ib_reg_init,
+ 		     mlx5_ib_stage_ib_reg_cleanup),
++	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
++		     mlx5_ib_stage_dev_notifier_init,
++		     mlx5_ib_stage_dev_notifier_cleanup),
+ 	STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
+ 		     mlx5_ib_stage_post_ib_reg_umr_init,
+ 		     NULL),
+@@ -4349,9 +4347,6 @@ const struct mlx5_ib_profile raw_eth_profile = {
+ 	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_RESOURCES,
+ 		     mlx5_ib_dev_res_init,
+ 		     mlx5_ib_dev_res_cleanup),
+-	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
+-		     mlx5_ib_stage_dev_notifier_init,
+-		     mlx5_ib_stage_dev_notifier_cleanup),
+ 	STAGE_CREATE(MLX5_IB_STAGE_COUNTERS,
+ 		     mlx5_ib_counters_init,
+ 		     mlx5_ib_counters_cleanup),
+@@ -4373,6 +4368,9 @@ const struct mlx5_ib_profile raw_eth_profile = {
+ 	STAGE_CREATE(MLX5_IB_STAGE_IB_REG,
+ 		     mlx5_ib_stage_ib_reg_init,
+ 		     mlx5_ib_stage_ib_reg_cleanup),
++	STAGE_CREATE(MLX5_IB_STAGE_DEVICE_NOTIFIER,
++		     mlx5_ib_stage_dev_notifier_init,
++		     mlx5_ib_stage_dev_notifier_cleanup),
+ 	STAGE_CREATE(MLX5_IB_STAGE_POST_IB_REG_UMR,
+ 		     mlx5_ib_stage_post_ib_reg_umr_init,
+ 		     NULL),
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 1c83d132197f5..94678e5c59dd5 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -954,7 +954,6 @@ enum mlx5_ib_stages {
+ 	MLX5_IB_STAGE_QP,
+ 	MLX5_IB_STAGE_SRQ,
+ 	MLX5_IB_STAGE_DEVICE_RESOURCES,
+-	MLX5_IB_STAGE_DEVICE_NOTIFIER,
+ 	MLX5_IB_STAGE_ODP,
+ 	MLX5_IB_STAGE_COUNTERS,
+ 	MLX5_IB_STAGE_CONG_DEBUGFS,
+@@ -963,6 +962,7 @@ enum mlx5_ib_stages {
+ 	MLX5_IB_STAGE_PRE_IB_REG_UMR,
+ 	MLX5_IB_STAGE_WHITELIST_UID,
+ 	MLX5_IB_STAGE_IB_REG,
++	MLX5_IB_STAGE_DEVICE_NOTIFIER,
+ 	MLX5_IB_STAGE_POST_IB_REG_UMR,
+ 	MLX5_IB_STAGE_DELAY_DROP,
+ 	MLX5_IB_STAGE_RESTRACK,
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-rxe-fix-the-qp-flush-warnings-in-req.patch b/queue-6.6/rdma-rxe-fix-the-qp-flush-warnings-in-req.patch
new file mode 100644
index 00000000000..e8799aebea5
--- /dev/null
+++ b/queue-6.6/rdma-rxe-fix-the-qp-flush-warnings-in-req.patch
@@ -0,0 +1,84 @@
+From d4e0ce71f5319deb2b233e4660f16a48cb63ac66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 17:20:36 +0200
+Subject: RDMA/rxe: Fix the qp flush warnings in req
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit ea4c990fa9e19ffef0648e40c566b94ba5ab31be ]
+
+When the qp is in error state, the status of WQEs in the queue should be
+set to error. Or else the following will appear.
+
+[  920.617269] WARNING: CPU: 1 PID: 21 at drivers/infiniband/sw/rxe/rxe_comp.c:756 rxe_completer+0x989/0xcc0 [rdma_rxe]
+[  920.617744] Modules linked in: rnbd_client(O) rtrs_client(O) rtrs_core(O) rdma_ucm rdma_cm iw_cm ib_cm crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel ib_uverbs ib_core loop brd null_blk ipv6
+[  920.618516] CPU: 1 PID: 21 Comm: ksoftirqd/1 Tainted: G           O       6.1.113-storage+ #65
+[  920.618986] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+[  920.619396] RIP: 0010:rxe_completer+0x989/0xcc0 [rdma_rxe]
+[  920.619658] Code: 0f b6 84 24 3a 02 00 00 41 89 84 24 44 04 00 00 e9 2a f7 ff ff 39 ca bb 03 00 00 00 b8 0e 00 00 00 48 0f 45 d8 e9 15 f7 ff ff <0f> 0b e9 cb f8 ff ff 41 bf f5 ff ff ff e9 08 f8 ff ff 49 8d bc 24
+[  920.620482] RSP: 0018:ffff97b7c00bbc38 EFLAGS: 00010246
+[  920.620817] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000008
+[  920.621183] RDX: ffff960dc396ebc0 RSI: 0000000000005400 RDI: ffff960dc4e2fbac
+[  920.621548] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffac406450
+[  920.621884] R10: ffffffffac4060c0 R11: 0000000000000001 R12: ffff960dc4e2f800
+[  920.622254] R13: ffff960dc4e2f928 R14: ffff97b7c029c580 R15: 0000000000000000
+[  920.622609] FS:  0000000000000000(0000) GS:ffff960ef7d00000(0000) knlGS:0000000000000000
+[  920.622979] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  920.623245] CR2: 00007fa056965e90 CR3: 00000001107f1000 CR4: 00000000000006e0
+[  920.623680] Call Trace:
+[  920.623815]  <TASK>
+[  920.623933]  ? __warn+0x79/0xc0
+[  920.624116]  ? rxe_completer+0x989/0xcc0 [rdma_rxe]
+[  920.624356]  ? report_bug+0xfb/0x150
+[  920.624594]  ? handle_bug+0x3c/0x60
+[  920.624796]  ? exc_invalid_op+0x14/0x70
+[  920.624976]  ? asm_exc_invalid_op+0x16/0x20
+[  920.625203]  ? rxe_completer+0x989/0xcc0 [rdma_rxe]
+[  920.625474]  ? rxe_completer+0x329/0xcc0 [rdma_rxe]
+[  920.625749]  rxe_do_task+0x80/0x110 [rdma_rxe]
+[  920.626037]  rxe_requester+0x625/0xde0 [rdma_rxe]
+[  920.626310]  ? rxe_cq_post+0xe2/0x180 [rdma_rxe]
+[  920.626583]  ? do_complete+0x18d/0x220 [rdma_rxe]
+[  920.626812]  ? rxe_completer+0x1a3/0xcc0 [rdma_rxe]
+[  920.627050]  rxe_do_task+0x80/0x110 [rdma_rxe]
+[  920.627285]  tasklet_action_common.constprop.0+0xa4/0x120
+[  920.627522]  handle_softirqs+0xc2/0x250
+[  920.627728]  ? sort_range+0x20/0x20
+[  920.627942]  run_ksoftirqd+0x1f/0x30
+[  920.628158]  smpboot_thread_fn+0xc7/0x1b0
+[  920.628334]  kthread+0xd6/0x100
+[  920.628504]  ? kthread_complete_and_exit+0x20/0x20
+[  920.628709]  ret_from_fork+0x1f/0x30
+[  920.628892]  </TASK>
+
+Fixes: ae720bdb703b ("RDMA/rxe: Generate error completion for error requester QP state")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://patch.msgid.link/20241025152036.121417-1-yanjun.zhu@linux.dev
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 7a36080d2baef..7ff152ffe15b9 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -693,10 +693,12 @@ int rxe_requester(struct rxe_qp *qp)
+ 	if (unlikely(qp_state(qp) == IB_QPS_ERR)) {
+ 		wqe = __req_next_wqe(qp);
+ 		spin_unlock_irqrestore(&qp->state_lock, flags);
+-		if (wqe)
++		if (wqe) {
++			wqe->status = IB_WC_WR_FLUSH_ERR;
+ 			goto err;
+-		else
++		} else {
+ 			goto exit;
++		}
+ 	}
+ 
+ 	if (unlikely(qp_state(qp) == IB_QPS_RESET)) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/rdma-rxe-set-queue-pair-cur_qp_state-when-being-quer.patch b/queue-6.6/rdma-rxe-set-queue-pair-cur_qp_state-when-being-quer.patch
new file mode 100644
index 00000000000..fb2985dd49f
--- /dev/null
+++ b/queue-6.6/rdma-rxe-set-queue-pair-cur_qp_state-when-being-quer.patch
@@ -0,0 +1,38 @@
+From 6fa197acbff50068ed69f1319e05533336705bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 17:20:19 +0800
+Subject: RDMA/rxe: Set queue pair cur_qp_state when being queried
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 775e6d3c8fda41083b16c26d05163fd69f029a62 ]
+
+Same with commit e375b9c92985 ("RDMA/cxgb4: Set queue pair state when
+ being queried"). The API for ib_query_qp requires the driver to set
+cur_qp_state on return, add the missing set.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Link: https://patch.msgid.link/20241031092019.2138467-1-liujian56@huawei.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_qp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 28e379c108bce..3767d7fc0aac8 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -781,6 +781,7 @@ int rxe_qp_to_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask)
+ 	 * Yield the processor
+ 	 */
+ 	spin_lock_irqsave(&qp->state_lock, flags);
++	attr->cur_qp_state = qp_state(qp);
+ 	if (qp->attr.sq_draining) {
+ 		spin_unlock_irqrestore(&qp->state_lock, flags);
+ 		cond_resched();
+-- 
+2.43.0
+
diff --git a/queue-6.6/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch b/queue-6.6/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch
new file mode 100644
index 00000000000..3b85fc1f538
--- /dev/null
+++ b/queue-6.6/regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch
@@ -0,0 +1,85 @@
+From bb47f899f6f52ca8df939500197db964cd4108df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 18:55:53 +0200
+Subject: regmap: irq: Set lockdep class for hierarchical IRQ domains
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 953e549471cabc9d4980f1da2e9fa79f4c23da06 ]
+
+Lockdep gives a false positive splat as it can't distinguish the lock
+which is taken by different IRQ descriptors from different IRQ chips
+that are organized in a way of a hierarchy:
+
+   ======================================================
+   WARNING: possible circular locking dependency detected
+   6.12.0-rc5-next-20241101-00148-g9fabf8160b53 #562 Tainted: G        W
+   ------------------------------------------------------
+   modprobe/141 is trying to acquire lock:
+   ffff899446947868 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}, at: regmap_update_bits_base+0x33/0x90
+
+   but task is already holding lock:
+   ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790
+
+   which lock already depends on the new lock.
+
+   -> #3 (&d->lock){+.+.}-{4:4}:
+   -> #2 (&desc->request_mutex){+.+.}-{4:4}:
+   -> #1 (ipclock){+.+.}-{4:4}:
+   -> #0 (intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock){+.+.}-{4:4}:
+
+   Chain exists of:
+     intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock --> &desc->request_mutex --> &d->lock
+
+    Possible unsafe locking scenario:
+
+          CPU0                    CPU1
+          ----                    ----
+     lock(&d->lock);
+                                  lock(&desc->request_mutex);
+                                  lock(&d->lock);
+     lock(intel_soc_pmic_bxtwc:502:(&bxtwc_regmap_config)->lock);
+
+    *** DEADLOCK ***
+
+   3 locks held by modprobe/141:
+    #0: ffff8994419368f8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0xf6/0x250
+    #1: ffff89944690b250 (&desc->request_mutex){+.+.}-{4:4}, at: __setup_irq+0x1a2/0x790
+    #2: ffff899446947c68 (&d->lock){+.+.}-{4:4}, at: __setup_irq+0x682/0x790
+
+Set a lockdep class when we map the IRQ so that it doesn't warn about
+a lockdep bug that doesn't exist.
+
+Fixes: 4af8be67fd99 ("regmap: Convert regmap_irq to use irq_domain")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20241101165553.4055617-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-irq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
+index 45fd13ef13fc6..dceab5d013dec 100644
+--- a/drivers/base/regmap/regmap-irq.c
++++ b/drivers/base/regmap/regmap-irq.c
+@@ -514,12 +514,16 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
+ 		return IRQ_NONE;
+ }
+ 
++static struct lock_class_key regmap_irq_lock_class;
++static struct lock_class_key regmap_irq_request_class;
++
+ static int regmap_irq_map(struct irq_domain *h, unsigned int virq,
+ 			  irq_hw_number_t hw)
+ {
+ 	struct regmap_irq_chip_data *data = h->host_data;
+ 
+ 	irq_set_chip_data(virq, data);
++	irq_set_lockdep_class(virq, &regmap_irq_lock_class, &regmap_irq_request_class);
+ 	irq_set_chip(virq, &data->irq_chip);
+ 	irq_set_nested_thread(virq, 1);
+ 	irq_set_parent(virq, data->irq);
+-- 
+2.43.0
+
diff --git a/queue-6.6/regulator-rk808-restrict-dvs-gpios-to-the-rk808-vari.patch b/queue-6.6/regulator-rk808-restrict-dvs-gpios-to-the-rk808-vari.patch
new file mode 100644
index 00000000000..4905dbd0f5d
--- /dev/null
+++ b/queue-6.6/regulator-rk808-restrict-dvs-gpios-to-the-rk808-vari.patch
@@ -0,0 +1,106 @@
+From 836e1dfc475f9312947bf7af90acb4a65670b9be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 12:43:41 +0200
+Subject: regulator: rk808: Restrict DVS GPIOs to the RK808 variant only
+
+From: Dragan Simic <dsimic@manjaro.org>
+
+[ Upstream commit 0d214f27c0e3d9694284c95bac1502c2d247355b ]
+
+The rk808-regulator driver supports multiple PMIC variants from the Rockckip
+RK80x and RK81x series, but the DVS GPIOs are supported on the RK808 variant
+only, according to the DT bindings [1][2][3][4][5][6] and the datasheets for
+the supported PMIC variants. [7][8][9][10][11][12]
+
+Thus, change the probe path so the "dvs-gpios" property is checked for and
+its value possibly used only when the handled PMIC variant is RK808.  There's
+no point in doing that on the other PMIC variants, because they don't support
+the DVS GPIOs, and it goes against the DT bindings to allow a possible out-
+of-place "dvs-gpios" property to actually be handled in the driver.
+
+This eliminates the following messages, emitted when the "dvs-gpios" property
+isn't found in the DT, from the kernel log on boards that actually don't use
+the RK808 variant, which may have provided a source of confusion:
+
+  rk808-regulator rk808-regulator.2.auto: there is no dvs0 gpio
+  rk808-regulator rk808-regulator.2.auto: there is no dvs1 gpio
+
+Furthermore, demote these kernel messages to debug messages, because they are
+useful during the board bringup phase only.  Emitting them afterwards, on the
+boards that use the RK808 variant, but actually don't use the DVS0/1 GPIOs,
+clutters the kernel log a bit, while they provide no value and may actually
+cause false impression that some PMIC-related issues are present.
+
+[1] Documentation/devicetree/bindings/mfd/rockchip,rk805.yaml
+[2] Documentation/devicetree/bindings/mfd/rockchip,rk806.yaml
+[3] Documentation/devicetree/bindings/mfd/rockchip,rk808.yaml
+[4] Documentation/devicetree/bindings/mfd/rockchip,rk816.yaml
+[5] Documentation/devicetree/bindings/mfd/rockchip,rk817.yaml
+[6] Documentation/devicetree/bindings/mfd/rockchip,rk818.yaml
+[7] https://rockchip.fr/RK805%20datasheet%20V1.2.pdf
+[8] https://wmsc.lcsc.com/wmsc/upload/file/pdf/v2/lcsc/2401261533_Rockchip-RK806-1_C5156483.pdf
+[9] https://rockchip.fr/RK808%20datasheet%20V1.4.pdf
+[10] https://rockchip.fr/RK816%20datasheet%20V1.3.pdf
+[11] https://rockchip.fr/RK817%20datasheet%20V1.01.pdf
+[12] https://rockchip.fr/RK818%20datasheet%20V1.0.pdf
+
+Fixes: 11375293530b ("regulator: rk808: Add regulator driver for RK818")
+Reported-by: Diederik de Haas <didi.debian@cknow.org>
+Signed-off-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://patch.msgid.link/9a415c59699e76fc7b88a2552520a4ca2538f44e.1728902488.git.dsimic@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rk808-regulator.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 2c83cb18d60dc..374d80dc6d17a 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -1649,7 +1649,7 @@ static int rk808_regulator_dt_parse_pdata(struct device *dev,
+ 		}
+ 
+ 		if (!pdata->dvs_gpio[i]) {
+-			dev_info(dev, "there is no dvs%d gpio\n", i);
++			dev_dbg(dev, "there is no dvs%d gpio\n", i);
+ 			continue;
+ 		}
+ 
+@@ -1685,12 +1685,6 @@ static int rk808_regulator_probe(struct platform_device *pdev)
+ 	if (!pdata)
+ 		return -ENOMEM;
+ 
+-	ret = rk808_regulator_dt_parse_pdata(&pdev->dev, regmap, pdata);
+-	if (ret < 0)
+-		return ret;
+-
+-	platform_set_drvdata(pdev, pdata);
+-
+ 	switch (rk808->variant) {
+ 	case RK805_ID:
+ 		regulators = rk805_reg;
+@@ -1701,6 +1695,11 @@ static int rk808_regulator_probe(struct platform_device *pdev)
+ 		nregulators = ARRAY_SIZE(rk806_reg);
+ 		break;
+ 	case RK808_ID:
++		/* DVS0/1 GPIOs are supported on the RK808 only */
++		ret = rk808_regulator_dt_parse_pdata(&pdev->dev, regmap, pdata);
++		if (ret < 0)
++			return ret;
++
+ 		regulators = rk808_reg;
+ 		nregulators = RK808_NUM_REGULATORS;
+ 		break;
+@@ -1722,6 +1721,8 @@ static int rk808_regulator_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
++	platform_set_drvdata(pdev, pdata);
++
+ 	config.dev = &pdev->dev;
+ 	config.driver_data = pdata;
+ 	config.regmap = regmap;
+-- 
+2.43.0
+
diff --git a/queue-6.6/remoteproc-qcom-pas-add-minidump_id-to-sm8350-resour.patch b/queue-6.6/remoteproc-qcom-pas-add-minidump_id-to-sm8350-resour.patch
new file mode 100644
index 00000000000..fb661918ad7
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom-pas-add-minidump_id-to-sm8350-resour.patch
@@ -0,0 +1,46 @@
+From a4f9a92320b9800d7dafa3d41be9f42e201aadda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2024 01:09:44 +0300
+Subject: remoteproc: qcom: pas: add minidump_id to SM8350 resources
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit e8983156d54f59f57e648ecd44f01c16572da842 ]
+
+Specify minidump_id for the SM8350 DSPs. It was omitted for in the
+original commit e8b4e9a21af7 ("remoteproc: qcom: pas: Add SM8350 PAS
+remoteprocs").
+
+Fixes: e8b4e9a21af7 ("remoteproc: qcom: pas: Add SM8350 PAS remoteprocs")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241027-sar2130p-adsp-v1-2-bd204e39d24e@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
+index b5447dd2dd35e..6235721f2c1ae 100644
+--- a/drivers/remoteproc/qcom_q6v5_pas.c
++++ b/drivers/remoteproc/qcom_q6v5_pas.c
+@@ -832,6 +832,7 @@ static const struct adsp_data sm8250_adsp_resource = {
+ 	.crash_reason_smem = 423,
+ 	.firmware_name = "adsp.mdt",
+ 	.pas_id = 1,
++	.minidump_id = 5,
+ 	.auto_boot = true,
+ 	.proxy_pd_names = (char*[]){
+ 		"lcx",
+@@ -973,6 +974,7 @@ static const struct adsp_data sm8350_cdsp_resource = {
+ 	.crash_reason_smem = 601,
+ 	.firmware_name = "cdsp.mdt",
+ 	.pas_id = 18,
++	.minidump_id = 7,
+ 	.auto_boot = true,
+ 	.proxy_pd_names = (char*[]){
+ 		"cx",
+-- 
+2.43.0
+
diff --git a/queue-6.6/remoteproc-qcom_q6v5_mss-re-order-writes-to-the-imem.patch b/queue-6.6/remoteproc-qcom_q6v5_mss-re-order-writes-to-the-imem.patch
new file mode 100644
index 00000000000..a67b6b1c31e
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom_q6v5_mss-re-order-writes-to-the-imem.patch
@@ -0,0 +1,52 @@
+From 87d98f9864420ede9501729d1c561947030f93b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 13:00:20 +0530
+Subject: remoteproc: qcom_q6v5_mss: Re-order writes to the IMEM region
+
+From: Sibi Sankar <quic_sibis@quicinc.com>
+
+[ Upstream commit 7b22b7719fc17d5979a991c918c868ab041be5c8 ]
+
+Any write access to the IMEM region when the Q6 is setting up XPU
+protection on it will result in a XPU violation. Fix this by ensuring
+IMEM writes related to the MBA post-mortem logs happen before the Q6
+is brought out of reset.
+
+Fixes: 318130cc9362 ("remoteproc: qcom_q6v5_mss: Add MBA log extraction support")
+Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20240819073020.3291287-1-quic_sibis@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 22fe7b5f5236d..2d717f2ed396c 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -1161,6 +1161,9 @@ static int q6v5_mba_load(struct q6v5 *qproc)
+ 		goto disable_active_clks;
+ 	}
+ 
++	if (qproc->has_mba_logs)
++		qcom_pil_info_store("mba", qproc->mba_phys, MBA_LOG_SIZE);
++
+ 	writel(qproc->mba_phys, qproc->rmb_base + RMB_MBA_IMAGE_REG);
+ 	if (qproc->dp_size) {
+ 		writel(qproc->mba_phys + SZ_1M, qproc->rmb_base + RMB_PMI_CODE_START_REG);
+@@ -1171,9 +1174,6 @@ static int q6v5_mba_load(struct q6v5 *qproc)
+ 	if (ret)
+ 		goto reclaim_mba;
+ 
+-	if (qproc->has_mba_logs)
+-		qcom_pil_info_store("mba", qproc->mba_phys, MBA_LOG_SIZE);
+-
+ 	ret = q6v5_rmb_mba_wait(qproc, 0, 5000);
+ 	if (ret == -ETIMEDOUT) {
+ 		dev_err(qproc->dev, "MBA boot timed out\n");
+-- 
+2.43.0
+
diff --git a/queue-6.6/revert-cgroup-fix-memory-leak-caused-by-missing-cgro.patch b/queue-6.6/revert-cgroup-fix-memory-leak-caused-by-missing-cgro.patch
new file mode 100644
index 00000000000..e6589f46748
--- /dev/null
+++ b/queue-6.6/revert-cgroup-fix-memory-leak-caused-by-missing-cgro.patch
@@ -0,0 +1,43 @@
+From 4ac2ac709d768c857a003280c96363408eccd09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 08:15:19 +0000
+Subject: Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline"
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit feb301c60970bd2a1310a53ce2d6e4375397a51b ]
+
+This reverts commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba.
+
+Only cgroup v2 can be attached by cgroup by BPF programs. Revert this
+commit and cgroup_bpf_inherit and cgroup_bpf_offline won't be called in
+cgroup v1. The memory leak issue will be fixed with next patch.
+
+Fixes: 04f8ef5643bc ("cgroup: Fix memory leak caused by missing cgroup_bpf_offline")
+Link: https://lore.kernel.org/cgroups/aka2hk5jsel5zomucpwlxsej6iwnfw4qu5jkrmjhyfhesjlfdw@46zxhg5bdnr7/
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cgroup.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index b927f0623ac77..d31cc406fb58e 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -2270,10 +2270,8 @@ static void cgroup_kill_sb(struct super_block *sb)
+ 	 * And don't kill the default root.
+ 	 */
+ 	if (list_empty(&root->cgrp.self.children) && root != &cgrp_dfl_root &&
+-	    !percpu_ref_is_dying(&root->cgrp.self.refcnt)) {
+-		cgroup_bpf_offline(&root->cgrp);
++	    !percpu_ref_is_dying(&root->cgrp.self.refcnt))
+ 		percpu_ref_kill(&root->cgrp.self.refcnt);
+-	}
+ 	cgroup_put(&root->cgrp);
+ 	kernfs_kill_sb(sb);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/risc-v-kvm-fix-aplic-in_clrip-and-clripnum-write-emu.patch b/queue-6.6/risc-v-kvm-fix-aplic-in_clrip-and-clripnum-write-emu.patch
new file mode 100644
index 00000000000..3b44e34e8e5
--- /dev/null
+++ b/queue-6.6/risc-v-kvm-fix-aplic-in_clrip-and-clripnum-write-emu.patch
@@ -0,0 +1,55 @@
+From 6d80e93c29e6f5947686a1b2fa9cf490d91dc88b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2024 16:55:39 +0800
+Subject: RISC-V: KVM: Fix APLIC in_clrip and clripnum write emulation
+
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+
+[ Upstream commit 60821fb4dd7345e5662094accf0a52845306de8c ]
+
+In the section "4.7 Precise effects on interrupt-pending bits"
+of the RISC-V AIA specification defines that:
+
+"If the source mode is Level1 or Level0 and the interrupt domain
+is configured in MSI delivery mode (domaincfg.DM = 1):
+The pending bit is cleared whenever the rectified input value is
+low, when the interrupt is forwarded by MSI, or by a relevant
+write to an in_clrip register or to clripnum."
+
+Update the aplic_write_pending() to match the spec.
+
+Fixes: d8dd9f113e16 ("RISC-V: KVM: Fix APLIC setipnum_le/be write emulation")
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Vincent Chen <vincent.chen@sifive.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Link: https://lore.kernel.org/r/20241029085542.30541-1-yongxuan.wang@sifive.com
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/aia_aplic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kvm/aia_aplic.c b/arch/riscv/kvm/aia_aplic.c
+index b467ba5ed9100..9d5b04c971c4d 100644
+--- a/arch/riscv/kvm/aia_aplic.c
++++ b/arch/riscv/kvm/aia_aplic.c
+@@ -143,7 +143,7 @@ static void aplic_write_pending(struct aplic *aplic, u32 irq, bool pending)
+ 	if (sm == APLIC_SOURCECFG_SM_LEVEL_HIGH ||
+ 	    sm == APLIC_SOURCECFG_SM_LEVEL_LOW) {
+ 		if (!pending)
+-			goto skip_write_pending;
++			goto noskip_write_pending;
+ 		if ((irqd->state & APLIC_IRQ_STATE_INPUT) &&
+ 		    sm == APLIC_SOURCECFG_SM_LEVEL_LOW)
+ 			goto skip_write_pending;
+@@ -152,6 +152,7 @@ static void aplic_write_pending(struct aplic *aplic, u32 irq, bool pending)
+ 			goto skip_write_pending;
+ 	}
+ 
++noskip_write_pending:
+ 	if (pending)
+ 		irqd->state |= APLIC_IRQ_STATE_PENDING;
+ 	else
+-- 
+2.43.0
+
diff --git a/queue-6.6/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch b/queue-6.6/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch
new file mode 100644
index 00000000000..c8a5fe606dc
--- /dev/null
+++ b/queue-6.6/rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch
@@ -0,0 +1,44 @@
+From f4371adee901970b4981d266b79be99596049f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 19:59:35 -0400
+Subject: rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name
+ length
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 06c59d97f63c1b8af521fa5aef8a716fb988b285 ]
+
+The name len field of the CMD_OPEN packet is only 16-bits and the upper
+16-bits of "param2" are a different "prio" field, which can be nonzero in
+certain situations, and CMD_OPEN packets can be unexpectedly dropped
+because of this.
+
+Fix this by masking out the upper 16 bits of param2.
+
+Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241007235935.6216-1-jonathan@marek.ca
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/qcom_glink_native.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
+index d877a1a1aeb4b..c7f91a82e634f 100644
+--- a/drivers/rpmsg/qcom_glink_native.c
++++ b/drivers/rpmsg/qcom_glink_native.c
+@@ -1117,7 +1117,8 @@ void qcom_glink_native_rx(struct qcom_glink *glink)
+ 			qcom_glink_rx_advance(glink, ALIGN(sizeof(msg), 8));
+ 			break;
+ 		case GLINK_CMD_OPEN:
+-			ret = qcom_glink_rx_defer(glink, param2);
++			/* upper 16 bits of param2 are the "prio" field */
++			ret = qcom_glink_rx_defer(glink, param2 & 0xffff);
+ 			break;
+ 		case GLINK_CMD_TX_DATA:
+ 		case GLINK_CMD_TX_DATA_CONT:
+-- 
+2.43.0
+
diff --git a/queue-6.6/rust-macros-fix-documentation-of-the-paste-macro.patch b/queue-6.6/rust-macros-fix-documentation-of-the-paste-macro.patch
new file mode 100644
index 00000000000..5ff79a66b79
--- /dev/null
+++ b/queue-6.6/rust-macros-fix-documentation-of-the-paste-macro.patch
@@ -0,0 +1,38 @@
+From 6db7ff4eea7af2ffb7b328ee98a6d4127ba3ece5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Oct 2024 09:22:08 +0200
+Subject: rust: macros: fix documentation of the paste! macro
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+[ Upstream commit 15541c9263ce34ff95a06bc68f45d9bc5c990bcd ]
+
+One of the example in this section uses a curious mix of the constant
+and function declaration syntaxes; fix it.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Alice Ryhl <aliceryhl@google.com>
+Fixes: 823d4737d4c2 ("rust: macros: add `paste!` proc macro")
+Link: https://lore.kernel.org/r/20241019072208.1016707-1-pbonzini@redhat.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/macros/lib.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
+index 34ae73f5db068..7bdb3a5a18a06 100644
+--- a/rust/macros/lib.rs
++++ b/rust/macros/lib.rs
+@@ -298,7 +298,7 @@ pub fn pinned_drop(args: TokenStream, input: TokenStream) -> TokenStream {
+ /// macro_rules! pub_no_prefix {
+ ///     ($prefix:ident, $($newname:ident),+) => {
+ ///         kernel::macros::paste! {
+-///             $(pub(crate) const fn [<$newname:lower:span>]: u32 = [<$prefix $newname:span>];)+
++///             $(pub(crate) const fn [<$newname:lower:span>]() -> u32 { [<$prefix $newname:span>] })+
+ ///         }
+ ///     };
+ /// }
+-- 
+2.43.0
+
diff --git a/queue-6.6/rxrpc-improve-setsockopt-handling-of-malformed-user-.patch b/queue-6.6/rxrpc-improve-setsockopt-handling-of-malformed-user-.patch
new file mode 100644
index 00000000000..19a323ea5f0
--- /dev/null
+++ b/queue-6.6/rxrpc-improve-setsockopt-handling-of-malformed-user-.patch
@@ -0,0 +1,47 @@
+From ae99200145d5522fa35f9613af715dc2396392ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 14:31:42 +0100
+Subject: rxrpc: Improve setsockopt() handling of malformed user input
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 02020056647017e70509bb58c3096448117099e1 ]
+
+copy_from_sockptr() does not return negative value on error; instead, it
+reports the number of bytes that failed to copy. Since it's deprecated,
+switch to copy_safe_from_sockptr().
+
+Note: Keeping the `optlen != sizeof(unsigned int)` check as
+copy_safe_from_sockptr() by itself would also accept
+optlen > sizeof(unsigned int). Which would allow a more lenient handling
+of inputs.
+
+Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/af_rxrpc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index fa8aec78f63d7..205e0d4d048ea 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -661,9 +661,10 @@ static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
+ 			ret = -EISCONN;
+ 			if (rx->sk.sk_state != RXRPC_UNBOUND)
+ 				goto error;
+-			ret = copy_from_sockptr(&min_sec_level, optval,
+-				       sizeof(unsigned int));
+-			if (ret < 0)
++			ret = copy_safe_from_sockptr(&min_sec_level,
++						     sizeof(min_sec_level),
++						     optval, optlen);
++			if (ret)
+ 				goto error;
+ 			ret = -EINVAL;
+ 			if (min_sec_level > RXRPC_SECURITY_MAX)
+-- 
+2.43.0
+
diff --git a/queue-6.6/s390-cio-do-not-unregister-the-subchannel-based-on-d.patch b/queue-6.6/s390-cio-do-not-unregister-the-subchannel-based-on-d.patch
new file mode 100644
index 00000000000..67e55759829
--- /dev/null
+++ b/queue-6.6/s390-cio-do-not-unregister-the-subchannel-based-on-d.patch
@@ -0,0 +1,112 @@
+From c63602a49508db3fb4dac69a23cffc39163effbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 22:16:43 +0200
+Subject: s390/cio: Do not unregister the subchannel based on DNV
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 8c58a229688ce3a097b3b1a2efe1b4f5508c2123 ]
+
+Starting with commit 2297791c92d0 ("s390/cio: dont unregister
+subchannel from child-drivers"), CIO does not unregister subchannels
+when the attached device is invalid or unavailable. Instead, it
+allows subchannels to exist without a connected device. However, if
+the DNV value is 0, such as, when all the CHPIDs of a subchannel are
+configured in standby state, the subchannel is unregistered, which
+contradicts the current subchannel specification.
+
+Update the logic so that subchannels are not unregistered based
+on the DNV value. Also update the SCHIB information even if the
+DNV bit is zero.
+
+Suggested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Fixes: 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/cio.c    |  6 +++++-
+ drivers/s390/cio/device.c | 18 +++++++++++++++++-
+ 2 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
+index 6127add746d18..81ef9002f0640 100644
+--- a/drivers/s390/cio/cio.c
++++ b/drivers/s390/cio/cio.c
+@@ -459,10 +459,14 @@ int cio_update_schib(struct subchannel *sch)
+ {
+ 	struct schib schib;
+ 
+-	if (stsch(sch->schid, &schib) || !css_sch_is_valid(&schib))
++	if (stsch(sch->schid, &schib))
+ 		return -ENODEV;
+ 
+ 	memcpy(&sch->schib, &schib, sizeof(schib));
++
++	if (!css_sch_is_valid(&schib))
++		return -EACCES;
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(cio_update_schib);
+diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
+index 57e0050dbaa53..6b374026cd4f4 100644
+--- a/drivers/s390/cio/device.c
++++ b/drivers/s390/cio/device.c
+@@ -1387,14 +1387,18 @@ enum io_sch_action {
+ 	IO_SCH_VERIFY,
+ 	IO_SCH_DISC,
+ 	IO_SCH_NOP,
++	IO_SCH_ORPH_CDEV,
+ };
+ 
+ static enum io_sch_action sch_get_action(struct subchannel *sch)
+ {
+ 	struct ccw_device *cdev;
++	int rc;
+ 
+ 	cdev = sch_get_cdev(sch);
+-	if (cio_update_schib(sch)) {
++	rc = cio_update_schib(sch);
++
++	if (rc == -ENODEV) {
+ 		/* Not operational. */
+ 		if (!cdev)
+ 			return IO_SCH_UNREG;
+@@ -1402,6 +1406,16 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
+ 			return IO_SCH_UNREG;
+ 		return IO_SCH_ORPH_UNREG;
+ 	}
++
++	/* Avoid unregistering subchannels without working device. */
++	if (rc == -EACCES) {
++		if (!cdev)
++			return IO_SCH_NOP;
++		if (ccw_device_notify(cdev, CIO_GONE) != NOTIFY_OK)
++			return IO_SCH_UNREG_CDEV;
++		return IO_SCH_ORPH_CDEV;
++	}
++
+ 	/* Operational. */
+ 	if (!cdev)
+ 		return IO_SCH_ATTACH;
+@@ -1471,6 +1485,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
+ 		rc = 0;
+ 		goto out_unlock;
+ 	case IO_SCH_ORPH_UNREG:
++	case IO_SCH_ORPH_CDEV:
+ 	case IO_SCH_ORPH_ATTACH:
+ 		ccw_device_set_disconnected(cdev);
+ 		break;
+@@ -1502,6 +1517,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
+ 	/* Handle attached ccw device. */
+ 	switch (action) {
+ 	case IO_SCH_ORPH_UNREG:
++	case IO_SCH_ORPH_CDEV:
+ 	case IO_SCH_ORPH_ATTACH:
+ 		/* Move ccw device to orphanage. */
+ 		rc = ccw_device_move_to_orph(cdev);
+-- 
+2.43.0
+
diff --git a/queue-6.6/s390-iucv-msg_peek-causes-memory-leak-in-iucv_sock_d.patch b/queue-6.6/s390-iucv-msg_peek-causes-memory-leak-in-iucv_sock_d.patch
new file mode 100644
index 00000000000..dd637279426
--- /dev/null
+++ b/queue-6.6/s390-iucv-msg_peek-causes-memory-leak-in-iucv_sock_d.patch
@@ -0,0 +1,113 @@
+From 89b4e4440d1e14a73842c9ce3f361044a443cabe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 16:22:19 +0100
+Subject: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
+
+From: Sidraya Jayagond <sidraya@linux.ibm.com>
+
+[ Upstream commit ebaf81317e42aa990ad20b113cfe3a7b20d4e937 ]
+
+Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount
+(skb->users) and iucv_sock_recvmsg() does not decrement skb refcount
+at exit.
+This results in skb memory leak in skb_queue_purge() and WARN_ON in
+iucv_sock_destruct() during socket close. To fix this decrease
+skb refcount by one if MSG_PEEK is set in order to prevent memory
+leak and WARN_ON.
+
+WARNING: CPU: 2 PID: 6292 at net/iucv/af_iucv.c:286 iucv_sock_destruct+0x144/0x1a0 [af_iucv]
+CPU: 2 PID: 6292 Comm: afiucv_test_msg Kdump: loaded Tainted: G        W          6.10.0-rc7 #1
+Hardware name: IBM 3931 A01 704 (z/VM 7.3.0)
+Call Trace:
+        [<001587c682c4aa98>] iucv_sock_destruct+0x148/0x1a0 [af_iucv]
+        [<001587c682c4a9d0>] iucv_sock_destruct+0x80/0x1a0 [af_iucv]
+        [<001587c704117a32>] __sk_destruct+0x52/0x550
+        [<001587c704104a54>] __sock_release+0xa4/0x230
+        [<001587c704104c0c>] sock_close+0x2c/0x40
+        [<001587c702c5f5a8>] __fput+0x2e8/0x970
+        [<001587c7024148c4>] task_work_run+0x1c4/0x2c0
+        [<001587c7023b0716>] do_exit+0x996/0x1050
+        [<001587c7023b13aa>] do_group_exit+0x13a/0x360
+        [<001587c7023b1626>] __s390x_sys_exit_group+0x56/0x60
+        [<001587c7022bccca>] do_syscall+0x27a/0x380
+        [<001587c7049a6a0c>] __do_syscall+0x9c/0x160
+        [<001587c7049ce8a8>] system_call+0x70/0x98
+        Last Breaking-Event-Address:
+        [<001587c682c4a9d4>] iucv_sock_destruct+0x84/0x1a0 [af_iucv]
+
+Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: Thorsten Winkler <twinkler@linux.ibm.com>
+Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Reviewed-by: David Wei <dw@davidwei.uk>
+Link: https://patch.msgid.link/20241119152219.3712168-1-wintera@linux.ibm.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 26 +++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index 815b1df0b2d19..0f660b1d3bd51 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1238,7 +1238,9 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 		return -EOPNOTSUPP;
+ 
+ 	/* receive/dequeue next skb:
+-	 * the function understands MSG_PEEK and, thus, does not dequeue skb */
++	 * the function understands MSG_PEEK and, thus, does not dequeue skb
++	 * only refcount is increased.
++	 */
+ 	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb) {
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+@@ -1254,9 +1256,8 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	cskb = skb;
+ 	if (skb_copy_datagram_msg(cskb, offset, msg, copied)) {
+-		if (!(flags & MSG_PEEK))
+-			skb_queue_head(&sk->sk_receive_queue, skb);
+-		return -EFAULT;
++		err = -EFAULT;
++		goto err_out;
+ 	}
+ 
+ 	/* SOCK_SEQPACKET: set MSG_TRUNC if recv buf size is too small */
+@@ -1273,11 +1274,8 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	err = put_cmsg(msg, SOL_IUCV, SCM_IUCV_TRGCLS,
+ 		       sizeof(IUCV_SKB_CB(skb)->class),
+ 		       (void *)&IUCV_SKB_CB(skb)->class);
+-	if (err) {
+-		if (!(flags & MSG_PEEK))
+-			skb_queue_head(&sk->sk_receive_queue, skb);
+-		return err;
+-	}
++	if (err)
++		goto err_out;
+ 
+ 	/* Mark read part of skb as used */
+ 	if (!(flags & MSG_PEEK)) {
+@@ -1333,8 +1331,18 @@ static int iucv_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	/* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
+ 	if (sk->sk_type == SOCK_SEQPACKET && (flags & MSG_TRUNC))
+ 		copied = rlen;
++	if (flags & MSG_PEEK)
++		skb_unref(skb);
+ 
+ 	return copied;
++
++err_out:
++	if (!(flags & MSG_PEEK))
++		skb_queue_head(&sk->sk_receive_queue, skb);
++	else
++		skb_unref(skb);
++
++	return err;
+ }
+ 
+ static inline __poll_t iucv_accept_poll(struct sock *parent)
+-- 
+2.43.0
+
diff --git a/queue-6.6/s390-pageattr-implement-missing-kernel_page_present.patch b/queue-6.6/s390-pageattr-implement-missing-kernel_page_present.patch
new file mode 100644
index 00000000000..c9f263d11d1
--- /dev/null
+++ b/queue-6.6/s390-pageattr-implement-missing-kernel_page_present.patch
@@ -0,0 +1,68 @@
+From 964a0962441e53f3abb2f51b0ce888571c067319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 14:26:23 +0200
+Subject: s390/pageattr: Implement missing kernel_page_present()
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 2835f8bf5530750c3381166005934f996a83ad05 ]
+
+kernel_page_present() was intentionally not implemented when adding
+ARCH_HAS_SET_DIRECT_MAP support, since it was only used for suspend/resume
+which is not supported anymore on s390.
+
+A new bpf use case led to a compile error specific to s390. Even though
+this specific use case went away implement kernel_page_present(), so that
+the API is complete and potential future users won't run into this problem.
+
+Reported-by: Daniel Borkmann <daniel@iogearbox.net>
+Closes: https://lore.kernel.org/all/045de961-ac69-40cc-b141-ab70ec9377ec@iogearbox.net
+Fixes: 0490d6d7ba0a ("s390/mm: enable ARCH_HAS_SET_DIRECT_MAP")
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/set_memory.h |  1 +
+ arch/s390/mm/pageattr.c            | 15 +++++++++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/arch/s390/include/asm/set_memory.h b/arch/s390/include/asm/set_memory.h
+index 06fbabe2f66c9..cb4cc0f59012f 100644
+--- a/arch/s390/include/asm/set_memory.h
++++ b/arch/s390/include/asm/set_memory.h
+@@ -62,5 +62,6 @@ __SET_MEMORY_FUNC(set_memory_4k, SET_MEMORY_4K)
+ 
+ int set_direct_map_invalid_noflush(struct page *page);
+ int set_direct_map_default_noflush(struct page *page);
++bool kernel_page_present(struct page *page);
+ 
+ #endif
+diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
+index 441f654d048d2..44271835c97e7 100644
+--- a/arch/s390/mm/pageattr.c
++++ b/arch/s390/mm/pageattr.c
+@@ -406,6 +406,21 @@ int set_direct_map_default_noflush(struct page *page)
+ 	return __set_memory((unsigned long)page_to_virt(page), 1, SET_MEMORY_DEF);
+ }
+ 
++bool kernel_page_present(struct page *page)
++{
++	unsigned long addr;
++	unsigned int cc;
++
++	addr = (unsigned long)page_address(page);
++	asm volatile(
++		"	lra	%[addr],0(%[addr])\n"
++		"	ipm	%[cc]\n"
++		: [cc] "=d" (cc), [addr] "+a" (addr)
++		:
++		: "cc");
++	return (cc >> 28) == 0;
++}
++
+ #if defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE)
+ 
+ static void ipte_range(pte_t *pte, unsigned long address, int nr)
+-- 
+2.43.0
+
diff --git a/queue-6.6/s390-syscalls-avoid-creation-of-arch-arch-directory.patch b/queue-6.6/s390-syscalls-avoid-creation-of-arch-arch-directory.patch
new file mode 100644
index 00000000000..3f021e79ae9
--- /dev/null
+++ b/queue-6.6/s390-syscalls-avoid-creation-of-arch-arch-directory.patch
@@ -0,0 +1,54 @@
+From a464135d20b81e905186f4a923089296a38b2f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 22:45:52 +0900
+Subject: s390/syscalls: Avoid creation of arch/arch/ directory
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 0708967e2d56e370231fd07defa0d69f9ad125e8 ]
+
+Building the kernel with ARCH=s390 creates a weird arch/arch/ directory.
+
+  $ find arch/arch
+  arch/arch
+  arch/arch/s390
+  arch/arch/s390/include
+  arch/arch/s390/include/generated
+  arch/arch/s390/include/generated/asm
+  arch/arch/s390/include/generated/uapi
+  arch/arch/s390/include/generated/uapi/asm
+
+The root cause is 'targets' in arch/s390/kernel/syscalls/Makefile,
+where the relative path is incorrect.
+
+Strictly speaking, 'targets' was not necessary in the first place
+because this Makefile uses 'filechk' instead of 'if_changed'.
+
+However, this commit keeps it, as it will be useful when converting
+'filechk' to 'if_changed' later.
+
+Fixes: 5c75824d915e ("s390/syscalls: add Makefile to generate system call header files")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Link: https://lore.kernel.org/r/20241111134603.2063226-1-masahiroy@kernel.org
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/syscalls/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/syscalls/Makefile b/arch/s390/kernel/syscalls/Makefile
+index fb85e797946db..2bd7756288df6 100644
+--- a/arch/s390/kernel/syscalls/Makefile
++++ b/arch/s390/kernel/syscalls/Makefile
+@@ -12,7 +12,7 @@ kapi-hdrs-y := $(kapi)/unistd_nr.h
+ uapi-hdrs-y := $(uapi)/unistd_32.h
+ uapi-hdrs-y += $(uapi)/unistd_64.h
+ 
+-targets += $(addprefix ../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
++targets += $(addprefix ../../../../,$(gen-y) $(kapi-hdrs-y) $(uapi-hdrs-y))
+ 
+ PHONY += kapi uapi
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch b/queue-6.6/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch
new file mode 100644
index 00000000000..328e66fda01
--- /dev/null
+++ b/queue-6.6/scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch
@@ -0,0 +1,109 @@
+From 314ac92840d21591e2ffe4bf719602aa86f11907 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 09:18:09 +0800
+Subject: scsi: bfa: Fix use-after-free in bfad_im_module_exit()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ]
+
+BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20
+Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303
+
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x95/0xe0
+ print_report+0xcb/0x620
+ kasan_report+0xbd/0xf0
+ __lock_acquire+0x2aca/0x3a20
+ lock_acquire+0x19b/0x520
+ _raw_spin_lock+0x2b/0x40
+ attribute_container_unregister+0x30/0x160
+ fc_release_transport+0x19/0x90 [scsi_transport_fc]
+ bfad_im_module_exit+0x23/0x60 [bfa]
+ bfad_init+0xdb/0xff0 [bfa]
+ do_one_initcall+0xdc/0x550
+ do_init_module+0x22d/0x6b0
+ load_module+0x4e96/0x5ff0
+ init_module_from_file+0xcd/0x130
+ idempotent_init_module+0x330/0x620
+ __x64_sys_finit_module+0xb3/0x110
+ do_syscall_64+0xc1/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+ </TASK>
+
+Allocated by task 25303:
+ kasan_save_stack+0x24/0x50
+ kasan_save_track+0x14/0x30
+ __kasan_kmalloc+0x7f/0x90
+ fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]
+ bfad_im_module_init+0x17/0x80 [bfa]
+ bfad_init+0x23/0xff0 [bfa]
+ do_one_initcall+0xdc/0x550
+ do_init_module+0x22d/0x6b0
+ load_module+0x4e96/0x5ff0
+ init_module_from_file+0xcd/0x130
+ idempotent_init_module+0x330/0x620
+ __x64_sys_finit_module+0xb3/0x110
+ do_syscall_64+0xc1/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 25303:
+ kasan_save_stack+0x24/0x50
+ kasan_save_track+0x14/0x30
+ kasan_save_free_info+0x3b/0x60
+ __kasan_slab_free+0x38/0x50
+ kfree+0x212/0x480
+ bfad_im_module_init+0x7e/0x80 [bfa]
+ bfad_init+0x23/0xff0 [bfa]
+ do_one_initcall+0xdc/0x550
+ do_init_module+0x22d/0x6b0
+ load_module+0x4e96/0x5ff0
+ init_module_from_file+0xcd/0x130
+ idempotent_init_module+0x330/0x620
+ __x64_sys_finit_module+0xb3/0x110
+ do_syscall_64+0xc1/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Above issue happens as follows:
+
+bfad_init
+  error = bfad_im_module_init()
+    fc_release_transport(bfad_im_scsi_transport_template);
+  if (error)
+    goto ext;
+
+ext:
+  bfad_im_module_exit();
+    fc_release_transport(bfad_im_scsi_transport_template);
+    --> Trigger double release
+
+Don't call bfad_im_module_exit() if bfad_im_module_init() failed.
+
+Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bfa/bfad.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index 62cb7a864fd53..70c7515a822f5 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -1693,9 +1693,8 @@ bfad_init(void)
+ 
+ 	error = bfad_im_module_init();
+ 	if (error) {
+-		error = -ENOMEM;
+ 		printk(KERN_WARNING "bfad_im_module_init failure\n");
+-		goto ext;
++		return -ENOMEM;
+ 	}
+ 
+ 	if (strcmp(FCPI_NAME, " fcpim") == 0)
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-fusion-remove-unused-variable-rc.patch b/queue-6.6/scsi-fusion-remove-unused-variable-rc.patch
new file mode 100644
index 00000000000..2ac0c8d78b6
--- /dev/null
+++ b/queue-6.6/scsi-fusion-remove-unused-variable-rc.patch
@@ -0,0 +1,46 @@
+From 7d6516ffe9126f487543c3313078ff812f49a286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 16:44:17 +0800
+Subject: scsi: fusion: Remove unused variable 'rc'
+
+From: Zeng Heng <zengheng4@huawei.com>
+
+[ Upstream commit bd65694223f7ad11c790ab63ad1af87a771192ee ]
+
+The return value of scsi_device_reprobe() is currently ignored in
+_scsih_reprobe_lun(). Fixing the calling code to deal with the potential
+error is non-trivial, so for now just WARN_ON().
+
+The handling of scsi_device_reprobe()'s return value refers to
+_scsih_reprobe_lun() and the following link:
+
+https://lore.kernel.org/all/094fdbf57487af4f395238c0525b2a560c8f68f0.1469766027.git.calvinowens@fb.com/
+
+Fixes: f99be43b3024 ("[SCSI] fusion: power pc and miscellaneous bug fixs")
+Signed-off-by: Zeng Heng <zengheng4@huawei.com>
+Link: https://lore.kernel.org/r/20241024084417.154655-1-zengheng4@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/message/fusion/mptsas.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 86f16f3ea4787..d97057f46ca86 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -4234,10 +4234,8 @@ mptsas_find_phyinfo_by_phys_disk_num(MPT_ADAPTER *ioc, u8 phys_disk_num,
+ static void
+ mptsas_reprobe_lun(struct scsi_device *sdev, void *data)
+ {
+-	int rc;
+-
+ 	sdev->no_uld_attach = data ? 1 : 0;
+-	rc = scsi_device_reprobe(sdev);
++	WARN_ON(scsi_device_reprobe(sdev));
+ }
+ 
+ static void
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-hisi_sas-enable-all-phys-that-are-not-disabled-.patch b/queue-6.6/scsi-hisi_sas-enable-all-phys-that-are-not-disabled-.patch
new file mode 100644
index 00000000000..b9e2d093907
--- /dev/null
+++ b/queue-6.6/scsi-hisi_sas-enable-all-phys-that-are-not-disabled-.patch
@@ -0,0 +1,57 @@
+From 432436391384c3600a058442259fed811c749596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:18:13 +0800
+Subject: scsi: hisi_sas: Enable all PHYs that are not disabled by user during
+ controller reset
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 08a07dc71d7fc6f58c35c4fc0bcede2811c5aa4c ]
+
+For the controller reset operation(such as FLR or clear nexus ha in SCSI
+EH), we will disable all PHYs and then enable PHY based on the
+hisi_hba->phy_state obtained in hisi_sas_controller_reset_prepare(). If
+the device is removed before controller reset or the PHY is not attached
+to any device in directly attached scenario, the corresponding bit of
+phy_state is not set. After controller reset done, the PHY is disabled.
+The device cannot be identified even if user reconnect the disk.
+
+Therefore, for PHYs that are not disabled by user, hisi_sas_phy_enable()
+needs to be executed even if the corresponding bit of phy_state is not
+set.
+
+Fixes: 89954f024c3a ("scsi: hisi_sas: Ensure all enabled PHYs up during controller reset")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Link: https://lore.kernel.org/r/20241008021822.2617339-5-liyihang9@huawei.com
+Reviewed-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index e4363b8c6ad26..db9ae206974c2 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -1539,10 +1539,16 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)
+ 	/* Init and wait for PHYs to come up and all libsas event finished. */
+ 	for (phy_no = 0; phy_no < hisi_hba->n_phy; phy_no++) {
+ 		struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
++		struct asd_sas_phy *sas_phy = &phy->sas_phy;
+ 
+-		if (!(hisi_hba->phy_state & BIT(phy_no)))
++		if (!sas_phy->phy->enabled)
+ 			continue;
+ 
++		if (!(hisi_hba->phy_state & BIT(phy_no))) {
++			hisi_sas_phy_enable(hisi_hba, phy_no, 1);
++			continue;
++		}
++
+ 		async_schedule_domain(hisi_sas_async_init_wait_phyup,
+ 				      phy, &async);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch b/queue-6.6/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch
new file mode 100644
index 00000000000..ae036fe722b
--- /dev/null
+++ b/queue-6.6/scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch
@@ -0,0 +1,37 @@
+From ced4e73a1f986c507f8510b60d54b78b0d39b102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 20:57:10 +0800
+Subject: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb ]
+
+Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA
+memory sb_virt when it fails. Add dma_free_coherent() to free it. This
+is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().
+
+Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20241026125711.484-2-thunder.leizhen@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 14625e6bc8824..9a81d14aef6b9 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -2737,6 +2737,7 @@ static int qedf_alloc_and_init_sb(struct qedf_ctx *qedf,
+ 	    sb_id, QED_SB_TYPE_STORAGE);
+ 
+ 	if (ret) {
++		dma_free_coherent(&qedf->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys);
+ 		QEDF_ERR(&qedf->dbg_ctx,
+ 			 "Status block initialization failed (0x%x) for id = %d.\n",
+ 			 ret, sb_id);
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch b/queue-6.6/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch
new file mode 100644
index 00000000000..243e8333290
--- /dev/null
+++ b/queue-6.6/scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch
@@ -0,0 +1,37 @@
+From a7cbb4995fad91142b0b99876901eb49d790aad4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 20:57:11 +0800
+Subject: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 95bbdca4999bc59a72ebab01663d421d6ce5775d ]
+
+Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA
+memory sb_virt when it fails. Add dma_free_coherent() to free it. This
+is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().
+
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20241026125711.484-3-thunder.leizhen@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index cd0180b1f5b9d..ede8d1f6ae236 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -369,6 +369,7 @@ static int qedi_alloc_and_init_sb(struct qedi_ctx *qedi,
+ 	ret = qedi_ops->common->sb_init(qedi->cdev, sb_info, sb_virt, sb_phys,
+ 				       sb_id, QED_SB_TYPE_STORAGE);
+ 	if (ret) {
++		dma_free_coherent(&qedi->pdev->dev, sizeof(*sb_virt), sb_virt, sb_phys);
+ 		QEDI_ERR(&qedi->dbg_ctx,
+ 			 "Status block initialization failed for id = %d.\n",
+ 			  sb_id);
+-- 
+2.43.0
+
diff --git a/queue-6.6/scsi-sg-enable-runtime-power-management.patch b/queue-6.6/scsi-sg-enable-runtime-power-management.patch
new file mode 100644
index 00000000000..592babcdb4c
--- /dev/null
+++ b/queue-6.6/scsi-sg-enable-runtime-power-management.patch
@@ -0,0 +1,74 @@
+From 03162878cb7f6eb6161cc9afa9292fe03573dc47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 15:03:10 -0700
+Subject: scsi: sg: Enable runtime power management
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 4045de893f691f75193c606aec440c365cf7a7be ]
+
+In 2010, runtime power management support was implemented in the SCSI
+core.  The description of patch "[SCSI] implement runtime Power
+Management" mentions that the sg driver is skipped but not why. This
+patch enables runtime power management even if an instance of the sg
+driver is held open.  Enabling runtime PM for the sg driver is safe
+because all interactions of the sg driver with the SCSI device pass
+through the block layer (blk_execute_rq_nowait()) and the block layer
+already supports runtime PM.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Douglas Gilbert <dgilbert@interlog.com>
+Fixes: bc4f24014de5 ("[SCSI] implement runtime Power Management")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20241030220310.1373569-1-bvanassche@acm.org
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sg.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index e6d8beb877766..dc9722b290f20 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -307,10 +307,6 @@ sg_open(struct inode *inode, struct file *filp)
+ 	if (retval)
+ 		goto sg_put;
+ 
+-	retval = scsi_autopm_get_device(device);
+-	if (retval)
+-		goto sdp_put;
+-
+ 	/* scsi_block_when_processing_errors() may block so bypass
+ 	 * check if O_NONBLOCK. Permits SCSI commands to be issued
+ 	 * during error recovery. Tread carefully. */
+@@ -318,7 +314,7 @@ sg_open(struct inode *inode, struct file *filp)
+ 	      scsi_block_when_processing_errors(device))) {
+ 		retval = -ENXIO;
+ 		/* we are in error recovery for this device */
+-		goto error_out;
++		goto sdp_put;
+ 	}
+ 
+ 	mutex_lock(&sdp->open_rel_lock);
+@@ -371,8 +367,6 @@ sg_open(struct inode *inode, struct file *filp)
+ 	}
+ error_mutex_locked:
+ 	mutex_unlock(&sdp->open_rel_lock);
+-error_out:
+-	scsi_autopm_put_device(device);
+ sdp_put:
+ 	kref_put(&sdp->d_ref, sg_device_destroy);
+ 	scsi_device_put(device);
+@@ -392,7 +386,6 @@ sg_release(struct inode *inode, struct file *filp)
+ 	SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
+ 
+ 	mutex_lock(&sdp->open_rel_lock);
+-	scsi_autopm_put_device(sdp->device);
+ 	kref_put(&sfp->f_ref, sg_remove_sfp);
+ 	sdp->open_cnt--;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-add-push-pop-checking-for-msg_verify_d.patch b/queue-6.6/selftests-bpf-add-push-pop-checking-for-msg_verify_d.patch
new file mode 100644
index 00000000000..285fe458edb
--- /dev/null
+++ b/queue-6.6/selftests-bpf-add-push-pop-checking-for-msg_verify_d.patch
@@ -0,0 +1,246 @@
+From 94aaace1998469d3e512803aeab56bc5bec669df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:16 +0000
+Subject: selftests/bpf: Add push/pop checking for msg_verify_data in
+ test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 862087c3d36219ed44569666eb263efc97f00c9a ]
+
+Add push/pop checking for msg_verify_data in test_sockmap, except for
+pop/push with cork tests, in these tests the logic will be different.
+1. With corking, pop/push might not be invoked in each sendmsg, it makes
+the layout of the received data difficult
+2. It makes it hard to calculate the total_bytes in the recvmsg
+Temporarily skip the data integrity test for these cases now, added a TODO
+
+Fixes: ee9b352ce465 ("selftests/bpf: Fix msg_verify_data in test_sockmap")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-5-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 106 ++++++++++++++++++++-
+ 1 file changed, 101 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 73f9ded58e507..dccaf9b8cb900 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -87,6 +87,10 @@ int ktls;
+ int peek_flag;
+ int skb_use_parser;
+ int txmsg_omit_skb_parser;
++int verify_push_start;
++int verify_push_len;
++int verify_pop_start;
++int verify_pop_len;
+ 
+ static const struct option long_options[] = {
+ 	{"help",	no_argument,		NULL, 'h' },
+@@ -513,12 +517,41 @@ static int msg_alloc_iov(struct msghdr *msg,
+ 	return -ENOMEM;
+ }
+ 
+-/* TODO: Add verification logic for push, pull and pop data */
++/* In push or pop test, we need to do some calculations for msg_verify_data */
++static void msg_verify_date_prep(void)
++{
++	int push_range_end = txmsg_start_push + txmsg_end_push - 1;
++	int pop_range_end = txmsg_start_pop + txmsg_pop - 1;
++
++	if (txmsg_end_push && txmsg_pop &&
++	    txmsg_start_push <= pop_range_end && txmsg_start_pop <= push_range_end) {
++		/* The push range and the pop range overlap */
++		int overlap_len;
++
++		verify_push_start = txmsg_start_push;
++		verify_pop_start = txmsg_start_pop;
++		if (txmsg_start_push < txmsg_start_pop)
++			overlap_len = min(push_range_end - txmsg_start_pop + 1, txmsg_pop);
++		else
++			overlap_len = min(pop_range_end - txmsg_start_push + 1, txmsg_end_push);
++		verify_push_len = max(txmsg_end_push - overlap_len, 0);
++		verify_pop_len = max(txmsg_pop - overlap_len, 0);
++	} else {
++		/* Otherwise */
++		verify_push_start = txmsg_start_push;
++		verify_pop_start = txmsg_start_pop;
++		verify_push_len = txmsg_end_push;
++		verify_pop_len = txmsg_pop;
++	}
++}
++
+ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,
+-				 unsigned char *k_p, int *bytes_cnt_p)
++			   unsigned char *k_p, int *bytes_cnt_p,
++			   int *check_cnt_p, int *push_p)
+ {
+-	int i, j, bytes_cnt = *bytes_cnt_p;
++	int bytes_cnt = *bytes_cnt_p, check_cnt = *check_cnt_p, push = *push_p;
+ 	unsigned char k = *k_p;
++	int i, j;
+ 
+ 	for (i = 0, j = 0; i < msg->msg_iovlen && size; i++, j = 0) {
+ 		unsigned char *d = msg->msg_iov[i].iov_base;
+@@ -537,6 +570,37 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,
+ 		}
+ 
+ 		for (; j < msg->msg_iov[i].iov_len && size; j++) {
++			if (push > 0 &&
++			    check_cnt == verify_push_start + verify_push_len - push) {
++				int skipped;
++revisit_push:
++				skipped = push;
++				if (j + push >= msg->msg_iov[i].iov_len)
++					skipped = msg->msg_iov[i].iov_len - j;
++				push -= skipped;
++				size -= skipped;
++				j += skipped - 1;
++				check_cnt += skipped;
++				continue;
++			}
++
++			if (verify_pop_len > 0 && check_cnt == verify_pop_start) {
++				bytes_cnt += verify_pop_len;
++				check_cnt += verify_pop_len;
++				k += verify_pop_len;
++
++				if (bytes_cnt == chunk_sz) {
++					k = 0;
++					bytes_cnt = 0;
++					check_cnt = 0;
++					push = verify_push_len;
++				}
++
++				if (push > 0 &&
++				    check_cnt == verify_push_start + verify_push_len - push)
++					goto revisit_push;
++			}
++
+ 			if (d[j] != k++) {
+ 				fprintf(stderr,
+ 					"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
+@@ -544,15 +608,20 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,
+ 				return -EDATAINTEGRITY;
+ 			}
+ 			bytes_cnt++;
++			check_cnt++;
+ 			if (bytes_cnt == chunk_sz) {
+ 				k = 0;
+ 				bytes_cnt = 0;
++				check_cnt = 0;
++				push = verify_push_len;
+ 			}
+ 			size--;
+ 		}
+ 	}
+ 	*k_p = k;
+ 	*bytes_cnt_p = bytes_cnt;
++	*check_cnt_p = check_cnt;
++	*push_p = push;
+ 	return 0;
+ }
+ 
+@@ -611,6 +680,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		struct timeval timeout;
+ 		unsigned char k = 0;
+ 		int bytes_cnt = 0;
++		int check_cnt = 0;
++		int push = 0;
+ 		fd_set w;
+ 
+ 		fcntl(fd, fd_flags);
+@@ -636,6 +707,10 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		}
+ 		total_bytes += txmsg_push_total;
+ 		total_bytes -= txmsg_pop_total;
++		if (data) {
++			msg_verify_date_prep();
++			push = verify_push_len;
++		}
+ 		err = clock_gettime(CLOCK_MONOTONIC, &s->start);
+ 		if (err < 0)
+ 			perror("recv start time");
+@@ -711,7 +786,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 						iov_length :
+ 						iov_length * iov_count;
+ 
+-				errno = msg_verify_data(&msg, recv, chunk_sz, &k, &bytes_cnt);
++				errno = msg_verify_data(&msg, recv, chunk_sz, &k, &bytes_cnt,
++							&check_cnt, &push);
+ 				if (errno) {
+ 					perror("data verify msg failed");
+ 					goto out_errno;
+@@ -721,7 +797,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 								recvp,
+ 								chunk_sz,
+ 								&k,
+-								&bytes_cnt);
++								&bytes_cnt,
++								&check_cnt,
++								&push);
+ 					if (errno) {
+ 						perror("data verify msg_peek failed");
+ 						goto out_errno;
+@@ -1639,6 +1717,8 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)
+ 
+ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
+ {
++	bool data = opt->data_test;
++
+ 	/* Test basic pop */
+ 	txmsg_pass = 1;
+ 	txmsg_start_pop = 1;
+@@ -1657,6 +1737,12 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
+ 	txmsg_pop = 2;
+ 	test_send_many(opt, cgrp);
+ 
++	/* TODO: Test for pop + cork should be different,
++	 * - It makes the layout of the received data difficult
++	 * - It makes it hard to calculate the total_bytes in the recvmsg
++	 * Temporarily skip the data integrity test for this case now.
++	 */
++	opt->data_test = false;
+ 	/* Test pop + cork */
+ 	txmsg_redir = 0;
+ 	txmsg_cork = 512;
+@@ -1670,10 +1756,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
+ 	txmsg_start_pop = 1;
+ 	txmsg_pop = 2;
+ 	test_send_many(opt, cgrp);
++	opt->data_test = data;
+ }
+ 
+ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)
+ {
++	bool data = opt->data_test;
++
+ 	/* Test basic push */
+ 	txmsg_pass = 1;
+ 	txmsg_start_push = 1;
+@@ -1692,12 +1781,19 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)
+ 	txmsg_end_push = 2;
+ 	test_send_many(opt, cgrp);
+ 
++	/* TODO: Test for push + cork should be different,
++	 * - It makes the layout of the received data difficult
++	 * - It makes it hard to calculate the total_bytes in the recvmsg
++	 * Temporarily skip the data integrity test for this case now.
++	 */
++	opt->data_test = false;
+ 	/* Test push + cork */
+ 	txmsg_redir = 0;
+ 	txmsg_cork = 512;
+ 	txmsg_start_push = 1;
+ 	txmsg_end_push = 2;
+ 	test_send_many(opt, cgrp);
++	opt->data_test = data;
+ }
+ 
+ static void test_txmsg_push_pop(int cgrp, struct sockmap_options *opt)
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-add-txmsg_pass-to-pull-push-pop-in-tes.patch b/queue-6.6/selftests-bpf-add-txmsg_pass-to-pull-push-pop-in-tes.patch
new file mode 100644
index 00000000000..751bb7618b0
--- /dev/null
+++ b/queue-6.6/selftests-bpf-add-txmsg_pass-to-pull-push-pop-in-tes.patch
@@ -0,0 +1,80 @@
+From f34c0f2a194a4d430b08a5b77f8751fdbac7bffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:13 +0000
+Subject: selftests/bpf: Add txmsg_pass to pull/push/pop in test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 66c54c20408d994be34be2c070fba08472f69eee ]
+
+Add txmsg_pass to test_txmsg_pull/push/pop. If txmsg_pass is missing,
+tx_prog will be NULL, and no program will be attached to the sockmap.
+As a result, pull/push/pop are never invoked.
+
+Fixes: 328aa08a081b ("bpf: Selftests, break down test_sockmap into subtests")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-2-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 4bfadafe51baa..2adf0276f881b 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -1599,11 +1599,13 @@ static void test_txmsg_cork_hangs(int cgrp, struct sockmap_options *opt)
+ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)
+ {
+ 	/* Test basic start/end */
++	txmsg_pass = 1;
+ 	txmsg_start = 1;
+ 	txmsg_end = 2;
+ 	test_send(opt, cgrp);
+ 
+ 	/* Test >4k pull */
++	txmsg_pass = 1;
+ 	txmsg_start = 4096;
+ 	txmsg_end = 9182;
+ 	test_send_large(opt, cgrp);
+@@ -1632,11 +1634,13 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)
+ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
+ {
+ 	/* Test basic pop */
++	txmsg_pass = 1;
+ 	txmsg_start_pop = 1;
+ 	txmsg_pop = 2;
+ 	test_send_many(opt, cgrp);
+ 
+ 	/* Test pop with >4k */
++	txmsg_pass = 1;
+ 	txmsg_start_pop = 4096;
+ 	txmsg_pop = 4096;
+ 	test_send_large(opt, cgrp);
+@@ -1665,11 +1669,13 @@ static void test_txmsg_pop(int cgrp, struct sockmap_options *opt)
+ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)
+ {
+ 	/* Test basic push */
++	txmsg_pass = 1;
+ 	txmsg_start_push = 1;
+ 	txmsg_end_push = 1;
+ 	test_send(opt, cgrp);
+ 
+ 	/* Test push 4kB >4k */
++	txmsg_pass = 1;
+ 	txmsg_start_push = 4096;
+ 	txmsg_end_push = 4096;
+ 	test_send_large(opt, cgrp);
+@@ -1690,6 +1696,7 @@ static void test_txmsg_push(int cgrp, struct sockmap_options *opt)
+ 
+ static void test_txmsg_push_pop(int cgrp, struct sockmap_options *opt)
+ {
++	txmsg_pass = 1;
+ 	txmsg_start_push = 1;
+ 	txmsg_end_push = 10;
+ 	txmsg_start_pop = 5;
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-fix-msg_verify_data-in-test_sockmap.patch b/queue-6.6/selftests-bpf-fix-msg_verify_data-in-test_sockmap.patch
new file mode 100644
index 00000000000..ca90a1ea34b
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-msg_verify_data-in-test_sockmap.patch
@@ -0,0 +1,150 @@
+From 3aa58586c069309cc592f2143b6003a3f01e3872 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 20:37:30 +0000
+Subject: selftests/bpf: Fix msg_verify_data in test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit ee9b352ce4650ffc0d8ca0ac373d7c009c7e561e ]
+
+Function msg_verify_data should have context of bytes_cnt and k instead of
+assuming they are zero. Otherwise, test_sockmap with data integrity test
+will report some errors. I also fix the logic related to size and index j
+
+1/ 6  sockmap::txmsg test passthrough:FAIL
+2/ 6  sockmap::txmsg test redirect:FAIL
+7/12  sockmap::txmsg test apply:FAIL
+10/11  sockmap::txmsg test push_data:FAIL
+11/17  sockmap::txmsg test pull-data:FAIL
+12/ 9  sockmap::txmsg test pop-data:FAIL
+13/ 1  sockmap::txmsg test push/pop data:FAIL
+...
+Pass: 24 Fail: 52
+
+After applying this patch, some of the errors are solved, but for push,
+pull and pop, we may need more fixes to msg_verify_data, added a TODO
+
+10/11  sockmap::txmsg test push_data:FAIL
+11/17  sockmap::txmsg test pull-data:FAIL
+12/ 9  sockmap::txmsg test pop-data:FAIL
+...
+Pass: 37 Fail: 15
+
+Besides, added a custom errno EDATAINTEGRITY for msg_verify_data, we
+shall not ignore the error in txmsg_cork case.
+
+Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
+Fixes: 16edddfe3c5d ("selftests/bpf: test_sockmap, check test failure")
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Link: https://lore.kernel.org/r/20241012203731.1248619-2-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 30 ++++++++++++++--------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index a181c0ccf98b2..1a9660554bd2b 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -56,6 +56,8 @@ static void running_handler(int a);
+ #define BPF_SOCKHASH_FILENAME "test_sockhash_kern.bpf.o"
+ #define CG_PATH "/sockmap"
+ 
++#define EDATAINTEGRITY 2001
++
+ /* global sockets */
+ int s1, s2, c1, c2, p1, p2;
+ int test_cnt;
+@@ -509,23 +511,25 @@ static int msg_alloc_iov(struct msghdr *msg,
+ 	return -ENOMEM;
+ }
+ 
+-static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)
++/* TODO: Add verification logic for push, pull and pop data */
++static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz,
++				 unsigned char *k_p, int *bytes_cnt_p)
+ {
+-	int i, j = 0, bytes_cnt = 0;
+-	unsigned char k = 0;
++	int i, j, bytes_cnt = *bytes_cnt_p;
++	unsigned char k = *k_p;
+ 
+-	for (i = 0; i < msg->msg_iovlen; i++) {
++	for (i = 0, j = 0; i < msg->msg_iovlen && size; i++, j = 0) {
+ 		unsigned char *d = msg->msg_iov[i].iov_base;
+ 
+ 		/* Special case test for skb ingress + ktls */
+ 		if (i == 0 && txmsg_ktls_skb) {
+ 			if (msg->msg_iov[i].iov_len < 4)
+-				return -EIO;
++				return -EDATAINTEGRITY;
+ 			if (memcmp(d, "PASS", 4) != 0) {
+ 				fprintf(stderr,
+ 					"detected skb data error with skb ingress update @iov[%i]:%i \"%02x %02x %02x %02x\" != \"PASS\"\n",
+ 					i, 0, d[0], d[1], d[2], d[3]);
+-				return -EIO;
++				return -EDATAINTEGRITY;
+ 			}
+ 			j = 4; /* advance index past PASS header */
+ 		}
+@@ -535,7 +539,7 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)
+ 				fprintf(stderr,
+ 					"detected data corruption @iov[%i]:%i %02x != %02x, %02x ?= %02x\n",
+ 					i, j, d[j], k - 1, d[j+1], k);
+-				return -EIO;
++				return -EDATAINTEGRITY;
+ 			}
+ 			bytes_cnt++;
+ 			if (bytes_cnt == chunk_sz) {
+@@ -545,6 +549,8 @@ static int msg_verify_data(struct msghdr *msg, int size, int chunk_sz)
+ 			size--;
+ 		}
+ 	}
++	*k_p = k;
++	*bytes_cnt_p = bytes_cnt;
+ 	return 0;
+ }
+ 
+@@ -601,6 +607,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		float total_bytes, txmsg_pop_total;
+ 		int fd_flags = O_NONBLOCK;
+ 		struct timeval timeout;
++		unsigned char k = 0;
++		int bytes_cnt = 0;
+ 		fd_set w;
+ 
+ 		fcntl(fd, fd_flags);
+@@ -695,7 +703,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 						iov_length * cnt :
+ 						iov_length * iov_count;
+ 
+-				errno = msg_verify_data(&msg, recv, chunk_sz);
++				errno = msg_verify_data(&msg, recv, chunk_sz, &k, &bytes_cnt);
+ 				if (errno) {
+ 					perror("data verify msg failed");
+ 					goto out_errno;
+@@ -703,7 +711,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 				if (recvp) {
+ 					errno = msg_verify_data(&msg_peek,
+ 								recvp,
+-								chunk_sz);
++								chunk_sz,
++								&k,
++								&bytes_cnt);
+ 					if (errno) {
+ 						perror("data verify msg_peek failed");
+ 						goto out_errno;
+@@ -811,7 +821,7 @@ static int sendmsg_test(struct sockmap_options *opt)
+ 				s.bytes_sent, sent_Bps, sent_Bps/giga,
+ 				s.bytes_recvd, recvd_Bps, recvd_Bps/giga,
+ 				peek_flag ? "(peek_msg)" : "");
+-		if (err && txmsg_cork)
++		if (err && err != -EDATAINTEGRITY && txmsg_cork)
+ 			err = 0;
+ 		exit(err ? 1 : 0);
+ 	} else if (rxpid == -1) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-fix-sendpage-data-logic-in-test_sockma.patch b/queue-6.6/selftests-bpf-fix-sendpage-data-logic-in-test_sockma.patch
new file mode 100644
index 00000000000..103f0be301d
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-sendpage-data-logic-in-test_sockma.patch
@@ -0,0 +1,86 @@
+From 2f67a50fb4a7babe10f1f6f82d2514c3b071a295 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:14 +0000
+Subject: selftests/bpf: Fix SENDPAGE data logic in test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 4095031463d4e99b534d2cd82035a417295764ae ]
+
+In the SENDPAGE test, "opt->iov_length * cnt" size of data will be sent
+cnt times by sendfile.
+1. In push/pop tests, they will be invoked cnt times, for the simplicity of
+msg_verify_data, change chunk_sz to iov_length
+2. Change iov_length in test_send_large from 1024 to 8192. We have pop test
+where txmsg_start_pop is 4096. 4096 > 1024, an error will be returned.
+
+Fixes: 328aa08a081b ("bpf: Selftests, break down test_sockmap into subtests")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-3-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 2adf0276f881b..6da3215b125b6 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -419,16 +419,18 @@ static int msg_loop_sendpage(int fd, int iov_length, int cnt,
+ {
+ 	bool drop = opt->drop_expected;
+ 	unsigned char k = 0;
++	int i, j, fp;
+ 	FILE *file;
+-	int i, fp;
+ 
+ 	file = tmpfile();
+ 	if (!file) {
+ 		perror("create file for sendpage");
+ 		return 1;
+ 	}
+-	for (i = 0; i < iov_length * cnt; i++, k++)
+-		fwrite(&k, sizeof(char), 1, file);
++	for (i = 0; i < cnt; i++, k = 0) {
++		for (j = 0; j < iov_length; j++, k++)
++			fwrite(&k, sizeof(char), 1, file);
++	}
+ 	fflush(file);
+ 	fseek(file, 0, SEEK_SET);
+ 
+@@ -622,7 +624,9 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		 * This is really only useful for testing edge cases in code
+ 		 * paths.
+ 		 */
+-		total_bytes = (float)iov_count * (float)iov_length * (float)cnt;
++		total_bytes = (float)iov_length * (float)cnt;
++		if (!opt->sendpage)
++			total_bytes *= (float)iov_count;
+ 		if (txmsg_apply)
+ 			txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);
+ 		else
+@@ -700,7 +704,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 
+ 			if (data) {
+ 				int chunk_sz = opt->sendpage ?
+-						iov_length * cnt :
++						iov_length :
+ 						iov_length * iov_count;
+ 
+ 				errno = msg_verify_data(&msg, recv, chunk_sz, &k, &bytes_cnt);
+@@ -1469,8 +1473,8 @@ static void test_send_many(struct sockmap_options *opt, int cgrp)
+ 
+ static void test_send_large(struct sockmap_options *opt, int cgrp)
+ {
+-	opt->iov_length = 256;
+-	opt->iov_count = 1024;
++	opt->iov_length = 8192;
++	opt->iov_count = 32;
+ 	opt->rate = 2;
+ 	test_exec(cgrp, opt);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-fix-test_spin_lock_fail.c-s-global-var.patch b/queue-6.6/selftests-bpf-fix-test_spin_lock_fail.c-s-global-var.patch
new file mode 100644
index 00000000000..f6d160b18a2
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-test_spin_lock_fail.c-s-global-var.patch
@@ -0,0 +1,50 @@
+From 8c7b757ee9e1cf92016382fd7681c4615b3e05f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 21:39:06 -0700
+Subject: selftests/bpf: fix test_spin_lock_fail.c's global vars usage
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 1b2bfc29695d273492c3dd8512775261f3272686 ]
+
+Global variables of special types (like `struct bpf_spin_lock`) make
+underlying ARRAY maps non-mmapable. To make this work with libbpf's
+mmaping logic, application is expected to declare such special variables
+as static, so libbpf doesn't even attempt to mmap() such ARRAYs.
+
+test_spin_lock_fail.c didn't follow this rule, but given it relied on
+this test to trigger failures, this went unnoticed, as we never got to
+the step of mmap()'ing these ARRAY maps.
+
+It is fragile and relies on specific sequence of libbpf steps, which are
+an internal implementation details.
+
+Fix the test by marking lockA and lockB as static.
+
+Fixes: c48748aea4f8 ("selftests/bpf: Add failure test cases for spin lock pairing")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20241023043908.3834423-2-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/test_spin_lock_fail.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c b/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c
+index 86cd183ef6dc8..293ac1049d388 100644
+--- a/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c
++++ b/tools/testing/selftests/bpf/progs/test_spin_lock_fail.c
+@@ -28,8 +28,8 @@ struct {
+ 	},
+ };
+ 
+-SEC(".data.A") struct bpf_spin_lock lockA;
+-SEC(".data.B") struct bpf_spin_lock lockB;
++static struct bpf_spin_lock lockA SEC(".data.A");
++static struct bpf_spin_lock lockB SEC(".data.B");
+ 
+ SEC("?tc")
+ int lock_id_kptr_preserve(void *ctx)
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-fix-total_bytes-in-msg_loop_rx-in-test.patch b/queue-6.6/selftests-bpf-fix-total_bytes-in-msg_loop_rx-in-test.patch
new file mode 100644
index 00000000000..d5367456cec
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-total_bytes-in-msg_loop_rx-in-test.patch
@@ -0,0 +1,71 @@
+From a505df5c50b126055904eb8353e707a6c7780b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 22:25:15 +0000
+Subject: selftests/bpf: Fix total_bytes in msg_loop_rx in test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 523dffccbadea0cfd65f1ff04944b864c558c4a8 ]
+
+total_bytes in msg_loop_rx should also take push into account, otherwise
+total_bytes will be a smaller value, which makes the msg_loop_rx end early.
+
+Besides, total_bytes has already taken pop into account, so we don't need
+to subtract some bytes from iov_buf in sendmsg_test. The additional
+subtraction may make total_bytes a negative number, and msg_loop_rx will
+just end without checking anything.
+
+Fixes: 18d4e900a450 ("bpf: Selftests, improve test_sockmap total bytes counter")
+Fixes: d69672147faa ("selftests, bpf: Add one test for sockmap with strparser")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20241106222520.527076-4-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 6da3215b125b6..73f9ded58e507 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -605,8 +605,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		}
+ 		clock_gettime(CLOCK_MONOTONIC, &s->end);
+ 	} else {
++		float total_bytes, txmsg_pop_total, txmsg_push_total;
+ 		int slct, recvp = 0, recv, max_fd = fd;
+-		float total_bytes, txmsg_pop_total;
+ 		int fd_flags = O_NONBLOCK;
+ 		struct timeval timeout;
+ 		unsigned char k = 0;
+@@ -627,10 +627,14 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
+ 		total_bytes = (float)iov_length * (float)cnt;
+ 		if (!opt->sendpage)
+ 			total_bytes *= (float)iov_count;
+-		if (txmsg_apply)
++		if (txmsg_apply) {
++			txmsg_push_total = txmsg_end_push * (total_bytes / txmsg_apply);
+ 			txmsg_pop_total = txmsg_pop * (total_bytes / txmsg_apply);
+-		else
++		} else {
++			txmsg_push_total = txmsg_end_push * cnt;
+ 			txmsg_pop_total = txmsg_pop * cnt;
++		}
++		total_bytes += txmsg_push_total;
+ 		total_bytes -= txmsg_pop_total;
+ 		err = clock_gettime(CLOCK_MONOTONIC, &s->start);
+ 		if (err < 0)
+@@ -799,8 +803,6 @@ static int sendmsg_test(struct sockmap_options *opt)
+ 
+ 	rxpid = fork();
+ 	if (rxpid == 0) {
+-		if (txmsg_pop || txmsg_start_pop)
+-			iov_buf -= (txmsg_pop - txmsg_start_pop + 1);
+ 		if (opt->drop_expected || txmsg_ktls_skb_drop)
+ 			_exit(0);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-bpf-fix-txmsg_redir-of-test_txmsg_pull-in-.patch b/queue-6.6/selftests-bpf-fix-txmsg_redir-of-test_txmsg_pull-in-.patch
new file mode 100644
index 00000000000..bc3ac91b522
--- /dev/null
+++ b/queue-6.6/selftests-bpf-fix-txmsg_redir-of-test_txmsg_pull-in-.patch
@@ -0,0 +1,38 @@
+From 6b3dcde7e95d77baf2b5c5c79d8c0559f695c3f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Oct 2024 20:37:31 +0000
+Subject: selftests/bpf: Fix txmsg_redir of test_txmsg_pull in test_sockmap
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit b29e231d66303c12b7b8ac3ac2a057df06b161e8 ]
+
+txmsg_redir in "Test pull + redirect" case of test_txmsg_pull should be
+1 instead of 0.
+
+Fixes: 328aa08a081b ("bpf: Selftests, break down test_sockmap into subtests")
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Link: https://lore.kernel.org/r/20241012203731.1248619-3-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sockmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
+index 1a9660554bd2b..4bfadafe51baa 100644
+--- a/tools/testing/selftests/bpf/test_sockmap.c
++++ b/tools/testing/selftests/bpf/test_sockmap.c
+@@ -1609,7 +1609,7 @@ static void test_txmsg_pull(int cgrp, struct sockmap_options *opt)
+ 	test_send_large(opt, cgrp);
+ 
+ 	/* Test pull + redirect */
+-	txmsg_redir = 0;
++	txmsg_redir = 1;
+ 	txmsg_start = 1;
+ 	txmsg_end = 2;
+ 	test_send(opt, cgrp);
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-mount_setattr-fix-failures-on-64k-page_siz.patch b/queue-6.6/selftests-mount_setattr-fix-failures-on-64k-page_siz.patch
new file mode 100644
index 00000000000..16f513f4317
--- /dev/null
+++ b/queue-6.6/selftests-mount_setattr-fix-failures-on-64k-page_siz.patch
@@ -0,0 +1,67 @@
+From c68b1d39f5a938e3dab275a7da731988be9eff13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2024 00:41:14 +1100
+Subject: selftests/mount_setattr: Fix failures on 64K PAGE_SIZE kernels
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit f13242a46438e690067a4bf47068fde4d5719947 ]
+
+Currently the mount_setattr_test fails on machines with a 64K PAGE_SIZE,
+with errors such as:
+
+  #  RUN           mount_setattr_idmapped.invalid_fd_negative ...
+  mkfs.ext4: No space left on device while writing out and closing file system
+  # mount_setattr_test.c:1055:invalid_fd_negative:Expected system("mkfs.ext4 -q /mnt/C/ext4.img") (256) == 0 (0)
+  # invalid_fd_negative: Test terminated by assertion
+  #          FAIL  mount_setattr_idmapped.invalid_fd_negative
+  not ok 12 mount_setattr_idmapped.invalid_fd_negative
+
+The code creates a 100,000 byte tmpfs:
+
+	ASSERT_EQ(mount("testing", "/mnt", "tmpfs", MS_NOATIME | MS_NODEV,
+			"size=100000,mode=700"), 0);
+
+And then a little later creates a 2MB ext4 filesystem in that tmpfs:
+
+	ASSERT_EQ(ftruncate(img_fd, 1024 * 2048), 0);
+	ASSERT_EQ(system("mkfs.ext4 -q /mnt/C/ext4.img"), 0);
+
+At first glance it seems like that should never work, after all 2MB is
+larger than 100,000 bytes. However the filesystem image doesn't actually
+occupy 2MB on "disk" (actually RAM, due to tmpfs). On 4K kernels the
+ext4.img uses ~84KB of actual space (according to du), which just fits.
+
+However on 64K PAGE_SIZE kernels the ext4.img takes at least 256KB,
+which is too large to fit in the tmpfs, hence the errors.
+
+It seems fraught to rely on the ext4.img taking less space on disk than
+the allocated size, so instead create the tmpfs with a size of 2MB. With
+that all 21 tests pass on 64K PAGE_SIZE kernels.
+
+Fixes: 01eadc8dd96d ("tests: add mount_setattr() selftests")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20241115134114.1219555-1-mpe@ellerman.id.au
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/mount_setattr/mount_setattr_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/mount_setattr/mount_setattr_test.c b/tools/testing/selftests/mount_setattr/mount_setattr_test.c
+index c6a8c732b8021..304e6422a1f1c 100644
+--- a/tools/testing/selftests/mount_setattr/mount_setattr_test.c
++++ b/tools/testing/selftests/mount_setattr/mount_setattr_test.c
+@@ -1026,7 +1026,7 @@ FIXTURE_SETUP(mount_setattr_idmapped)
+ 			"size=100000,mode=700"), 0);
+ 
+ 	ASSERT_EQ(mount("testing", "/mnt", "tmpfs", MS_NOATIME | MS_NODEV,
+-			"size=100000,mode=700"), 0);
++			"size=2m,mode=700"), 0);
+ 
+ 	ASSERT_EQ(mkdir("/mnt/A", 0777), 0);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-net-really-check-for-bg-process-completion.patch b/queue-6.6/selftests-net-really-check-for-bg-process-completion.patch
new file mode 100644
index 00000000000..75268fc07f0
--- /dev/null
+++ b/queue-6.6/selftests-net-really-check-for-bg-process-completion.patch
@@ -0,0 +1,43 @@
+From f212debe21240318287d0a62589315395eba82ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2024 19:23:51 +0100
+Subject: selftests: net: really check for bg process completion
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 52ed077aa6336dbef83a2d6d21c52d1706fb7f16 ]
+
+A recent refactor transformed the check for process completion
+in a true statement, due to a typo.
+
+As a result, the relevant test-case is unable to catch the
+regression it was supposed to detect.
+
+Restore the correct condition.
+
+Fixes: 691bb4e49c98 ("selftests: net: avoid just another constant wait")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/0e6f213811f8e93a235307e683af8225cc6277ae.1730828007.git.pabeni@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/pmtu.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
+index d65fdd407d73f..1c0dd2f781678 100755
+--- a/tools/testing/selftests/net/pmtu.sh
++++ b/tools/testing/selftests/net/pmtu.sh
+@@ -1961,7 +1961,7 @@ check_running() {
+ 	pid=${1}
+ 	cmd=${2}
+ 
+-	[ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "{cmd}" ]
++	[ "$(cat /proc/${pid}/cmdline 2>/dev/null | tr -d '\0')" = "${cmd}" ]
+ }
+ 
+ test_cleanup_vxlanX_exception() {
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-resctrl-fix-memory-overflow-due-to-unhandl.patch b/queue-6.6/selftests-resctrl-fix-memory-overflow-due-to-unhandl.patch
new file mode 100644
index 00000000000..c9b19bd779f
--- /dev/null
+++ b/queue-6.6/selftests-resctrl-fix-memory-overflow-due-to-unhandl.patch
@@ -0,0 +1,53 @@
+From 7cbc05472e0806ead0b531c723863baf4e4872fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:18:40 -0700
+Subject: selftests/resctrl: Fix memory overflow due to unhandled wraparound
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+[ Upstream commit caf02626b2bf164a02c808240f19dbf97aced664 ]
+
+alloc_buffer() allocates and initializes (with random data) a
+buffer of requested size. The initialization starts from the beginning
+of the allocated buffer and incrementally assigns sizeof(uint64_t) random
+data to each cache line. The initialization uses the size of the
+buffer to control the initialization flow, decrementing the amount of
+buffer needing to be initialized after each iteration.
+
+The size of the buffer is stored in an unsigned (size_t) variable s64
+and the test "s64 > 0" is used to decide if initialization is complete.
+The problem is that decrementing the buffer size may wrap around
+if the buffer size is not divisible by "CL_SIZE / sizeof(uint64_t)"
+resulting in the "s64 > 0" test being true and memory beyond the buffer
+"initialized".
+
+Use a signed value for the buffer size to support all buffer sizes.
+
+Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark")
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/fill_buf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
+index 635f938b11f09..a85ae8148db84 100644
+--- a/tools/testing/selftests/resctrl/fill_buf.c
++++ b/tools/testing/selftests/resctrl/fill_buf.c
+@@ -116,7 +116,7 @@ static unsigned char *alloc_buffer(size_t buf_size, int memflush)
+ {
+ 	void *buf = NULL;
+ 	uint64_t *p64;
+-	size_t s64;
++	ssize_t s64;
+ 	int ret;
+ 
+ 	ret = posix_memalign(&buf, PAGE_SIZE, buf_size);
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-resctrl-protect-against-array-overrun-duri.patch b/queue-6.6/selftests-resctrl-protect-against-array-overrun-duri.patch
new file mode 100644
index 00000000000..6ad201badad
--- /dev/null
+++ b/queue-6.6/selftests-resctrl-protect-against-array-overrun-duri.patch
@@ -0,0 +1,67 @@
+From 55ee8268103a619b5c967620f1e74c56a08462a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 14:18:41 -0700
+Subject: selftests/resctrl: Protect against array overrun during iMC config
+ parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+[ Upstream commit 48ed4e799e8fbebae838dca404a8527763d41191 ]
+
+The MBM and MBA tests need to discover the event and umask with which to
+configure the performance event used to measure read memory bandwidth.
+This is done by parsing the
+/sys/bus/event_source/devices/uncore_imc_<imc instance>/events/cas_count_read
+file for each iMC instance that contains the formatted
+output: "event=<event>,umask=<umask>"
+
+Parsing of cas_count_read contents is done by initializing an array of
+MAX_TOKENS elements with tokens (deliminated by "=,") from this file.
+Remove the unnecessary append of a delimiter to the string needing to be
+parsed. Per the strtok() man page: "delimiter bytes at the start or end of
+the string are ignored". This has no impact on the token placement within
+the array.
+
+After initialization, the actual event and umask is determined by
+parsing the tokens directly following the "event" and "umask" tokens
+respectively.
+
+Iterating through the array up to index "i < MAX_TOKENS" but then
+accessing index "i + 1" risks array overrun during the final iteration.
+Avoid array overrun by ensuring that the index used within for
+loop will always be valid.
+
+Fixes: 1d3f08687d76 ("selftests/resctrl: Read memory bandwidth from perf IMC counter and from resctrl file system")
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/resctrl_val.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c
+index 45439e726e79c..d77fdf356e98e 100644
+--- a/tools/testing/selftests/resctrl/resctrl_val.c
++++ b/tools/testing/selftests/resctrl/resctrl_val.c
+@@ -102,13 +102,12 @@ void get_event_and_umask(char *cas_count_cfg, int count, bool op)
+ 	char *token[MAX_TOKENS];
+ 	int i = 0;
+ 
+-	strcat(cas_count_cfg, ",");
+ 	token[0] = strtok(cas_count_cfg, "=,");
+ 
+ 	for (i = 1; i < MAX_TOKENS; i++)
+ 		token[i] = strtok(NULL, "=,");
+ 
+-	for (i = 0; i < MAX_TOKENS; i++) {
++	for (i = 0; i < MAX_TOKENS - 1; i++) {
+ 		if (!token[i])
+ 			break;
+ 		if (strcmp(token[i], "event") == 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-resctrl-refactor-fill_buf-functions.patch b/queue-6.6/selftests-resctrl-refactor-fill_buf-functions.patch
new file mode 100644
index 00000000000..be455c90051
--- /dev/null
+++ b/queue-6.6/selftests-resctrl-refactor-fill_buf-functions.patch
@@ -0,0 +1,145 @@
+From d393d98a354a37c257dbd624ed829f02fc61869e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 17:04:52 +0200
+Subject: selftests/resctrl: Refactor fill_buf functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 24be05591fb7a2a3edd639092c045298dd57aeea ]
+
+There are unnecessary nested calls in fill_buf.c:
+  - run_fill_buf() calls fill_cache()
+  - alloc_buffer() calls malloc_and_init_memory()
+
+Simplify the code flow and remove those unnecessary call levels by
+moving the called code inside the calling function and remove the
+duplicated error print.
+
+Resolve the difference in run_fill_buf() and fill_cache() parameter
+name into 'buf_size' which is more descriptive than 'span'. Also, while
+moving the allocation related code, rename 'p' into 'buf' to be
+consistent in naming the variables.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: caf02626b2bf ("selftests/resctrl: Fix memory overflow due to unhandled wraparound")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/fill_buf.c | 59 +++++++---------------
+ tools/testing/selftests/resctrl/resctrl.h  |  2 +-
+ 2 files changed, 18 insertions(+), 43 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
+index 6d1d5eed595cd..635f938b11f09 100644
+--- a/tools/testing/selftests/resctrl/fill_buf.c
++++ b/tools/testing/selftests/resctrl/fill_buf.c
+@@ -51,29 +51,6 @@ static void mem_flush(unsigned char *buf, size_t buf_size)
+ 	sb();
+ }
+ 
+-static void *malloc_and_init_memory(size_t buf_size)
+-{
+-	void *p = NULL;
+-	uint64_t *p64;
+-	size_t s64;
+-	int ret;
+-
+-	ret = posix_memalign(&p, PAGE_SIZE, buf_size);
+-	if (ret < 0)
+-		return NULL;
+-
+-	p64 = (uint64_t *)p;
+-	s64 = buf_size / sizeof(uint64_t);
+-
+-	while (s64 > 0) {
+-		*p64 = (uint64_t)rand();
+-		p64 += (CL_SIZE / sizeof(uint64_t));
+-		s64 -= (CL_SIZE / sizeof(uint64_t));
+-	}
+-
+-	return p;
+-}
+-
+ static int fill_one_span_read(unsigned char *buf, size_t buf_size)
+ {
+ 	unsigned char *end_ptr = buf + buf_size;
+@@ -137,12 +114,25 @@ static int fill_cache_write(unsigned char *buf, size_t buf_size, bool once)
+ 
+ static unsigned char *alloc_buffer(size_t buf_size, int memflush)
+ {
+-	unsigned char *buf;
++	void *buf = NULL;
++	uint64_t *p64;
++	size_t s64;
++	int ret;
+ 
+-	buf = malloc_and_init_memory(buf_size);
+-	if (!buf)
++	ret = posix_memalign(&buf, PAGE_SIZE, buf_size);
++	if (ret < 0)
+ 		return NULL;
+ 
++	/* Initialize the buffer */
++	p64 = buf;
++	s64 = buf_size / sizeof(uint64_t);
++
++	while (s64 > 0) {
++		*p64 = (uint64_t)rand();
++		p64 += (CL_SIZE / sizeof(uint64_t));
++		s64 -= (CL_SIZE / sizeof(uint64_t));
++	}
++
+ 	/* Flush the memory before using to avoid "cache hot pages" effect */
+ 	if (memflush)
+ 		mem_flush(buf, buf_size);
+@@ -150,7 +140,7 @@ static unsigned char *alloc_buffer(size_t buf_size, int memflush)
+ 	return buf;
+ }
+ 
+-static int fill_cache(size_t buf_size, int memflush, int op, bool once)
++int run_fill_buf(size_t buf_size, int memflush, int op, bool once)
+ {
+ 	unsigned char *buf;
+ 	int ret;
+@@ -164,21 +154,6 @@ static int fill_cache(size_t buf_size, int memflush, int op, bool once)
+ 	else
+ 		ret = fill_cache_write(buf, buf_size, once);
+ 	free(buf);
+-
+-	if (ret) {
+-		printf("\n Error in fill cache read/write...\n");
+-		return -1;
+-	}
+-
+-	return ret;
+-}
+-
+-int run_fill_buf(size_t span, int memflush, int op, bool once)
+-{
+-	size_t cache_size = span;
+-	int ret;
+-
+-	ret = fill_cache(cache_size, memflush, op, once);
+ 	if (ret) {
+ 		printf("\n Error in fill cache\n");
+ 		return -1;
+diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h
+index dd3546655657a..a848e9c755787 100644
+--- a/tools/testing/selftests/resctrl/resctrl.h
++++ b/tools/testing/selftests/resctrl/resctrl.h
+@@ -91,7 +91,7 @@ int write_bm_pid_to_resctrl(pid_t bm_pid, char *ctrlgrp, char *mongrp,
+ 			    char *resctrl_val);
+ int perf_event_open(struct perf_event_attr *hw_event, pid_t pid, int cpu,
+ 		    int group_fd, unsigned long flags);
+-int run_fill_buf(size_t span, int memflush, int op, bool once);
++int run_fill_buf(size_t buf_size, int memflush, int op, bool once);
+ int resctrl_val(const char * const *benchmark_cmd, struct resctrl_val_param *param);
+ int mbm_bw_change(int cpu_no, const char * const *benchmark_cmd);
+ void tests_cleanup(void);
+-- 
+2.43.0
+
diff --git a/queue-6.6/selftests-resctrl-split-fill_buf-to-allow-tests-fine.patch b/queue-6.6/selftests-resctrl-split-fill_buf-to-allow-tests-fine.patch
new file mode 100644
index 00000000000..c56ea575909
--- /dev/null
+++ b/queue-6.6/selftests-resctrl-split-fill_buf-to-allow-tests-fine.patch
@@ -0,0 +1,92 @@
+From a10d61e7e4c2334f4ad682d7cfe96ade7760e98d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 17:04:51 +0200
+Subject: selftests/resctrl: Split fill_buf to allow tests finer-grained
+ control
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit f8f669699977db503569465b64dc5220ab21bb41 ]
+
+MBM, MBA and CMT test cases call run_fill_buf() that in turn calls
+fill_cache() to alloc and loop indefinitely around the buffer. This
+binds buffer allocation and running the benchmark into a single bundle
+so that a selftest cannot allocate a buffer once and reuse it. CAT test
+doesn't want to loop around the buffer continuously and after rewrite
+it needs the ability to allocate the buffer separately.
+
+Split buffer allocation out of fill_cache() into alloc_buffer(). This
+change is part of preparation for the new CAT test that allocates a
+buffer and does multiple passes over the same buffer (but not in an
+infinite loop).
+
+Co-developed-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: caf02626b2bf ("selftests/resctrl: Fix memory overflow due to unhandled wraparound")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/resctrl/fill_buf.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
+index 0f6cca61ec94b..6d1d5eed595cd 100644
+--- a/tools/testing/selftests/resctrl/fill_buf.c
++++ b/tools/testing/selftests/resctrl/fill_buf.c
+@@ -135,24 +135,34 @@ static int fill_cache_write(unsigned char *buf, size_t buf_size, bool once)
+ 	return 0;
+ }
+ 
+-static int fill_cache(size_t buf_size, int memflush, int op, bool once)
++static unsigned char *alloc_buffer(size_t buf_size, int memflush)
+ {
+ 	unsigned char *buf;
+-	int ret;
+ 
+ 	buf = malloc_and_init_memory(buf_size);
+ 	if (!buf)
+-		return -1;
++		return NULL;
+ 
+ 	/* Flush the memory before using to avoid "cache hot pages" effect */
+ 	if (memflush)
+ 		mem_flush(buf, buf_size);
+ 
++	return buf;
++}
++
++static int fill_cache(size_t buf_size, int memflush, int op, bool once)
++{
++	unsigned char *buf;
++	int ret;
++
++	buf = alloc_buffer(buf_size, memflush);
++	if (!buf)
++		return -1;
++
+ 	if (op == 0)
+ 		ret = fill_cache_read(buf, buf_size, once);
+ 	else
+ 		ret = fill_cache_write(buf, buf_size, once);
+-
+ 	free(buf);
+ 
+ 	if (ret) {
+@@ -160,8 +170,7 @@ static int fill_cache(size_t buf_size, int memflush, int op, bool once)
+ 		return -1;
+ 	}
+ 
+-
+-	return 0;
++	return ret;
+ }
+ 
+ int run_fill_buf(size_t span, int memflush, int op, bool once)
+-- 
+2.43.0
+
diff --git a/queue-6.6/series b/queue-6.6/series
index fa9ad3613ee..9bedc15cd69 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -46,3 +46,407 @@ platform-x86-x86-android-tablets-unregister-devices-.patch
 drm-amd-display-add-null-check-for-pipe_ctx-plane_st.patch
 mptcp-fix-possible-integer-overflow-in-mptcp_reset_t.patch
 bpf-support-non-r10-register-spill-fill-to-from-stac.patch
+arm64-probes-disable-kprobes-uprobes-on-mops-instruc.patch
+kselftest-arm64-mte-fix-printf-type-warnings-about-_.patch
+kselftest-arm64-mte-fix-printf-type-warnings-about-l.patch
+s390-cio-do-not-unregister-the-subchannel-based-on-d.patch
+s390-pageattr-implement-missing-kernel_page_present.patch
+x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch
+x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
+brd-defer-automatic-disk-creation-until-module-initi.patch
+ext4-avoid-remount-errors-with-abort-mount-option.patch
+mips-asm-fix-warning-when-disabling-mips_fp_support.patch
+initramfs-avoid-filename-buffer-overrun.patch
+nvme-pci-fix-freeing-of-the-hmb-descriptor-table.patch
+m68k-mvme147-fix-scsi-controller-irq-numbers.patch
+m68k-mvme16x-add-and-use-mvme16x.h.patch
+m68k-mvme147-reinstate-early-console.patch
+arm64-fix-.data.rel.ro-size-assertion-when-config_lt.patch
+acpi-arm64-adjust-error-handling-procedure-in-gtdt_p.patch
+cachefiles-fix-missing-pos-updates-in-cachefiles_ond.patch
+netfs-fscache-add-a-memory-barrier-for-fscache_volum.patch
+block-fix-bio_split_rw_at-to-take-zone_write_granula.patch
+s390-syscalls-avoid-creation-of-arch-arch-directory.patch
+hfsplus-don-t-query-the-device-logical-block-size-mu.patch
+ext4-remove-calls-to-to-set-clear-the-folio-error-fl.patch
+ext4-pipeline-buffer-reads-in-mext_page_mkuptodate.patch
+ext4-remove-array-of-buffer_heads-from-mext_page_mku.patch
+ext4-fix-race-in-buffer_head-read-fault-injection.patch
+nvme-pci-reverse-request-order-in-nvme_queue_rqs.patch
+virtio_blk-reverse-request-order-in-virtio_queue_rqs.patch
+crypto-caam-fix-the-pointer-passed-to-caam_qi_shutdo.patch
+crypto-qat-remove-check-after-debugfs_create_dir.patch
+crypto-powerpc-p10-aes-gcm-register-modules-as-simd.patch
+crypto-powerpc-p10-aes-gcm-add-dependency-on-crypto_.patch
+crypto-qat-qat_4xxx-fix-off-by-one-in-uof_get_name.patch
+firmware-google-unregister-driver_info-on-failure.patch
+edac-bluefield-fix-potential-integer-overflow.patch
+crypto-qat-remove-faulty-arbiter-config-reset.patch
+thermal-core-initialize-thermal-zones-before-registe.patch
+edac-fsl_ddr-fix-bad-bit-shift-operations.patch
+edac-skx_common-differentiate-memory-error-sources.patch
+edac-skx_common-i10nm-fix-incorrect-far-memory-error.patch
+crypto-pcrypt-call-crypto-layer-directly-when-padata.patch
+crypto-cavium-fix-the-if-condition-to-exit-loop-afte.patch
+amd-pstate-set-min_perf-to-nominal_perf-for-active-m.patch
+crypto-hisilicon-qm-disable-same-error-report-before.patch
+edac-igen6-avoid-segmentation-fault-on-module-unload.patch
+crypto-inside-secure-fix-the-return-value-of-safexce.patch
+doc-rcu-update-printed-dynticks-counter-bits.patch
+rcu-kvfree-fix-data-race-in-__mod_timer-kvfree_call_.patch
+hwmon-pmbus_core-allow-to-hook-pmbus_smbalert_mask.patch
+hwmon-pmbus-core-clear-faults-after-setting-smbalert.patch
+hwmon-nct6775-core-fix-overflows-seen-when-writing-l.patch
+acpi-cppc-fix-_cpc-register-setting-issue.patch
+crypto-caam-add-error-check-to-caam_rsa_set_priv_key.patch
+crypto-bcm-add-error-check-in-the-ahash_hmac_init-fu.patch
+crypto-aes-gcm-p10-use-the-correct-bit-to-test-for-p.patch
+crypto-cavium-fix-an-error-handling-path-in-cpt_ucod.patch
+rcuscale-do-a-proper-cleanup-if-kfree_scale_init-fai.patch
+tools-lib-thermal-make-more-generic-the-command-enco.patch
+thermal-lib-fix-memory-leak-on-error-in-thermal_genl.patch
+x86-unwind-orc-fix-unwind-for-newly-forked-tasks.patch
+time-partially-revert-cleanup-on-msecs_to_jiffies-do.patch
+time-fix-references-to-_msecs_to_jiffies-handling-of.patch
+kcsan-seqlock-support-seqcount_latch_t.patch
+kcsan-seqlock-fix-incorrect-assumption-in-read_seqbe.patch
+clocksource-drivers-sp804-make-user-selectable.patch
+clocksource-drivers-timer-ti-dm-fix-child-node-refco.patch
+spi-spi-fsl-lpspi-use-irqf_no_autoen-flag-in-request.patch
+arm-dts-renesas-remove-unused-lbsc-nodes-from-board-.patch
+arm-dts-renesas-genmai-add-flash-nodes.patch
+arm-dts-renesas-genmai-fix-partition-size-for-qspi-n.patch
+drivers-soc-xilinx-add-the-missing-kfree-in-xlnx_add.patch
+microblaze-export-xmb_manager-functions.patch
+arm64-dts-mt8195-fix-dtbs_check-error-for-mutex-node.patch
+arm64-dts-mt8195-fix-dtbs_check-error-for-infracfg_a.patch
+soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch
+soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch
+arm64-dts-qcom-sm6350-fix-gpu-frequencies-missing-on.patch
+arm-dts-microchip-sam9x60-add-missing-property-atmel.patch
+mmc-mmc_spi-drop-buggy-snprintf.patch
+openrisc-implement-fixmap-to-fix-earlycon.patch
+efi-libstub-fix-efi_parse_options-ignoring-the-defau.patch
+tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch
+media-i2c-ds90ub960-fix-missing-return-check-on-ub96.patch
+arm64-dts-mt8183-krane-fix-the-address-of-eeprom-at-.patch
+arm64-dts-mt8183-kukui-fix-the-address-of-eeprom-at-.patch
+arm64-dts-mediatek-mt8173-elm-hana-add-vdd-supply-to.patch
+revert-cgroup-fix-memory-leak-caused-by-missing-cgro.patch
+cgroup-bpf-only-cgroup-v2-can-be-attached-by-bpf-pro.patch
+regulator-rk808-restrict-dvs-gpios-to-the-rk808-vari.patch
+arm64-dts-mt8183-fennel-add-i2c2-s-i2c-scl-internal-.patch
+arm64-dts-mt8183-burnet-add-i2c2-s-i2c-scl-internal-.patch
+arm64-dts-mt8183-cozmo-add-i2c2-s-i2c-scl-internal-d.patch
+arm64-dts-mt8183-damu-add-i2c2-s-i2c-scl-internal-de.patch
+pwm-imx27-workaround-of-the-pwm-output-bug-when-decr.patch
+arm-dts-cubieboard4-fix-dcdc5-regulator-constraints.patch
+arm64-dts-ti-k3-j7200-use-ti-j7200-padconf-compatibl.patch
+arm64-dts-ti-k3-j7200-fix-register-map-for-main-doma.patch
+arm64-dts-ti-k3-j7200-fix-clock-ids-for-mcspi-instan.patch
+arm64-dts-ti-k3-j721e-fix-clock-ids-for-mcspi-instan.patch
+arm64-dts-ti-k3-j721s2-fix-clock-ids-for-mcspi-insta.patch
+um-unconditionally-call-unflatten_device_tree.patch
+x86-of-unconditionally-call-unflatten_and_copy_devic.patch
+of-fdt-add-dt_phys-arg-to-early_init_dt_scan-and-ear.patch
+pmdomain-ti-sci-add-missing-of_node_put-for-args.np.patch
+spi-tegra210-quad-avoid-shift-out-of-bounds.patch
+spi-zynqmp-gqspi-undo-runtime-pm-changes-at-driver-e.patch
+regmap-irq-set-lockdep-class-for-hierarchical-irq-do.patch
+arm64-dts-renesas-hihope-drop-sound-dai-cells.patch
+arm64-dts-mediatek-add-adc-node-on-mt6357-mt6358-mt6.patch
+arm64-dts-mediatek-mt6358-fix-dtbs_check-error.patch
+arm64-dts-mediatek-mt8183-kukui-jacuzzi-fix-dp-bridg.patch
+arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-supplies.patch
+selftests-resctrl-split-fill_buf-to-allow-tests-fine.patch
+selftests-resctrl-refactor-fill_buf-functions.patch
+selftests-resctrl-fix-memory-overflow-due-to-unhandl.patch
+selftests-resctrl-protect-against-array-overrun-duri.patch
+firmware-arm_scpi-check-the-dvfs-opp-count-returned-.patch
+media-venus-fix-enc-dec-destruction-order.patch
+media-venus-sync-with-threaded-irq-during-inst-destr.patch
+media-atomisp-add-check-for-rgby_data-memory-allocat.patch
+arm64-dts-rockchip-correct-analog-audio-name-on-indi.patch
+hid-hyperv-streamline-driver-probe-to-avoid-devres-i.patch
+platform-x86-panasonic-laptop-return-errno-correctly.patch
+drm-mm-mark-drm_mm_interval_tree-functions-with-__ma.patch
+drm-vc4-hvs-don-t-write-gamma-luts-on-2711.patch
+drm-vc4-hdmi-avoid-hang-with-debug-registers-when-su.patch
+drm-vc4-hvs-fix-dlist-debug-not-resetting-the-next-e.patch
+drm-vc4-hvs-remove-incorrect-limit-from-hvs_dlist-de.patch
+drm-vc4-hvs-correct-logic-on-stopping-an-hvs-channel.patch
+wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch
+drm-omap-fix-possible-null-dereference.patch
+drm-omap-fix-locking-in-omap_gem_new_dmabuf.patch
+wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch
+wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch
+drm-imx-dcss-use-irqf_no_autoen-flag-in-request_irq.patch
+drm-imx-ipuv3-use-irqf_no_autoen-flag-in-request_irq.patch
+drm-v3d-address-race-condition-in-mmu-flush.patch
+wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch
+wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch-17860
+wifi-ath12k-skip-rx-tid-cleanup-for-self-peer.patch
+dt-bindings-vendor-prefixes-add-neofidelity-inc.patch
+asoc-fsl_micfil-fix-regmap_write_bits-usage.patch
+asoc-dt-bindings-mt6359-update-generic-node-name-and.patch
+drm-bridge-anx7625-drop-edid-cache-on-bridge-power-o.patch
+drm-bridge-it6505-drop-edid-cache-on-bridge-power-of.patch
+libbpf-fix-expected_attach_type-set-handling-in-prog.patch
+libbpf-fix-output-.symtab-byte-order-during-linking.patch
+bpf-fix-the-xdp_adjust_tail-sample-prog-issue.patch
+wifi-ath11k-fix-ce-offset-address-calculation-for-wc.patch
+virtchnl-add-crc-stripping-capability.patch
+ice-support-fcs-crc-strip-disable-for-vf.patch
+ice-consistently-use-q_idx-in-ice_vc_cfg_qs_msg.patch
+drm-vc4-match-drm_dev_enter-and-exit-calls-in-vc4_hv.patch
+libbpf-fix-sym_is_subprog-logic-for-weak-global-subp.patch
+asoc-rt722-sdca-remove-logically-deadcode-in-rt722-s.patch
+libbpf-never-interpret-subprogs-in-.text-as-entry-pr.patch
+netdevsim-copy-addresses-for-both-in-and-out-paths.patch
+drm-bridge-tc358767-fix-link-properties-discovery.patch
+selftests-bpf-fix-msg_verify_data-in-test_sockmap.patch
+selftests-bpf-fix-txmsg_redir-of-test_txmsg_pull-in-.patch
+wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch
+drm-fsl-dcu-enable-pixclk-on-ls1021a.patch
+drm-msm-dpu-on-sdm845-move-dspp_3-to-lm_5-block.patch
+drm-msm-dpu-drop-lm_3-lm_4-on-sdm845.patch
+drm-msm-dpu-drop-lm_3-lm_4-on-msm8998.patch
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-18928
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-1819
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-cn10.patch
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-921
+octeontx2-pf-handle-otx2_mbox_get_rsp-errors-in-otx2.patch-5160
+selftests-bpf-fix-test_spin_lock_fail.c-s-global-var.patch
+drm-panfrost-remove-unused-id_mask-from-struct-panfr.patch
+bpf-arm64-remove-garbage-frame-for-struct_ops-trampo.patch
+drm-msm-adreno-use-irqf_no_autoen-flag-in-request_ir.patch
+drm-msm-gpu-check-the-status-of-registration-to-pm-q.patch
+drm-etnaviv-request-pages-from-dma32-zone-on-address.patch
+drm-etnaviv-hold-gpu-lock-across-perfmon-sampling.patch
+drm-nouveau-gr-gf100-fix-missing-unlock-in-gf100_gr_.patch
+drm-zynqmp_kms-unplug-drm-device-before-removal.patch
+wifi-wfx-fix-error-handling-in-wfx_core_init.patch
+drm-msm-dpu-cast-crtc_clk-calculation-to-u64-in-_dpu.patch
+bpf-bpftool-fix-incorrect-disasm-pc.patch
+drm-vkms-drop-unnecessary-call-to-drm_crtc_cleanup.patch
+drm-use-atomic64_init-for-atomic64_t.patch
+netfilter-nf_tables-open-code-audit-log-call-in-nf_t.patch
+netfilter-nf_tables-introduce-nf_tables_getrule_sing.patch
+netfilter-nf_tables-avoid-false-positive-lockdep-spl.patch
+netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch
+netfilter-nf_tables-skip-transaction-if-update-objec.patch
+netfilter-nf_tables-must-hold-rcu-read-lock-while-it.patch-562
+netlink-typographical-error-in-nlmsg_type-constants-.patch
+selftests-bpf-add-txmsg_pass-to-pull-push-pop-in-tes.patch
+selftests-bpf-fix-sendpage-data-logic-in-test_sockma.patch
+selftests-bpf-fix-total_bytes-in-msg_loop_rx-in-test.patch
+selftests-bpf-add-push-pop-checking-for-msg_verify_d.patch
+bpf-sockmap-several-fixes-to-bpf_msg_push_data.patch
+bpf-sockmap-several-fixes-to-bpf_msg_pop_data.patch
+bpf-sockmap-fix-sk_msg_reset_curr.patch
+sock_diag-add-module-pointer-to-struct-sock_diag_han.patch
+sock_diag-allow-concurrent-operations.patch
+sock_diag-allow-concurrent-operation-in-sock_diag_rc.patch
+net-use-unrcu_pointer-helper.patch
+ipv6-release-nexthop-on-device-removal.patch
+selftests-net-really-check-for-bg-process-completion.patch
+drm-amdkfd-fix-wrong-usage-of-init_work.patch
+bpf-force-uprobe-bpf-program-to-always-return-0.patch
+net-rfkill-gpio-add-check-for-clk_enable.patch
+alsa-usx2y-use-snd_card_free_when_closed-at-disconne.patch
+alsa-us122l-use-snd_card_free_when_closed-at-disconn.patch
+alsa-caiaq-use-snd_card_free_when_closed-at-disconne.patch
+alsa-6fire-release-resources-at-card-release.patch
+bluetooth-fix-use-after-free-in-device_for_each_chil.patch
+erofs-handle-nonhead-delta-1-lclusters-gracefully.patch
+netpoll-use-rcu_access_pointer-in-netpoll_poll_lock.patch
+wireguard-selftests-load-nf_conntrack-if-not-present.patch
+bpf-fix-recursive-lock-when-verdict-program-return-s.patch
+unicode-fix-utf8_load-error-path.patch
+cppc_cpufreq-use-desired-perf-if-feedback-ctrs-are-0.patch
+clk-mediatek-drop-two-dead-config-options.patch
+trace-trace_event_perf-remove-duplicate-samples-on-t.patch
+pinctrl-zynqmp-drop-excess-struct-member-description.patch
+scsi-hisi_sas-enable-all-phys-that-are-not-disabled-.patch
+powerpc-vdso-flag-vdso64-entry-points-as-functions.patch
+mfd-tps65010-use-irqf_no_autoen-flag-in-request_irq-.patch
+mfd-da9052-spi-change-read-mask-to-write-mask.patch
+mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-usb-type.patch
+mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-tmu-devi.patch
+mfd-intel_soc_pmic_bxtwc-use-irq-domain-for-pmic-dev.patch
+cpufreq-loongson2-unregister-platform_driver-on-fail.patch
+powerpc-fadump-refactor-and-prepare-fadump_cma_init-.patch
+powerpc-fadump-move-fadump_cma_init-to-setup_arch-af.patch
+mtd-hyperbus-rpc-if-convert-to-platform-remove-callb.patch
+mtd-hyperbus-rpc-if-add-missing-module_device_table.patch
+mtd-rawnand-atmel-fix-possible-memory-leak.patch
+powerpc-mm-fault-fix-kfence-page-fault-reporting.patch
+mtd-spi-nor-spansion-use-nor-addr_nbytes-in-octal-dt.patch
+powerpc-pseries-fix-dtl_access_lock-to-be-a-rw_semap.patch
+cpufreq-cppc-fix-possible-null-ptr-deref-for-cpufreq.patch
+cpufreq-cppc-fix-possible-null-ptr-deref-for-cppc_ge.patch
+rdma-hns-fix-an-aeqe-overflow-error-caused-by-untime.patch
+rdma-hns-use-dev_-printings-in-hem-code-instead-of-i.patch
+rdma-hns-fix-cpu-stuck-caused-by-printings-during-re.patch
+rdma-rxe-fix-the-qp-flush-warnings-in-req.patch
+rdma-bnxt_re-check-cqe-flags-to-know-imm_data-vs-inv.patch
+clk-sunxi-ng-d1-fix-pll_audio0-preset.patch
+clk-renesas-rzg2l-fix-foutpostdiv-clk.patch
+rdma-rxe-set-queue-pair-cur_qp_state-when-being-quer.patch
+risc-v-kvm-fix-aplic-in_clrip-and-clripnum-write-emu.patch
+clk-imx-lpcg-scu-sw-workaround-for-errata-e10858.patch
+clk-imx-fracn-gppll-correct-pll-initialization-flow.patch
+clk-imx-fracn-gppll-fix-pll-power-up.patch
+clk-imx-clk-scu-fix-clk-enable-state-save-and-restor.patch
+clk-imx-imx8-acm-fix-return-value-check-in-clk_imx_a.patch
+iommu-vt-d-fix-checks-and-print-in-dmar_fault_dump_p.patch
+iommu-vt-d-fix-checks-and-print-in-pgtable_walk.patch
+checkpatch-check-for-missing-fixes-tags.patch
+checkpatch-always-parse-orig_commit-in-fixes-tag.patch
+mfd-rt5033-fix-missing-regmap_del_irq_chip.patch
+fs-proc-kcore.c-fix-coccinelle-reported-error-instan.patch
+scsi-bfa-fix-use-after-free-in-bfad_im_module_exit.patch
+scsi-fusion-remove-unused-variable-rc.patch
+scsi-qedf-fix-a-possible-memory-leak-in-qedf_alloc_a.patch
+scsi-qedi-fix-a-possible-memory-leak-in-qedi_alloc_a.patch
+scsi-sg-enable-runtime-power-management.patch
+x86-tdx-skip-saving-output-regs-when-seamcall-fails-.patch
+x86-tdx-make-macros-of-tdcalls-consistent-with-the-s.patch
+x86-tdx-rename-__tdx_module_call-to-__tdcall.patch
+x86-tdx-pass-tdcall-seamcall-input-output-registers-.patch
+x86-tdx-introduce-wrappers-to-read-and-write-td-meta.patch
+x86-tdx-rename-tdx_parse_tdinfo-to-tdx_setup.patch
+x86-tdx-dynamically-disable-sept-violations-from-cau.patch
+rdma-hns-fix-out-of-order-issue-of-requester-when-se.patch
+rdma-hns-fix-null-pointer-derefernce-in-hns_roce_map.patch
+cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch
+cpufreq-cppc-fix-wrong-return-value-in-cppc_get_cpu_.patch-19495
+ocfs2-fix-uninitialized-value-in-ocfs2_file_read_ite.patch
+dax-delete-a-stale-directory-pmem.patch
+kvm-ppc-book3s-hv-stop-using-vc-dpdes-for-nested-kvm.patch
+kvm-ppc-book3s-hv-avoid-returning-to-nested-hypervis.patch
+powerpc-sstep-make-emulate_vsx_load-and-emulate_vsx_.patch
+powerpc-kexec-fix-return-of-uninitialized-variable.patch
+fbdev-sh7760fb-fix-a-possible-memory-leak-in-sh7760f.patch
+ib-mlx5-allocate-resources-just-before-first-qp-srq-.patch
+rdma-mlx5-move-events-notifier-registration-to-be-af.patch
+clk-clk-apple-nco-add-null-check-in-applnco_probe.patch
+clk-ralink-mtmips-fix-clock-plan-for-ralink-soc-rt38.patch
+clk-ralink-mtmips-fix-clocks-probe-order-in-oldest-r.patch
+dt-bindings-clock-axi-clkgen-include-axi-clk.patch
+clk-clk-axi-clkgen-make-sure-to-enable-the-axi-bus-c.patch
+arm64-dts-qcom-sc8180x-add-a-soc-specific-compatible.patch
+pinctrl-k210-undef-k210_pc_default.patch
+smb-cached-directories-can-be-more-than-root-file-ha.patch
+mailbox-arm_mhuv2-clean-up-loop-in-get_irq_chan_comb.patch
+perf-cs-etm-don-t-flush-when-packet_queue-fills-up.patch
+gfs2-get-rid-of-gfs2_glock_queue_put-in-signal_our_w.patch
+gfs2-replace-gfs2_glock_queue_put-with-gfs2_glock_pu.patch
+gfs2-rename-glf_verify_evict-to-glf_verify_delete.patch
+gfs2-allow-immediate-glf_verify_delete-work.patch
+gfs2-fix-unlinked-inode-cleanup.patch
+pci-fix-reset_method_store-memory-leak.patch
+perf-stat-close-cork_fd-when-create_perf_stat_counte.patch
+perf-stat-fix-affinity-memory-leaks-on-error-path.patch
+perf-trace-keep-exited-threads-for-summary.patch
+perf-test-attr-add-back-missing-topdown-events.patch
+f2fs-compress-fix-inconsistent-update-of-i_blocks-in.patch
+f2fs-fix-to-account-dirty-data-in-__get_secs_require.patch
+perf-probe-fix-libdw-memory-leak.patch
+perf-probe-correct-demangled-symbols-in-c-program.patch
+rust-macros-fix-documentation-of-the-paste-macro.patch
+pci-cpqphp-use-pci_possible_error-to-check-config-re.patch
+pci-cpqphp-fix-pcibios_-return-value-confusion.patch
+perf-ftrace-latency-fix-unit-on-histogram-first-entr.patch
+f2fs-fix-the-wrong-f2fs_bug_on-condition-in-f2fs_do_.patch
+f2fs-check-curseg-inited-before-write_sum_page-in-ch.patch
+f2fs-fix-to-avoid-potential-deadlock-in-f2fs_record_.patch
+f2fs-fix-to-avoid-use-gc_at-when-setting-gc_mode-as-.patch
+pci-add-t_pvperl-macro.patch
+pci-j721e-add-per-platform-maximum-lane-settings.patch
+pci-j721e-add-pcie-4x-lane-selection-support.patch
+pci-cadence-extract-link-setup-sequence-from-cdns_pc.patch
+pci-cadence-set-cdns_pcie_host_init-global.patch
+pci-j721e-add-reset-gpio-to-struct-j721e_pcie.patch
+pci-j721e-use-t_perst_clk_us-macro.patch
+pci-j721e-add-suspend-and-resume-support.patch
+pci-j721e-deassert-perst-after-a-delay-of-pcie_t_pvp.patch
+f2fs-fix-race-in-concurrent-f2fs_stop_gc_thread.patch
+f2fs-fix-to-avoid-forcing-direct-write-to-use-buffer.patch
+perf-trace-avoid-garbage-when-not-printing-a-trace-e.patch
+m68k-mcfgpio-fix-incorrect-register-offset-for-confi.patch
+m68k-coldfire-device.c-only-build-fec-when-hw-macros.patch
+svcrdma-address-an-integer-overflow.patch
+perf-list-fix-topic-and-pmu_name-argument-order.patch
+perf-trace-fix-tracing-itself-creating-feedback-loop.patch
+perf-trace-do-not-lose-last-events-in-a-race.patch
+perf-trace-avoid-garbage-when-not-printing-a-syscall.patch
+remoteproc-qcom-pas-add-minidump_id-to-sm8350-resour.patch
+rpmsg-glink-use-only-lower-16-bits-of-param2-for-cmd.patch
+remoteproc-qcom_q6v5_mss-re-order-writes-to-the-imem.patch
+pci-endpoint-epf-mhi-avoid-null-dereference-if-dt-la.patch
+nfsd-prevent-null-dereference-in-nfsd4_process_cb_up.patch
+nfsd-cap-the-number-of-bytes-copied-by-nfs4_reset_re.patch
+nfsd-release-svc_expkey-svc_export-with-rcu_work.patch
+svcrdma-fix-miss-destroy-percpu_counter-in-svc_rdma_.patch
+nfsd-fix-nfsd4_shutdown_copy.patch
+hwmon-tps23861-fix-reporting-of-negative-temperature.patch
+vdpa-mlx5-fix-suboptimal-range-on-iotlb-iteration.patch
+selftests-mount_setattr-fix-failures-on-64k-page_siz.patch
+gpio-zevio-add-missed-label-initialisation.patch
+vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch
+fs_parser-update-mount_api-doc-to-match-function-sig.patch
+loongarch-fix-build-failure-with-gcc-15-std-gnu23.patch
+loongarch-bpf-sign-extend-return-values.patch
+power-supply-core-remove-might_sleep-from-power_supp.patch
+power-supply-bq27xxx-fix-registers-of-bq27426.patch
+power-supply-rt9471-fix-wrong-wdt-function-regfield-.patch
+power-supply-rt9471-use-ic-status-regfield-to-report.patch
+net-usb-lan78xx-fix-double-free-issue-with-interrupt.patch
+net-usb-lan78xx-fix-memory-leak-on-device-unplug-by-.patch
+tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch
+net-usb-lan78xx-fix-refcounting-and-autosuspend-on-i.patch
+net-microchip-vcap-add-typegroup-table-terminators-i.patch
+s390-iucv-msg_peek-causes-memory-leak-in-iucv_sock_d.patch
+net-ipv6-delete-temporary-address-if-mngtmpaddr-is-r.patch
+net-mdio-ipq4019-add-missing-error-check.patch
+marvell-pxa168_eth-fix-call-balance-of-pep-clk-handl.patch
+net-stmmac-dwmac-socfpga-set-rx-watchdog-interrupt-a.patch
+octeontx2-af-rpm-fix-mismatch-in-lmac-type.patch
+octeontx2-af-rpm-fix-low-network-performance.patch
+octeontx2-pf-reset-mac-stats-during-probe.patch
+octeontx2-af-rpm-fix-stale-rsfec-counters.patch
+octeontx2-af-rpm-fix-stale-fcfec-counters.patch
+octeontx2-af-quiesce-traffic-before-nix-block-reset.patch
+spi-atmel-quadspi-fix-register-name-in-verbose-loggi.patch
+net-hsr-fix-hsr_init_sk-vs-network-transport-headers.patch
+bnxt_en-reserve-rings-after-pcie-aer-recovery-if-nic.patch
+bnxt_en-refactor-bnxt_ptp_init.patch
+bnxt_en-unregister-ptp-during-pci-shutdown-and-suspe.patch
+bluetooth-mgmt-fix-slab-use-after-free-read-in-set_p.patch
+bluetooth-mgmt-fix-possible-deadlocks.patch
+llc-improve-setsockopt-handling-of-malformed-user-in.patch
+rxrpc-improve-setsockopt-handling-of-malformed-user-.patch
+tcp-fix-use-after-free-of-nreq-in-reqsk_timer_handle.patch
+ip6mr-fix-tables-suspicious-rcu-usage.patch
+ipmr-fix-tables-suspicious-rcu-usage.patch
+iio-light-al3010-fix-an-error-handling-path-in-al301.patch
+usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch
+usb-yurex-make-waiting-on-yurex_write-interruptible.patch
+usb-chaoskey-fail-open-after-removal.patch
+usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch
+misc-apds990x-fix-missing-pm_runtime_disable.patch
+counter-stm32-timer-cnt-add-check-for-clk_enable.patch
+counter-ti-ecap-capture-add-check-for-clk_enable.patch
+staging-greybus-uart-fix-atomicity-violation-in-get_.patch
+firmware_loader-fix-possible-resource-leak-in-fw_log.patch
+alsa-hda-realtek-update-alc256-depop-procedure.patch
+drm-radeon-add-helper-rdev_to_drm-rdev.patch
+drm-radeon-change-rdev-ddev-to-rdev_to_drm-rdev.patch
+drm-radeon-fix-spurious-unplug-event-on-radeon-hdmi.patch
+drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch
+apparmor-fix-do-simple-duplicate-message-elimination.patch
+asoc-amd-yc-fix-for-enabling-dmic-on-acp6x-via-_dsd-.patch
+gfs2-don-t-set-glf_lock-in-gfs2_dispose_glock_lru.patch
+gfs2-remove-and-replace-gfs2_glock_queue_work.patch
diff --git a/queue-6.6/smb-cached-directories-can-be-more-than-root-file-ha.patch b/queue-6.6/smb-cached-directories-can-be-more-than-root-file-ha.patch
new file mode 100644
index 00000000000..d24330f8a83
--- /dev/null
+++ b/queue-6.6/smb-cached-directories-can-be-more-than-root-file-ha.patch
@@ -0,0 +1,37 @@
+From 2b1775b7c70707991f4b02f793dfedcfb6574982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 14:29:02 -0800
+Subject: smb: cached directories can be more than root file handle
+
+From: Paul Aurich <paul@darkrain42.org>
+
+[ Upstream commit 128630e1dbec8074c7707aad107299169047e68f ]
+
+Update this log message since cached fids may represent things other
+than the root of a mount.
+
+Fixes: e4029e072673 ("cifs: find and use the dentry for cached non-root directories also")
+Signed-off-by: Paul Aurich <paul@darkrain42.org>
+Reviewed-by: Bharath SM <bharathsm@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cached_dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c
+index 0ff2491c311d8..adcba13352045 100644
+--- a/fs/smb/client/cached_dir.c
++++ b/fs/smb/client/cached_dir.c
+@@ -401,7 +401,7 @@ int open_cached_dir_by_dentry(struct cifs_tcon *tcon,
+ 	spin_lock(&cfids->cfid_list_lock);
+ 	list_for_each_entry(cfid, &cfids->entries, entry) {
+ 		if (dentry && cfid->dentry == dentry) {
+-			cifs_dbg(FYI, "found a cached root file handle by dentry\n");
++			cifs_dbg(FYI, "found a cached file handle by dentry\n");
+ 			kref_get(&cfid->refcount);
+ 			*ret_cfid = cfid;
+ 			spin_unlock(&cfids->cfid_list_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.6/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch b/queue-6.6/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch
new file mode 100644
index 00000000000..e9119d7f896
--- /dev/null
+++ b/queue-6.6/soc-qcom-geni-se-fix-array-underflow-in-geni_se_clk_.patch
@@ -0,0 +1,40 @@
+From 3db0163921918e164d3eaa7ad62d5c2d68d22d57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 10:51:31 +0300
+Subject: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 78261cb08f06c93d362cab5c5034bf5899bc7552 ]
+
+This loop is supposed to break if the frequency returned from
+clk_round_rate() is the same as on the previous iteration.  However,
+that check doesn't make sense on the first iteration through the loop.
+It leads to reading before the start of these->clk_perf_tbl[] array.
+
+Fixes: eddac5af0654 ("soc: qcom: Add GENI based QUP Wrapper driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/8cd12678-f44a-4b16-a579-c8f11175ee8c@stanley.mountain
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom-geni-se.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index ba788762835fa..e339253ccba86 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -586,7 +586,8 @@ int geni_se_clk_tbl_get(struct geni_se *se, unsigned long **tbl)
+ 
+ 	for (i = 0; i < MAX_CLK_PERF_LEVEL; i++) {
+ 		freq = clk_round_rate(se->clk, freq + 1);
+-		if (freq <= 0 || freq == se->clk_perf_tbl[i - 1])
++		if (freq <= 0 ||
++		    (i > 0 && freq == se->clk_perf_tbl[i - 1]))
+ 			break;
+ 		se->clk_perf_tbl[i] = freq;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch b/queue-6.6/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch
new file mode 100644
index 00000000000..095d1931441
--- /dev/null
+++ b/queue-6.6/soc-ti-smartreflex-use-irqf_no_autoen-flag-in-reques.patch
@@ -0,0 +1,45 @@
+From 6603cf39ad4102e4fc5ace322cf2b0616844b57b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 11:41:47 +0800
+Subject: soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 16a0a69244240cfa32c525c021c40f85e090557a ]
+
+If request_irq() fails in sr_late_init(), there is no need to enable
+the irq, and if it succeeds, disable_irq() after request_irq() still has
+a time gap in which interrupts can come.
+
+request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when
+request IRQ.
+
+Fixes: 1279ba5916f6 ("OMAP3+: SR: disable interrupt by default")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://lore.kernel.org/r/20240912034147.3014213-1-ruanjinjie@huawei.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/smartreflex.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/smartreflex.c b/drivers/soc/ti/smartreflex.c
+index 62b2f1464e467..55c48ddcf50da 100644
+--- a/drivers/soc/ti/smartreflex.c
++++ b/drivers/soc/ti/smartreflex.c
+@@ -202,10 +202,10 @@ static int sr_late_init(struct omap_sr *sr_info)
+ 
+ 	if (sr_class->notify && sr_class->notify_flags && sr_info->irq) {
+ 		ret = devm_request_irq(&sr_info->pdev->dev, sr_info->irq,
+-				       sr_interrupt, 0, sr_info->name, sr_info);
++				       sr_interrupt, IRQF_NO_AUTOEN,
++				       sr_info->name, sr_info);
+ 		if (ret)
+ 			goto error;
+-		disable_irq(sr_info->irq);
+ 	}
+ 
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/sock_diag-add-module-pointer-to-struct-sock_diag_han.patch b/queue-6.6/sock_diag-add-module-pointer-to-struct-sock_diag_han.patch
new file mode 100644
index 00000000000..743aa539280
--- /dev/null
+++ b/queue-6.6/sock_diag-add-module-pointer-to-struct-sock_diag_han.patch
@@ -0,0 +1,152 @@
+From 973fcf24b8dbbb2ee04029dacd2ae6a88db61c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:25:59 +0000
+Subject: sock_diag: add module pointer to "struct sock_diag_handler"
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 114b4bb1cc19239b272d52ebbe156053483fe2f8 ]
+
+Following patch is going to use RCU instead of
+sock_diag_table_mutex acquisition.
+
+This patch is a preparation, no change of behavior yet.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: eb02688c5c45 ("ipv6: release nexthop on device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sock_diag.h | 1 +
+ net/ipv4/inet_diag.c      | 2 ++
+ net/netlink/diag.c        | 1 +
+ net/packet/diag.c         | 1 +
+ net/smc/smc_diag.c        | 1 +
+ net/tipc/diag.c           | 1 +
+ net/unix/diag.c           | 1 +
+ net/vmw_vsock/diag.c      | 1 +
+ net/xdp/xsk_diag.c        | 1 +
+ 9 files changed, 10 insertions(+)
+
+diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
+index 0b9ecd8cf9793..7c07754d711b9 100644
+--- a/include/linux/sock_diag.h
++++ b/include/linux/sock_diag.h
+@@ -13,6 +13,7 @@ struct nlmsghdr;
+ struct sock;
+ 
+ struct sock_diag_handler {
++	struct module *owner;
+ 	__u8 family;
+ 	int (*dump)(struct sk_buff *skb, struct nlmsghdr *nlh);
+ 	int (*get_info)(struct sk_buff *skb, struct sock *sk);
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 87ecefea72398..c1ff0e426b677 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -1397,6 +1397,7 @@ int inet_diag_handler_get_info(struct sk_buff *skb, struct sock *sk)
+ }
+ 
+ static const struct sock_diag_handler inet_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_INET,
+ 	.dump = inet_diag_handler_cmd,
+ 	.get_info = inet_diag_handler_get_info,
+@@ -1404,6 +1405,7 @@ static const struct sock_diag_handler inet_diag_handler = {
+ };
+ 
+ static const struct sock_diag_handler inet6_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_INET6,
+ 	.dump = inet_diag_handler_cmd,
+ 	.get_info = inet_diag_handler_get_info,
+diff --git a/net/netlink/diag.c b/net/netlink/diag.c
+index 9c4f231be2757..7b15aa5f7bc20 100644
+--- a/net/netlink/diag.c
++++ b/net/netlink/diag.c
+@@ -241,6 +241,7 @@ static int netlink_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+ }
+ 
+ static const struct sock_diag_handler netlink_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_NETLINK,
+ 	.dump = netlink_diag_handler_dump,
+ };
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index f6b200cb3c066..d4142636aa2b7 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -245,6 +245,7 @@ static int packet_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+ }
+ 
+ static const struct sock_diag_handler packet_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_PACKET,
+ 	.dump = packet_diag_handler_dump,
+ };
+diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
+index 37833b96b508e..d58c699b5328a 100644
+--- a/net/smc/smc_diag.c
++++ b/net/smc/smc_diag.c
+@@ -250,6 +250,7 @@ static int smc_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+ }
+ 
+ static const struct sock_diag_handler smc_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_SMC,
+ 	.dump = smc_diag_handler_dump,
+ };
+diff --git a/net/tipc/diag.c b/net/tipc/diag.c
+index 73137f4aeb68f..11da9d2ebbf69 100644
+--- a/net/tipc/diag.c
++++ b/net/tipc/diag.c
+@@ -95,6 +95,7 @@ static int tipc_sock_diag_handler_dump(struct sk_buff *skb,
+ }
+ 
+ static const struct sock_diag_handler tipc_sock_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_TIPC,
+ 	.dump = tipc_sock_diag_handler_dump,
+ };
+diff --git a/net/unix/diag.c b/net/unix/diag.c
+index 1de7500b41b61..a6bd861314df0 100644
+--- a/net/unix/diag.c
++++ b/net/unix/diag.c
+@@ -322,6 +322,7 @@ static int unix_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+ }
+ 
+ static const struct sock_diag_handler unix_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_UNIX,
+ 	.dump = unix_diag_handler_dump,
+ };
+diff --git a/net/vmw_vsock/diag.c b/net/vmw_vsock/diag.c
+index a2823b1c5e28b..6efa9eb93336f 100644
+--- a/net/vmw_vsock/diag.c
++++ b/net/vmw_vsock/diag.c
+@@ -157,6 +157,7 @@ static int vsock_diag_handler_dump(struct sk_buff *skb, struct nlmsghdr *h)
+ }
+ 
+ static const struct sock_diag_handler vsock_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_VSOCK,
+ 	.dump = vsock_diag_handler_dump,
+ };
+diff --git a/net/xdp/xsk_diag.c b/net/xdp/xsk_diag.c
+index 22b36c8143cfd..e1012bfec7207 100644
+--- a/net/xdp/xsk_diag.c
++++ b/net/xdp/xsk_diag.c
+@@ -194,6 +194,7 @@ static int xsk_diag_handler_dump(struct sk_buff *nlskb, struct nlmsghdr *hdr)
+ }
+ 
+ static const struct sock_diag_handler xsk_diag_handler = {
++	.owner = THIS_MODULE,
+ 	.family = AF_XDP,
+ 	.dump = xsk_diag_handler_dump,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.6/sock_diag-allow-concurrent-operation-in-sock_diag_rc.patch b/queue-6.6/sock_diag-allow-concurrent-operation-in-sock_diag_rc.patch
new file mode 100644
index 00000000000..8db44a569ba
--- /dev/null
+++ b/queue-6.6/sock_diag-allow-concurrent-operation-in-sock_diag_rc.patch
@@ -0,0 +1,168 @@
+From d1460bf5e44692b86beccc02605690e1bdd3fbcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:26:01 +0000
+Subject: sock_diag: allow concurrent operation in sock_diag_rcv_msg()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 86e8921df05c6e9423ab74ab8d41022775d8b83a ]
+
+TCPDIAG_GETSOCK and DCCPDIAG_GETSOCK diag are serialized
+on sock_diag_table_mutex.
+
+This is to make sure inet_diag module is not unloaded
+while diag was ongoing.
+
+It is time to get rid of this mutex and use RCU protection,
+allowing full parallelism.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: eb02688c5c45 ("ipv6: release nexthop on device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sock_diag.h |  9 ++++++--
+ net/core/sock_diag.c      | 43 +++++++++++++++++++++++----------------
+ net/ipv4/inet_diag.c      |  9 ++++++--
+ 3 files changed, 40 insertions(+), 21 deletions(-)
+
+diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
+index 7c07754d711b9..110978dc9af1b 100644
+--- a/include/linux/sock_diag.h
++++ b/include/linux/sock_diag.h
+@@ -23,8 +23,13 @@ struct sock_diag_handler {
+ int sock_diag_register(const struct sock_diag_handler *h);
+ void sock_diag_unregister(const struct sock_diag_handler *h);
+ 
+-void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
+-void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh));
++struct sock_diag_inet_compat {
++	struct module *owner;
++	int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh);
++};
++
++void sock_diag_register_inet_compat(const struct sock_diag_inet_compat *ptr);
++void sock_diag_unregister_inet_compat(const struct sock_diag_inet_compat *ptr);
+ 
+ u64 __sock_gen_cookie(struct sock *sk);
+ 
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index 72009e1f4380d..5c3666431df49 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -17,8 +17,9 @@
+ #include <linux/sock_diag.h>
+ 
+ static const struct sock_diag_handler __rcu *sock_diag_handlers[AF_MAX];
+-static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
+-static DEFINE_MUTEX(sock_diag_table_mutex);
++
++static struct sock_diag_inet_compat __rcu *inet_rcv_compat;
++
+ static struct workqueue_struct *broadcast_wq;
+ 
+ DEFINE_COOKIE(sock_cookie);
+@@ -184,19 +185,20 @@ void sock_diag_broadcast_destroy(struct sock *sk)
+ 	queue_work(broadcast_wq, &bsk->work);
+ }
+ 
+-void sock_diag_register_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh))
++void sock_diag_register_inet_compat(const struct sock_diag_inet_compat *ptr)
+ {
+-	mutex_lock(&sock_diag_table_mutex);
+-	inet_rcv_compat = fn;
+-	mutex_unlock(&sock_diag_table_mutex);
++	xchg((__force const struct sock_diag_inet_compat **)&inet_rcv_compat,
++	     ptr);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_register_inet_compat);
+ 
+-void sock_diag_unregister_inet_compat(int (*fn)(struct sk_buff *skb, struct nlmsghdr *nlh))
++void sock_diag_unregister_inet_compat(const struct sock_diag_inet_compat *ptr)
+ {
+-	mutex_lock(&sock_diag_table_mutex);
+-	inet_rcv_compat = NULL;
+-	mutex_unlock(&sock_diag_table_mutex);
++	const struct sock_diag_inet_compat *old;
++
++	old = xchg((__force const struct sock_diag_inet_compat **)&inet_rcv_compat,
++		   NULL);
++	WARN_ON_ONCE(old != ptr);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat);
+ 
+@@ -259,20 +261,27 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
+ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 			     struct netlink_ext_ack *extack)
+ {
++	const struct sock_diag_inet_compat *ptr;
+ 	int ret;
+ 
+ 	switch (nlh->nlmsg_type) {
+ 	case TCPDIAG_GETSOCK:
+ 	case DCCPDIAG_GETSOCK:
+-		if (inet_rcv_compat == NULL)
++
++		if (!rcu_access_pointer(inet_rcv_compat))
+ 			sock_load_diag_module(AF_INET, 0);
+ 
+-		mutex_lock(&sock_diag_table_mutex);
+-		if (inet_rcv_compat != NULL)
+-			ret = inet_rcv_compat(skb, nlh);
+-		else
+-			ret = -EOPNOTSUPP;
+-		mutex_unlock(&sock_diag_table_mutex);
++		rcu_read_lock();
++		ptr = rcu_dereference(inet_rcv_compat);
++		if (ptr && !try_module_get(ptr->owner))
++			ptr = NULL;
++		rcu_read_unlock();
++
++		ret = -EOPNOTSUPP;
++		if (ptr) {
++			ret = ptr->fn(skb, nlh);
++			module_put(ptr->owner);
++		}
+ 
+ 		return ret;
+ 	case SOCK_DIAG_BY_FAMILY:
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index c1ff0e426b677..5d09ab3ed735e 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -1445,6 +1445,11 @@ void inet_diag_unregister(const struct inet_diag_handler *h)
+ }
+ EXPORT_SYMBOL_GPL(inet_diag_unregister);
+ 
++static const struct sock_diag_inet_compat inet_diag_compat = {
++	.owner	= THIS_MODULE,
++	.fn	= inet_diag_rcv_msg_compat,
++};
++
+ static int __init inet_diag_init(void)
+ {
+ 	const int inet_diag_table_size = (IPPROTO_MAX *
+@@ -1463,7 +1468,7 @@ static int __init inet_diag_init(void)
+ 	if (err)
+ 		goto out_free_inet;
+ 
+-	sock_diag_register_inet_compat(inet_diag_rcv_msg_compat);
++	sock_diag_register_inet_compat(&inet_diag_compat);
+ out:
+ 	return err;
+ 
+@@ -1478,7 +1483,7 @@ static void __exit inet_diag_exit(void)
+ {
+ 	sock_diag_unregister(&inet6_diag_handler);
+ 	sock_diag_unregister(&inet_diag_handler);
+-	sock_diag_unregister_inet_compat(inet_diag_rcv_msg_compat);
++	sock_diag_unregister_inet_compat(&inet_diag_compat);
+ 	kfree(inet_diag_table);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/sock_diag-allow-concurrent-operations.patch b/queue-6.6/sock_diag-allow-concurrent-operations.patch
new file mode 100644
index 00000000000..f7bb7f173d8
--- /dev/null
+++ b/queue-6.6/sock_diag-allow-concurrent-operations.patch
@@ -0,0 +1,174 @@
+From 57e62af51e767c06fde40f87252c0c4b9576e6c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:26:00 +0000
+Subject: sock_diag: allow concurrent operations
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 1d55a6974756cf3979efd2cc68bcece611a44053 ]
+
+sock_diag_broadcast_destroy_work() and __sock_diag_cmd()
+are currently using sock_diag_table_mutex to protect
+against concurrent sock_diag_handlers[] changes.
+
+This makes inet_diag dump serialized, thus less scalable
+than legacy /proc files.
+
+It is time to switch to full RCU protection.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: eb02688c5c45 ("ipv6: release nexthop on device removal")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_diag.c | 73 +++++++++++++++++++++++++-------------------
+ 1 file changed, 42 insertions(+), 31 deletions(-)
+
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index c53b731f2d672..72009e1f4380d 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -16,7 +16,7 @@
+ #include <linux/inet_diag.h>
+ #include <linux/sock_diag.h>
+ 
+-static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
++static const struct sock_diag_handler __rcu *sock_diag_handlers[AF_MAX];
+ static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
+ static DEFINE_MUTEX(sock_diag_table_mutex);
+ static struct workqueue_struct *broadcast_wq;
+@@ -122,6 +122,24 @@ static size_t sock_diag_nlmsg_size(void)
+ 	       + nla_total_size_64bit(sizeof(struct tcp_info))); /* INET_DIAG_INFO */
+ }
+ 
++static const struct sock_diag_handler *sock_diag_lock_handler(int family)
++{
++	const struct sock_diag_handler *handler;
++
++	rcu_read_lock();
++	handler = rcu_dereference(sock_diag_handlers[family]);
++	if (handler && !try_module_get(handler->owner))
++		handler = NULL;
++	rcu_read_unlock();
++
++	return handler;
++}
++
++static void sock_diag_unlock_handler(const struct sock_diag_handler *handler)
++{
++	module_put(handler->owner);
++}
++
+ static void sock_diag_broadcast_destroy_work(struct work_struct *work)
+ {
+ 	struct broadcast_sk *bsk =
+@@ -138,12 +156,12 @@ static void sock_diag_broadcast_destroy_work(struct work_struct *work)
+ 	if (!skb)
+ 		goto out;
+ 
+-	mutex_lock(&sock_diag_table_mutex);
+-	hndl = sock_diag_handlers[sk->sk_family];
+-	if (hndl && hndl->get_info)
+-		err = hndl->get_info(skb, sk);
+-	mutex_unlock(&sock_diag_table_mutex);
+-
++	hndl = sock_diag_lock_handler(sk->sk_family);
++	if (hndl) {
++		if (hndl->get_info)
++			err = hndl->get_info(skb, sk);
++		sock_diag_unlock_handler(hndl);
++	}
+ 	if (!err)
+ 		nlmsg_multicast(sock_net(sk)->diag_nlsk, skb, 0, group,
+ 				GFP_KERNEL);
+@@ -184,33 +202,26 @@ EXPORT_SYMBOL_GPL(sock_diag_unregister_inet_compat);
+ 
+ int sock_diag_register(const struct sock_diag_handler *hndl)
+ {
+-	int err = 0;
++	int family = hndl->family;
+ 
+-	if (hndl->family >= AF_MAX)
++	if (family >= AF_MAX)
+ 		return -EINVAL;
+ 
+-	mutex_lock(&sock_diag_table_mutex);
+-	if (sock_diag_handlers[hndl->family])
+-		err = -EBUSY;
+-	else
+-		WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
+-	mutex_unlock(&sock_diag_table_mutex);
+-
+-	return err;
++	return !cmpxchg((const struct sock_diag_handler **)
++				&sock_diag_handlers[family],
++			NULL, hndl) ? 0 : -EBUSY;
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_register);
+ 
+-void sock_diag_unregister(const struct sock_diag_handler *hnld)
++void sock_diag_unregister(const struct sock_diag_handler *hndl)
+ {
+-	int family = hnld->family;
++	int family = hndl->family;
+ 
+ 	if (family >= AF_MAX)
+ 		return;
+ 
+-	mutex_lock(&sock_diag_table_mutex);
+-	BUG_ON(sock_diag_handlers[family] != hnld);
+-	WRITE_ONCE(sock_diag_handlers[family], NULL);
+-	mutex_unlock(&sock_diag_table_mutex);
++	xchg((const struct sock_diag_handler **)&sock_diag_handlers[family],
++	     NULL);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_unregister);
+ 
+@@ -227,20 +238,20 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		return -EINVAL;
+ 	req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
+ 
+-	if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
++	if (!rcu_access_pointer(sock_diag_handlers[req->sdiag_family]))
+ 		sock_load_diag_module(req->sdiag_family, 0);
+ 
+-	mutex_lock(&sock_diag_table_mutex);
+-	hndl = sock_diag_handlers[req->sdiag_family];
++	hndl = sock_diag_lock_handler(req->sdiag_family);
+ 	if (hndl == NULL)
+-		err = -ENOENT;
+-	else if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY)
++		return -ENOENT;
++
++	if (nlh->nlmsg_type == SOCK_DIAG_BY_FAMILY)
+ 		err = hndl->dump(skb, nlh);
+ 	else if (nlh->nlmsg_type == SOCK_DESTROY && hndl->destroy)
+ 		err = hndl->destroy(skb, nlh);
+ 	else
+ 		err = -EOPNOTSUPP;
+-	mutex_unlock(&sock_diag_table_mutex);
++	sock_diag_unlock_handler(hndl);
+ 
+ 	return err;
+ }
+@@ -286,12 +297,12 @@ static int sock_diag_bind(struct net *net, int group)
+ 	switch (group) {
+ 	case SKNLGRP_INET_TCP_DESTROY:
+ 	case SKNLGRP_INET_UDP_DESTROY:
+-		if (!READ_ONCE(sock_diag_handlers[AF_INET]))
++		if (!rcu_access_pointer(sock_diag_handlers[AF_INET]))
+ 			sock_load_diag_module(AF_INET, 0);
+ 		break;
+ 	case SKNLGRP_INET6_TCP_DESTROY:
+ 	case SKNLGRP_INET6_UDP_DESTROY:
+-		if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
++		if (!rcu_access_pointer(sock_diag_handlers[AF_INET6]))
+ 			sock_load_diag_module(AF_INET6, 0);
+ 		break;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/spi-atmel-quadspi-fix-register-name-in-verbose-loggi.patch b/queue-6.6/spi-atmel-quadspi-fix-register-name-in-verbose-loggi.patch
new file mode 100644
index 00000000000..e5ac5360a32
--- /dev/null
+++ b/queue-6.6/spi-atmel-quadspi-fix-register-name-in-verbose-loggi.patch
@@ -0,0 +1,43 @@
+From 5524ee20da06fb2048a3dbdecb31d49461e44389 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2024 15:13:02 +0100
+Subject: spi: atmel-quadspi: Fix register name in verbose logging function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Csókás, Bence <csokas.bence@prolan.hu>
+
+[ Upstream commit 2ac40e6d0ccdd93031f8b1af61b0fe5cdd704923 ]
+
+`atmel_qspi_reg_name()` is used for pretty-printing register offsets
+for verbose logging of register accesses. However, due to a typo
+(likely a copy-paste error), QSPI_RD's offset prints as "MR", the
+name of the previous register. Fix this typo.
+
+Fixes: c528ecfbef04 ("spi: atmel-quadspi: Add verbose debug facilities to monitor register accesses")
+Signed-off-by: Csókás, Bence <csokas.bence@prolan.hu>
+Reviewed-by: Alexander Dahl <ada@thorsis.com>
+Link: https://patch.msgid.link/20241122141302.2599636-1-csokas.bence@prolan.hu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/atmel-quadspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c
+index 6f9e9d8716775..e7ae7cb4b92a8 100644
+--- a/drivers/spi/atmel-quadspi.c
++++ b/drivers/spi/atmel-quadspi.c
+@@ -183,7 +183,7 @@ static const char *atmel_qspi_reg_name(u32 offset, char *tmp, size_t sz)
+ 	case QSPI_MR:
+ 		return "MR";
+ 	case QSPI_RD:
+-		return "MR";
++		return "RD";
+ 	case QSPI_TD:
+ 		return "TD";
+ 	case QSPI_SR:
+-- 
+2.43.0
+
diff --git a/queue-6.6/spi-spi-fsl-lpspi-use-irqf_no_autoen-flag-in-request.patch b/queue-6.6/spi-spi-fsl-lpspi-use-irqf_no_autoen-flag-in-request.patch
new file mode 100644
index 00000000000..a9c3449c598
--- /dev/null
+++ b/queue-6.6/spi-spi-fsl-lpspi-use-irqf_no_autoen-flag-in-request.patch
@@ -0,0 +1,56 @@
+From 53606796d1cdf233ace0eeff753af44a3633ad7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 10:28:28 +0800
+Subject: spi: spi-fsl-lpspi: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 003c7e01916c5e2af95add9b0cbda2e6163873e8 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 9728fb3ce117 ("spi: lpspi: disable lpspi module irq in DMA mode")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20240906022828.891812-1-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 13313f07839b6..514a2c5c84226 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -891,7 +891,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = devm_request_irq(&pdev->dev, irq, fsl_lpspi_isr, 0,
++	ret = devm_request_irq(&pdev->dev, irq, fsl_lpspi_isr, IRQF_NO_AUTOEN,
+ 			       dev_name(&pdev->dev), fsl_lpspi);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "can't get irq%d: %d\n", irq, ret);
+@@ -948,14 +948,10 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ 	ret = fsl_lpspi_dma_init(&pdev->dev, fsl_lpspi, controller);
+ 	if (ret == -EPROBE_DEFER)
+ 		goto out_pm_get;
+-	if (ret < 0)
++	if (ret < 0) {
+ 		dev_warn(&pdev->dev, "dma setup error %d, use pio\n", ret);
+-	else
+-		/*
+-		 * disable LPSPI module IRQ when enable DMA mode successfully,
+-		 * to prevent the unexpected LPSPI module IRQ events.
+-		 */
+-		disable_irq(irq);
++		enable_irq(irq);
++	}
+ 
+ 	ret = devm_spi_register_controller(&pdev->dev, controller);
+ 	if (ret < 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.6/spi-tegra210-quad-avoid-shift-out-of-bounds.patch b/queue-6.6/spi-tegra210-quad-avoid-shift-out-of-bounds.patch
new file mode 100644
index 00000000000..796ffbe6e19
--- /dev/null
+++ b/queue-6.6/spi-tegra210-quad-avoid-shift-out-of-bounds.patch
@@ -0,0 +1,49 @@
+From b4b02e0c3dce885caffc6d11a2b0c9c711698004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 05:53:59 -0700
+Subject: spi: tegra210-quad: Avoid shift-out-of-bounds
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit f399051ec1ff02e74ae5c2517aed2cc486fd005b ]
+
+A shift-out-of-bounds issue was identified by UBSAN in the
+tegra_qspi_fill_tx_fifo_from_client_txbuf() function.
+
+	 UBSAN: shift-out-of-bounds in drivers/spi/spi-tegra210-quad.c:345:27
+	 shift exponent 32 is too large for 32-bit type 'u32' (aka 'unsigned int')
+	 Call trace:
+	  tegra_qspi_start_cpu_based_transfer
+
+The problem arises when shifting the contents of tx_buf left by 8 times
+the value of i, which can exceed 4 and result in an exponent larger than
+32 bits.
+
+Resolve this by restrict the value of i to be less than 4, preventing
+the shift operation from overflowing.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Fixes: 921fc1838fb0 ("spi: tegra210-quad: Add support for Tegra210 QSPI controller")
+Link: https://patch.msgid.link/20241004125400.1791089-1-leitao@debian.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra210-quad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-tegra210-quad.c b/drivers/spi/spi-tegra210-quad.c
+index e9ad9b0b598b5..d1afa4140e8a2 100644
+--- a/drivers/spi/spi-tegra210-quad.c
++++ b/drivers/spi/spi-tegra210-quad.c
+@@ -341,7 +341,7 @@ tegra_qspi_fill_tx_fifo_from_client_txbuf(struct tegra_qspi *tqspi, struct spi_t
+ 		for (count = 0; count < max_n_32bit; count++) {
+ 			u32 x = 0;
+ 
+-			for (i = 0; len && (i < bytes_per_word); i++, len--)
++			for (i = 0; len && (i < min(4, bytes_per_word)); i++, len--)
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tegra_qspi_writel(tqspi, x, QSPI_TX_FIFO);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.6/spi-zynqmp-gqspi-undo-runtime-pm-changes-at-driver-e.patch b/queue-6.6/spi-zynqmp-gqspi-undo-runtime-pm-changes-at-driver-e.patch
new file mode 100644
index 00000000000..2b863e0e0b6
--- /dev/null
+++ b/queue-6.6/spi-zynqmp-gqspi-undo-runtime-pm-changes-at-driver-e.patch
@@ -0,0 +1,51 @@
+From de0e59035a1dd40eaf656bbb16f929e8c2c2a1a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2024 17:11:35 +0800
+Subject: =?UTF-8?q?spi:=20zynqmp-gqspi:=20Undo=20runtime=20PM=20changes=20?=
+ =?UTF-8?q?at=20driver=20exit=20time=E2=80=8B?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 2219576883e709737f3100aa9ded84976be49bd7 ]
+
+It's important to undo pm_runtime_use_autosuspend() with
+pm_runtime_dont_use_autosuspend() at driver exit time.
+
+So, call pm_runtime_dont_use_autosuspend() at driver exit time
+to fix it.
+
+Fixes: 9e3a000362ae ("spi: zynqmp: Add pm runtime support")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20240920091135.2741574-1-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 9a46b2478f4e9..3503e6c0a5c98 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -1341,6 +1341,7 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
+ 
+ clk_dis_all:
+ 	pm_runtime_disable(&pdev->dev);
++	pm_runtime_dont_use_autosuspend(&pdev->dev);
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 	pm_runtime_set_suspended(&pdev->dev);
+ 	clk_disable_unprepare(xqspi->refclk);
+@@ -1371,6 +1372,7 @@ static void zynqmp_qspi_remove(struct platform_device *pdev)
+ 	zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0);
+ 
+ 	pm_runtime_disable(&pdev->dev);
++	pm_runtime_dont_use_autosuspend(&pdev->dev);
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 	pm_runtime_set_suspended(&pdev->dev);
+ 	clk_disable_unprepare(xqspi->refclk);
+-- 
+2.43.0
+
diff --git a/queue-6.6/staging-greybus-uart-fix-atomicity-violation-in-get_.patch b/queue-6.6/staging-greybus-uart-fix-atomicity-violation-in-get_.patch
new file mode 100644
index 00000000000..96a2100d52d
--- /dev/null
+++ b/queue-6.6/staging-greybus-uart-fix-atomicity-violation-in-get_.patch
@@ -0,0 +1,49 @@
+From d4311c0085500a28ff42adaf0d7776c9d938a021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 19:33:37 +0800
+Subject: staging: greybus: uart: Fix atomicity violation in get_serial_info()
+
+From: Qiu-ji Chen <chenqiuji666@gmail.com>
+
+[ Upstream commit fe0ebeafc3b723b2f8edf27ecec6d353b08397df ]
+
+Our static checker found a bug where set_serial_info() uses a mutex, but
+get_serial_info() does not. Fortunately, the impact of this is relatively
+minor. It doesn't cause a crash or any other serious issues. However, if a
+race condition occurs between set_serial_info() and get_serial_info(),
+there is a chance that the data returned by get_serial_info() will be
+meaningless.
+
+Signed-off-by: Qiu-ji Chen <chenqiuji666@gmail.com>
+Fixes: 0aad5ad563c8 ("greybus/uart: switch to ->[sg]et_serial()")
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Alex Elder <elder@riscstar.com>
+Link: https://lore.kernel.org/r/20241107113337.402042-1-chenqiuji666@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/uart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
+index 999ce613dca81..a8b794616ec5b 100644
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -596,11 +596,13 @@ static int get_serial_info(struct tty_struct *tty,
+ 	struct gb_tty *gb_tty = tty->driver_data;
+ 
+ 	ss->line = gb_tty->minor;
++	mutex_lock(&gb_tty->port.mutex);
+ 	ss->close_delay = jiffies_to_msecs(gb_tty->port.close_delay) / 10;
+ 	ss->closing_wait =
+ 		gb_tty->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
+ 		ASYNC_CLOSING_WAIT_NONE :
+ 		jiffies_to_msecs(gb_tty->port.closing_wait) / 10;
++	mutex_unlock(&gb_tty->port.mutex);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/svcrdma-address-an-integer-overflow.patch b/queue-6.6/svcrdma-address-an-integer-overflow.patch
new file mode 100644
index 00000000000..9eebfc1e6de
--- /dev/null
+++ b/queue-6.6/svcrdma-address-an-integer-overflow.patch
@@ -0,0 +1,68 @@
+From bb28001b5cffc88bca47cc5497aed8a18513ecf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2024 12:15:29 -0400
+Subject: svcrdma: Address an integer overflow
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 3c63d8946e578663b868cb9912dac616ea68bfd0 ]
+
+Dan Carpenter reports:
+> Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data
+> structure") from Jun 22, 2020 (linux-next), leads to the following
+> Smatch static checker warning:
+>
+>	net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
+>	warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
+>
+> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+>     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
+>     489 {
+>     490         u32 segcount;
+>     491         __be32 *p;
+>     492
+>     493         if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
+>                                                               ^^^^^^^^
+>
+>     494                 return false;
+>     495
+>     496         /* A bogus segcount causes this buffer overflow check to fail. */
+>     497         p = xdr_inline_decode(&rctxt->rc_stream,
+> --> 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));
+>
+>
+> segcount is an untrusted u32.  On 32bit systems anything >= SIZE_MAX / 16 will
+> have an integer overflow and some those values will be accepted by
+> xdr_inline_decode().
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+index 3b05f90a3e50d..9cec7bcb8a976 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -478,7 +478,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
+ 	if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
+ 		return false;
+ 
+-	/* A bogus segcount causes this buffer overflow check to fail. */
++	/* Before trusting the segcount value enough to use it in
++	 * a computation, perform a simple range check. This is an
++	 * arbitrary but sensible limit (ie, not architectural).
++	 */
++	if (unlikely(segcount > RPCSVC_MAXPAGES))
++		return false;
++
+ 	p = xdr_inline_decode(&rctxt->rc_stream,
+ 			      segcount * rpcrdma_segment_maxsz * sizeof(*p));
+ 	return p != NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.6/svcrdma-fix-miss-destroy-percpu_counter-in-svc_rdma_.patch b/queue-6.6/svcrdma-fix-miss-destroy-percpu_counter-in-svc_rdma_.patch
new file mode 100644
index 00000000000..db0361fdb8b
--- /dev/null
+++ b/queue-6.6/svcrdma-fix-miss-destroy-percpu_counter-in-svc_rdma_.patch
@@ -0,0 +1,100 @@
+From f39f9217a19c8d79309e9ae4843bc2c2bb4f2683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 09:55:20 +0800
+Subject: svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit ce89e742a4c12b20f09a43fec1b21db33f2166cd ]
+
+There's issue as follows:
+RPC: Registered rdma transport module.
+RPC: Registered rdma backchannel transport module.
+RPC: Unregistered rdma transport module.
+RPC: Unregistered rdma backchannel transport module.
+BUG: unable to handle page fault for address: fffffbfff80c609a
+PGD 123fee067 P4D 123fee067 PUD 123fea067 PMD 10c624067 PTE 0
+Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
+RIP: 0010:percpu_counter_destroy_many+0xf7/0x2a0
+Call Trace:
+ <TASK>
+ __die+0x1f/0x70
+ page_fault_oops+0x2cd/0x860
+ spurious_kernel_fault+0x36/0x450
+ do_kern_addr_fault+0xca/0x100
+ exc_page_fault+0x128/0x150
+ asm_exc_page_fault+0x26/0x30
+ percpu_counter_destroy_many+0xf7/0x2a0
+ mmdrop+0x209/0x350
+ finish_task_switch.isra.0+0x481/0x840
+ schedule_tail+0xe/0xd0
+ ret_from_fork+0x23/0x80
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+If register_sysctl() return NULL, then svc_rdma_proc_cleanup() will not
+destroy the percpu counters which init in svc_rdma_proc_init().
+If CONFIG_HOTPLUG_CPU is enabled, residual nodes may be in the
+'percpu_counters' list. The above issue may occur once the module is
+removed. If the CONFIG_HOTPLUG_CPU configuration is not enabled, memory
+leakage occurs.
+To solve above issue just destroy all percpu counters when
+register_sysctl() return NULL.
+
+Fixes: 1e7e55731628 ("svcrdma: Restore read and write stats")
+Fixes: 22df5a22462e ("svcrdma: Convert rdma_stat_sq_starve to a per-CPU counter")
+Fixes: df971cd853c0 ("svcrdma: Convert rdma_stat_recv to a per-CPU counter")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
+index f0d5eeed4c886..e1d4e426b21fa 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma.c
++++ b/net/sunrpc/xprtrdma/svc_rdma.c
+@@ -234,25 +234,34 @@ static int svc_rdma_proc_init(void)
+ 
+ 	rc = percpu_counter_init(&svcrdma_stat_read, 0, GFP_KERNEL);
+ 	if (rc)
+-		goto out_err;
++		goto err;
+ 	rc = percpu_counter_init(&svcrdma_stat_recv, 0, GFP_KERNEL);
+ 	if (rc)
+-		goto out_err;
++		goto err_read;
+ 	rc = percpu_counter_init(&svcrdma_stat_sq_starve, 0, GFP_KERNEL);
+ 	if (rc)
+-		goto out_err;
++		goto err_recv;
+ 	rc = percpu_counter_init(&svcrdma_stat_write, 0, GFP_KERNEL);
+ 	if (rc)
+-		goto out_err;
++		goto err_sq;
+ 
+ 	svcrdma_table_header = register_sysctl("sunrpc/svc_rdma",
+ 					       svcrdma_parm_table);
++	if (!svcrdma_table_header)
++		goto err_write;
++
+ 	return 0;
+ 
+-out_err:
++err_write:
++	rc = -ENOMEM;
++	percpu_counter_destroy(&svcrdma_stat_write);
++err_sq:
+ 	percpu_counter_destroy(&svcrdma_stat_sq_starve);
++err_recv:
+ 	percpu_counter_destroy(&svcrdma_stat_recv);
++err_read:
+ 	percpu_counter_destroy(&svcrdma_stat_read);
++err:
+ 	return rc;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/tcp-fix-use-after-free-of-nreq-in-reqsk_timer_handle.patch b/queue-6.6/tcp-fix-use-after-free-of-nreq-in-reqsk_timer_handle.patch
new file mode 100644
index 00000000000..b02edf31ec3
--- /dev/null
+++ b/queue-6.6/tcp-fix-use-after-free-of-nreq-in-reqsk_timer_handle.patch
@@ -0,0 +1,49 @@
+From 8af8bcae4f7a1090ca32d83e0f2d6178b6dfc983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2024 09:42:36 -0800
+Subject: tcp: Fix use-after-free of nreq in reqsk_timer_handler().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit c31e72d021db2714df03df6c42855a1db592716c ]
+
+The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with
+__inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler().
+
+Then, oreq should be passed to reqsk_put() instead of req; otherwise
+use-after-free of nreq could happen when reqsk is migrated but the
+retry attempt failed (e.g. due to timeout).
+
+Let's pass oreq to reqsk_put().
+
+Fixes: e8c526f2bdf1 ("tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().")
+Reported-by: Liu Jian <liujian56@huawei.com>
+Closes: https://lore.kernel.org/netdev/1284490f-9525-42ee-b7b8-ccadf6606f6d@huawei.com/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20241123174236.62438-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index ca8cc0988b618..bd032ac2376ed 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -1124,7 +1124,7 @@ static void reqsk_timer_handler(struct timer_list *t)
+ 
+ drop:
+ 	__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);
+-	reqsk_put(req);
++	reqsk_put(oreq);
+ }
+ 
+ static bool reqsk_queue_hash_req(struct request_sock *req,
+-- 
+2.43.0
+
diff --git a/queue-6.6/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch b/queue-6.6/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch
new file mode 100644
index 00000000000..d0e348f3b6c
--- /dev/null
+++ b/queue-6.6/tg3-set-coherent-dma-mask-bits-to-31-for-bcm57766-ch.patch
@@ -0,0 +1,61 @@
+From 8efd47216e30ebedc99bba15d7cfc8a97d81352f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 21:57:41 -0800
+Subject: tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+[ Upstream commit 614f4d166eeeb9bd709b0ad29552f691c0f45776 ]
+
+The hardware on Broadcom 1G chipsets have a known limitation
+where they cannot handle DMA addresses that cross over 4GB.
+When such an address is encountered, the hardware sets the
+address overflow error bit in the DMA status register and
+triggers a reset.
+
+However, BCM57766 hardware is setting the overflow bit and
+triggering a reset in some cases when there is no actual
+underlying address overflow. The hardware team analyzed the
+issue and concluded that it is happening when the status
+block update has an address with higher (b16 to b31) bits
+as 0xffff following a previous update that had lowest bits
+as 0xffff.
+
+To work around this bug in the BCM57766 hardware, set the
+coherent dma mask from the current 64b to 31b. This will
+ensure that upper bits of the status block DMA address are
+always at most 0x7fff, thus avoiding the improper overflow
+check described above. This work around is intended for only
+status block and ring memories and has no effect on TX and
+RX buffers as they do not require coherent memory.
+
+Fixes: 72f2afb8a685 ("[TG3]: Add DMA address workaround")
+Reported-by: Salam Noureddine <noureddine@arista.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Link: https://patch.msgid.link/20241119055741.147144-1-pavan.chebbi@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index f1c8ff5b63acd..7f74e5e106d9d 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17731,6 +17731,9 @@ static int tg3_init_one(struct pci_dev *pdev,
+ 	} else
+ 		persist_dma_mask = dma_mask = DMA_BIT_MASK(64);
+ 
++	if (tg3_asic_rev(tp) == ASIC_REV_57766)
++		persist_dma_mask = DMA_BIT_MASK(31);
++
+ 	/* Configure DMA attributes. */
+ 	if (dma_mask > DMA_BIT_MASK(32)) {
+ 		err = dma_set_mask(&pdev->dev, dma_mask);
+-- 
+2.43.0
+
diff --git a/queue-6.6/thermal-core-initialize-thermal-zones-before-registe.patch b/queue-6.6/thermal-core-initialize-thermal-zones-before-registe.patch
new file mode 100644
index 00000000000..27904f32f91
--- /dev/null
+++ b/queue-6.6/thermal-core-initialize-thermal-zones-before-registe.patch
@@ -0,0 +1,46 @@
+From 8d9fdbca166089c889159b3930b62aaef571798f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 21:05:49 +0200
+Subject: thermal: core: Initialize thermal zones before registering them
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 662f920f7e390db5d1a6792a2b0ffa59b6c962fc ]
+
+Since user space can start interacting with a new thermal zone as soon
+as device_register() called by thermal_zone_device_register_with_trips()
+returns, it is better to initialize the thermal zone before calling
+device_register() on it.
+
+Fixes: d0df264fbd3c ("thermal/core: Remove pointless thermal_zone_device_reset() function")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://patch.msgid.link/3336146.44csPzL39Z@rjwysocki.net
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index d7ac7eef680e1..dad909547179f 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1336,6 +1336,7 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t
+ 		thermal_zone_destroy_device_groups(tz);
+ 		goto remove_id;
+ 	}
++	thermal_zone_device_init(tz);
+ 	result = device_register(&tz->device);
+ 	if (result)
+ 		goto release_device;
+@@ -1381,7 +1382,6 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t
+ 
+ 	INIT_DELAYED_WORK(&tz->poll_queue, thermal_zone_device_check);
+ 
+-	thermal_zone_device_init(tz);
+ 	/* Update the new thermal zone and mark it as already updated. */
+ 	if (atomic_cmpxchg(&tz->need_update, 1, 0))
+ 		thermal_zone_device_update(tz, THERMAL_EVENT_UNSPECIFIED);
+-- 
+2.43.0
+
diff --git a/queue-6.6/thermal-lib-fix-memory-leak-on-error-in-thermal_genl.patch b/queue-6.6/thermal-lib-fix-memory-leak-on-error-in-thermal_genl.patch
new file mode 100644
index 00000000000..c89646b616b
--- /dev/null
+++ b/queue-6.6/thermal-lib-fix-memory-leak-on-error-in-thermal_genl.patch
@@ -0,0 +1,64 @@
+From 3f8bbf9f86878ba73abcb16ced495e204f7003a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 12:59:38 +0200
+Subject: thermal/lib: Fix memory leak on error in thermal_genl_auto()
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 7569406e95f2353070d88ebc88e8c13698542317 ]
+
+The function thermal_genl_auto() does not free the allocated message
+in the error path. Fix that by putting a out label and jump to it
+which will free the message instead of directly returning an error.
+
+Fixes: 47c4b0de080a ("tools/lib/thermal: Add a thermal library")
+Reported-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/20241024105938.1095358-1-daniel.lezcano@linaro.org
+[ rjw: Fixed up the !msg error path, added Fixes tag ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/commands.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c
+index a9223df91dcf5..27b4442f0e347 100644
+--- a/tools/lib/thermal/commands.c
++++ b/tools/lib/thermal/commands.c
+@@ -279,6 +279,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
+ 					 struct cmd_param *param,
+ 					 int cmd, int flags, void *arg)
+ {
++	thermal_error_t ret = THERMAL_ERROR;
+ 	struct nl_msg *msg;
+ 	void *hdr;
+ 
+@@ -289,17 +290,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
+ 	hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id,
+ 			  0, flags, cmd, THERMAL_GENL_VERSION);
+ 	if (!hdr)
+-		return THERMAL_ERROR;
++		goto out;
+ 
+ 	if (cmd_cb && cmd_cb(msg, param))
+-		return THERMAL_ERROR;
++		goto out;
+ 
+ 	if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
+-		return THERMAL_ERROR;
++		goto out;
+ 
++	ret = THERMAL_SUCCESS;
++out:
+ 	nlmsg_free(msg);
+ 
+-	return THERMAL_SUCCESS;
++	return ret;
+ }
+ 
+ thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
+-- 
+2.43.0
+
diff --git a/queue-6.6/time-fix-references-to-_msecs_to_jiffies-handling-of.patch b/queue-6.6/time-fix-references-to-_msecs_to_jiffies-handling-of.patch
new file mode 100644
index 00000000000..727911b16c8
--- /dev/null
+++ b/queue-6.6/time-fix-references-to-_msecs_to_jiffies-handling-of.patch
@@ -0,0 +1,55 @@
+From 4af1b1a4191d16a3d02562160d40d5996ff8d4e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 13:01:41 +0200
+Subject: time: Fix references to _msecs_to_jiffies() handling of values
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit 92b043fd995a63a57aae29ff85a39b6f30cd440c ]
+
+The details about the handling of the "normal" values were moved
+to the _msecs_to_jiffies() helpers in commit ca42aaf0c861 ("time:
+Refactor msecs_to_jiffies"). However, the same commit still mentioned
+__msecs_to_jiffies() in the added documentation.
+
+Thus point to _msecs_to_jiffies() instead.
+
+Fixes: ca42aaf0c861 ("time: Refactor msecs_to_jiffies")
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20241025110141.157205-2-ojeda@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/jiffies.h | 2 +-
+ kernel/time/time.c      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
+index e0ae2a43e0ebd..03f38fe9b9a10 100644
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -499,7 +499,7 @@ static inline unsigned long _msecs_to_jiffies(const unsigned int m)
+  * - all other values are converted to jiffies by either multiplying
+  *   the input value by a factor or dividing it with a factor and
+  *   handling any 32-bit overflows.
+- *   for the details see __msecs_to_jiffies()
++ *   for the details see _msecs_to_jiffies()
+  *
+  * msecs_to_jiffies() checks for the passed in value being a constant
+  * via __builtin_constant_p() allowing gcc to eliminate most of the
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index e1879ca321033..1ad88e97b4ebc 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -556,7 +556,7 @@ EXPORT_SYMBOL(ns_to_timespec64);
+  * - all other values are converted to jiffies by either multiplying
+  *   the input value by a factor or dividing it with a factor and
+  *   handling any 32-bit overflows.
+- *   for the details see __msecs_to_jiffies()
++ *   for the details see _msecs_to_jiffies()
+  *
+  * msecs_to_jiffies() checks for the passed in value being a constant
+  * via __builtin_constant_p() allowing gcc to eliminate most of the
+-- 
+2.43.0
+
diff --git a/queue-6.6/time-partially-revert-cleanup-on-msecs_to_jiffies-do.patch b/queue-6.6/time-partially-revert-cleanup-on-msecs_to_jiffies-do.patch
new file mode 100644
index 00000000000..d6a33535a05
--- /dev/null
+++ b/queue-6.6/time-partially-revert-cleanup-on-msecs_to_jiffies-do.patch
@@ -0,0 +1,42 @@
+From f6bf85cc9e1070a73bfcd64e1686a0f53c2faaff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 13:01:40 +0200
+Subject: time: Partially revert cleanup on msecs_to_jiffies() documentation
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+[ Upstream commit b05aefc1f5886c8aece650c9c1639c87b976191a ]
+
+The documentation's intention is to compare msecs_to_jiffies() (first
+sentence) with __msecs_to_jiffies() (second sentence), which is what the
+original documentation did. One of the cleanups in commit f3cb80804b82
+("time: Fix various kernel-doc problems") may have thought the paragraph
+was talking about the latter since that is what it is being documented.
+
+Thus revert that part of the change.
+
+Fixes: f3cb80804b82 ("time: Fix various kernel-doc problems")
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20241025110141.157205-1-ojeda@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/time.c b/kernel/time/time.c
+index 642647f5046be..e1879ca321033 100644
+--- a/kernel/time/time.c
++++ b/kernel/time/time.c
+@@ -558,7 +558,7 @@ EXPORT_SYMBOL(ns_to_timespec64);
+  *   handling any 32-bit overflows.
+  *   for the details see __msecs_to_jiffies()
+  *
+- * __msecs_to_jiffies() checks for the passed in value being a constant
++ * msecs_to_jiffies() checks for the passed in value being a constant
+  * via __builtin_constant_p() allowing gcc to eliminate most of the
+  * code, __msecs_to_jiffies() is called if the value passed does not
+  * allow constant folding and the actual conversion must be done at
+-- 
+2.43.0
+
diff --git a/queue-6.6/tools-lib-thermal-make-more-generic-the-command-enco.patch b/queue-6.6/tools-lib-thermal-make-more-generic-the-command-enco.patch
new file mode 100644
index 00000000000..ce477322c51
--- /dev/null
+++ b/queue-6.6/tools-lib-thermal-make-more-generic-the-command-enco.patch
@@ -0,0 +1,115 @@
+From 9324a45aa1c79f5797d16e45a24887a8f0be4052 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 17:51:43 +0200
+Subject: tools/lib/thermal: Make more generic the command encoding function
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit 24b216b2d13568c703a76137ef54a2a9531a71d8 ]
+
+The thermal netlink has been extended with more commands which require
+an encoding with more information. The generic encoding function puts
+the thermal zone id with the command name. It is the unique
+parameters.
+
+The next changes will provide more parameters to the command. Set the
+scene for those new parameters by making the encoding function more
+generic.
+
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/20241022155147.463475-4-daniel.lezcano@linaro.org
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 7569406e95f2 ("thermal/lib: Fix memory leak on error in thermal_genl_auto()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/thermal/commands.c | 41 ++++++++++++++++++++++++++++--------
+ 1 file changed, 32 insertions(+), 9 deletions(-)
+
+diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c
+index 73d4d4e8d6ec0..a9223df91dcf5 100644
+--- a/tools/lib/thermal/commands.c
++++ b/tools/lib/thermal/commands.c
+@@ -261,8 +261,23 @@ static struct genl_ops thermal_cmd_ops = {
+ 	.o_ncmds	= ARRAY_SIZE(thermal_cmds),
+ };
+ 
+-static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, int cmd,
+-					 int flags, void *arg)
++struct cmd_param {
++	int tz_id;
++};
++
++typedef int (*cmd_cb_t)(struct nl_msg *, struct cmd_param *);
++
++static int thermal_genl_tz_id_encode(struct nl_msg *msg, struct cmd_param *p)
++{
++	if (p->tz_id >= 0 && nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, p->tz_id))
++		return -1;
++
++	return 0;
++}
++
++static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cmd_cb,
++					 struct cmd_param *param,
++					 int cmd, int flags, void *arg)
+ {
+ 	struct nl_msg *msg;
+ 	void *hdr;
+@@ -276,7 +291,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, int
+ 	if (!hdr)
+ 		return THERMAL_ERROR;
+ 
+-	if (id >= 0 && nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id))
++	if (cmd_cb && cmd_cb(msg, param))
+ 		return THERMAL_ERROR;
+ 
+ 	if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
+@@ -289,30 +304,38 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, int id, int
+ 
+ thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
+ {
+-	return thermal_genl_auto(th, -1, THERMAL_GENL_CMD_TZ_GET_ID,
++	return thermal_genl_auto(th, NULL, NULL, THERMAL_GENL_CMD_TZ_GET_ID,
+ 				 NLM_F_DUMP | NLM_F_ACK, tz);
+ }
+ 
+ thermal_error_t thermal_cmd_get_cdev(struct thermal_handler *th, struct thermal_cdev **tc)
+ {
+-	return thermal_genl_auto(th, -1, THERMAL_GENL_CMD_CDEV_GET,
++	return thermal_genl_auto(th, NULL, NULL, THERMAL_GENL_CMD_CDEV_GET,
+ 				 NLM_F_DUMP | NLM_F_ACK, tc);
+ }
+ 
+ thermal_error_t thermal_cmd_get_trip(struct thermal_handler *th, struct thermal_zone *tz)
+ {
+-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_TRIP,
+-				 0, tz);
++	struct cmd_param p = { .tz_id = tz->id };
++
++	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
++				 THERMAL_GENL_CMD_TZ_GET_TRIP, 0, tz);
+ }
+ 
+ thermal_error_t thermal_cmd_get_governor(struct thermal_handler *th, struct thermal_zone *tz)
+ {
+-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_GOV, 0, tz);
++	struct cmd_param p = { .tz_id = tz->id };
++
++	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
++				 THERMAL_GENL_CMD_TZ_GET_GOV, 0, tz);
+ }
+ 
+ thermal_error_t thermal_cmd_get_temp(struct thermal_handler *th, struct thermal_zone *tz)
+ {
+-	return thermal_genl_auto(th, tz->id, THERMAL_GENL_CMD_TZ_GET_TEMP, 0, tz);
++	struct cmd_param p = { .tz_id = tz->id };
++
++	return thermal_genl_auto(th, thermal_genl_tz_id_encode, &p,
++				 THERMAL_GENL_CMD_TZ_GET_TEMP, 0, tz);
+ }
+ 
+ thermal_error_t thermal_cmd_exit(struct thermal_handler *th)
+-- 
+2.43.0
+
diff --git a/queue-6.6/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch b/queue-6.6/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch
new file mode 100644
index 00000000000..fbc8189cfe7
--- /dev/null
+++ b/queue-6.6/tpm-fix-signed-unsigned-bug-when-checking-event-logs.patch
@@ -0,0 +1,83 @@
+From f2c6685a5f0b4787f7449f97be07d0bb822a7085 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 19:19:51 -0400
+Subject: tpm: fix signed/unsigned bug when checking event logs
+
+From: Gregory Price <gourry@gourry.net>
+
+[ Upstream commit e6d654e9f5a97742cfe794b1c4bb5d3fb2d25e98 ]
+
+A prior bugfix that fixes a signed/unsigned error causes
+another signed unsigned error.
+
+A situation where log_tbl->size is invalid can cause the
+size passed to memblock_reserve to become negative.
+
+log_size from the main event log is an unsigned int, and
+the code reduces to the following
+
+u64 value = (int)unsigned_value;
+
+This results in sign extension, and the value sent to
+memblock_reserve becomes effectively negative.
+
+Fixes: be59d57f9806 ("efi/tpm: Fix sanity check of unsigned tbl_size being less than zero")
+Signed-off-by: Gregory Price <gourry@gourry.net>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/tpm.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
+index e8d69bd548f3f..9c3613e6af158 100644
+--- a/drivers/firmware/efi/tpm.c
++++ b/drivers/firmware/efi/tpm.c
+@@ -40,7 +40,8 @@ int __init efi_tpm_eventlog_init(void)
+ {
+ 	struct linux_efi_tpm_eventlog *log_tbl;
+ 	struct efi_tcg2_final_events_table *final_tbl;
+-	int tbl_size;
++	unsigned int tbl_size;
++	int final_tbl_size;
+ 	int ret = 0;
+ 
+ 	if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
+@@ -80,26 +81,26 @@ int __init efi_tpm_eventlog_init(void)
+ 		goto out;
+ 	}
+ 
+-	tbl_size = 0;
++	final_tbl_size = 0;
+ 	if (final_tbl->nr_events != 0) {
+ 		void *events = (void *)efi.tpm_final_log
+ 				+ sizeof(final_tbl->version)
+ 				+ sizeof(final_tbl->nr_events);
+ 
+-		tbl_size = tpm2_calc_event_log_size(events,
+-						    final_tbl->nr_events,
+-						    log_tbl->log);
++		final_tbl_size = tpm2_calc_event_log_size(events,
++							  final_tbl->nr_events,
++							  log_tbl->log);
+ 	}
+ 
+-	if (tbl_size < 0) {
++	if (final_tbl_size < 0) {
+ 		pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
+ 		ret = -EINVAL;
+ 		goto out_calc;
+ 	}
+ 
+ 	memblock_reserve(efi.tpm_final_log,
+-			 tbl_size + sizeof(*final_tbl));
+-	efi_tpm_final_log_size = tbl_size;
++			 final_tbl_size + sizeof(*final_tbl));
++	efi_tpm_final_log_size = final_tbl_size;
+ 
+ out_calc:
+ 	early_memunmap(final_tbl, sizeof(*final_tbl));
+-- 
+2.43.0
+
diff --git a/queue-6.6/trace-trace_event_perf-remove-duplicate-samples-on-t.patch b/queue-6.6/trace-trace_event_perf-remove-duplicate-samples-on-t.patch
new file mode 100644
index 00000000000..931aa9879e6
--- /dev/null
+++ b/queue-6.6/trace-trace_event_perf-remove-duplicate-samples-on-t.patch
@@ -0,0 +1,83 @@
+From 7b8a4c1e25fce202a458af8baff7ce9cdf2d9c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 03:13:47 +0100
+Subject: trace/trace_event_perf: remove duplicate samples on the first
+ tracepoint event
+
+From: Levi Yun <yeoreum.yun@arm.com>
+
+[ Upstream commit afe5960dc208fe069ddaaeb0994d857b24ac19d1 ]
+
+When a tracepoint event is created with attr.freq = 1,
+'hwc->period_left' is not initialized correctly. As a result,
+in the perf_swevent_overflow() function, when the first time the event occurs,
+it calculates the event overflow and the perf_swevent_set_period() returns 3,
+this leads to the event are recorded for three duplicate times.
+
+Step to reproduce:
+    1. Enable the tracepoint event & starting tracing
+         $ echo 1 > /sys/kernel/tracing/events/module/module_free
+         $ echo 1 > /sys/kernel/tracing/tracing_on
+
+    2. Record with perf
+         $ perf record -a --strict-freq -F 1 -e "module:module_free"
+
+    3. Trigger module_free event.
+         $ modprobe -i sunrpc
+         $ modprobe -r sunrpc
+
+Result:
+     - Trace pipe result:
+         $ cat trace_pipe
+         modprobe-174509  [003] .....  6504.868896: module_free: sunrpc
+
+     - perf sample:
+         modprobe  174509 [003]  6504.868980: module:module_free: sunrpc
+         modprobe  174509 [003]  6504.868980: module:module_free: sunrpc
+         modprobe  174509 [003]  6504.868980: module:module_free: sunrpc
+
+By setting period_left via perf_swevent_set_period() as other sw_event did,
+This problem could be solved.
+
+After patch:
+     - Trace pipe result:
+         $ cat trace_pipe
+         modprobe 1153096 [068] 613468.867774: module:module_free: xfs
+
+     - perf sample
+         modprobe 1153096 [068] 613468.867794: module:module_free: xfs
+
+Link: https://lore.kernel.org/20240913021347.595330-1-yeoreum.yun@arm.com
+Fixes: bd2b5b12849a ("perf_counter: More aggressive frequency adjustment")
+Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_event_perf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
+index 05e7912418126..3ff9caa4a71bb 100644
+--- a/kernel/trace/trace_event_perf.c
++++ b/kernel/trace/trace_event_perf.c
+@@ -352,10 +352,16 @@ void perf_uprobe_destroy(struct perf_event *p_event)
+ int perf_trace_add(struct perf_event *p_event, int flags)
+ {
+ 	struct trace_event_call *tp_event = p_event->tp_event;
++	struct hw_perf_event *hwc = &p_event->hw;
+ 
+ 	if (!(flags & PERF_EF_START))
+ 		p_event->hw.state = PERF_HES_STOPPED;
+ 
++	if (is_sampling_event(p_event)) {
++		hwc->last_period = hwc->sample_period;
++		perf_swevent_set_period(p_event);
++	}
++
+ 	/*
+ 	 * If TRACE_REG_PERF_ADD returns false; no custom action was performed
+ 	 * and we need to take the default action of enqueueing our event on
+-- 
+2.43.0
+
diff --git a/queue-6.6/um-unconditionally-call-unflatten_device_tree.patch b/queue-6.6/um-unconditionally-call-unflatten_device_tree.patch
new file mode 100644
index 00000000000..74c10cbafaa
--- /dev/null
+++ b/queue-6.6/um-unconditionally-call-unflatten_device_tree.patch
@@ -0,0 +1,78 @@
+From ad80c839c7e47e946eb264394b8451e57a0114ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 17:05:52 -0800
+Subject: um: Unconditionally call unflatten_device_tree()
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 221a819aa3ca5bbbc91ce425b3e8d9463b121d09 ]
+
+Call this function unconditionally so that we can populate an empty DTB
+on platforms that don't boot with a command line provided DTB.  There's
+no harm in calling unflatten_device_tree() unconditionally. If there
+isn't a valid initial_boot_params dtb then unflatten_device_tree()
+returns early.
+
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: linux-um@lists.infradead.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20240217010557.2381548-4-sboyd@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: b2473a359763 ("of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/kernel/dtb.c  | 16 ++++++++--------
+ drivers/of/unittest.c |  4 ----
+ 2 files changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/arch/um/kernel/dtb.c b/arch/um/kernel/dtb.c
+index 484141b06938f..4954188a6a090 100644
+--- a/arch/um/kernel/dtb.c
++++ b/arch/um/kernel/dtb.c
+@@ -16,16 +16,16 @@ void uml_dtb_init(void)
+ 	void *area;
+ 
+ 	area = uml_load_file(dtb, &size);
+-	if (!area)
+-		return;
+-
+-	if (!early_init_dt_scan(area)) {
+-		pr_err("invalid DTB %s\n", dtb);
+-		memblock_free(area, size);
+-		return;
++	if (area) {
++		if (!early_init_dt_scan(area)) {
++			pr_err("invalid DTB %s\n", dtb);
++			memblock_free(area, size);
++			return;
++		}
++
++		early_init_fdt_scan_reserved_mem();
+ 	}
+ 
+-	early_init_fdt_scan_reserved_mem();
+ 	unflatten_device_tree();
+ }
+ 
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 4f58345b5c683..7986113adc7d3 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -4017,10 +4017,6 @@ static int __init of_unittest(void)
+ 	add_taint(TAINT_TEST, LOCKDEP_STILL_OK);
+ 
+ 	/* adding data for unittest */
+-
+-	if (IS_ENABLED(CONFIG_UML))
+-		unittest_unflatten_overlay_base();
+-
+ 	res = unittest_data_add();
+ 	if (res)
+ 		return res;
+-- 
+2.43.0
+
diff --git a/queue-6.6/unicode-fix-utf8_load-error-path.patch b/queue-6.6/unicode-fix-utf8_load-error-path.patch
new file mode 100644
index 00000000000..c9eeb6cc995
--- /dev/null
+++ b/queue-6.6/unicode-fix-utf8_load-error-path.patch
@@ -0,0 +1,64 @@
+From 5bf60bfa3c96c203882de997e01868e409118bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 19:55:03 -0300
+Subject: unicode: Fix utf8_load() error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Almeida <andrealmeid@igalia.com>
+
+[ Upstream commit 156bb2c569cd869583c593d27a5bd69e7b2a4264 ]
+
+utf8_load() requests the symbol "utf8_data_table" and then checks if the
+requested UTF-8 version is supported. If it's unsupported, it tries to
+put the data table using symbol_put(). If an unsupported version is
+requested, symbol_put() fails like this:
+
+ kernel BUG at kernel/module/main.c:786!
+ RIP: 0010:__symbol_put+0x93/0xb0
+ Call Trace:
+  <TASK>
+  ? __die_body.cold+0x19/0x27
+  ? die+0x2e/0x50
+  ? do_trap+0xca/0x110
+  ? do_error_trap+0x65/0x80
+  ? __symbol_put+0x93/0xb0
+  ? exc_invalid_op+0x51/0x70
+  ? __symbol_put+0x93/0xb0
+  ? asm_exc_invalid_op+0x1a/0x20
+  ? __pfx_cmp_name+0x10/0x10
+  ? __symbol_put+0x93/0xb0
+  ? __symbol_put+0x62/0xb0
+  utf8_load+0xf8/0x150
+
+That happens because symbol_put() expects the unique string that
+identify the symbol, instead of a pointer to the loaded symbol. Fix that
+by using such string.
+
+Fixes: 2b3d04787012 ("unicode: Add utf8-data module")
+Signed-off-by: André Almeida <andrealmeid@igalia.com>
+Reviewed-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/20240902225511.757831-2-andrealmeid@igalia.com
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/unicode/utf8-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/unicode/utf8-core.c b/fs/unicode/utf8-core.c
+index 8395066341a43..0400824ef4936 100644
+--- a/fs/unicode/utf8-core.c
++++ b/fs/unicode/utf8-core.c
+@@ -198,7 +198,7 @@ struct unicode_map *utf8_load(unsigned int version)
+ 	return um;
+ 
+ out_symbol_put:
+-	symbol_put(um->tables);
++	symbol_put(utf8_data_table);
+ out_free_um:
+ 	kfree(um);
+ 	return ERR_PTR(-EINVAL);
+-- 
+2.43.0
+
diff --git a/queue-6.6/usb-chaoskey-fail-open-after-removal.patch b/queue-6.6/usb-chaoskey-fail-open-after-removal.patch
new file mode 100644
index 00000000000..749f6eb2cd4
--- /dev/null
+++ b/queue-6.6/usb-chaoskey-fail-open-after-removal.patch
@@ -0,0 +1,146 @@
+From 9933c120457cc39c794da905972708cfc118a11b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 15:21:41 +0200
+Subject: USB: chaoskey: fail open after removal
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit 422dc0a4d12d0b80dd3aab3fe5943f665ba8f041 ]
+
+chaoskey_open() takes the lock only to increase the
+counter of openings. That means that the mutual exclusion
+with chaoskey_disconnect() cannot prevent an increase
+of the counter and chaoskey_open() returning a success.
+
+If that race is hit, chaoskey_disconnect() will happily
+free all resources associated with the device after
+it has dropped the lock, as it has read the counter
+as zero.
+
+To prevent this race chaoskey_open() has to check
+the presence of the device under the lock.
+However, the current per device lock cannot be used,
+because it is a part of the data structure to be
+freed. Hence an additional global mutex is needed.
+The issue is as old as the driver.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Reported-by: syzbot+422188bce66e76020e55@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=422188bce66e76020e55
+Fixes: 66e3e591891da ("usb: Add driver for Altus Metrum ChaosKey device (v2)")
+Rule: add
+Link: https://lore.kernel.org/stable/20241002132201.552578-1-oneukum%40suse.com
+Link: https://lore.kernel.org/r/20241002132201.552578-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/chaoskey.c | 35 ++++++++++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
+index 6fb5140e29b9d..e8b63df5f9759 100644
+--- a/drivers/usb/misc/chaoskey.c
++++ b/drivers/usb/misc/chaoskey.c
+@@ -27,6 +27,8 @@ static struct usb_class_driver chaoskey_class;
+ static int chaoskey_rng_read(struct hwrng *rng, void *data,
+ 			     size_t max, bool wait);
+ 
++static DEFINE_MUTEX(chaoskey_list_lock);
++
+ #define usb_dbg(usb_if, format, arg...) \
+ 	dev_dbg(&(usb_if)->dev, format, ## arg)
+ 
+@@ -230,6 +232,7 @@ static void chaoskey_disconnect(struct usb_interface *interface)
+ 	if (dev->hwrng_registered)
+ 		hwrng_unregister(&dev->hwrng);
+ 
++	mutex_lock(&chaoskey_list_lock);
+ 	usb_deregister_dev(interface, &chaoskey_class);
+ 
+ 	usb_set_intfdata(interface, NULL);
+@@ -244,6 +247,7 @@ static void chaoskey_disconnect(struct usb_interface *interface)
+ 	} else
+ 		mutex_unlock(&dev->lock);
+ 
++	mutex_unlock(&chaoskey_list_lock);
+ 	usb_dbg(interface, "disconnect done");
+ }
+ 
+@@ -251,6 +255,7 @@ static int chaoskey_open(struct inode *inode, struct file *file)
+ {
+ 	struct chaoskey *dev;
+ 	struct usb_interface *interface;
++	int rv = 0;
+ 
+ 	/* get the interface from minor number and driver information */
+ 	interface = usb_find_interface(&chaoskey_driver, iminor(inode));
+@@ -266,18 +271,23 @@ static int chaoskey_open(struct inode *inode, struct file *file)
+ 	}
+ 
+ 	file->private_data = dev;
++	mutex_lock(&chaoskey_list_lock);
+ 	mutex_lock(&dev->lock);
+-	++dev->open;
++	if (dev->present)
++		++dev->open;
++	else
++		rv = -ENODEV;
+ 	mutex_unlock(&dev->lock);
++	mutex_unlock(&chaoskey_list_lock);
+ 
+-	usb_dbg(interface, "open success");
+-	return 0;
++	return rv;
+ }
+ 
+ static int chaoskey_release(struct inode *inode, struct file *file)
+ {
+ 	struct chaoskey *dev = file->private_data;
+ 	struct usb_interface *interface;
++	int rv = 0;
+ 
+ 	if (dev == NULL)
+ 		return -ENODEV;
+@@ -286,14 +296,15 @@ static int chaoskey_release(struct inode *inode, struct file *file)
+ 
+ 	usb_dbg(interface, "release");
+ 
++	mutex_lock(&chaoskey_list_lock);
+ 	mutex_lock(&dev->lock);
+ 
+ 	usb_dbg(interface, "open count at release is %d", dev->open);
+ 
+ 	if (dev->open <= 0) {
+ 		usb_dbg(interface, "invalid open count (%d)", dev->open);
+-		mutex_unlock(&dev->lock);
+-		return -ENODEV;
++		rv = -ENODEV;
++		goto bail;
+ 	}
+ 
+ 	--dev->open;
+@@ -302,13 +313,15 @@ static int chaoskey_release(struct inode *inode, struct file *file)
+ 		if (dev->open == 0) {
+ 			mutex_unlock(&dev->lock);
+ 			chaoskey_free(dev);
+-		} else
+-			mutex_unlock(&dev->lock);
+-	} else
+-		mutex_unlock(&dev->lock);
+-
++			goto destruction;
++		}
++	}
++bail:
++	mutex_unlock(&dev->lock);
++destruction:
++	mutex_lock(&chaoskey_list_lock);
+ 	usb_dbg(interface, "release success");
+-	return 0;
++	return rv;
+ }
+ 
+ static void chaos_read_callback(struct urb *urb)
+-- 
+2.43.0
+
diff --git a/queue-6.6/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch b/queue-6.6/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch
new file mode 100644
index 00000000000..529160c0891
--- /dev/null
+++ b/queue-6.6/usb-chaoskey-fix-possible-deadlock-chaoskey_list_loc.patch
@@ -0,0 +1,154 @@
+From 407c00e01748ca748107c059d1dc04f4b5b18c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 22:52:07 +0800
+Subject: USB: chaoskey: Fix possible deadlock chaoskey_list_lock
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit d73dc7b182be4238b75278bfae16afb4c5564a58 ]
+
+[Syzbot reported two possible deadlocks]
+The first possible deadlock is:
+WARNING: possible recursive locking detected
+6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
+--------------------------------------------
+syz-executor363/2651 is trying to acquire lock:
+ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x15d/0x2c0 drivers/usb/misc/chaoskey.c:322
+
+but task is already holding lock:
+ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_release+0x7f/0x2c0 drivers/usb/misc/chaoskey.c:299
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+       CPU0
+       ----
+  lock(chaoskey_list_lock);
+  lock(chaoskey_list_lock);
+
+ *** DEADLOCK ***
+
+The second possible deadlock is:
+WARNING: possible circular locking dependency detected
+6.12.0-rc1-syzkaller-00027-g4a9fe2a8ac53 #0 Not tainted
+------------------------------------------------------
+kworker/0:2/804 is trying to acquire lock:
+ffffffff899dadb0 (minor_rwsem){++++}-{3:3}, at: usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186
+
+but task is already holding lock:
+ffffffff89b120e8 (chaoskey_list_lock){+.+.}-{3:3}, at: chaoskey_disconnect+0xa8/0x2a0 drivers/usb/misc/chaoskey.c:235
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (chaoskey_list_lock){+.+.}-{3:3}:
+       __mutex_lock_common kernel/locking/mutex.c:608 [inline]
+       __mutex_lock+0x175/0x9c0 kernel/locking/mutex.c:752
+       chaoskey_open+0xdd/0x220 drivers/usb/misc/chaoskey.c:274
+       usb_open+0x186/0x220 drivers/usb/core/file.c:47
+       chrdev_open+0x237/0x6a0 fs/char_dev.c:414
+       do_dentry_open+0x6cb/0x1390 fs/open.c:958
+       vfs_open+0x82/0x3f0 fs/open.c:1088
+       do_open fs/namei.c:3774 [inline]
+       path_openat+0x1e6a/0x2d60 fs/namei.c:3933
+       do_filp_open+0x1dc/0x430 fs/namei.c:3960
+       do_sys_openat2+0x17a/0x1e0 fs/open.c:1415
+       do_sys_open fs/open.c:1430 [inline]
+       __do_sys_openat fs/open.c:1446 [inline]
+       __se_sys_openat fs/open.c:1441 [inline]
+       __x64_sys_openat+0x175/0x210 fs/open.c:1441
+       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
+       entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+-> #0 (minor_rwsem){++++}-{3:3}:
+       check_prev_add kernel/locking/lockdep.c:3161 [inline]
+       check_prevs_add kernel/locking/lockdep.c:3280 [inline]
+       validate_chain kernel/locking/lockdep.c:3904 [inline]
+       __lock_acquire+0x250b/0x3ce0 kernel/locking/lockdep.c:5202
+       lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5825
+       down_write+0x93/0x200 kernel/locking/rwsem.c:1577
+       usb_deregister_dev+0x7c/0x1e0 drivers/usb/core/file.c:186
+       chaoskey_disconnect+0xb7/0x2a0 drivers/usb/misc/chaoskey.c:236
+       usb_unbind_interface+0x1e8/0x970 drivers/usb/core/driver.c:461
+       device_remove drivers/base/dd.c:569 [inline]
+       device_remove+0x122/0x170 drivers/base/dd.c:561
+       __device_release_driver drivers/base/dd.c:1273 [inline]
+       device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
+       bus_remove_device+0x22f/0x420 drivers/base/bus.c:576
+       device_del+0x396/0x9f0 drivers/base/core.c:3864
+       usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418
+       usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2304
+       hub_port_connect drivers/usb/core/hub.c:5361 [inline]
+       hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
+       port_event drivers/usb/core/hub.c:5821 [inline]
+       hub_event+0x1bed/0x4f40 drivers/usb/core/hub.c:5903
+       process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
+       process_scheduled_works kernel/workqueue.c:3310 [inline]
+       worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
+       kthread+0x2c1/0x3a0 kernel/kthread.c:389
+       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
+       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(chaoskey_list_lock);
+                               lock(minor_rwsem);
+                               lock(chaoskey_list_lock);
+  lock(minor_rwsem);
+
+ *** DEADLOCK ***
+[Analysis]
+The first is AA lock, it because wrong logic, it need a unlock.
+The second is AB lock, it needs to rearrange the order of lock usage.
+
+Fixes: 422dc0a4d12d ("USB: chaoskey: fail open after removal")
+Reported-by: syzbot+685e14d04fe35692d3bc@syzkaller.appspotmail.com
+Reported-by: syzbot+1f8ca5ee82576ec01f12@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=685e14d04fe35692d3bc
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Tested-by: syzbot+685e14d04fe35692d3bc@syzkaller.appspotmail.com
+Reported-by: syzbot+5f1ce62e956b7b19610e@syzkaller.appspotmail.com
+Tested-by: syzbot+5f1ce62e956b7b19610e@syzkaller.appspotmail.com
+Tested-by: syzbot+1f8ca5ee82576ec01f12@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/tencent_84EB865C89862EC22EE94CB3A7C706C59206@qq.com
+Cc: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/chaoskey.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
+index e8b63df5f9759..225863321dc47 100644
+--- a/drivers/usb/misc/chaoskey.c
++++ b/drivers/usb/misc/chaoskey.c
+@@ -232,10 +232,10 @@ static void chaoskey_disconnect(struct usb_interface *interface)
+ 	if (dev->hwrng_registered)
+ 		hwrng_unregister(&dev->hwrng);
+ 
+-	mutex_lock(&chaoskey_list_lock);
+ 	usb_deregister_dev(interface, &chaoskey_class);
+ 
+ 	usb_set_intfdata(interface, NULL);
++	mutex_lock(&chaoskey_list_lock);
+ 	mutex_lock(&dev->lock);
+ 
+ 	dev->present = false;
+@@ -319,7 +319,7 @@ static int chaoskey_release(struct inode *inode, struct file *file)
+ bail:
+ 	mutex_unlock(&dev->lock);
+ destruction:
+-	mutex_lock(&chaoskey_list_lock);
++	mutex_unlock(&chaoskey_list_lock);
+ 	usb_dbg(interface, "release success");
+ 	return rv;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.6/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch b/queue-6.6/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch
new file mode 100644
index 00000000000..168611a9073
--- /dev/null
+++ b/queue-6.6/usb-using-mutex-lock-and-supporting-o_nonblock-flag-.patch
@@ -0,0 +1,130 @@
+From ea614d4662cd7a7165dcb718ebe00630071d7a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2024 19:34:03 +0900
+Subject: usb: using mutex lock and supporting O_NONBLOCK flag in
+ iowarrior_read()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+[ Upstream commit 44feafbaa66ec86232b123bb8437a6a262442025 ]
+
+iowarrior_read() uses the iowarrior dev structure, but does not use any
+lock on the structure. This can cause various bugs including data-races,
+so it is more appropriate to use a mutex lock to safely protect the
+iowarrior dev structure. When using a mutex lock, you should split the
+branch to prevent blocking when the O_NONBLOCK flag is set.
+
+In addition, it is unnecessary to check for NULL on the iowarrior dev
+structure obtained by reading file->private_data. Therefore, it is
+better to remove the check.
+
+Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Link: https://lore.kernel.org/r/20240919103403.3986-1-aha310510@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/iowarrior.c | 46 ++++++++++++++++++++++++++++--------
+ 1 file changed, 36 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 1e3df27bab58f..8cb78c0e2f415 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -277,28 +277,45 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,
+ 	struct iowarrior *dev;
+ 	int read_idx;
+ 	int offset;
++	int retval;
+ 
+ 	dev = file->private_data;
+ 
++	if (file->f_flags & O_NONBLOCK) {
++		retval = mutex_trylock(&dev->mutex);
++		if (!retval)
++			return -EAGAIN;
++	} else {
++		retval = mutex_lock_interruptible(&dev->mutex);
++		if (retval)
++			return -ERESTARTSYS;
++	}
++
+ 	/* verify that the device wasn't unplugged */
+-	if (!dev || !dev->present)
+-		return -ENODEV;
++	if (!dev->present) {
++		retval = -ENODEV;
++		goto exit;
++	}
+ 
+ 	dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
+ 		dev->minor, count);
+ 
+ 	/* read count must be packet size (+ time stamp) */
+ 	if ((count != dev->report_size)
+-	    && (count != (dev->report_size + 1)))
+-		return -EINVAL;
++	    && (count != (dev->report_size + 1))) {
++		retval = -EINVAL;
++		goto exit;
++	}
+ 
+ 	/* repeat until no buffer overrun in callback handler occur */
+ 	do {
+ 		atomic_set(&dev->overflow_flag, 0);
+ 		if ((read_idx = read_index(dev)) == -1) {
+ 			/* queue empty */
+-			if (file->f_flags & O_NONBLOCK)
+-				return -EAGAIN;
++			if (file->f_flags & O_NONBLOCK) {
++				retval = -EAGAIN;
++				goto exit;
++			}
+ 			else {
+ 				//next line will return when there is either new data, or the device is unplugged
+ 				int r = wait_event_interruptible(dev->read_wait,
+@@ -309,28 +326,37 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,
+ 								  -1));
+ 				if (r) {
+ 					//we were interrupted by a signal
+-					return -ERESTART;
++					retval = -ERESTART;
++					goto exit;
+ 				}
+ 				if (!dev->present) {
+ 					//The device was unplugged
+-					return -ENODEV;
++					retval = -ENODEV;
++					goto exit;
+ 				}
+ 				if (read_idx == -1) {
+ 					// Can this happen ???
+-					return 0;
++					retval = 0;
++					goto exit;
+ 				}
+ 			}
+ 		}
+ 
+ 		offset = read_idx * (dev->report_size + 1);
+ 		if (copy_to_user(buffer, dev->read_queue + offset, count)) {
+-			return -EFAULT;
++			retval = -EFAULT;
++			goto exit;
+ 		}
+ 	} while (atomic_read(&dev->overflow_flag));
+ 
+ 	read_idx = ++read_idx == MAX_INTERRUPT_BUFFER ? 0 : read_idx;
+ 	atomic_set(&dev->read_idx, read_idx);
++	mutex_unlock(&dev->mutex);
+ 	return count;
++
++exit:
++	mutex_unlock(&dev->mutex);
++	return retval;
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.6/usb-yurex-make-waiting-on-yurex_write-interruptible.patch b/queue-6.6/usb-yurex-make-waiting-on-yurex_write-interruptible.patch
new file mode 100644
index 00000000000..ebc70310c48
--- /dev/null
+++ b/queue-6.6/usb-yurex-make-waiting-on-yurex_write-interruptible.patch
@@ -0,0 +1,68 @@
+From a276cc7240dfc924e45426729d11115c9b0c3cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 10:43:45 +0200
+Subject: usb: yurex: make waiting on yurex_write interruptible
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit e0aa9614ab0fd35b404e4b16ebe879f9fc152591 ]
+
+The IO yurex_write() needs to wait for in order to have a device
+ready for writing again can take a long time time.
+Consequently the sleep is done in an interruptible state.
+Therefore others waiting for yurex_write() itself to finish should
+use mutex_lock_interruptible.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 6bc235a2e24a5 ("USB: add driver for Meywa-Denki & Kayac YUREX")
+Rule: add
+Link: https://lore.kernel.org/stable/20240924084415.300557-1-oneukum%40suse.com
+Link: https://lore.kernel.org/r/20240924084415.300557-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/iowarrior.c | 4 ----
+ drivers/usb/misc/yurex.c     | 5 ++++-
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index 8cb78c0e2f415..4fae04094021e 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -912,7 +912,6 @@ static int iowarrior_probe(struct usb_interface *interface,
+ static void iowarrior_disconnect(struct usb_interface *interface)
+ {
+ 	struct iowarrior *dev = usb_get_intfdata(interface);
+-	int minor = dev->minor;
+ 
+ 	usb_deregister_dev(interface, &iowarrior_class);
+ 
+@@ -936,9 +935,6 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ 		mutex_unlock(&dev->mutex);
+ 		iowarrior_delete(dev);
+ 	}
+-
+-	dev_info(&interface->dev, "I/O-Warror #%d now disconnected\n",
+-		 minor - IOWARRIOR_MINOR_BASE);
+ }
+ 
+ /* usb specific object needed to register this driver with the usb subsystem */
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index c313cd41f7a5a..0eed614ac1273 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -441,7 +441,10 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
+ 	if (count == 0)
+ 		goto error;
+ 
+-	mutex_lock(&dev->io_mutex);
++	retval = mutex_lock_interruptible(&dev->io_mutex);
++	if (retval < 0)
++		return -EINTR;
++
+ 	if (dev->disconnected) {		/* already disconnected */
+ 		mutex_unlock(&dev->io_mutex);
+ 		retval = -ENODEV;
+-- 
+2.43.0
+
diff --git a/queue-6.6/vdpa-mlx5-fix-suboptimal-range-on-iotlb-iteration.patch b/queue-6.6/vdpa-mlx5-fix-suboptimal-range-on-iotlb-iteration.patch
new file mode 100644
index 00000000000..c605c5df7e9
--- /dev/null
+++ b/queue-6.6/vdpa-mlx5-fix-suboptimal-range-on-iotlb-iteration.patch
@@ -0,0 +1,53 @@
+From 7133112f906a515f3646fbf0fbad90dcdc296108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 16:40:40 +0300
+Subject: vdpa/mlx5: Fix suboptimal range on iotlb iteration
+
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+
+[ Upstream commit 35025963326e44d8bced3eecd42d2f040f4f0024 ]
+
+The starting iova address to iterate iotlb map entry within a range
+was set to an irrelevant value when passing to the itree_next()
+iterator, although luckily it doesn't affect the outcome of finding
+out the granule of the smallest iotlb map size. Fix the code to make
+it consistent with the following for-loop.
+
+Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Message-Id: <20241021134040.975221-3-dtatulea@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/core/mr.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
+index 59fa9f3d5ec87..aa4ab4c847fdc 100644
+--- a/drivers/vdpa/mlx5/core/mr.c
++++ b/drivers/vdpa/mlx5/core/mr.c
+@@ -227,7 +227,6 @@ static int map_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mr
+ 	unsigned long lgcd = 0;
+ 	int log_entity_size;
+ 	unsigned long size;
+-	u64 start = 0;
+ 	int err;
+ 	struct page *pg;
+ 	unsigned int nsg;
+@@ -238,10 +237,9 @@ static int map_direct_mr(struct mlx5_vdpa_dev *mvdev, struct mlx5_vdpa_direct_mr
+ 	struct device *dma = mvdev->vdev.dma_dev;
+ 
+ 	for (map = vhost_iotlb_itree_first(iotlb, mr->start, mr->end - 1);
+-	     map; map = vhost_iotlb_itree_next(map, start, mr->end - 1)) {
++	     map; map = vhost_iotlb_itree_next(map, mr->start, mr->end - 1)) {
+ 		size = maplen(map, mr);
+ 		lgcd = gcd(lgcd, size);
+-		start += size;
+ 	}
+ 	log_entity_size = ilog2(lgcd);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch b/queue-6.6/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch
new file mode 100644
index 00000000000..7306dc2ddf1
--- /dev/null
+++ b/queue-6.6/vfio-pci-properly-hide-first-in-list-pcie-extended-c.patch
@@ -0,0 +1,115 @@
+From 4542b5a405a3cd5fca9068a8bb335fb7bb9b96b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 16:27:39 +0200
+Subject: vfio/pci: Properly hide first-in-list PCIe extended capability
+
+From: Avihai Horon <avihaih@nvidia.com>
+
+[ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ]
+
+There are cases where a PCIe extended capability should be hidden from
+the user. For example, an unknown capability (i.e., capability with ID
+greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally
+chosen to be hidden from the user.
+
+Hiding a capability is done by virtualizing and modifying the 'Next
+Capability Offset' field of the previous capability so it points to the
+capability after the one that should be hidden.
+
+The special case where the first capability in the list should be hidden
+is handled differently because there is no previous capability that can
+be modified. In this case, the capability ID and version are zeroed
+while leaving the next pointer intact. This hides the capability and
+leaves an anchor for the rest of the capability list.
+
+However, today, hiding the first capability in the list is not done
+properly if the capability is unknown, as struct
+vfio_pci_core_device->pci_config_map is set to the capability ID during
+initialization but the capability ID is not properly checked later when
+used in vfio_config_do_rw(). This leads to the following warning [1] and
+to an out-of-bounds access to ecap_perms array.
+
+Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater
+than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct
+read only access instead of the ecap_perms array.
+
+Note that this is safe since the above is the only case where cap_id can
+exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which
+are already checked before).
+
+[1]
+
+WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
+CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1
+(snip)
+Call Trace:
+ <TASK>
+ ? show_regs+0x69/0x80
+ ? __warn+0x8d/0x140
+ ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
+ ? report_bug+0x18f/0x1a0
+ ? handle_bug+0x63/0xa0
+ ? exc_invalid_op+0x19/0x70
+ ? asm_exc_invalid_op+0x1b/0x20
+ ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core]
+ ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core]
+ vfio_pci_rw+0x101/0x1b0 [vfio_pci_core]
+ vfio_pci_core_read+0x1d/0x30 [vfio_pci_core]
+ vfio_device_fops_read+0x27/0x40 [vfio]
+ vfs_read+0xbd/0x340
+ ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio]
+ ? __rseq_handle_notify_resume+0xa4/0x4b0
+ __x64_sys_pread64+0x96/0xc0
+ x64_sys_call+0x1c3d/0x20d0
+ do_syscall_64+0x4d/0x120
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Reviewed-by: Yi Liu <yi.l.liu@intel.com>
+Tested-by: Yi Liu <yi.l.liu@intel.com>
+Link: https://lore.kernel.org/r/20241124142739.21698-1-avihaih@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 7e2e62ab0869c..a2ad4f7c716bf 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -313,6 +313,10 @@ static int vfio_virt_config_read(struct vfio_pci_core_device *vdev, int pos,
+ 	return count;
+ }
+ 
++static struct perm_bits direct_ro_perms = {
++	.readfn = vfio_direct_config_read,
++};
++
+ /* Default capability regions to read-only, no-virtualization */
+ static struct perm_bits cap_perms[PCI_CAP_ID_MAX + 1] = {
+ 	[0 ... PCI_CAP_ID_MAX] = { .readfn = vfio_direct_config_read }
+@@ -1897,9 +1901,17 @@ static ssize_t vfio_config_do_rw(struct vfio_pci_core_device *vdev, char __user
+ 		cap_start = *ppos;
+ 	} else {
+ 		if (*ppos >= PCI_CFG_SPACE_SIZE) {
+-			WARN_ON(cap_id > PCI_EXT_CAP_ID_MAX);
++			/*
++			 * We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX
++			 * if we're hiding an unknown capability at the start
++			 * of the extended capability list.  Use default, ro
++			 * access, which will virtualize the id and next values.
++			 */
++			if (cap_id > PCI_EXT_CAP_ID_MAX)
++				perm = &direct_ro_perms;
++			else
++				perm = &ecap_perms[cap_id];
+ 
+-			perm = &ecap_perms[cap_id];
+ 			cap_start = vfio_find_cap_start(vdev, *ppos);
+ 		} else {
+ 			WARN_ON(cap_id > PCI_CAP_ID_MAX);
+-- 
+2.43.0
+
diff --git a/queue-6.6/virtchnl-add-crc-stripping-capability.patch b/queue-6.6/virtchnl-add-crc-stripping-capability.patch
new file mode 100644
index 00000000000..a78b8d930ef
--- /dev/null
+++ b/queue-6.6/virtchnl-add-crc-stripping-capability.patch
@@ -0,0 +1,64 @@
+From ca7d5b5d2ad5c3510824bdca010b4d7069032191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 13:57:01 -0600
+Subject: virtchnl: Add CRC stripping capability
+
+From: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
+
+[ Upstream commit 89de9921dfa77e43b985bde99a6031ab66511020 ]
+
+Some VFs may want to disable CRC stripping on incoming packets so create
+an offload for that. The VF already sends information about configuring
+its RX queues so use that structure to indicate that the CRC stripping
+should be enabled or not.
+
+Signed-off-by: Paul M Stillwell Jr <paul.m.stillwell.jr@intel.com>
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Stable-dep-of: a884c304e18a ("ice: consistently use q_idx in ice_vc_cfg_qs_msg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/avf/virtchnl.h | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
+index 6e950594215a0..99ae7960a8d13 100644
+--- a/include/linux/avf/virtchnl.h
++++ b/include/linux/avf/virtchnl.h
+@@ -245,6 +245,7 @@ VIRTCHNL_CHECK_STRUCT_LEN(16, virtchnl_vsi_resource);
+ #define VIRTCHNL_VF_OFFLOAD_REQ_QUEUES		BIT(6)
+ /* used to negotiate communicating link speeds in Mbps */
+ #define VIRTCHNL_VF_CAP_ADV_LINK_SPEED		BIT(7)
++#define  VIRTCHNL_VF_OFFLOAD_CRC		BIT(10)
+ #define VIRTCHNL_VF_OFFLOAD_VLAN_V2		BIT(15)
+ #define VIRTCHNL_VF_OFFLOAD_VLAN		BIT(16)
+ #define VIRTCHNL_VF_OFFLOAD_RX_POLLING		BIT(17)
+@@ -300,7 +301,13 @@ VIRTCHNL_CHECK_STRUCT_LEN(24, virtchnl_txq_info);
+ /* VIRTCHNL_OP_CONFIG_RX_QUEUE
+  * VF sends this message to set up parameters for one RX queue.
+  * External data buffer contains one instance of virtchnl_rxq_info.
+- * PF configures requested queue and returns a status code.
++ * PF configures requested queue and returns a status code. The
++ * crc_disable flag disables CRC stripping on the VF. Setting
++ * the crc_disable flag to 1 will disable CRC stripping for each
++ * queue in the VF where the flag is set. The VIRTCHNL_VF_OFFLOAD_CRC
++ * offload must have been set prior to sending this info or the PF
++ * will ignore the request. This flag should be set the same for
++ * all of the queues for a VF.
+  */
+ 
+ /* Rx queue config info */
+@@ -312,7 +319,7 @@ struct virtchnl_rxq_info {
+ 	u16 splithdr_enabled; /* deprecated with AVF 1.0 */
+ 	u32 databuffer_size;
+ 	u32 max_pkt_size;
+-	u8 pad0;
++	u8 crc_disable;
+ 	u8 rxdid;
+ 	u8 pad1[2];
+ 	u64 dma_ring_addr;
+-- 
+2.43.0
+
diff --git a/queue-6.6/virtio_blk-reverse-request-order-in-virtio_queue_rqs.patch b/queue-6.6/virtio_blk-reverse-request-order-in-virtio_queue_rqs.patch
new file mode 100644
index 00000000000..859ff44695a
--- /dev/null
+++ b/queue-6.6/virtio_blk-reverse-request-order-in-virtio_queue_rqs.patch
@@ -0,0 +1,112 @@
+From bf34c4a87345ffd8ae41094b22bf6c3ebf9c10a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 16:20:42 +0100
+Subject: virtio_blk: reverse request order in virtio_queue_rqs
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 7f212e997edbb7a2cb85cef2ac14265dfaf88717 ]
+
+blk_mq_flush_plug_list submits requests in the reverse order that they
+were submitted, which leads to a rather suboptimal I/O pattern
+especially in rotational devices. Fix this by rewriting virtio_queue_rqs
+so that it always pops the requests from the passed in request list, and
+then adds them to the head of a local submit list. This actually
+simplifies the code a bit as it removes the complicated list splicing,
+at the cost of extra updates of the rq_next pointer. As that should be
+cache hot anyway it should be an easy price to pay.
+
+Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241113152050.157179-3-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 46 +++++++++++++++++---------------------
+ 1 file changed, 21 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 41b2fd7e1b9e5..997106fe73e49 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -475,18 +475,18 @@ static bool virtblk_prep_rq_batch(struct request *req)
+ 	return virtblk_prep_rq(req->mq_hctx, vblk, req, vbr) == BLK_STS_OK;
+ }
+ 
+-static bool virtblk_add_req_batch(struct virtio_blk_vq *vq,
++static void virtblk_add_req_batch(struct virtio_blk_vq *vq,
+ 					struct request **rqlist)
+ {
++	struct request *req;
+ 	unsigned long flags;
+-	int err;
+ 	bool kick;
+ 
+ 	spin_lock_irqsave(&vq->lock, flags);
+ 
+-	while (!rq_list_empty(*rqlist)) {
+-		struct request *req = rq_list_pop(rqlist);
++	while ((req = rq_list_pop(rqlist))) {
+ 		struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
++		int err;
+ 
+ 		err = virtblk_add_req(vq->vq, vbr);
+ 		if (err) {
+@@ -499,37 +499,33 @@ static bool virtblk_add_req_batch(struct virtio_blk_vq *vq,
+ 	kick = virtqueue_kick_prepare(vq->vq);
+ 	spin_unlock_irqrestore(&vq->lock, flags);
+ 
+-	return kick;
++	if (kick)
++		virtqueue_notify(vq->vq);
+ }
+ 
+ static void virtio_queue_rqs(struct request **rqlist)
+ {
+-	struct request *req, *next, *prev = NULL;
++	struct request *submit_list = NULL;
+ 	struct request *requeue_list = NULL;
++	struct request **requeue_lastp = &requeue_list;
++	struct virtio_blk_vq *vq = NULL;
++	struct request *req;
+ 
+-	rq_list_for_each_safe(rqlist, req, next) {
+-		struct virtio_blk_vq *vq = get_virtio_blk_vq(req->mq_hctx);
+-		bool kick;
+-
+-		if (!virtblk_prep_rq_batch(req)) {
+-			rq_list_move(rqlist, &requeue_list, req, prev);
+-			req = prev;
+-			if (!req)
+-				continue;
+-		}
++	while ((req = rq_list_pop(rqlist))) {
++		struct virtio_blk_vq *this_vq = get_virtio_blk_vq(req->mq_hctx);
+ 
+-		if (!next || req->mq_hctx != next->mq_hctx) {
+-			req->rq_next = NULL;
+-			kick = virtblk_add_req_batch(vq, rqlist);
+-			if (kick)
+-				virtqueue_notify(vq->vq);
++		if (vq && vq != this_vq)
++			virtblk_add_req_batch(vq, &submit_list);
++		vq = this_vq;
+ 
+-			*rqlist = next;
+-			prev = NULL;
+-		} else
+-			prev = req;
++		if (virtblk_prep_rq_batch(req))
++			rq_list_add(&submit_list, req); /* reverse order */
++		else
++			rq_list_add_tail(&requeue_lastp, req);
+ 	}
+ 
++	if (vq)
++		virtblk_add_req_batch(vq, &submit_list);
+ 	*rqlist = requeue_list;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch b/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch
new file mode 100644
index 00000000000..b4e126bbef1
--- /dev/null
+++ b/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch
@@ -0,0 +1,52 @@
+From d1ba31b82ee490df655fc02e0e0ad71ff492a6bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 10:03:43 +0800
+Subject: wifi: ath10k: fix invalid VHT parameters in
+ supported_vht_mcs_rate_nss1
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit d50886b27850447d90c0cd40c725238097909d1e ]
+
+In supported_vht_mcs_rate_nss1, the rate for MCS9 & VHT20 is defined as
+{780,  867}, this does not align with firmware's definition and therefore
+fails the verification in ath10k_mac_get_rate_flags_vht():
+
+	invalid vht params rate 960 100kbps nss 1 mcs 9
+
+Change it to {865,  960} to align with firmware, so this issue could be
+fixed.
+
+Since ath10k_hw_params::supports_peer_stats_info is enabled only for
+QCA6174, this change does not affect other chips.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: 3344b99d69ab ("ath10k: add bitrate parse for peer stats info")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/lkml/fba24cd3-4a1e-4072-8585-8402272788ff@molgen.mpg.de/
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20240711020344.98040-2-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 03e7bc5b6c0bd..cc7cf91f11147 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -9119,7 +9119,7 @@ static const struct ath10k_index_vht_data_rate_type supported_vht_mcs_rate_nss1[
+ 	{6,  {2633, 2925}, {1215, 1350}, {585,  650} },
+ 	{7,  {2925, 3250}, {1350, 1500}, {650,  722} },
+ 	{8,  {3510, 3900}, {1620, 1800}, {780,  867} },
+-	{9,  {3900, 4333}, {1800, 2000}, {780,  867} }
++	{9,  {3900, 4333}, {1800, 2000}, {865,  960} }
+ };
+ 
+ /*MCS parameters with Nss = 2 */
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch-17860 b/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch-17860
new file mode 100644
index 00000000000..3c4086d7f21
--- /dev/null
+++ b/queue-6.6/wifi-ath10k-fix-invalid-vht-parameters-in-supported_.patch-17860
@@ -0,0 +1,56 @@
+From fa04a9dae2d5164107a559db596d390fb96c9079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2024 10:03:44 +0800
+Subject: wifi: ath10k: fix invalid VHT parameters in
+ supported_vht_mcs_rate_nss2
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit 52db16ec5bae7bd027804265b968259d1a6c3970 ]
+
+In supported_vht_mcs_rate_nss2, the rate for MCS9 & VHT20 is defined as
+{1560, 1733}, this does not align with firmware's definition and therefore
+fails the verification in ath10k_mac_get_rate_flags_vht():
+
+	invalid vht params rate 1730 100kbps nss 2 mcs 9
+
+and:
+
+	invalid vht params rate 1920 100kbps nss 2 mcs 9
+
+Change it to {1730,  1920} to align with firmware to fix the issue.
+
+Since ath10k_hw_params::supports_peer_stats_info is enabled only for
+QCA6174, this change does not affect other chips.
+
+Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1
+
+Fixes: 3344b99d69ab ("ath10k: add bitrate parse for peer stats info")
+Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Closes: https://lore.kernel.org/lkml/fba24cd3-4a1e-4072-8585-8402272788ff@molgen.mpg.de/
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Tested-by: Paul Menzel <pmenzel@molgen.mpg.de> # Dell XPS 13 9360
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20240711020344.98040-3-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index cc7cf91f11147..d5e6e11f630b9 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -9134,7 +9134,7 @@ static const struct ath10k_index_vht_data_rate_type supported_vht_mcs_rate_nss2[
+ 	{6,  {5265, 5850}, {2430, 2700}, {1170, 1300} },
+ 	{7,  {5850, 6500}, {2700, 3000}, {1300, 1444} },
+ 	{8,  {7020, 7800}, {3240, 3600}, {1560, 1733} },
+-	{9,  {7800, 8667}, {3600, 4000}, {1560, 1733} }
++	{9,  {7800, 8667}, {3600, 4000}, {1730, 1920} }
+ };
+ 
+ static void ath10k_mac_get_rate_flags_ht(struct ath10k *ar, u32 rate, u8 nss, u8 mcs,
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-ath11k-fix-ce-offset-address-calculation-for-wc.patch b/queue-6.6/wifi-ath11k-fix-ce-offset-address-calculation-for-wc.patch
new file mode 100644
index 00000000000..4d677288dec
--- /dev/null
+++ b/queue-6.6/wifi-ath11k-fix-ce-offset-address-calculation-for-wc.patch
@@ -0,0 +1,62 @@
+From 4802abdb48533e24876c7dee9c35fdcaa89d80c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 15:28:25 +0530
+Subject: wifi: ath11k: Fix CE offset address calculation for WCN6750 in SSR
+
+From: Balaji Pothunoori <quic_bpothuno@quicinc.com>
+
+[ Upstream commit 4c57ec6c4bb9979b42ae7fa7273fc2d4a361d576 ]
+
+Currently, mem_ce and mem iomem addresses are used to calculate the
+CE offset address. mem_ce is initialized with mem address, and for
+targets where ce_remap is needed, mem_ce is remapped to a new address
+space during AHB probe.
+
+For targets such as WCN6750 in which CE address space is same as WCSS
+address space (i.e. "ce_remap" hw_param is set to false), mem_ce and
+mem iomem addresses are same. In the initial SRNG setup for such targets,
+the CE offset address and hence CE register base addresses are
+calculated correctly in ath11k_hal_srng_init() as both mem and mem_ce
+are initialized with same iomem address.
+
+Later, after the firmware download, mem is initialized with BAR address
+received in qmi_wlanfw_device_info_resp_msg_v01 QMI message, while mem_ce
+is not updated.
+
+After initial setup success, during Subsystem Restart (SSR), as part
+of reinitialization, ath11k_hal_srng_init() will be called again,
+and CE offset address will be calculated incorrectly this time as mem_ce
+address was not updated. Due to the incorrect CE offset address,
+APPS accesses an invalid CE register address which leads to improper
+behavior in firmware after SSR is triggered.
+
+To fix the above issue, update mem_ce to mem iomem address in
+ath11k_qmi_request_device_info() for targets which do not support
+ce_remap feature.
+
+Signed-off-by: Balaji Pothunoori <quic_bpothuno@quicinc.com>
+Fixes: b42b3678c91f ("wifi: ath11k: remap ce register space for IPQ5018")
+Link: https://patch.msgid.link/20240927095825.22317-1-quic_bpothuno@quicinc.com
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
+index 83dc284392de2..fa46e645009cf 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -2180,6 +2180,9 @@ static int ath11k_qmi_request_device_info(struct ath11k_base *ab)
+ 	ab->mem = bar_addr_va;
+ 	ab->mem_len = resp.bar_size;
+ 
++	if (!ab->hw_params.ce_remap)
++		ab->mem_ce = ab->mem;
++
+ 	return 0;
+ out:
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-ath12k-skip-rx-tid-cleanup-for-self-peer.patch b/queue-6.6/wifi-ath12k-skip-rx-tid-cleanup-for-self-peer.patch
new file mode 100644
index 00000000000..ea2e48526cd
--- /dev/null
+++ b/queue-6.6/wifi-ath12k-skip-rx-tid-cleanup-for-self-peer.patch
@@ -0,0 +1,66 @@
+From b6ad4af6b795ccc397cb647a4fa407f224657871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 09:58:51 +0530
+Subject: wifi: ath12k: Skip Rx TID cleanup for self peer
+
+From: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+
+[ Upstream commit 1a0c640ce1cdcde3eb131a0c1e70ca1ed7cf27cb ]
+
+During peer create, dp setup for the peer is done where Rx TID is
+updated for all the TIDs. Peer object for self peer will not go through
+dp setup.
+
+When core halts, dp cleanup is done for all the peers. While cleanup,
+rx_tid::ab is accessed which causes below stack trace for self peer.
+
+WARNING: CPU: 6 PID: 12297 at drivers/net/wireless/ath/ath12k/dp_rx.c:851
+Call Trace:
+__warn+0x7b/0x1a0
+ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k]
+report_bug+0x10b/0x200
+handle_bug+0x3f/0x70
+exc_invalid_op+0x13/0x60
+asm_exc_invalid_op+0x16/0x20
+ath12k_dp_rx_frags_cleanup+0xd2/0xe0 [ath12k]
+ath12k_dp_rx_frags_cleanup+0xca/0xe0 [ath12k]
+ath12k_dp_rx_peer_tid_cleanup+0x39/0xa0 [ath12k]
+ath12k_mac_peer_cleanup_all+0x61/0x100 [ath12k]
+ath12k_core_halt+0x3b/0x100 [ath12k]
+ath12k_core_reset+0x494/0x4c0 [ath12k]
+
+sta object in peer will be updated when remote peer is created. Hence
+use peer::sta to detect the self peer and skip the cleanup.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Ramya Gnanasekar <quic_rgnanase@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20240905042851.2282306-1-quic_rgnanase@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 4bb30e4037287..f90191a290c26 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -775,7 +775,10 @@ void ath12k_mac_peer_cleanup_all(struct ath12k *ar)
+ 
+ 	spin_lock_bh(&ab->base_lock);
+ 	list_for_each_entry_safe(peer, tmp, &ab->peers, list) {
+-		ath12k_dp_rx_peer_tid_cleanup(ar, peer);
++		/* Skip Rx TID cleanup for self peer */
++		if (peer->sta)
++			ath12k_dp_rx_peer_tid_cleanup(ar, peer);
++
+ 		list_del(&peer->list);
+ 		kfree(peer);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch b/queue-6.6/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch
new file mode 100644
index 00000000000..ac2a9d2af1f
--- /dev/null
+++ b/queue-6.6/wifi-ath9k-add-range-check-for-conn_rsp_epid-in-htc_.patch
@@ -0,0 +1,61 @@
+From 32ef4057a5e5f505fac9c06f14cef884df108e7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2024 12:06:03 +0300
+Subject: wifi: ath9k: add range check for conn_rsp_epid in
+ htc_connect_service()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+[ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ]
+
+I found the following bug in my fuzzer:
+
+  UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
+  index 255 is out of range for type 'htc_endpoint [22]'
+  CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+  Workqueue: events request_firmware_work_func
+  Call Trace:
+   <TASK>
+   dump_stack_lvl+0x180/0x1b0
+   __ubsan_handle_out_of_bounds+0xd4/0x130
+   htc_issue_send.constprop.0+0x20c/0x230
+   ? _raw_spin_unlock_irqrestore+0x3c/0x70
+   ath9k_wmi_cmd+0x41d/0x610
+   ? mark_held_locks+0x9f/0xe0
+   ...
+
+Since this bug has been confirmed to be caused by insufficient verification
+of conn_rsp_epid, I think it would be appropriate to add a range check for
+conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://patch.msgid.link/20240909103855.68006-1-aha310510@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
+index 99667aba289df..00dc97ac53b9d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
+@@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target,
+ 		return -ETIMEDOUT;
+ 	}
+ 
++	if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX)
++		return -EINVAL;
++
+ 	*conn_rsp_epid = target->conn_rsp_epid;
+ 	return 0;
+ err:
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch b/queue-6.6/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch
new file mode 100644
index 00000000000..a9cd90b74d7
--- /dev/null
+++ b/queue-6.6/wifi-mwifiex-fix-memcpy-field-spanning-write-warning.patch
@@ -0,0 +1,56 @@
+From b3a46bb04470c78d61ce42847ad731bf6f444ced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 01:20:54 +0300
+Subject: wifi: mwifiex: Fix memcpy() field-spanning write warning in
+ mwifiex_config_scan()
+
+From: Alper Nebi Yasak <alpernebiyasak@gmail.com>
+
+[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ]
+
+Replace one-element array with a flexible-array member in `struct
+mwifiex_ie_types_wildcard_ssid_params` to fix the following warning
+on a MT8173 Chromebook (mt8173-elm-hana):
+
+[  356.775250] ------------[ cut here ]------------
+[  356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)
+[  356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]
+
+The "(size 6)" above is exactly the length of the SSID of the network
+this device was connected to. The source of the warning looks like:
+
+    ssid_len = user_scan_in->ssid_list[i].ssid_len;
+    [...]
+    memcpy(wildcard_ssid_tlv->ssid,
+           user_scan_in->ssid_list[i].ssid, ssid_len);
+
+There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this
+struct, but it already didn't account for the size of the one-element
+array, so it doesn't need to be changed.
+
+Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
+Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20241007222301.24154-1-alpernebiyasak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
+index a3be37526697b..7b06a6d57ffb0 100644
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -842,7 +842,7 @@ struct mwifiex_ietypes_chanstats {
+ struct mwifiex_ie_types_wildcard_ssid_params {
+ 	struct mwifiex_ie_types_header header;
+ 	u8 max_ssid_length;
+-	u8 ssid[1];
++	u8 ssid[];
+ } __packed;
+ 
+ #define TSF_DATA_SIZE            8
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.6/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644
index 00000000000..b7d134846dd
--- /dev/null
+++ b/queue-6.6/wifi-mwifiex-use-irqf_no_autoen-flag-in-request_irq.patch
@@ -0,0 +1,48 @@
+From 9aeb87c841b99d900e4d713edfdadbb53cea5013 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 20:43:13 +0800
+Subject: wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 9a98dd48b6d834d7a3fe5e8e7b8c3a1d006f9685 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 853402a00823 ("mwifiex: Enable WoWLAN for both sdio and pcie")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Acked-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20240910124314.698896-3-ruanjinjie@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index d99127dc466ec..6c60a4c21a312 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -1633,7 +1633,8 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter)
+ 	}
+ 
+ 	ret = devm_request_irq(dev, adapter->irq_wakeup,
+-			       mwifiex_irq_wakeup_handler, IRQF_TRIGGER_LOW,
++			       mwifiex_irq_wakeup_handler,
++			       IRQF_TRIGGER_LOW | IRQF_NO_AUTOEN,
+ 			       "wifi_wake", adapter);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to request irq_wakeup %d (%d)\n",
+@@ -1641,7 +1642,6 @@ static void mwifiex_probe_of(struct mwifiex_adapter *adapter)
+ 		goto err_exit;
+ 	}
+ 
+-	disable_irq(adapter->irq_wakeup);
+ 	if (device_init_wakeup(dev, true)) {
+ 		dev_err(dev, "fail to init wakeup for mwifiex\n");
+ 		goto err_exit;
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.6/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644
index 00000000000..c2b6ffff8f9
--- /dev/null
+++ b/queue-6.6/wifi-p54-use-irqf_no_autoen-flag-in-request_irq.patch
@@ -0,0 +1,47 @@
+From 3292edf24647dfb8bd9992bfac330add208e3e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2024 20:43:12 +0800
+Subject: wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit bcd1371bd85e560ccc9159b7747f94bfe43b77a6 ]
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: cd8d3d321285 ("p54spi: p54spi driver")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20240910124314.698896-2-ruanjinjie@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/p54/p54spi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c
+index ce0179b8ab368..90ebed33d792b 100644
+--- a/drivers/net/wireless/intersil/p54/p54spi.c
++++ b/drivers/net/wireless/intersil/p54/p54spi.c
+@@ -624,7 +624,7 @@ static int p54spi_probe(struct spi_device *spi)
+ 	gpio_direction_input(p54spi_gpio_irq);
+ 
+ 	ret = request_irq(gpio_to_irq(p54spi_gpio_irq),
+-			  p54spi_interrupt, 0, "p54spi",
++			  p54spi_interrupt, IRQF_NO_AUTOEN, "p54spi",
+ 			  priv->spi);
+ 	if (ret < 0) {
+ 		dev_err(&priv->spi->dev, "request_irq() failed");
+@@ -633,8 +633,6 @@ static int p54spi_probe(struct spi_device *spi)
+ 
+ 	irq_set_irq_type(gpio_to_irq(p54spi_gpio_irq), IRQ_TYPE_EDGE_RISING);
+ 
+-	disable_irq(gpio_to_irq(p54spi_gpio_irq));
+-
+ 	INIT_WORK(&priv->work, p54spi_work);
+ 	init_completion(&priv->fw_comp);
+ 	INIT_LIST_HEAD(&priv->tx_pending);
+-- 
+2.43.0
+
diff --git a/queue-6.6/wifi-wfx-fix-error-handling-in-wfx_core_init.patch b/queue-6.6/wifi-wfx-fix-error-handling-in-wfx_core_init.patch
new file mode 100644
index 00000000000..faedbf8e87c
--- /dev/null
+++ b/queue-6.6/wifi-wfx-fix-error-handling-in-wfx_core_init.patch
@@ -0,0 +1,60 @@
+From b9de501af8de7ab8c9988a2b6426f563027b6900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 17:04:53 +0800
+Subject: wifi: wfx: Fix error handling in wfx_core_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 3b88a9876779b55478a4dde867e73f7a100ffa23 ]
+
+The wfx_core_init() returns without checking the retval from
+sdio_register_driver().
+If the sdio_register_driver() failed, the module failed to install,
+leaving the wfx_spi_driver not unregistered.
+
+Fixes: a7a91ca5a23d ("staging: wfx: add infrastructure for new driver")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20241022090453.84679-1-yuancan@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/silabs/wfx/main.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/silabs/wfx/main.c b/drivers/net/wireless/silabs/wfx/main.c
+index ede822d771aaf..f2409830d87e3 100644
+--- a/drivers/net/wireless/silabs/wfx/main.c
++++ b/drivers/net/wireless/silabs/wfx/main.c
+@@ -475,10 +475,23 @@ static int __init wfx_core_init(void)
+ {
+ 	int ret = 0;
+ 
+-	if (IS_ENABLED(CONFIG_SPI))
++	if (IS_ENABLED(CONFIG_SPI)) {
+ 		ret = spi_register_driver(&wfx_spi_driver);
+-	if (IS_ENABLED(CONFIG_MMC) && !ret)
++		if (ret)
++			goto out;
++	}
++	if (IS_ENABLED(CONFIG_MMC)) {
+ 		ret = sdio_register_driver(&wfx_sdio_driver);
++		if (ret)
++			goto unregister_spi;
++	}
++
++	return 0;
++
++unregister_spi:
++	if (IS_ENABLED(CONFIG_SPI))
++		spi_unregister_driver(&wfx_spi_driver);
++out:
+ 	return ret;
+ }
+ module_init(wfx_core_init);
+-- 
+2.43.0
+
diff --git a/queue-6.6/wireguard-selftests-load-nf_conntrack-if-not-present.patch b/queue-6.6/wireguard-selftests-load-nf_conntrack-if-not-present.patch
new file mode 100644
index 00000000000..bd25aa00c6b
--- /dev/null
+++ b/queue-6.6/wireguard-selftests-load-nf_conntrack-if-not-present.patch
@@ -0,0 +1,40 @@
+From 5c42f5841b02609214fca0ca9726cd47727a3a37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2024 22:20:29 +0100
+Subject: wireguard: selftests: load nf_conntrack if not present
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 0290abc9860917f1ee8b58309c2bbd740a39ee8e ]
+
+Some distros may not load nf_conntrack by default, which will cause
+subsequent nf_conntrack sets to fail. Load this module if it is not
+already loaded.
+
+Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+[ Jason: add [[ -e ... ]] check so this works in the qemu harness. ]
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Link: https://patch.msgid.link/20241117212030.629159-4-Jason@zx2c4.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/wireguard/netns.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh
+index 405ff262ca93d..55500f901fbc3 100755
+--- a/tools/testing/selftests/wireguard/netns.sh
++++ b/tools/testing/selftests/wireguard/netns.sh
+@@ -332,6 +332,7 @@ waitiface $netns1 vethc
+ waitiface $netns2 veths
+ 
+ n0 bash -c 'printf 1 > /proc/sys/net/ipv4/ip_forward'
++[[ -e /proc/sys/net/netfilter/nf_conntrack_udp_timeout ]] || modprobe nf_conntrack
+ n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout'
+ n0 bash -c 'printf 2 > /proc/sys/net/netfilter/nf_conntrack_udp_timeout_stream'
+ n0 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j SNAT --to 10.0.0.1
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-of-unconditionally-call-unflatten_and_copy_devic.patch b/queue-6.6/x86-of-unconditionally-call-unflatten_and_copy_devic.patch
new file mode 100644
index 00000000000..8d7f49340cb
--- /dev/null
+++ b/queue-6.6/x86-of-unconditionally-call-unflatten_and_copy_devic.patch
@@ -0,0 +1,77 @@
+From 09bf4fd081a502dd7c3ddb4473deaf92b5faccd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 17:05:53 -0800
+Subject: x86/of: Unconditionally call unflatten_and_copy_device_tree()
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 40f18dbbb42c56019b889b5b1fdce3da89e354da ]
+
+Call this function unconditionally so that we can populate an empty DTB
+on platforms that don't boot with a firmware provided or builtin DTB.
+There's no harm in calling unflatten_device_tree() unconditionally here.
+If there isn't a non-NULL 'initial_boot_params' pointer then
+unflatten_device_tree() returns early.
+
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: x86@kernel.org
+Cc: H. Peter Anvin <hpa@zytor.com>
+Tested-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20240217010557.2381548-5-sboyd@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Stable-dep-of: b2473a359763 ("of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/devicetree.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
+index c13c9cb40b9b4..47fe7de1575dd 100644
+--- a/arch/x86/kernel/devicetree.c
++++ b/arch/x86/kernel/devicetree.c
+@@ -283,22 +283,24 @@ static void __init x86_flattree_get_config(void)
+ 	u32 size, map_len;
+ 	void *dt;
+ 
+-	if (!initial_dtb)
+-		return;
+-
+-	map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
++	if (initial_dtb) {
++		map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
++
++		dt = early_memremap(initial_dtb, map_len);
++		size = fdt_totalsize(dt);
++		if (map_len < size) {
++			early_memunmap(dt, map_len);
++			dt = early_memremap(initial_dtb, size);
++			map_len = size;
++		}
+ 
+-	dt = early_memremap(initial_dtb, map_len);
+-	size = fdt_totalsize(dt);
+-	if (map_len < size) {
+-		early_memunmap(dt, map_len);
+-		dt = early_memremap(initial_dtb, size);
+-		map_len = size;
++		early_init_dt_verify(dt);
+ 	}
+ 
+-	early_init_dt_verify(dt);
+ 	unflatten_and_copy_device_tree();
+-	early_memunmap(dt, map_len);
++
++	if (initial_dtb)
++		early_memunmap(dt, map_len);
+ }
+ #else
+ static inline void x86_flattree_get_config(void) { }
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch b/queue-6.6/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
new file mode 100644
index 00000000000..b5a49779117
--- /dev/null
+++ b/queue-6.6/x86-pvh-call-c-code-via-the-kernel-virtual-mapping.patch
@@ -0,0 +1,54 @@
+From edbf6dae03a54271d3074fc77b7f7397ab45e87b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 18:04:40 +0200
+Subject: x86/pvh: Call C code via the kernel virtual mapping
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e8fbc0d9cab6c1ee6403f42c0991b0c1d5dbc092 ]
+
+Calling C code via a different mapping than it was linked at is
+problematic, because the compiler assumes that RIP-relative and absolute
+symbol references are interchangeable. GCC in particular may use
+RIP-relative per-CPU variable references even when not using -fpic.
+
+So call xen_prepare_pvh() via its kernel virtual mapping on x86_64, so
+that those RIP-relative references produce the correct values. This
+matches the pre-existing behavior for i386, which also invokes
+xen_prepare_pvh() via the kernel virtual mapping before invoking
+startup_32 with paging disabled again.
+
+Fixes: 7243b93345f7 ("xen/pvh: Bootstrap PVH guest")
+Tested-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Jason Andryuk <jason.andryuk@amd.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Message-ID: <20241009160438.3884381-8-ardb+git@google.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index c994ea58bdf7a..008a805522245 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -107,7 +107,14 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+ 	movq %rbp, %rbx
+ 	subq $_pa(pvh_start_xen), %rbx
+ 	movq %rbx, phys_base(%rip)
+-	call xen_prepare_pvh
++
++	/* Call xen_prepare_pvh() via the kernel virtual mapping */
++	leaq xen_prepare_pvh(%rip), %rax
++	subq phys_base(%rip), %rax
++	addq $__START_KERNEL_map, %rax
++	ANNOTATE_RETPOLINE_SAFE
++	call *%rax
++
+ 	/*
+ 	 * Clear phys_base.  __startup_64 will *add* to its value,
+ 	 * so reset to 0.
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch b/queue-6.6/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch
new file mode 100644
index 00000000000..cf5c7d946a4
--- /dev/null
+++ b/queue-6.6/x86-pvh-set-phys_base-when-calling-xen_prepare_pvh.patch
@@ -0,0 +1,52 @@
+From 67cfd6cc82bd2e2c4aebc337b60c18f8de580e84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2024 15:36:28 -0400
+Subject: x86/pvh: Set phys_base when calling xen_prepare_pvh()
+
+From: Jason Andryuk <jason.andryuk@amd.com>
+
+[ Upstream commit b464b461d27d564125db760938643374864c1b1f ]
+
+phys_base needs to be set for __pa() to work in xen_pvh_init() when
+finding the hypercall page.  Set it before calling into
+xen_prepare_pvh(), which calls xen_pvh_init().  Clear it afterward to
+avoid __startup_64() adding to it and creating an incorrect value.
+
+Signed-off-by: Jason Andryuk <jason.andryuk@amd.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Message-ID: <20240823193630.2583107-4-jason.andryuk@amd.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Stable-dep-of: e8fbc0d9cab6 ("x86/pvh: Call C code via the kernel virtual mapping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/pvh/head.S | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
+index c4365a05ab83b..c994ea58bdf7a 100644
+--- a/arch/x86/platform/pvh/head.S
++++ b/arch/x86/platform/pvh/head.S
+@@ -100,7 +100,20 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
+ 	xor %edx, %edx
+ 	wrmsr
+ 
++	/*
++	 * Calculate load offset and store in phys_base.  __pa() needs
++	 * phys_base set to calculate the hypercall page in xen_pvh_init().
++	 */
++	movq %rbp, %rbx
++	subq $_pa(pvh_start_xen), %rbx
++	movq %rbx, phys_base(%rip)
+ 	call xen_prepare_pvh
++	/*
++	 * Clear phys_base.  __startup_64 will *add* to its value,
++	 * so reset to 0.
++	 */
++	xor  %rbx, %rbx
++	movq %rbx, phys_base(%rip)
+ 
+ 	/* startup_64 expects boot_params in %rsi. */
+ 	mov $_pa(pvh_bootparams), %rsi
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-dynamically-disable-sept-violations-from-cau.patch b/queue-6.6/x86-tdx-dynamically-disable-sept-violations-from-cau.patch
new file mode 100644
index 00000000000..fd6e9821868
--- /dev/null
+++ b/queue-6.6/x86-tdx-dynamically-disable-sept-violations-from-cau.patch
@@ -0,0 +1,172 @@
+From b51aab4fcfe147ccf8097530232dcdaeb2a8ae7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:38:02 +0200
+Subject: x86/tdx: Dynamically disable SEPT violations from causing #VEs
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit f65aa0ad79fca4ace921da0701644f020129043d ]
+
+Memory access #VEs are hard for Linux to handle in contexts like the
+entry code or NMIs.  But other OSes need them for functionality.
+There's a static (pre-guest-boot) way for a VMM to choose one or the
+other.  But VMMs don't always know which OS they are booting, so they
+choose to deliver those #VEs so the "other" OSes will work.  That,
+unfortunately has left us in the lurch and exposed to these
+hard-to-handle #VEs.
+
+The TDX module has introduced a new feature. Even if the static
+configuration is set to "send nasty #VEs", the kernel can dynamically
+request that they be disabled. Once they are disabled, access to private
+memory that is not in the Mapped state in the Secure-EPT (SEPT) will
+result in an exit to the VMM rather than injecting a #VE.
+
+Check if the feature is available and disable SEPT #VE if possible.
+
+If the TD is allowed to disable/enable SEPT #VEs, the ATTR_SEPT_VE_DISABLE
+attribute is no longer reliable. It reflects the initial state of the
+control for the TD, but it will not be updated if someone (e.g. bootloader)
+changes it before the kernel starts. Kernel must check TDCS_TD_CTLS bit to
+determine if SEPT #VEs are enabled or disabled.
+
+[ dhansen: remove 'return' at end of function ]
+
+Fixes: 373e715e31bf ("x86/tdx: Panic on bad configs that #VE on "private" memory access")
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Acked-by: Kai Huang <kai.huang@intel.com>
+Link: https://lore.kernel.org/all/20241104103803.195705-4-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdx.c           | 74 ++++++++++++++++++++++++-------
+ arch/x86/include/asm/shared/tdx.h | 10 ++++-
+ 2 files changed, 67 insertions(+), 17 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index de4ff833fcf00..2f67e196a2ead 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -75,7 +75,7 @@ static inline void tdcall(u64 fn, struct tdx_module_args *args)
+ }
+ 
+ /* Read TD-scoped metadata */
+-static inline u64 __maybe_unused tdg_vm_rd(u64 field, u64 *value)
++static inline u64 tdg_vm_rd(u64 field, u64 *value)
+ {
+ 	struct tdx_module_args args = {
+ 		.rdx = field,
+@@ -169,6 +169,60 @@ static void __noreturn tdx_panic(const char *msg)
+ 		__tdx_hypercall(&args);
+ }
+ 
++/*
++ * The kernel cannot handle #VEs when accessing normal kernel memory. Ensure
++ * that no #VE will be delivered for accesses to TD-private memory.
++ *
++ * TDX 1.0 does not allow the guest to disable SEPT #VE on its own. The VMM
++ * controls if the guest will receive such #VE with TD attribute
++ * ATTR_SEPT_VE_DISABLE.
++ *
++ * Newer TDX modules allow the guest to control if it wants to receive SEPT
++ * violation #VEs.
++ *
++ * Check if the feature is available and disable SEPT #VE if possible.
++ *
++ * If the TD is allowed to disable/enable SEPT #VEs, the ATTR_SEPT_VE_DISABLE
++ * attribute is no longer reliable. It reflects the initial state of the
++ * control for the TD, but it will not be updated if someone (e.g. bootloader)
++ * changes it before the kernel starts. Kernel must check TDCS_TD_CTLS bit to
++ * determine if SEPT #VEs are enabled or disabled.
++ */
++static void disable_sept_ve(u64 td_attr)
++{
++	const char *msg = "TD misconfiguration: SEPT #VE has to be disabled";
++	bool debug = td_attr & ATTR_DEBUG;
++	u64 config, controls;
++
++	/* Is this TD allowed to disable SEPT #VE */
++	tdg_vm_rd(TDCS_CONFIG_FLAGS, &config);
++	if (!(config & TDCS_CONFIG_FLEXIBLE_PENDING_VE)) {
++		/* No SEPT #VE controls for the guest: check the attribute */
++		if (td_attr & ATTR_SEPT_VE_DISABLE)
++			return;
++
++		/* Relax SEPT_VE_DISABLE check for debug TD for backtraces */
++		if (debug)
++			pr_warn("%s\n", msg);
++		else
++			tdx_panic(msg);
++		return;
++	}
++
++	/* Check if SEPT #VE has been disabled before us */
++	tdg_vm_rd(TDCS_TD_CTLS, &controls);
++	if (controls & TD_CTLS_PENDING_VE_DISABLE)
++		return;
++
++	/* Keep #VEs enabled for splats in debugging environments */
++	if (debug)
++		return;
++
++	/* Disable SEPT #VEs */
++	tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_PENDING_VE_DISABLE,
++		  TD_CTLS_PENDING_VE_DISABLE);
++}
++
+ static void tdx_setup(u64 *cc_mask)
+ {
+ 	struct tdx_module_args args = {};
+@@ -194,24 +248,12 @@ static void tdx_setup(u64 *cc_mask)
+ 	gpa_width = args.rcx & GENMASK(5, 0);
+ 	*cc_mask = BIT_ULL(gpa_width - 1);
+ 
++	td_attr = args.rdx;
++
+ 	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+ 	tdg_vm_wr(TDCS_NOTIFY_ENABLES, 0, -1ULL);
+ 
+-	/*
+-	 * The kernel can not handle #VE's when accessing normal kernel
+-	 * memory.  Ensure that no #VE will be delivered for accesses to
+-	 * TD-private memory.  Only VMM-shared memory (MMIO) will #VE.
+-	 */
+-	td_attr = args.rdx;
+-	if (!(td_attr & ATTR_SEPT_VE_DISABLE)) {
+-		const char *msg = "TD misconfiguration: SEPT_VE_DISABLE attribute must be set.";
+-
+-		/* Relax SEPT_VE_DISABLE check for debug TD. */
+-		if (td_attr & ATTR_DEBUG)
+-			pr_warn("%s\n", msg);
+-		else
+-			tdx_panic(msg);
+-	}
++	disable_sept_ve(td_attr);
+ }
+ 
+ /*
+diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
+index dfae78d2d4791..aed99fb099d9c 100644
+--- a/arch/x86/include/asm/shared/tdx.h
++++ b/arch/x86/include/asm/shared/tdx.h
+@@ -18,9 +18,17 @@
+ #define TDG_VM_RD			7
+ #define TDG_VM_WR			8
+ 
+-/* TDCS fields. To be used by TDG.VM.WR and TDG.VM.RD module calls */
++/* TDX TD-Scope Metadata. To be used by TDG.VM.WR and TDG.VM.RD */
++#define TDCS_CONFIG_FLAGS		0x1110000300000016
++#define TDCS_TD_CTLS			0x1110000300000017
+ #define TDCS_NOTIFY_ENABLES		0x9100000000000010
+ 
++/* TDCS_CONFIG_FLAGS bits */
++#define TDCS_CONFIG_FLEXIBLE_PENDING_VE	BIT_ULL(1)
++
++/* TDCS_TD_CTLS bits */
++#define TD_CTLS_PENDING_VE_DISABLE	BIT_ULL(0)
++
+ /* TDX hypercall Leaf IDs */
+ #define TDVMCALL_MAP_GPA		0x10001
+ #define TDVMCALL_REPORT_FATAL_ERROR	0x10003
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-introduce-wrappers-to-read-and-write-td-meta.patch b/queue-6.6/x86-tdx-introduce-wrappers-to-read-and-write-td-meta.patch
new file mode 100644
index 00000000000..b226dd38f35
--- /dev/null
+++ b/queue-6.6/x86-tdx-introduce-wrappers-to-read-and-write-td-meta.patch
@@ -0,0 +1,106 @@
+From dc5f4a423b2d67496a1885ea8df6968c517b4cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:38:00 +0200
+Subject: x86/tdx: Introduce wrappers to read and write TD metadata
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 5081e8fadb809253c911b349b01d87c5b4e3fec5 ]
+
+The TDG_VM_WR TDCALL is used to ask the TDX module to change some
+TD-specific VM configuration. There is currently only one user in the
+kernel of this TDCALL leaf.  More will be added shortly.
+
+Refactor to make way for more users of TDG_VM_WR who will need to modify
+other TD configuration values.
+
+Add a wrapper for the TDG_VM_RD TDCALL that requests TD-specific
+metadata from the TDX module. There are currently no users for
+TDG_VM_RD. Mark it as __maybe_unused until the first user appears.
+
+This is preparation for enumeration and enabling optional TD features.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://lore.kernel.org/all/20241104103803.195705-2-kirill.shutemov%40linux.intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdx.c           | 32 ++++++++++++++++++++++++++-----
+ arch/x86/include/asm/shared/tdx.h |  1 +
+ 2 files changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index d0d7a42230b84..0bb895344497e 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -74,6 +74,32 @@ static inline void tdcall(u64 fn, struct tdx_module_args *args)
+ 		panic("TDCALL %lld failed (Buggy TDX module!)\n", fn);
+ }
+ 
++/* Read TD-scoped metadata */
++static inline u64 __maybe_unused tdg_vm_rd(u64 field, u64 *value)
++{
++	struct tdx_module_args args = {
++		.rdx = field,
++	};
++	u64 ret;
++
++	ret = __tdcall_ret(TDG_VM_RD, &args);
++	*value = args.r8;
++
++	return ret;
++}
++
++/* Write TD-scoped metadata */
++static inline u64 tdg_vm_wr(u64 field, u64 value, u64 mask)
++{
++	struct tdx_module_args args = {
++		.rdx = field,
++		.r8 = value,
++		.r9 = mask,
++	};
++
++	return __tdcall(TDG_VM_WR, &args);
++}
++
+ /**
+  * tdx_mcall_get_report0() - Wrapper to get TDREPORT0 (a.k.a. TDREPORT
+  *                           subtype 0) using TDG.MR.REPORT TDCALL.
+@@ -767,10 +793,6 @@ static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
+ 
+ void __init tdx_early_init(void)
+ {
+-	struct tdx_module_args args = {
+-		.rdx = TDCS_NOTIFY_ENABLES,
+-		.r9 = -1ULL,
+-	};
+ 	u64 cc_mask;
+ 	u32 eax, sig[3];
+ 
+@@ -786,7 +808,7 @@ void __init tdx_early_init(void)
+ 	cc_set_mask(cc_mask);
+ 
+ 	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+-	tdcall(TDG_VM_WR, &args);
++	tdg_vm_wr(TDCS_NOTIFY_ENABLES, 0, -1ULL);
+ 
+ 	/*
+ 	 * All bits above GPA width are reserved and kernel treats shared bit
+diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
+index 3606463ebf6fb..dfae78d2d4791 100644
+--- a/arch/x86/include/asm/shared/tdx.h
++++ b/arch/x86/include/asm/shared/tdx.h
+@@ -15,6 +15,7 @@
+ #define TDG_VP_VEINFO_GET		3
+ #define TDG_MR_REPORT			4
+ #define TDG_MEM_PAGE_ACCEPT		6
++#define TDG_VM_RD			7
+ #define TDG_VM_WR			8
+ 
+ /* TDCS fields. To be used by TDG.VM.WR and TDG.VM.RD module calls */
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-make-macros-of-tdcalls-consistent-with-the-s.patch b/queue-6.6/x86-tdx-make-macros-of-tdcalls-consistent-with-the-s.patch
new file mode 100644
index 00000000000..582ea215a1c
--- /dev/null
+++ b/queue-6.6/x86-tdx-make-macros-of-tdcalls-consistent-with-the-s.patch
@@ -0,0 +1,121 @@
+From cfeb60c1831a2b0d87c01691272b766961c37796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 23:01:57 +1200
+Subject: x86/tdx: Make macros of TDCALLs consistent with the spec
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit f0024dbfc48d8814d915eb5bd5253496b9b8a6df ]
+
+The TDX spec names all TDCALLs with prefix "TDG".  Currently, the kernel
+doesn't follow such convention for the macros of those TDCALLs but uses
+prefix "TDX_" for all of them.  Although it's arguable whether the TDX
+spec names those TDCALLs properly, it's better for the kernel to follow
+the spec when naming those macros.
+
+Change all macros of TDCALLs to make them consistent with the spec.  As
+a bonus, they get distinguished easily from the host-side SEAMCALLs,
+which all have prefix "TDH".
+
+No functional change intended.
+
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/all/516dccd0bd8fb9a0b6af30d25bb2d971aa03d598.1692096753.git.kai.huang%40intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdx-shared.c    |  4 ++--
+ arch/x86/coco/tdx/tdx.c           |  8 ++++----
+ arch/x86/include/asm/shared/tdx.h | 10 +++++-----
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdx-shared.c b/arch/x86/coco/tdx/tdx-shared.c
+index ef20ddc37b58a..f10cd3e4a04ed 100644
+--- a/arch/x86/coco/tdx/tdx-shared.c
++++ b/arch/x86/coco/tdx/tdx-shared.c
+@@ -35,7 +35,7 @@ static unsigned long try_accept_one(phys_addr_t start, unsigned long len,
+ 	}
+ 
+ 	tdcall_rcx = start | page_size;
+-	if (__tdx_module_call(TDX_ACCEPT_PAGE, tdcall_rcx, 0, 0, 0, NULL))
++	if (__tdx_module_call(TDG_MEM_PAGE_ACCEPT, tdcall_rcx, 0, 0, 0, NULL))
+ 		return 0;
+ 
+ 	return accept_size;
+@@ -45,7 +45,7 @@ bool tdx_accept_memory(phys_addr_t start, phys_addr_t end)
+ {
+ 	/*
+ 	 * For shared->private conversion, accept the page using
+-	 * TDX_ACCEPT_PAGE TDX module call.
++	 * TDG_MEM_PAGE_ACCEPT TDX module call.
+ 	 */
+ 	while (start < end) {
+ 		unsigned long len = end - start;
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index 905ac8a3f7165..fd389b137fab8 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -93,7 +93,7 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
+ {
+ 	u64 ret;
+ 
+-	ret = __tdx_module_call(TDX_GET_REPORT, virt_to_phys(tdreport),
++	ret = __tdx_module_call(TDG_MR_REPORT, virt_to_phys(tdreport),
+ 				virt_to_phys(reportdata), TDREPORT_SUBTYPE_0,
+ 				0, NULL);
+ 	if (ret) {
+@@ -154,7 +154,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	 * Guest-Host-Communication Interface (GHCI), section 2.4.2 TDCALL
+ 	 * [TDG.VP.INFO].
+ 	 */
+-	tdx_module_call(TDX_GET_INFO, 0, 0, 0, 0, &out);
++	tdx_module_call(TDG_VP_INFO, 0, 0, 0, 0, &out);
+ 
+ 	/*
+ 	 * The highest bit of a guest physical address is the "sharing" bit.
+@@ -600,7 +600,7 @@ void tdx_get_ve_info(struct ve_info *ve)
+ 	 * Note, the TDX module treats virtual NMIs as inhibited if the #VE
+ 	 * valid flag is set. It means that NMI=>#VE will not result in a #DF.
+ 	 */
+-	tdx_module_call(TDX_GET_VEINFO, 0, 0, 0, 0, &out);
++	tdx_module_call(TDG_VP_VEINFO_GET, 0, 0, 0, 0, &out);
+ 
+ 	/* Transfer the output parameters */
+ 	ve->exit_reason = out.rcx;
+@@ -780,7 +780,7 @@ void __init tdx_early_init(void)
+ 	cc_set_mask(cc_mask);
+ 
+ 	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+-	tdx_module_call(TDX_WR, 0, TDCS_NOTIFY_ENABLES, 0, -1ULL, NULL);
++	tdx_module_call(TDG_VM_WR, 0, TDCS_NOTIFY_ENABLES, 0, -1ULL, NULL);
+ 
+ 	/*
+ 	 * All bits above GPA width are reserved and kernel treats shared bit
+diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
+index 7513b3bb69b7e..78f109446da6f 100644
+--- a/arch/x86/include/asm/shared/tdx.h
++++ b/arch/x86/include/asm/shared/tdx.h
+@@ -11,11 +11,11 @@
+ #define TDX_IDENT		"IntelTDX    "
+ 
+ /* TDX module Call Leaf IDs */
+-#define TDX_GET_INFO			1
+-#define TDX_GET_VEINFO			3
+-#define TDX_GET_REPORT			4
+-#define TDX_ACCEPT_PAGE			6
+-#define TDX_WR				8
++#define TDG_VP_INFO			1
++#define TDG_VP_VEINFO_GET		3
++#define TDG_MR_REPORT			4
++#define TDG_MEM_PAGE_ACCEPT		6
++#define TDG_VM_WR			8
+ 
+ /* TDCS fields. To be used by TDG.VM.WR and TDG.VM.RD module calls */
+ #define TDCS_NOTIFY_ENABLES		0x9100000000000010
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-pass-tdcall-seamcall-input-output-registers-.patch b/queue-6.6/x86-tdx-pass-tdcall-seamcall-input-output-registers-.patch
new file mode 100644
index 00000000000..108dea81405
--- /dev/null
+++ b/queue-6.6/x86-tdx-pass-tdcall-seamcall-input-output-registers-.patch
@@ -0,0 +1,455 @@
+From 3532f0520c83828d5117a3473d431cd1c0d2125c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 23:01:59 +1200
+Subject: x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit 57a420bb8186d1d0178b857e5dd5026093641654 ]
+
+Currently, the TDX_MODULE_CALL asm macro, which handles both TDCALL and
+SEAMCALL, takes one parameter for each input register and an optional
+'struct tdx_module_output' (a collection of output registers) as output.
+This is different from the TDX_HYPERCALL macro which uses a single
+'struct tdx_hypercall_args' to carry all input/output registers.
+
+The newer TDX versions introduce more TDCALLs/SEAMCALLs which use more
+input/output registers.  Also, the TDH.VP.ENTER (which isn't covered
+by the current TDX_MODULE_CALL macro) basically can use all registers
+that the TDX_HYPERCALL does.  The current TDX_MODULE_CALL macro isn't
+extendible to cover those cases.
+
+Similar to the TDX_HYPERCALL macro, simplify the TDX_MODULE_CALL macro
+to use a single structure 'struct tdx_module_args' to carry all the
+input/output registers.  Currently, R10/R11 are only used as output
+register but not as input by any TDCALL/SEAMCALL.  Change to also use
+R10/R11 as input register to make input/output registers symmetric.
+
+Currently, the TDX_MODULE_CALL macro depends on the caller to pass a
+non-NULL 'struct tdx_module_output' to get additional output registers.
+Similar to the TDX_HYPERCALL macro, change the TDX_MODULE_CALL macro to
+take a new 'ret' macro argument to indicate whether to save the output
+registers to the 'struct tdx_module_args'.  Also introduce a new
+__tdcall_ret() for that purpose, similar to the __tdx_hypercall_ret().
+
+Note the tdcall(), which is a wrapper of __tdcall(), is called by three
+callers: tdx_parse_tdinfo(), tdx_get_ve_info() and tdx_early_init().
+The former two need the additional output but the last one doesn't.  For
+simplicity, make tdcall() always call __tdcall_ret() to avoid another
+"_ret()" wrapper.  The last caller tdx_early_init() isn't performance
+critical anyway.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/all/483616c1762d85eb3a3c3035a7de061cfacf2f14.1692096753.git.kai.huang%40intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdcall.S        | 47 ++++++---------
+ arch/x86/coco/tdx/tdx-shared.c    |  6 +-
+ arch/x86/coco/tdx/tdx.c           | 44 +++++++-------
+ arch/x86/include/asm/shared/tdx.h |  8 +--
+ arch/x86/kernel/asm-offsets.c     | 12 ++--
+ arch/x86/virt/vmx/tdx/tdxcall.S   | 95 +++++++++++++------------------
+ 6 files changed, 95 insertions(+), 117 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdcall.S b/arch/x86/coco/tdx/tdcall.S
+index 6aebac08f2bfe..56b9cd32895e4 100644
+--- a/arch/x86/coco/tdx/tdcall.S
++++ b/arch/x86/coco/tdx/tdcall.S
+@@ -43,37 +43,10 @@
+  * __tdcall()  - Used by TDX guests to request services from the TDX
+  * module (does not include VMM services) using TDCALL instruction.
+  *
+- * Transforms function call register arguments into the TDCALL register ABI.
+- * After TDCALL operation, TDX module output is saved in @out (if it is
+- * provided by the user).
+- *
+- *-------------------------------------------------------------------------
+- * TDCALL ABI:
+- *-------------------------------------------------------------------------
+- * Input Registers:
+- *
+- * RAX                 - TDCALL Leaf number.
+- * RCX,RDX,R8-R9       - TDCALL Leaf specific input registers.
+- *
+- * Output Registers:
+- *
+- * RAX                 - TDCALL instruction error code.
+- * RCX,RDX,R8-R11      - TDCALL Leaf specific output registers.
+- *
+- *-------------------------------------------------------------------------
+- *
+  * __tdcall() function ABI:
+  *
+- * @fn  (RDI)          - TDCALL Leaf ID,    moved to RAX
+- * @rcx (RSI)          - Input parameter 1, moved to RCX
+- * @rdx (RDX)          - Input parameter 2, moved to RDX
+- * @r8  (RCX)          - Input parameter 3, moved to R8
+- * @r9  (R8)           - Input parameter 4, moved to R9
+- *
+- * @out (R9)           - struct tdx_module_output pointer
+- *                       stored temporarily in R12 (not
+- *                       shared with the TDX module). It
+- *                       can be NULL.
++ * @fn   (RDI)	- TDCALL Leaf ID, moved to RAX
++ * @args (RSI)	- struct tdx_module_args for input
+  *
+  * Return status of TDCALL via RAX.
+  */
+@@ -81,6 +54,22 @@ SYM_FUNC_START(__tdcall)
+ 	TDX_MODULE_CALL host=0
+ SYM_FUNC_END(__tdcall)
+ 
++/*
++ * __tdcall_ret() - Used by TDX guests to request services from the TDX
++ * module (does not include VMM services) using TDCALL instruction, with
++ * saving output registers to the 'struct tdx_module_args' used as input.
++ *
++ * __tdcall_ret() function ABI:
++ *
++ * @fn   (RDI)	- TDCALL Leaf ID, moved to RAX
++ * @args (RSI)	- struct tdx_module_args for input and output
++ *
++ * Return status of TDCALL via RAX.
++ */
++SYM_FUNC_START(__tdcall_ret)
++	TDX_MODULE_CALL host=0 ret=1
++SYM_FUNC_END(__tdcall_ret)
++
+ /*
+  * TDX_HYPERCALL - Make hypercalls to a TDX VMM using TDVMCALL leaf of TDCALL
+  * instruction
+diff --git a/arch/x86/coco/tdx/tdx-shared.c b/arch/x86/coco/tdx/tdx-shared.c
+index 90631abdac34d..a7396d0ddef9e 100644
+--- a/arch/x86/coco/tdx/tdx-shared.c
++++ b/arch/x86/coco/tdx/tdx-shared.c
+@@ -5,7 +5,7 @@ static unsigned long try_accept_one(phys_addr_t start, unsigned long len,
+ 				    enum pg_level pg_level)
+ {
+ 	unsigned long accept_size = page_level_size(pg_level);
+-	u64 tdcall_rcx;
++	struct tdx_module_args args = {};
+ 	u8 page_size;
+ 
+ 	if (!IS_ALIGNED(start, accept_size))
+@@ -34,8 +34,8 @@ static unsigned long try_accept_one(phys_addr_t start, unsigned long len,
+ 		return 0;
+ 	}
+ 
+-	tdcall_rcx = start | page_size;
+-	if (__tdcall(TDG_MEM_PAGE_ACCEPT, tdcall_rcx, 0, 0, 0, NULL))
++	args.rcx = start | page_size;
++	if (__tdcall(TDG_MEM_PAGE_ACCEPT, &args))
+ 		return 0;
+ 
+ 	return accept_size;
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index e37a2464ac7fc..d0d7a42230b84 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -68,10 +68,9 @@ EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
+  * should only be used for calls that have no legitimate reason to fail
+  * or where the kernel can not survive the call failing.
+  */
+-static inline void tdcall(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
+-			  struct tdx_module_output *out)
++static inline void tdcall(u64 fn, struct tdx_module_args *args)
+ {
+-	if (__tdcall(fn, rcx, rdx, r8, r9, out))
++	if (__tdcall_ret(fn, args))
+ 		panic("TDCALL %lld failed (Buggy TDX module!)\n", fn);
+ }
+ 
+@@ -91,11 +90,14 @@ static inline void tdcall(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
+  */
+ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
+ {
++	struct tdx_module_args args = {
++		.rcx = virt_to_phys(tdreport),
++		.rdx = virt_to_phys(reportdata),
++		.r8 = TDREPORT_SUBTYPE_0,
++	};
+ 	u64 ret;
+ 
+-	ret = __tdcall(TDG_MR_REPORT, virt_to_phys(tdreport),
+-			virt_to_phys(reportdata), TDREPORT_SUBTYPE_0,
+-			0, NULL);
++	ret = __tdcall(TDG_MR_REPORT, &args);
+ 	if (ret) {
+ 		if (TDCALL_RETURN_CODE(ret) == TDCALL_INVALID_OPERAND)
+ 			return -EINVAL;
+@@ -143,7 +145,7 @@ static void __noreturn tdx_panic(const char *msg)
+ 
+ static void tdx_parse_tdinfo(u64 *cc_mask)
+ {
+-	struct tdx_module_output out;
++	struct tdx_module_args args = {};
+ 	unsigned int gpa_width;
+ 	u64 td_attr;
+ 
+@@ -154,7 +156,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	 * Guest-Host-Communication Interface (GHCI), section 2.4.2 TDCALL
+ 	 * [TDG.VP.INFO].
+ 	 */
+-	tdcall(TDG_VP_INFO, 0, 0, 0, 0, &out);
++	tdcall(TDG_VP_INFO, &args);
+ 
+ 	/*
+ 	 * The highest bit of a guest physical address is the "sharing" bit.
+@@ -163,7 +165,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	 * The GPA width that comes out of this call is critical. TDX guests
+ 	 * can not meaningfully run without it.
+ 	 */
+-	gpa_width = out.rcx & GENMASK(5, 0);
++	gpa_width = args.rcx & GENMASK(5, 0);
+ 	*cc_mask = BIT_ULL(gpa_width - 1);
+ 
+ 	/*
+@@ -171,7 +173,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	 * memory.  Ensure that no #VE will be delivered for accesses to
+ 	 * TD-private memory.  Only VMM-shared memory (MMIO) will #VE.
+ 	 */
+-	td_attr = out.rdx;
++	td_attr = args.rdx;
+ 	if (!(td_attr & ATTR_SEPT_VE_DISABLE)) {
+ 		const char *msg = "TD misconfiguration: SEPT_VE_DISABLE attribute must be set.";
+ 
+@@ -583,7 +585,7 @@ __init bool tdx_early_handle_ve(struct pt_regs *regs)
+ 
+ void tdx_get_ve_info(struct ve_info *ve)
+ {
+-	struct tdx_module_output out;
++	struct tdx_module_args args = {};
+ 
+ 	/*
+ 	 * Called during #VE handling to retrieve the #VE info from the
+@@ -600,15 +602,15 @@ void tdx_get_ve_info(struct ve_info *ve)
+ 	 * Note, the TDX module treats virtual NMIs as inhibited if the #VE
+ 	 * valid flag is set. It means that NMI=>#VE will not result in a #DF.
+ 	 */
+-	tdcall(TDG_VP_VEINFO_GET, 0, 0, 0, 0, &out);
++	tdcall(TDG_VP_VEINFO_GET, &args);
+ 
+ 	/* Transfer the output parameters */
+-	ve->exit_reason = out.rcx;
+-	ve->exit_qual   = out.rdx;
+-	ve->gla         = out.r8;
+-	ve->gpa         = out.r9;
+-	ve->instr_len   = lower_32_bits(out.r10);
+-	ve->instr_info  = upper_32_bits(out.r10);
++	ve->exit_reason = args.rcx;
++	ve->exit_qual   = args.rdx;
++	ve->gla         = args.r8;
++	ve->gpa         = args.r9;
++	ve->instr_len   = lower_32_bits(args.r10);
++	ve->instr_info  = upper_32_bits(args.r10);
+ }
+ 
+ /*
+@@ -765,6 +767,10 @@ static bool tdx_enc_status_change_finish(unsigned long vaddr, int numpages,
+ 
+ void __init tdx_early_init(void)
+ {
++	struct tdx_module_args args = {
++		.rdx = TDCS_NOTIFY_ENABLES,
++		.r9 = -1ULL,
++	};
+ 	u64 cc_mask;
+ 	u32 eax, sig[3];
+ 
+@@ -780,7 +786,7 @@ void __init tdx_early_init(void)
+ 	cc_set_mask(cc_mask);
+ 
+ 	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+-	tdcall(TDG_VM_WR, 0, TDCS_NOTIFY_ENABLES, 0, -1ULL, NULL);
++	tdcall(TDG_VM_WR, &args);
+ 
+ 	/*
+ 	 * All bits above GPA width are reserved and kernel treats shared bit
+diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
+index 9e3699b751ef2..3606463ebf6fb 100644
+--- a/arch/x86/include/asm/shared/tdx.h
++++ b/arch/x86/include/asm/shared/tdx.h
+@@ -74,11 +74,11 @@ static inline u64 _tdx_hypercall(u64 fn, u64 r12, u64 r13, u64 r14, u64 r15)
+ void __tdx_hypercall_failed(void);
+ 
+ /*
+- * Used in __tdx_module_call() to gather the output registers' values of the
++ * Used in __tdcall*() to gather the input/output registers' values of the
+  * TDCALL instruction when requesting services from the TDX module. This is a
+  * software only structure and not part of the TDX module/VMM ABI
+  */
+-struct tdx_module_output {
++struct tdx_module_args {
+ 	u64 rcx;
+ 	u64 rdx;
+ 	u64 r8;
+@@ -88,8 +88,8 @@ struct tdx_module_output {
+ };
+ 
+ /* Used to communicate with the TDX module */
+-u64 __tdcall(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
+-	     struct tdx_module_output *out);
++u64 __tdcall(u64 fn, struct tdx_module_args *args);
++u64 __tdcall_ret(u64 fn, struct tdx_module_args *args);
+ 
+ bool tdx_accept_memory(phys_addr_t start, phys_addr_t end);
+ 
+diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
+index dc3576303f1ad..50383bc46dd77 100644
+--- a/arch/x86/kernel/asm-offsets.c
++++ b/arch/x86/kernel/asm-offsets.c
+@@ -68,12 +68,12 @@ static void __used common(void)
+ #endif
+ 
+ 	BLANK();
+-	OFFSET(TDX_MODULE_rcx, tdx_module_output, rcx);
+-	OFFSET(TDX_MODULE_rdx, tdx_module_output, rdx);
+-	OFFSET(TDX_MODULE_r8,  tdx_module_output, r8);
+-	OFFSET(TDX_MODULE_r9,  tdx_module_output, r9);
+-	OFFSET(TDX_MODULE_r10, tdx_module_output, r10);
+-	OFFSET(TDX_MODULE_r11, tdx_module_output, r11);
++	OFFSET(TDX_MODULE_rcx, tdx_module_args, rcx);
++	OFFSET(TDX_MODULE_rdx, tdx_module_args, rdx);
++	OFFSET(TDX_MODULE_r8,  tdx_module_args, r8);
++	OFFSET(TDX_MODULE_r9,  tdx_module_args, r9);
++	OFFSET(TDX_MODULE_r10, tdx_module_args, r10);
++	OFFSET(TDX_MODULE_r11, tdx_module_args, r11);
+ 
+ 	BLANK();
+ 	OFFSET(TDX_HYPERCALL_r8,  tdx_hypercall_args, r8);
+diff --git a/arch/x86/virt/vmx/tdx/tdxcall.S b/arch/x86/virt/vmx/tdx/tdxcall.S
+index 6bdf6e1379534..e9e19e7d77f81 100644
+--- a/arch/x86/virt/vmx/tdx/tdxcall.S
++++ b/arch/x86/virt/vmx/tdx/tdxcall.S
+@@ -17,34 +17,35 @@
+  *            TDX module and hypercalls to the VMM.
+  * SEAMCALL - used by TDX hosts to make requests to the
+  *            TDX module.
++ *
++ *-------------------------------------------------------------------------
++ * TDCALL/SEAMCALL ABI:
++ *-------------------------------------------------------------------------
++ * Input Registers:
++ *
++ * RAX                 - TDCALL/SEAMCALL Leaf number.
++ * RCX,RDX,R8-R11      - TDCALL/SEAMCALL Leaf specific input registers.
++ *
++ * Output Registers:
++ *
++ * RAX                 - TDCALL/SEAMCALL instruction error code.
++ * RCX,RDX,R8-R11      - TDCALL/SEAMCALL Leaf specific output registers.
++ *
++ *-------------------------------------------------------------------------
+  */
+-.macro TDX_MODULE_CALL host:req
++.macro TDX_MODULE_CALL host:req ret=0
+ 	FRAME_BEGIN
+-	/*
+-	 * R12 will be used as temporary storage for struct tdx_module_output
+-	 * pointer. Since R12-R15 registers are not used by TDCALL/SEAMCALL
+-	 * services supported by this function, it can be reused.
+-	 */
+-
+-	/* Callee saved, so preserve it */
+-	push %r12
+-
+-	/*
+-	 * Push output pointer to stack.
+-	 * After the operation, it will be fetched into R12 register.
+-	 */
+-	push %r9
+ 
+-	/* Mangle function call ABI into TDCALL/SEAMCALL ABI: */
+ 	/* Move Leaf ID to RAX */
+ 	mov %rdi, %rax
+-	/* Move input 4 to R9 */
+-	mov %r8,  %r9
+-	/* Move input 3 to R8 */
+-	mov %rcx, %r8
+-	/* Move input 1 to RCX */
+-	mov %rsi, %rcx
+-	/* Leave input param 2 in RDX */
++
++	/* Move other input regs from 'struct tdx_module_args' */
++	movq	TDX_MODULE_rcx(%rsi), %rcx
++	movq	TDX_MODULE_rdx(%rsi), %rdx
++	movq	TDX_MODULE_r8(%rsi),  %r8
++	movq	TDX_MODULE_r9(%rsi),  %r9
++	movq	TDX_MODULE_r10(%rsi), %r10
++	movq	TDX_MODULE_r11(%rsi), %r11
+ 
+ .if \host
+ 	seamcall
+@@ -59,49 +60,31 @@
+ 	 * This value will never be used as actual SEAMCALL error code as
+ 	 * it is from the Reserved status code class.
+ 	 */
+-	jc .Lseamcall_vmfailinvalid
++	jc .Lseamcall_vmfailinvalid\@
+ .else
+ 	tdcall
+ .endif
+ 
+-	/*
+-	 * Fetch output pointer from stack to R12 (It is used
+-	 * as temporary storage)
+-	 */
+-	pop %r12
+-
+-	/*
+-	 * Since this macro can be invoked with NULL as an output pointer,
+-	 * check if caller provided an output struct before storing output
+-	 * registers.
+-	 *
+-	 * Update output registers, even if the call failed (RAX != 0).
+-	 * Other registers may contain details of the failure.
+-	 */
+-	test %r12, %r12
+-	jz .Lout
+-
+-	/* Copy result registers to output struct: */
+-	movq %rcx, TDX_MODULE_rcx(%r12)
+-	movq %rdx, TDX_MODULE_rdx(%r12)
+-	movq %r8,  TDX_MODULE_r8(%r12)
+-	movq %r9,  TDX_MODULE_r9(%r12)
+-	movq %r10, TDX_MODULE_r10(%r12)
+-	movq %r11, TDX_MODULE_r11(%r12)
+-
+-.Lout:
+-	/* Restore the state of R12 register */
+-	pop %r12
++.if \ret
++	/* Copy output registers to the structure */
++	movq %rcx, TDX_MODULE_rcx(%rsi)
++	movq %rdx, TDX_MODULE_rdx(%rsi)
++	movq %r8,  TDX_MODULE_r8(%rsi)
++	movq %r9,  TDX_MODULE_r9(%rsi)
++	movq %r10, TDX_MODULE_r10(%rsi)
++	movq %r11, TDX_MODULE_r11(%rsi)
++.endif
+ 
++.if \host
++.Lout\@:
++.endif
+ 	FRAME_END
+ 	RET
+ 
+ .if \host
+-.Lseamcall_vmfailinvalid:
++.Lseamcall_vmfailinvalid\@:
+ 	mov $TDX_SEAMCALL_VMFAILINVALID, %rax
+-	/* pop the unused output pointer back to %r9 */
+-	pop %r9
+-	jmp .Lout
++	jmp .Lout\@
+ .endif	/* \host */
+ 
+ .endm
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-rename-__tdx_module_call-to-__tdcall.patch b/queue-6.6/x86-tdx-rename-__tdx_module_call-to-__tdcall.patch
new file mode 100644
index 00000000000..27a54650703
--- /dev/null
+++ b/queue-6.6/x86-tdx-rename-__tdx_module_call-to-__tdcall.patch
@@ -0,0 +1,158 @@
+From 6ead66928c9eb0792d526a3b0f4c32345f1b2f63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 23:01:58 +1200
+Subject: x86/tdx: Rename __tdx_module_call() to __tdcall()
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit 5efb96289e581c187af1bc288ce5d26ed6181749 ]
+
+__tdx_module_call() is only used by the TDX guest to issue TDCALL to the
+TDX module.  Rename it to __tdcall() to match its behaviour, e.g., it
+cannot be used to make host-side SEAMCALL.
+
+Also rename tdx_module_call() which is a wrapper of __tdx_module_call()
+to tdcall().
+
+No functional change intended.
+
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/all/785d20d99fbcd0db8262c94da6423375422d8c75.1692096753.git.kai.huang%40intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdcall.S        | 10 +++++-----
+ arch/x86/coco/tdx/tdx-shared.c    |  2 +-
+ arch/x86/coco/tdx/tdx.c           | 18 +++++++++---------
+ arch/x86/include/asm/shared/tdx.h |  4 ++--
+ 4 files changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdcall.S b/arch/x86/coco/tdx/tdcall.S
+index e5d4b7d8ecd4a..6aebac08f2bfe 100644
+--- a/arch/x86/coco/tdx/tdcall.S
++++ b/arch/x86/coco/tdx/tdcall.S
+@@ -40,8 +40,8 @@
+ .section .noinstr.text, "ax"
+ 
+ /*
+- * __tdx_module_call()  - Used by TDX guests to request services from
+- * the TDX module (does not include VMM services) using TDCALL instruction.
++ * __tdcall()  - Used by TDX guests to request services from the TDX
++ * module (does not include VMM services) using TDCALL instruction.
+  *
+  * Transforms function call register arguments into the TDCALL register ABI.
+  * After TDCALL operation, TDX module output is saved in @out (if it is
+@@ -62,7 +62,7 @@
+  *
+  *-------------------------------------------------------------------------
+  *
+- * __tdx_module_call() function ABI:
++ * __tdcall() function ABI:
+  *
+  * @fn  (RDI)          - TDCALL Leaf ID,    moved to RAX
+  * @rcx (RSI)          - Input parameter 1, moved to RCX
+@@ -77,9 +77,9 @@
+  *
+  * Return status of TDCALL via RAX.
+  */
+-SYM_FUNC_START(__tdx_module_call)
++SYM_FUNC_START(__tdcall)
+ 	TDX_MODULE_CALL host=0
+-SYM_FUNC_END(__tdx_module_call)
++SYM_FUNC_END(__tdcall)
+ 
+ /*
+  * TDX_HYPERCALL - Make hypercalls to a TDX VMM using TDVMCALL leaf of TDCALL
+diff --git a/arch/x86/coco/tdx/tdx-shared.c b/arch/x86/coco/tdx/tdx-shared.c
+index f10cd3e4a04ed..90631abdac34d 100644
+--- a/arch/x86/coco/tdx/tdx-shared.c
++++ b/arch/x86/coco/tdx/tdx-shared.c
+@@ -35,7 +35,7 @@ static unsigned long try_accept_one(phys_addr_t start, unsigned long len,
+ 	}
+ 
+ 	tdcall_rcx = start | page_size;
+-	if (__tdx_module_call(TDG_MEM_PAGE_ACCEPT, tdcall_rcx, 0, 0, 0, NULL))
++	if (__tdcall(TDG_MEM_PAGE_ACCEPT, tdcall_rcx, 0, 0, 0, NULL))
+ 		return 0;
+ 
+ 	return accept_size;
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index fd389b137fab8..e37a2464ac7fc 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -68,10 +68,10 @@ EXPORT_SYMBOL_GPL(tdx_kvm_hypercall);
+  * should only be used for calls that have no legitimate reason to fail
+  * or where the kernel can not survive the call failing.
+  */
+-static inline void tdx_module_call(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
+-				   struct tdx_module_output *out)
++static inline void tdcall(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
++			  struct tdx_module_output *out)
+ {
+-	if (__tdx_module_call(fn, rcx, rdx, r8, r9, out))
++	if (__tdcall(fn, rcx, rdx, r8, r9, out))
+ 		panic("TDCALL %lld failed (Buggy TDX module!)\n", fn);
+ }
+ 
+@@ -93,9 +93,9 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
+ {
+ 	u64 ret;
+ 
+-	ret = __tdx_module_call(TDG_MR_REPORT, virt_to_phys(tdreport),
+-				virt_to_phys(reportdata), TDREPORT_SUBTYPE_0,
+-				0, NULL);
++	ret = __tdcall(TDG_MR_REPORT, virt_to_phys(tdreport),
++			virt_to_phys(reportdata), TDREPORT_SUBTYPE_0,
++			0, NULL);
+ 	if (ret) {
+ 		if (TDCALL_RETURN_CODE(ret) == TDCALL_INVALID_OPERAND)
+ 			return -EINVAL;
+@@ -154,7 +154,7 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	 * Guest-Host-Communication Interface (GHCI), section 2.4.2 TDCALL
+ 	 * [TDG.VP.INFO].
+ 	 */
+-	tdx_module_call(TDG_VP_INFO, 0, 0, 0, 0, &out);
++	tdcall(TDG_VP_INFO, 0, 0, 0, 0, &out);
+ 
+ 	/*
+ 	 * The highest bit of a guest physical address is the "sharing" bit.
+@@ -600,7 +600,7 @@ void tdx_get_ve_info(struct ve_info *ve)
+ 	 * Note, the TDX module treats virtual NMIs as inhibited if the #VE
+ 	 * valid flag is set. It means that NMI=>#VE will not result in a #DF.
+ 	 */
+-	tdx_module_call(TDG_VP_VEINFO_GET, 0, 0, 0, 0, &out);
++	tdcall(TDG_VP_VEINFO_GET, 0, 0, 0, 0, &out);
+ 
+ 	/* Transfer the output parameters */
+ 	ve->exit_reason = out.rcx;
+@@ -780,7 +780,7 @@ void __init tdx_early_init(void)
+ 	cc_set_mask(cc_mask);
+ 
+ 	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+-	tdx_module_call(TDG_VM_WR, 0, TDCS_NOTIFY_ENABLES, 0, -1ULL, NULL);
++	tdcall(TDG_VM_WR, 0, TDCS_NOTIFY_ENABLES, 0, -1ULL, NULL);
+ 
+ 	/*
+ 	 * All bits above GPA width are reserved and kernel treats shared bit
+diff --git a/arch/x86/include/asm/shared/tdx.h b/arch/x86/include/asm/shared/tdx.h
+index 78f109446da6f..9e3699b751ef2 100644
+--- a/arch/x86/include/asm/shared/tdx.h
++++ b/arch/x86/include/asm/shared/tdx.h
+@@ -88,8 +88,8 @@ struct tdx_module_output {
+ };
+ 
+ /* Used to communicate with the TDX module */
+-u64 __tdx_module_call(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
+-		      struct tdx_module_output *out);
++u64 __tdcall(u64 fn, u64 rcx, u64 rdx, u64 r8, u64 r9,
++	     struct tdx_module_output *out);
+ 
+ bool tdx_accept_memory(phys_addr_t start, phys_addr_t end);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-rename-tdx_parse_tdinfo-to-tdx_setup.patch b/queue-6.6/x86-tdx-rename-tdx_parse_tdinfo-to-tdx_setup.patch
new file mode 100644
index 00000000000..80213b0e377
--- /dev/null
+++ b/queue-6.6/x86-tdx-rename-tdx_parse_tdinfo-to-tdx_setup.patch
@@ -0,0 +1,67 @@
+From 6269dd9845bcd8be266b7f122305ecc397ce0287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 12:38:01 +0200
+Subject: x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup()
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit b064043d9565786b385f85e6436ca5716bbd5552 ]
+
+Rename tdx_parse_tdinfo() to tdx_setup() and move setting NOTIFY_ENABLES
+there.
+
+The function will be extended to adjust TD configuration.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Kai Huang <kai.huang@intel.com>
+Link: https://lore.kernel.org/all/20241104103803.195705-3-kirill.shutemov%40linux.intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdx.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
+index 0bb895344497e..de4ff833fcf00 100644
+--- a/arch/x86/coco/tdx/tdx.c
++++ b/arch/x86/coco/tdx/tdx.c
+@@ -169,7 +169,7 @@ static void __noreturn tdx_panic(const char *msg)
+ 		__tdx_hypercall(&args);
+ }
+ 
+-static void tdx_parse_tdinfo(u64 *cc_mask)
++static void tdx_setup(u64 *cc_mask)
+ {
+ 	struct tdx_module_args args = {};
+ 	unsigned int gpa_width;
+@@ -194,6 +194,9 @@ static void tdx_parse_tdinfo(u64 *cc_mask)
+ 	gpa_width = args.rcx & GENMASK(5, 0);
+ 	*cc_mask = BIT_ULL(gpa_width - 1);
+ 
++	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
++	tdg_vm_wr(TDCS_NOTIFY_ENABLES, 0, -1ULL);
++
+ 	/*
+ 	 * The kernel can not handle #VE's when accessing normal kernel
+ 	 * memory.  Ensure that no #VE will be delivered for accesses to
+@@ -804,11 +807,11 @@ void __init tdx_early_init(void)
+ 	setup_force_cpu_cap(X86_FEATURE_TDX_GUEST);
+ 
+ 	cc_vendor = CC_VENDOR_INTEL;
+-	tdx_parse_tdinfo(&cc_mask);
+-	cc_set_mask(cc_mask);
+ 
+-	/* Kernel does not use NOTIFY_ENABLES and does not need random #VEs */
+-	tdg_vm_wr(TDCS_NOTIFY_ENABLES, 0, -1ULL);
++	/* Configure the TD */
++	tdx_setup(&cc_mask);
++
++	cc_set_mask(cc_mask);
+ 
+ 	/*
+ 	 * All bits above GPA width are reserved and kernel treats shared bit
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-tdx-skip-saving-output-regs-when-seamcall-fails-.patch b/queue-6.6/x86-tdx-skip-saving-output-regs-when-seamcall-fails-.patch
new file mode 100644
index 00000000000..2678d43b627
--- /dev/null
+++ b/queue-6.6/x86-tdx-skip-saving-output-regs-when-seamcall-fails-.patch
@@ -0,0 +1,125 @@
+From 8a83345f43e085807cb63237221cbd3ec18f8bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Aug 2023 23:01:56 +1200
+Subject: x86/tdx: Skip saving output regs when SEAMCALL fails with
+ VMFailInvalid
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit 03a423d40cb30e0e1cb77a801acb56ddb0bf6f5e ]
+
+If SEAMCALL fails with VMFailInvalid, the SEAM software (e.g., the TDX
+module) won't have chance to set any output register.  Skip saving the
+output registers to the structure in this case.
+
+Also, as '.Lno_output_struct' is the very last symbol before RET, rename
+it to '.Lout' to make it short.
+
+Opportunistically make the asm directives unindented.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/all/704088f5b4d72c7e24084f7f15bd1ac5005b7213.1692096753.git.kai.huang%40intel.com
+Stable-dep-of: f65aa0ad79fc ("x86/tdx: Dynamically disable SEPT violations from causing #VEs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/tdx/tdcall.S      |  3 ---
+ arch/x86/virt/vmx/tdx/tdxcall.S | 29 ++++++++++++++++++++---------
+ 2 files changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/coco/tdx/tdcall.S b/arch/x86/coco/tdx/tdcall.S
+index 2eca5f43734fe..e5d4b7d8ecd4a 100644
+--- a/arch/x86/coco/tdx/tdcall.S
++++ b/arch/x86/coco/tdx/tdcall.S
+@@ -78,10 +78,7 @@
+  * Return status of TDCALL via RAX.
+  */
+ SYM_FUNC_START(__tdx_module_call)
+-	FRAME_BEGIN
+ 	TDX_MODULE_CALL host=0
+-	FRAME_END
+-	RET
+ SYM_FUNC_END(__tdx_module_call)
+ 
+ /*
+diff --git a/arch/x86/virt/vmx/tdx/tdxcall.S b/arch/x86/virt/vmx/tdx/tdxcall.S
+index 49a54356ae992..6bdf6e1379534 100644
+--- a/arch/x86/virt/vmx/tdx/tdxcall.S
++++ b/arch/x86/virt/vmx/tdx/tdxcall.S
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ #include <asm/asm-offsets.h>
++#include <asm/frame.h>
+ #include <asm/tdx.h>
+ 
+ /*
+@@ -18,6 +19,7 @@
+  *            TDX module.
+  */
+ .macro TDX_MODULE_CALL host:req
++	FRAME_BEGIN
+ 	/*
+ 	 * R12 will be used as temporary storage for struct tdx_module_output
+ 	 * pointer. Since R12-R15 registers are not used by TDCALL/SEAMCALL
+@@ -44,7 +46,7 @@
+ 	mov %rsi, %rcx
+ 	/* Leave input param 2 in RDX */
+ 
+-	.if \host
++.if \host
+ 	seamcall
+ 	/*
+ 	 * SEAMCALL instruction is essentially a VMExit from VMX root
+@@ -57,13 +59,10 @@
+ 	 * This value will never be used as actual SEAMCALL error code as
+ 	 * it is from the Reserved status code class.
+ 	 */
+-	jnc .Lno_vmfailinvalid
+-	mov $TDX_SEAMCALL_VMFAILINVALID, %rax
+-.Lno_vmfailinvalid:
+-
+-	.else
++	jc .Lseamcall_vmfailinvalid
++.else
+ 	tdcall
+-	.endif
++.endif
+ 
+ 	/*
+ 	 * Fetch output pointer from stack to R12 (It is used
+@@ -80,7 +79,7 @@
+ 	 * Other registers may contain details of the failure.
+ 	 */
+ 	test %r12, %r12
+-	jz .Lno_output_struct
++	jz .Lout
+ 
+ 	/* Copy result registers to output struct: */
+ 	movq %rcx, TDX_MODULE_rcx(%r12)
+@@ -90,7 +89,19 @@
+ 	movq %r10, TDX_MODULE_r10(%r12)
+ 	movq %r11, TDX_MODULE_r11(%r12)
+ 
+-.Lno_output_struct:
++.Lout:
+ 	/* Restore the state of R12 register */
+ 	pop %r12
++
++	FRAME_END
++	RET
++
++.if \host
++.Lseamcall_vmfailinvalid:
++	mov $TDX_SEAMCALL_VMFAILINVALID, %rax
++	/* pop the unused output pointer back to %r9 */
++	pop %r9
++	jmp .Lout
++.endif	/* \host */
++
+ .endm
+-- 
+2.43.0
+
diff --git a/queue-6.6/x86-unwind-orc-fix-unwind-for-newly-forked-tasks.patch b/queue-6.6/x86-unwind-orc-fix-unwind-for-newly-forked-tasks.patch
new file mode 100644
index 00000000000..0db31e6b110
--- /dev/null
+++ b/queue-6.6/x86-unwind-orc-fix-unwind-for-newly-forked-tasks.patch
@@ -0,0 +1,49 @@
+From 72dbdf132ad7a5262d7b19a0394d139a2147095e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 10:45:01 +0800
+Subject: x86/unwind/orc: Fix unwind for newly forked tasks
+
+From: Zheng Yejian <zhengyejian@huaweicloud.com>
+
+[ Upstream commit 3bf19a0fb690022ec22ce87a5afeb1030cbcb56c ]
+
+When arch_stack_walk_reliable() is called to unwind for newly forked
+tasks, the return value is negative which means the call stack is
+unreliable. This obviously does not meet expectations.
+
+The root cause is that after commit 3aec4ecb3d1f ("x86: Rewrite
+ ret_from_fork() in C"), the 'ret_addr' of newly forked task is changed
+to 'ret_from_fork_asm' (see copy_thread()), then at the start of the
+unwind, it is incorrectly interprets not as a "signal" one because
+'ret_from_fork' is still used to determine the initial "signal" (see
+__unwind_start()). Then the address gets incorrectly decremented in the
+call to orc_find() (see unwind_next_frame()) and resulting in the
+incorrect ORC data.
+
+To fix it, check 'ret_from_fork_asm' rather than 'ret_from_fork' in
+__unwind_start().
+
+Fixes: 3aec4ecb3d1f ("x86: Rewrite ret_from_fork() in C")
+Signed-off-by: Zheng Yejian <zhengyejian@huaweicloud.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/unwind_orc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 7e574cf3bf8a2..7784076819de5 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -723,7 +723,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ 		state->sp = task->thread.sp + sizeof(*frame);
+ 		state->bp = READ_ONCE_NOCHECK(frame->bp);
+ 		state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
+-		state->signal = (void *)state->ip == ret_from_fork;
++		state->signal = (void *)state->ip == ret_from_fork_asm;
+ 	}
+ 
+ 	if (get_stack_info((unsigned long *)state->sp, state->task,
+-- 
+2.43.0
+
-- 
2.47.3